remcos | 928f75ac182baea6734e08cdd425bcea33bf7f27a43922b9f693d199d7aee550

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2022 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

2.4MB
MD5

05f6fa39a293a904e53aad577744ee8e
SHA1

99126bc0831b9d49eb46fd6dcdf7a12376db415d
SHA256

928f75ac182baea6734e08cdd425bcea33bf7f27a43922b9f693d199d7aee550
SHA512

3136c7a911b07496d0f85885780edf684592ec265173801a1a472406a8b73bc1bebe0fa48202ded9b83acb8a0f633d6b1ce1657adc6a5775ca8946010d76df9b

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

vivald21.hopto.org:3240

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-9HMSCN
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 4 IoCs

Processes:

._cache_tmp.exeSynaptics.exeSynaptics.exe._cache_Synaptics.exe

pid process

3096 ._cache_tmp.exe
4076 Synaptics.exe
4996 Synaptics.exe
3516 ._cache_Synaptics.exe

pid	process
3096	._cache_tmp.exe
4076	Synaptics.exe
4996	Synaptics.exe
3516	._cache_Synaptics.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

tmp.exetmp.exeSynaptics.exeSynaptics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	tmp.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

tmp.exeSynaptics.exe

description	pid	process	target process
PID 4856 set thread context of 1700	4856	tmp.exe	tmp.exe
PID 4076 set thread context of 4996	4076	Synaptics.exe	Synaptics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4216 schtasks.exe
4060 schtasks.exe

pid	process
4216	schtasks.exe
4060	schtasks.exe

Modifies registry class 2 IoCs

Processes:

tmp.exeSynaptics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

tmp.exepowershell.exeSynaptics.exepowershell.exe

pid	process
4856	tmp.exe
4856	tmp.exe
4856	tmp.exe
3836	powershell.exe
4856	tmp.exe
3836	powershell.exe
4076	Synaptics.exe
5080	powershell.exe
4076	Synaptics.exe
5080	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tmp.exepowershell.exeSynaptics.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4856	tmp.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	4076	Synaptics.exe
Token: SeDebugPrivilege	5080	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

tmp.exeSynaptics.exe

pid process

4856 tmp.exe
4076 Synaptics.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

tmp.exeSynaptics.exe

pid process

4856 tmp.exe
4076 Synaptics.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

._cache_tmp.exe

pid process

3096 ._cache_tmp.exe

pid	process
3096	._cache_tmp.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

tmp.exetmp.exeSynaptics.exeSynaptics.exe

description	pid	process	target process
PID 4856 wrote to memory of 3836	4856	tmp.exe	powershell.exe
PID 4856 wrote to memory of 3836	4856	tmp.exe	powershell.exe
PID 4856 wrote to memory of 3836	4856	tmp.exe	powershell.exe
PID 4856 wrote to memory of 4216	4856	tmp.exe	schtasks.exe
PID 4856 wrote to memory of 4216	4856	tmp.exe	schtasks.exe
PID 4856 wrote to memory of 4216	4856	tmp.exe	schtasks.exe
PID 4856 wrote to memory of 4564	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 4564	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 4564	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 4856 wrote to memory of 1700	4856	tmp.exe	tmp.exe
PID 1700 wrote to memory of 3096	1700	tmp.exe	._cache_tmp.exe
PID 1700 wrote to memory of 3096	1700	tmp.exe	._cache_tmp.exe
PID 1700 wrote to memory of 3096	1700	tmp.exe	._cache_tmp.exe
PID 1700 wrote to memory of 4076	1700	tmp.exe	Synaptics.exe
PID 1700 wrote to memory of 4076	1700	tmp.exe	Synaptics.exe
PID 1700 wrote to memory of 4076	1700	tmp.exe	Synaptics.exe
PID 4076 wrote to memory of 5080	4076	Synaptics.exe	powershell.exe
PID 4076 wrote to memory of 5080	4076	Synaptics.exe	powershell.exe
PID 4076 wrote to memory of 5080	4076	Synaptics.exe	powershell.exe
PID 4076 wrote to memory of 4060	4076	Synaptics.exe	schtasks.exe
PID 4076 wrote to memory of 4060	4076	Synaptics.exe	schtasks.exe
PID 4076 wrote to memory of 4060	4076	Synaptics.exe	schtasks.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4076 wrote to memory of 4996	4076	Synaptics.exe	Synaptics.exe
PID 4996 wrote to memory of 3516	4996	Synaptics.exe	._cache_Synaptics.exe
PID 4996 wrote to memory of 3516	4996	Synaptics.exe	._cache_Synaptics.exe
PID 4996 wrote to memory of 3516	4996	Synaptics.exe	._cache_Synaptics.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HziGohhJaJ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HziGohhJaJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2546.tmp"
2⤵
- Creates scheduled task(s)
PID:4216

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
PID:4564

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3096

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HziGohhJaJ.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HziGohhJaJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF5C.tmp"
4⤵
- Creates scheduled task(s)
PID:4060

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4996

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
5⤵
- Executes dropped EXE
PID:3516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe
Filesize
2.4MB

MD5
05f6fa39a293a904e53aad577744ee8e

SHA1
99126bc0831b9d49eb46fd6dcdf7a12376db415d

SHA256
928f75ac182baea6734e08cdd425bcea33bf7f27a43922b9f693d199d7aee550

SHA512
3136c7a911b07496d0f85885780edf684592ec265173801a1a472406a8b73bc1bebe0fa48202ded9b83acb8a0f633d6b1ce1657adc6a5775ca8946010d76df9b

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe
Filesize
2.4MB

MD5
05f6fa39a293a904e53aad577744ee8e

SHA1
99126bc0831b9d49eb46fd6dcdf7a12376db415d

SHA256
928f75ac182baea6734e08cdd425bcea33bf7f27a43922b9f693d199d7aee550

SHA512
3136c7a911b07496d0f85885780edf684592ec265173801a1a472406a8b73bc1bebe0fa48202ded9b83acb8a0f633d6b1ce1657adc6a5775ca8946010d76df9b

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe
Filesize
2.4MB

MD5
05f6fa39a293a904e53aad577744ee8e

SHA1
99126bc0831b9d49eb46fd6dcdf7a12376db415d

SHA256
928f75ac182baea6734e08cdd425bcea33bf7f27a43922b9f693d199d7aee550

SHA512
3136c7a911b07496d0f85885780edf684592ec265173801a1a472406a8b73bc1bebe0fa48202ded9b83acb8a0f633d6b1ce1657adc6a5775ca8946010d76df9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
3ddf556da360c3b91899e9cc27621197

SHA1
b3b0c569dec4bbc411cc954a43c22c86269cf777

SHA256
aeabc52f4f629a6cbe1d0b9e7de20e8fdbb50d8bb380618d24ba32bb14cff97a

SHA512
f71a71a2f582e814522fd25dff0bcc8516e34f9ba7f3539c12a894a227091412cbba73fde158d4f699dd70a8c30f9c3f4927796d6453546296921af93bab908c

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
Filesize
466KB

MD5
e729b5c9501252eba5d7917256950424

SHA1
4dd74a695e40e22760e00a532677e1cc8857687c

SHA256
395cf5e6d3f891a3049ec3412a97e687a8fdd077834fd30a83dcf9b3fb0f2807

SHA512
31eac3aa066b30019f51b3678ed8dc628f8d518a2c05b93c15798ca2d7bce263245e700fe7a5e3af29eed5d47d66cf70ca08a7220ebd8d054e1f8b02dfa13443

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
Filesize
466KB

MD5
e729b5c9501252eba5d7917256950424

SHA1
4dd74a695e40e22760e00a532677e1cc8857687c

SHA256
395cf5e6d3f891a3049ec3412a97e687a8fdd077834fd30a83dcf9b3fb0f2807

SHA512
31eac3aa066b30019f51b3678ed8dc628f8d518a2c05b93c15798ca2d7bce263245e700fe7a5e3af29eed5d47d66cf70ca08a7220ebd8d054e1f8b02dfa13443

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe
Filesize
466KB

MD5
e729b5c9501252eba5d7917256950424

SHA1
4dd74a695e40e22760e00a532677e1cc8857687c

SHA256
395cf5e6d3f891a3049ec3412a97e687a8fdd077834fd30a83dcf9b3fb0f2807

SHA512
31eac3aa066b30019f51b3678ed8dc628f8d518a2c05b93c15798ca2d7bce263245e700fe7a5e3af29eed5d47d66cf70ca08a7220ebd8d054e1f8b02dfa13443

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe
Filesize
466KB

MD5
e729b5c9501252eba5d7917256950424

SHA1
4dd74a695e40e22760e00a532677e1cc8857687c

SHA256
395cf5e6d3f891a3049ec3412a97e687a8fdd077834fd30a83dcf9b3fb0f2807

SHA512
31eac3aa066b30019f51b3678ed8dc628f8d518a2c05b93c15798ca2d7bce263245e700fe7a5e3af29eed5d47d66cf70ca08a7220ebd8d054e1f8b02dfa13443

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2546.tmp
Filesize
1KB

MD5
451b80a26990149a410b828449967da3

SHA1
c2f3bd18bc549491f7d343b7d3852fed0bc9fc45

SHA256
47f041c99f49f34e799dfbfb95a30f9a6b13eb5ea921512f89f5f0dd6624912c

SHA512
19b4ec1ca47ec86c7edd4365fe414c45a7cdeafbc638fac7eaf205bc1aa7030196ca524d5f3b6f2cc8b9aadac0820086e4f38552abc0f1acd6431821e8155e32

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEF5C.tmp
Filesize
1KB

MD5
451b80a26990149a410b828449967da3

SHA1
c2f3bd18bc549491f7d343b7d3852fed0bc9fc45

SHA256
47f041c99f49f34e799dfbfb95a30f9a6b13eb5ea921512f89f5f0dd6624912c

SHA512
19b4ec1ca47ec86c7edd4365fe414c45a7cdeafbc638fac7eaf205bc1aa7030196ca524d5f3b6f2cc8b9aadac0820086e4f38552abc0f1acd6431821e8155e32

Download Submit
memory/1700-145-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1700-144-0x0000000000000000-mapping.dmp

Download
memory/1700-147-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1700-158-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1700-149-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1700-150-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3096-152-0x0000000000000000-mapping.dmp

Download
memory/3516-180-0x0000000000000000-mapping.dmp

Download
memory/3836-162-0x00000000078C0000-0x0000000007F3A000-memory.dmp

Filesize
6.5MB

Download
memory/3836-166-0x00000000074A0000-0x00000000074AE000-memory.dmp

Filesize
56KB

Download
memory/3836-151-0x0000000005F70000-0x0000000005F8E000-memory.dmp

Filesize
120KB

Download
memory/3836-142-0x00000000052B0000-0x00000000058D8000-memory.dmp

Filesize
6.2MB

Download
memory/3836-138-0x0000000000000000-mapping.dmp

Download
memory/3836-140-0x0000000002680000-0x00000000026B6000-memory.dmp

Filesize
216KB

Download
memory/3836-168-0x0000000007590000-0x0000000007598000-memory.dmp

Filesize
32KB

Download
memory/3836-148-0x0000000005050000-0x00000000050B6000-memory.dmp

Filesize
408KB

Download
memory/3836-159-0x0000000006F20000-0x0000000006F52000-memory.dmp

Filesize
200KB

Download
memory/3836-160-0x000000006F900000-0x000000006F94C000-memory.dmp

Filesize
304KB

Download
memory/3836-161-0x0000000006EE0000-0x0000000006EFE000-memory.dmp

Filesize
120KB

Download
memory/3836-146-0x0000000004EB0000-0x0000000004ED2000-memory.dmp

Filesize
136KB

Download
memory/3836-163-0x0000000007270000-0x000000000728A000-memory.dmp

Filesize
104KB

Download
memory/3836-164-0x00000000072E0000-0x00000000072EA000-memory.dmp

Filesize
40KB

Download
memory/3836-165-0x00000000074F0000-0x0000000007586000-memory.dmp

Filesize
600KB

Download
memory/3836-167-0x00000000075B0000-0x00000000075CA000-memory.dmp

Filesize
104KB

Download
memory/4060-170-0x0000000000000000-mapping.dmp

Download
memory/4076-155-0x0000000000000000-mapping.dmp

Download
memory/4216-139-0x0000000000000000-mapping.dmp

Download
memory/4564-143-0x0000000000000000-mapping.dmp

Download
memory/4856-134-0x0000000007680000-0x0000000007712000-memory.dmp

Filesize
584KB

Download
memory/4856-137-0x000000000B5F0000-0x000000000B656000-memory.dmp

Filesize
408KB

Download
memory/4856-136-0x000000000B350000-0x000000000B3EC000-memory.dmp

Filesize
624KB

Download
memory/4856-135-0x0000000007600000-0x000000000760A000-memory.dmp

Filesize
40KB

Download
memory/4856-132-0x0000000000520000-0x0000000000790000-memory.dmp

Filesize
2.4MB

Download
memory/4856-133-0x0000000007B90000-0x0000000008134000-memory.dmp

Filesize
5.6MB

Download
memory/4996-173-0x0000000000000000-mapping.dmp

Download
memory/4996-177-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4996-179-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4996-184-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5080-169-0x0000000000000000-mapping.dmp

Download
memory/5080-183-0x00000000721C0000-0x000000007220C000-memory.dmp

Filesize
304KB

Download