remcos | abe27f90a49a7e563fc39eb1e0da5c0327e490aefe6638fa4dfa50fea16c42d2

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2023, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe
Size 928KB
Sample230111-jc11fsbd66
SHA256 abe27f90a49a7e563fc39eb1e0da5c0327e490aefe6638fa4dfa50fea16c42d2
MD5 707bc07daa50b4470e8e992acc3c3a70
SHA1 acac050601ee41db935f340b4842dae2c4affa95
SHA512 a857def44933c4c70152a8059d4b2378cfc8200b484e9008527e1160273d786d61daf580d98dc23f3d3414ab5ab885842bc315c1f45546f6508e6eb19e7d11ad
SSDEEP 24576:gmmP6+bkwvwXnRc9bniMhmbdOkXrsbp1T3:0P6tRXn+AMYhOEkp9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

brremcoz1.ddns.net:3270

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GF6GEY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 3 IoCs

pid	Process
4536	remcos.exe
2708	remcos.exe
432	remcos.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	remcos.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4912 set thread context of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4536 set thread context of 432	4536	remcos.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2232	schtasks.exe
3000	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1908	powershell.exe
1908	powershell.exe
884	powershell.exe
4536	remcos.exe
4536	remcos.exe
884	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	4536	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
432	remcos.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1908	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	85
PID 4912 wrote to memory of 1908	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	85
PID 4912 wrote to memory of 1908	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	85
PID 4912 wrote to memory of 2232	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	87
PID 4912 wrote to memory of 2232	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	87
PID 4912 wrote to memory of 2232	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	87
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 4912 wrote to memory of 3988	4912	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	89
PID 3988 wrote to memory of 3132	3988	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	90
PID 3988 wrote to memory of 3132	3988	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	90
PID 3988 wrote to memory of 3132	3988	SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe	90
PID 3132 wrote to memory of 4328	3132	WScript.exe	91
PID 3132 wrote to memory of 4328	3132	WScript.exe	91
PID 3132 wrote to memory of 4328	3132	WScript.exe	91
PID 4328 wrote to memory of 4536	4328	cmd.exe	93
PID 4328 wrote to memory of 4536	4328	cmd.exe	93
PID 4328 wrote to memory of 4536	4328	cmd.exe	93
PID 4536 wrote to memory of 884	4536	remcos.exe	100
PID 4536 wrote to memory of 884	4536	remcos.exe	100
PID 4536 wrote to memory of 884	4536	remcos.exe	100
PID 4536 wrote to memory of 3000	4536	remcos.exe	102
PID 4536 wrote to memory of 3000	4536	remcos.exe	102
PID 4536 wrote to memory of 3000	4536	remcos.exe	102
PID 4536 wrote to memory of 2708	4536	remcos.exe	104
PID 4536 wrote to memory of 2708	4536	remcos.exe	104
PID 4536 wrote to memory of 2708	4536	remcos.exe	104
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105
PID 4536 wrote to memory of 432	4536	remcos.exe	105

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jKNdcTqQC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jKNdcTqQC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3539.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2232
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.25621.22051.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4328
    - - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4536
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jKNdcTqQC.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jKNdcTqQC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA14.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:3000
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        6⤵
        Executes dropped EXE
        
        PID:2708
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 26949101f19c28ede2f3c8380a4f3d106faee380ddabd2df7dc2cb8062196749
MD5 580bd0dd070a0f7f9db07dd598fa539e
SHA1 54dd51da468c8eddab109204ed97a514a54b1c69
SHA512 10f454073cb94b2b618af820027859fc085f4c742ac20e9969740d1ea08eb48b15c4444b54072b753aa7141e88d89d091f1f683a38a0829cf8443f6691de620e
SSDEEP 384:Osf+BZ9i+11Gj/+zLC8ty4uIUpZo9o2TVK6seYLME/J03SoZ+fYSgIjEDk+Q0gdI:bfT05U4o2TVNgrSSZWWEDzCO3
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 418B
SHA256 fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
MD5 b92d64fe5b1d1f59df4b738262aea8df
SHA1 c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA512 2566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
MD5 SHA1 SHA512

Submit Download

tmp3539.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3539.tmp
Size 1KB
SHA256 b31a37f1f6f94bc59520ac310d660d22e1d707e6e755d2013aa47b2c92ff18b7
MD5 12c98cbbeab31d357632b96b0ea590d9
SHA1 ef74e0b2dfbdcd252b3caca5c891042f3e418140
SHA512 f40a650cffd5af7873e47e076c12073305756f63b60c5d37227f7c6c6593ed8c3801528e829517424f0ff537e46e09b52da3f9873eb0a12f6bd87e2b10005eb8
MD5 SHA1 SHA512

Submit Download

tmpDA14.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpDA14.tmp
Size 1KB
SHA256 b31a37f1f6f94bc59520ac310d660d22e1d707e6e755d2013aa47b2c92ff18b7
MD5 12c98cbbeab31d357632b96b0ea590d9
SHA1 ef74e0b2dfbdcd252b3caca5c891042f3e418140
SHA512 f40a650cffd5af7873e47e076c12073305756f63b60c5d37227f7c6c6593ed8c3801528e829517424f0ff537e46e09b52da3f9873eb0a12f6bd87e2b10005eb8
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 928KB
SHA256 abe27f90a49a7e563fc39eb1e0da5c0327e490aefe6638fa4dfa50fea16c42d2
MD5 707bc07daa50b4470e8e992acc3c3a70
SHA1 acac050601ee41db935f340b4842dae2c4affa95
SHA512 a857def44933c4c70152a8059d4b2378cfc8200b484e9008527e1160273d786d61daf580d98dc23f3d3414ab5ab885842bc315c1f45546f6508e6eb19e7d11ad
SSDEEP 24576:gmmP6+bkwvwXnRc9bniMhmbdOkXrsbp1T3:0P6tRXn+AMYhOEkp9
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 928KB
SHA256 abe27f90a49a7e563fc39eb1e0da5c0327e490aefe6638fa4dfa50fea16c42d2
MD5 707bc07daa50b4470e8e992acc3c3a70
SHA1 acac050601ee41db935f340b4842dae2c4affa95
SHA512 a857def44933c4c70152a8059d4b2378cfc8200b484e9008527e1160273d786d61daf580d98dc23f3d3414ab5ab885842bc315c1f45546f6508e6eb19e7d11ad
SSDEEP 24576:gmmP6+bkwvwXnRc9bniMhmbdOkXrsbp1T3:0P6tRXn+AMYhOEkp9
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 928KB
SHA256 abe27f90a49a7e563fc39eb1e0da5c0327e490aefe6638fa4dfa50fea16c42d2
MD5 707bc07daa50b4470e8e992acc3c3a70
SHA1 acac050601ee41db935f340b4842dae2c4affa95
SHA512 a857def44933c4c70152a8059d4b2378cfc8200b484e9008527e1160273d786d61daf580d98dc23f3d3414ab5ab885842bc315c1f45546f6508e6eb19e7d11ad
SSDEEP 24576:gmmP6+bkwvwXnRc9bniMhmbdOkXrsbp1T3:0P6tRXn+AMYhOEkp9
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 928KB
SHA256 abe27f90a49a7e563fc39eb1e0da5c0327e490aefe6638fa4dfa50fea16c42d2
MD5 707bc07daa50b4470e8e992acc3c3a70
SHA1 acac050601ee41db935f340b4842dae2c4affa95
SHA512 a857def44933c4c70152a8059d4b2378cfc8200b484e9008527e1160273d786d61daf580d98dc23f3d3414ab5ab885842bc315c1f45546f6508e6eb19e7d11ad
SSDEEP 24576:gmmP6+bkwvwXnRc9bniMhmbdOkXrsbp1T3:0P6tRXn+AMYhOEkp9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-179-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/432-178-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/432-181-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/432-182-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/884-180-0x0000000071C60000-0x0000000071CAC000-memory.dmp

Download

memory/1908-167-0x0000000007850000-0x0000000007858000-memory.dmp

Download

memory/1908-165-0x0000000007760000-0x000000000776E000-memory.dmp

Download

memory/1908-139-0x0000000002920000-0x0000000002956000-memory.dmp

Download

memory/1908-148-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Download

memory/1908-153-0x0000000006210000-0x000000000622E000-memory.dmp

Download

memory/1908-141-0x0000000005360000-0x0000000005988000-memory.dmp

Download

memory/1908-166-0x0000000007870000-0x000000000788A000-memory.dmp

Download

memory/1908-147-0x0000000005B40000-0x0000000005BA6000-memory.dmp

Download

memory/1908-146-0x0000000005250000-0x0000000005272000-memory.dmp

Download

memory/1908-158-0x00000000071C0000-0x00000000071F2000-memory.dmp

Download

memory/1908-159-0x0000000071330000-0x000000007137C000-memory.dmp

Download

memory/1908-160-0x00000000067D0000-0x00000000067EE000-memory.dmp

Download

memory/1908-161-0x0000000007B70000-0x00000000081EA000-memory.dmp

Download

memory/1908-162-0x0000000007520000-0x000000000753A000-memory.dmp

Download

memory/1908-163-0x0000000007590000-0x000000000759A000-memory.dmp

Download

memory/1908-164-0x00000000077B0000-0x0000000007846000-memory.dmp

Download

memory/3988-144-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3988-143-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3988-145-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3988-151-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3988-149-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4912-132-0x0000000000420000-0x000000000050C000-memory.dmp

Download

memory/4912-136-0x0000000008890000-0x000000000892C000-memory.dmp

Download

memory/4912-135-0x0000000005050000-0x000000000505A000-memory.dmp

Download

memory/4912-134-0x0000000004EB0000-0x0000000004F42000-memory.dmp

Download

memory/4912-133-0x0000000005460000-0x0000000005A04000-memory.dmp

Download