remcos | daf1a1aade909546d0e1b6ef05f6ee947b429988722ffb0253bed11e9b1bd80e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2023 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mensaje De cobro N°03, Cobro de Administración vencida..exe
Size

880KB
MD5

da7acde65b7eb804162b577605f539b7
SHA1

fcf94aed79d6853a184ec90f4d0df4594e3b02f4
SHA256

daf1a1aade909546d0e1b6ef05f6ee947b429988722ffb0253bed11e9b1bd80e
SHA512

5d5ba005612c00c97704f22920481161c227fec7bb1d1dfc4761f3e4645dbfa4d486aba10a63ec0de8ac270fbf6b15971d6c26e126eeae32727816861941ca32
SSDEEP

12288:UWb4FlLKHFjcs3KKm1O5iMaVKXO2cBZMB+/KTLefMM/jWSc5gA7yXZQJ/scAlibr:/+KmIi8cBOKA2z/jo5gA7O+J/sbQbr

Score

10^/10

remcos plata rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

PLATA

santiagoroblesplata.con-ip.com:1014

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-IPJMNR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	Mensaje De cobro N°03, Cobro de Administración vencida..exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe
1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe
1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe
1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe
3684	powershell.exe
3684	powershell.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3300	RegSvcs.exe
1368	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	1368	taskmgr.exe
Token: SeSystemProfilePrivilege	1368	taskmgr.exe
Token: SeCreateGlobalPrivilege	1368	taskmgr.exe
Token: 33	1368	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1368	taskmgr.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe

Suspicious use of SendNotifyMessage 49 IoCs

pid	Process
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe
1368	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3300	RegSvcs.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3684	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	93
PID 1656 wrote to memory of 3684	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	93
PID 1656 wrote to memory of 3684	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	93
PID 1656 wrote to memory of 3152	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	95
PID 1656 wrote to memory of 3152	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	95
PID 1656 wrote to memory of 3152	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	95
PID 1656 wrote to memory of 1584	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	97
PID 1656 wrote to memory of 1584	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	97
PID 1656 wrote to memory of 1584	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	97
PID 1656 wrote to memory of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98
PID 1656 wrote to memory of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98
PID 1656 wrote to memory of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98
PID 1656 wrote to memory of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98
PID 1656 wrote to memory of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98
PID 1656 wrote to memory of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98
PID 1656 wrote to memory of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98
PID 1656 wrote to memory of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98
PID 1656 wrote to memory of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98
PID 1656 wrote to memory of 3300	1656	Mensaje De cobro N°03, Cobro de Administración vencida..exe	98

C:\Users\Admin\AppData\Local\Temp\Mensaje De cobro N°03, Cobro de Administración vencida..exe
"C:\Users\Admin\AppData\Local\Temp\Mensaje De cobro N°03, Cobro de Administración vencida..exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eOPCeE.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3684
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eOPCeE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp156C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3300

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4748

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jet2xg11.1se.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp156C.tmp

Filesize
1KB

MD5
35e5147a154c95d07e01d35b4cf1046d

SHA1
659aee5d1601c42b37f148bf0bf9782dad450f8a

SHA256
b5a072ad1dc4f4d6dde7c6aa4b6ec58336ed5438e133c3dfdc55696bba4337e2

SHA512
4f39b2ba9dec58c4322161718f0354ac86c875f225240f61d72b7c9a1d098234415cb3cf14c6d3e5483542361f7037f3489445d314a6d0a49fdea786f3b8b5b2

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
170B

MD5
035e352219bab6897d08f2bd240d314c

SHA1
3e27d5265bf3e48bc0a840d43fb8d77e86b76f86

SHA256
78fdd88b7110e780f220f8f47a56adda60301fc873904eae2a6cf95f39fd86b0

SHA512
73a407c1ff92c6bef6d35537c373a1dc71ccf4bd75792c8b5286450423d1116cb96aba5694751ca2ebc02a8cb78b866a1b73e198bbf51c68a9391653596b7899

Download Submit
memory/1368-234-0x00000230B28E0000-0x00000230B28E1000-memory.dmp

Filesize
4KB

Download
memory/1368-233-0x00000230B28E0000-0x00000230B28E1000-memory.dmp

Filesize
4KB

Download
memory/1368-232-0x00000230B28E0000-0x00000230B28E1000-memory.dmp

Filesize
4KB

Download
memory/1368-238-0x00000230B28E0000-0x00000230B28E1000-memory.dmp

Filesize
4KB

Download
memory/1368-244-0x00000230B28E0000-0x00000230B28E1000-memory.dmp

Filesize
4KB

Download
memory/1368-239-0x00000230B28E0000-0x00000230B28E1000-memory.dmp

Filesize
4KB

Download
memory/1368-242-0x00000230B28E0000-0x00000230B28E1000-memory.dmp

Filesize
4KB

Download
memory/1368-243-0x00000230B28E0000-0x00000230B28E1000-memory.dmp

Filesize
4KB

Download
memory/1368-241-0x00000230B28E0000-0x00000230B28E1000-memory.dmp

Filesize
4KB

Download
memory/1368-240-0x00000230B28E0000-0x00000230B28E1000-memory.dmp

Filesize
4KB

Download
memory/1656-136-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1656-139-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1656-133-0x0000000000380000-0x0000000000462000-memory.dmp

Filesize
904KB

Download
memory/1656-137-0x0000000004CD0000-0x0000000004CDA000-memory.dmp

Filesize
40KB

Download
memory/1656-138-0x00000000063B0000-0x000000000644C000-memory.dmp

Filesize
624KB

Download
memory/1656-135-0x0000000004D00000-0x0000000004D92000-memory.dmp

Filesize
584KB

Download
memory/1656-134-0x0000000005360000-0x0000000005904000-memory.dmp

Filesize
5.6MB

Download
memory/3300-207-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-218-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-265-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-171-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-264-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-262-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-261-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-184-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-260-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-259-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-256-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-255-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-254-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-253-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-250-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-249-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-196-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-197-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-199-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-200-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-201-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-202-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-203-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-206-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-248-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-208-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-209-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-211-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-212-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-213-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-214-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-216-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-217-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-247-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-219-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-147-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-222-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-223-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-224-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-225-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-228-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-229-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-230-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-231-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-150-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-151-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-154-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3300-155-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3684-191-0x00000000074D0000-0x00000000074DE000-memory.dmp

Filesize
56KB

Download
memory/3684-173-0x0000000070B30000-0x0000000070B7C000-memory.dmp

Filesize
304KB

Download
memory/3684-158-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/3684-156-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/3684-146-0x0000000005120000-0x0000000005748000-memory.dmp

Filesize
6.2MB

Download
memory/3684-144-0x0000000002600000-0x0000000002636000-memory.dmp

Filesize
216KB

Download
memory/3684-169-0x0000000005FA0000-0x0000000005FBE000-memory.dmp

Filesize
120KB

Download
memory/3684-152-0x0000000004F50000-0x0000000004F72000-memory.dmp

Filesize
136KB

Download
memory/3684-170-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/3684-157-0x0000000005850000-0x00000000058B6000-memory.dmp

Filesize
408KB

Download
memory/3684-159-0x00000000058C0000-0x0000000005926000-memory.dmp

Filesize
408KB

Download
memory/3684-190-0x0000000007520000-0x00000000075B6000-memory.dmp

Filesize
600KB

Download
memory/3684-189-0x0000000007310000-0x000000000731A000-memory.dmp

Filesize
40KB

Download
memory/3684-188-0x000000007FA50000-0x000000007FA60000-memory.dmp

Filesize
64KB

Download
memory/3684-187-0x00000000072A0000-0x00000000072BA000-memory.dmp

Filesize
104KB

Download
memory/3684-186-0x00000000078E0000-0x0000000007F5A000-memory.dmp

Filesize
6.5MB

Download
memory/3684-183-0x0000000006F70000-0x0000000006F8E000-memory.dmp

Filesize
120KB

Download
memory/3684-192-0x00000000075E0000-0x00000000075FA000-memory.dmp

Filesize
104KB

Download
memory/3684-172-0x0000000006550000-0x0000000006582000-memory.dmp

Filesize
200KB

Download
memory/3684-193-0x00000000075C0000-0x00000000075C8000-memory.dmp

Filesize
32KB

Download