remcos | b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
Size

910KB
MD5

783addabb1e7dcb48130649faaf852c7
SHA1

c87553da7df62530e9262b35930d6a15aff4949a
SHA256

b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da
SHA512

9f352fd443bd680a71ce1a4ece252baa81c2c293727d520ce57da93d461808f50be6c22f4a6f8e0a18f0857785b47f783f1f3cc6c41442275c12149e067b3c3b
SSDEEP

24576:IsWW2f6w8r89u8TeWMkzIULsHTJMGoMzyc/VdK:IsT2fTC8BSWMkluMMzyctd

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

bignight.net:3363

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-1XSDBO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 19 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1528-39-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-44-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-49-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-51-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-54-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-52-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-55-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-57-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-105-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-106-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-107-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-112-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-113-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-119-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-120-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-125-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-126-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-131-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1528-133-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4312-8-0x000000000C350000-0x000000000C35C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe

description	pid	process	target process
PID 4312 set thread context of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1948 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

4288 powershell.exe
1340 powershell.exe
1340 powershell.exe
4288 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1340 powershell.exe
Token: SeDebugPrivilege 4288 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe

pid process

1528 b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe

pid	process
1948	schtasks.exe

pid	process
4288	powershell.exe
1340	powershell.exe
1340	powershell.exe
4288	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe

pid	process
1528	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe

description	pid	process	target process
PID 4312 wrote to memory of 1340	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	powershell.exe
PID 4312 wrote to memory of 1340	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	powershell.exe
PID 4312 wrote to memory of 1340	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	powershell.exe
PID 4312 wrote to memory of 4288	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	powershell.exe
PID 4312 wrote to memory of 4288	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	powershell.exe
PID 4312 wrote to memory of 4288	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	powershell.exe
PID 4312 wrote to memory of 1948	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	schtasks.exe
PID 4312 wrote to memory of 1948	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	schtasks.exe
PID 4312 wrote to memory of 1948	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	schtasks.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
PID 4312 wrote to memory of 1528	4312	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe	b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe

C:\Users\Admin\AppData\Local\Temp\b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
"C:\Users\Admin\AppData\Local\Temp\b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HFqduGIsFotY.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HFqduGIsFotY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9B84.tmp"
2⤵
- Creates scheduled task(s)
PID:1948

C:\Users\Admin\AppData\Local\Temp\b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe
"C:\Users\Admin\AppData\Local\Temp\b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
83b186ad7ed3c4dfe70dfc529ebe5e3b

SHA1
21a85e3c7fe7d37a7e5e69aa901c0cbf543a9355

SHA256
a9e1d1c5c5adf82ec0a4c4688dd228d4357b4222c434c5371b9bc50d4e259937

SHA512
e28c763fb4f6d07e02a04e7eeb70bb067821d62514362420f3477480ba66fcc32be3db3fb5295e822890d4cabfd943cb06c0661fa5c0996900b7bc9a4aa1a4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
14140dcf30200324419f32b2da3a6e14

SHA1
5991540bd79b2f93dbac2a4eed99e4f7b281ecdd

SHA256
a6bd150d9a3194f7ebf3b7aa14f191e8213ad77b2e6f10e5f156b579d9187088

SHA512
0b22a272a049df7e0f2592dee9ca570e867a10948dfb6bf3a86ca71082ca957d1649066e87b0bfd5e1777cc8fc761a913d8f3c1a6f550dc25ff924c7d651b4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v2dw2thr.pti.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9B84.tmp

Filesize
1KB

MD5
4261dfbd8420edb2cbe56ccb96f8c5b1

SHA1
18763e8e73f07110292fce297c0109bc28f08515

SHA256
edff98cccbcc6cb4cc6a7aeef7f26531a63c1407734223e4a34724cb1022f01d

SHA512
35277635da186b5faaec8d9599eff9e0abc6271bd1a4b359d3e56c49c4d74a63c5a1dcc6d3c04fa615ba763d88b7e7b87586e6df1f8e4c46b89161ccdff1436d

Download Submit
memory/1340-58-0x0000000006690000-0x00000000066DC000-memory.dmp

Filesize
304KB

Download
memory/1340-43-0x0000000005C80000-0x0000000005FD4000-memory.dmp

Filesize
3.3MB

Download
memory/1340-100-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/1340-94-0x00000000077B0000-0x00000000077B8000-memory.dmp

Filesize
32KB

Download
memory/1340-93-0x00000000077D0000-0x00000000077EA000-memory.dmp

Filesize
104KB

Download
memory/1340-91-0x00000000076C0000-0x00000000076CE000-memory.dmp

Filesize
56KB

Download
memory/1340-15-0x0000000002820000-0x0000000002856000-memory.dmp

Filesize
216KB

Download
memory/1340-18-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1340-17-0x0000000005450000-0x0000000005A78000-memory.dmp

Filesize
6.2MB

Download
memory/1340-16-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/1340-61-0x000000007F530000-0x000000007F540000-memory.dmp

Filesize
64KB

Download
memory/1340-19-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1340-89-0x0000000007710000-0x00000000077A6000-memory.dmp

Filesize
600KB

Download
memory/1340-86-0x0000000006120000-0x000000000613A000-memory.dmp

Filesize
104KB

Download
memory/1340-84-0x0000000007350000-0x00000000073F3000-memory.dmp

Filesize
652KB

Download
memory/1340-60-0x0000000007310000-0x0000000007342000-memory.dmp

Filesize
200KB

Download
memory/1340-31-0x0000000005390000-0x00000000053F6000-memory.dmp

Filesize
408KB

Download
memory/1340-74-0x0000000006710000-0x000000000672E000-memory.dmp

Filesize
120KB

Download
memory/1340-63-0x00000000710C0000-0x000000007110C000-memory.dmp

Filesize
304KB

Download
memory/1340-56-0x0000000004EC0000-0x0000000004EDE000-memory.dmp

Filesize
120KB

Download
memory/1528-120-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-133-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-125-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-126-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-106-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-131-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-107-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-105-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-112-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-113-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1528-119-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4288-62-0x000000007F3D0000-0x000000007F3E0000-memory.dmp

Filesize
64KB

Download
memory/4288-85-0x0000000007690000-0x0000000007D0A000-memory.dmp

Filesize
6.5MB

Download
memory/4288-87-0x00000000070E0000-0x00000000070EA000-memory.dmp

Filesize
40KB

Download
memory/4288-21-0x0000000002440000-0x0000000002450000-memory.dmp

Filesize
64KB

Download
memory/4288-90-0x0000000007070000-0x0000000007081000-memory.dmp

Filesize
68KB

Download
memory/4288-59-0x0000000002440000-0x0000000002450000-memory.dmp

Filesize
64KB

Download
memory/4288-92-0x00000000072B0000-0x00000000072C4000-memory.dmp

Filesize
80KB

Download
memory/4288-23-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/4288-64-0x00000000710C0000-0x000000007110C000-memory.dmp

Filesize
304KB

Download
memory/4288-24-0x0000000004C40000-0x0000000004C62000-memory.dmp

Filesize
136KB

Download
memory/4288-25-0x0000000005440000-0x00000000054A6000-memory.dmp

Filesize
408KB

Download
memory/4288-101-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/4288-20-0x0000000002440000-0x0000000002450000-memory.dmp

Filesize
64KB

Download
memory/4312-6-0x00000000055A0000-0x00000000055B8000-memory.dmp

Filesize
96KB

Download
memory/4312-7-0x0000000005580000-0x0000000005588000-memory.dmp

Filesize
32KB

Download
memory/4312-2-0x00000000057B0000-0x0000000005D54000-memory.dmp

Filesize
5.6MB

Download
memory/4312-1-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/4312-3-0x00000000052E0000-0x0000000005372000-memory.dmp

Filesize
584KB

Download
memory/4312-8-0x000000000C350000-0x000000000C35C000-memory.dmp

Filesize
48KB

Download
memory/4312-9-0x000000000C830000-0x000000000C8F0000-memory.dmp

Filesize
768KB

Download
memory/4312-10-0x000000000FF40000-0x000000000FFDC000-memory.dmp

Filesize
624KB

Download
memory/4312-5-0x00000000053A0000-0x00000000053AA000-memory.dmp

Filesize
40KB

Download
memory/4312-0-0x0000000000810000-0x00000000008FA000-memory.dmp

Filesize
936KB

Download
memory/4312-4-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/4312-50-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download