remcos | 75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wegivenebstthingsforbeterplaceformebetthingscoming.hta
Size 8KB
Sample260706-pw52eabs4p
SHA256 75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b
MD5 ccd07811a2b885361a3495d92c2b9e61
SHA1 80e2a9e587eb8c68f6e969b1a58a498ad3df9554
SHA512 5991939dbd553f01b34ab136e88243b3aeb44431a790c8c1c57462a7ca8af7d7edc86b120dbd7be58505b7d652bb3daf26e1a3e335cfc846a9e405182ae9ba40
SSDEEP 96:VTpkAfculHfNXsPx0mnCtmsSF9eN2v24j3ZN2+UQhXj3tKhS4Q3RTb7UVE73QNLQ:FphfculH/mnuIrBUQhzIhVQ3Rn7qyQOL
TLSH
T15902D297C92ECCFE6F3A163B108131C5A28D8296CD0E83337D2EA07D6767C1485F2959
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost collection discovery execution remcos rat

Malware Config

Extracted

Family

remcos

Version

6.0.0 Pro

Botnet

RemoteHost

155.103.70.198:13408

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-8MT8UK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	1744	powershell.exe	88

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/924-34-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/5540-36-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/5248-40-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5540-36-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/924-34-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1776	powershell.exe
3	1776	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Caspol.exe

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key queried	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key queried	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key queried	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 1776 set thread context of 5812	1776	powershell.exe	92
PID 5812 set thread context of 924	5812	Caspol.exe	94
PID 5812 set thread context of 5540	5812	Caspol.exe	95
PID 5812 set thread context of 5248	5812	Caspol.exe	97
PID 5812 set thread context of 3336	5812	Caspol.exe	101
PID 5812 set thread context of 3316	5812	Caspol.exe	102
PID 5812 set thread context of 4776	5812	Caspol.exe	103
PID 5812 set thread context of 2444	5812	Caspol.exe	106
PID 5812 set thread context of 2232	5812	Caspol.exe	107
PID 5812 set thread context of 2012	5812	Caspol.exe	108

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1776	powershell.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4356	924	WerFault.exe
4804	3336	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
924	Caspol.exe
924	Caspol.exe
5248	Caspol.exe
5248	Caspol.exe
3336	Caspol.exe
3336	Caspol.exe
4776	Caspol.exe
4776	Caspol.exe
2444	Caspol.exe
2444	Caspol.exe
2012	Caspol.exe
2012	Caspol.exe
2444	Caspol.exe
2444	Caspol.exe

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
5812	Caspol.exe
5812	Caspol.exe
5812	Caspol.exe
5812	Caspol.exe
5812	Caspol.exe
5812	Caspol.exe
5812	Caspol.exe
5812	Caspol.exe
5812	Caspol.exe
5812	Caspol.exe
5812	Caspol.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	5248	Caspol.exe
Token: SeDebugPrivilege	4776	Caspol.exe
Token: SeDebugPrivilege	2012	Caspol.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 984	1776	powershell.exe	91
PID 1776 wrote to memory of 5812	1776	powershell.exe	92
PID 1776 wrote to memory of 5812	1776	powershell.exe	92
PID 1776 wrote to memory of 5812	1776	powershell.exe	92
PID 1776 wrote to memory of 5812	1776	powershell.exe	92
PID 1776 wrote to memory of 5812	1776	powershell.exe	92
PID 1776 wrote to memory of 5812	1776	powershell.exe	92
PID 1776 wrote to memory of 5812	1776	powershell.exe	92
PID 5812 wrote to memory of 5036	5812	Caspol.exe	93
PID 5812 wrote to memory of 924	5812	Caspol.exe	94
PID 5812 wrote to memory of 5540	5812	Caspol.exe	95
PID 5812 wrote to memory of 1864	5812	Caspol.exe	96
PID 5812 wrote to memory of 5248	5812	Caspol.exe	97
PID 5812 wrote to memory of 3336	5812	Caspol.exe	101
PID 5812 wrote to memory of 3316	5812	Caspol.exe	102
PID 5812 wrote to memory of 4776	5812	Caspol.exe	103
PID 5812 wrote to memory of 2444	5812	Caspol.exe	106
PID 5812 wrote to memory of 2232	5812	Caspol.exe	107
PID 5812 wrote to memory of 2012	5812	Caspol.exe	108

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Caspol.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\wegivenebstthingsforbeterplaceformebetthingscoming.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
PID:3000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:intermediator"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\dcbnnvkmkzgkjxdnvgfyw"
    3⤵
    PID:5036
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\dcbnnvkmkzgkjxdnvgfyw"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 584
      4⤵
      Program crash
      PID:4356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\negggovoyhyoldrrnrraztpv"
    3⤵
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    PID:5540
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\yztqhgfhmpqtvjnvwcmbkgkmrmn"
    3⤵
    PID:1864
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\yztqhgfhmpqtvjnvwcmbkgkmrmn"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\fkatfqvojcfeufbrybzpoyd"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 240
      4⤵
      Program crash
      PID:4804
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\qefefigqxkxjwlqvhmmjzdxcur"
    3⤵
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    PID:3316
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\agkwgbrjlspohzmzyxzkcqsldxuxj"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\ungodalvzothtaifrj"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\xpmgdswwnxluvgejjuzfc"
    3⤵
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - outlook_office_path
    PID:2232
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe /stext "C:\Users\Admin\AppData\Local\Temp\hkzzekgqbfdzfmsvsfuyfjkt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 924 -ip 924
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3336 -ip 3336
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ungodalvzothtaifrj

Path C:\Users\Admin\AppData\Local\Temp\ungodalvzothtaifrj
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/924-31-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/924-34-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/924-33-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1776-12-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-15-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-8-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-9-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-10-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-11-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-4-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-13-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-14-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-7-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-16-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-17-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-18-0x0000024BF70A0000-0x0000024BF7154000-memory.dmp

Download

memory/1776-19-0x0000024BF6BB0000-0x0000024BF6BBA000-memory.dmp

Download

memory/1776-3-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-0-0x00007FF962EDF000-0x00007FF962EE0000-memory.dmp

Download

memory/1776-2-0x0000024BF6B30000-0x0000024BF6B52000-memory.dmp

Download

memory/1776-25-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/1776-1-0x00007FF962D50000-0x00007FF9636F4000-memory.dmp

Download

memory/5248-39-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5248-38-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5248-40-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5540-32-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5540-35-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5540-36-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/5812-77-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-64-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5812-28-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-27-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-24-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-29-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-22-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-26-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-20-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-69-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-23-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-67-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5812-30-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-70-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-71-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-72-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-74-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-75-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-68-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5812-76-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-78-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/5812-79-0x0000000000400000-0x0000000000480000-memory.dmp

Download