Analysis
-
max time kernel
155s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 18:38
Static task
static1
Behavioral task
behavioral1
Sample
1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe
Resource
win10v2004-20220812-en
General
-
Target
1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe
-
Size
893KB
-
MD5
e62c6746f84f89027d8924786fbe3280
-
SHA1
1b5c55ebe31f1588d0d677e81d68bb11a48be894
-
SHA256
1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f
-
SHA512
4233989e6594ab17d20d2d9b7397552e652028ab99b081fde885067904d0e949e564a5d9131dcd5a4b2a2cc3573437047dc29d0bfb385e88b8685f203001cb99
-
SSDEEP
12288:qBtwEru0VeNlhjfdF+/gKzfYIPI/Lj9tjAYpGo9pIt+9Hc+S2VLgxVQFt9M6sDPE:qNolhRczxILj3AVoIF2h+Cnbs7E
Malware Config
Extracted
remcos
3.1.0 Pro
RemoteHost
berryttttiere.duckdns.org:6553
asddskfjjer.duckdns.org:6553
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-Q3VG56
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 4888 remcos.exe 2608 remcos.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
remcos.exe1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation remcos.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
remcos.exemsedge.exe1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exeremcos.exeremcos.exedescription pid process target process PID 2800 set thread context of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 4888 set thread context of 2608 4888 remcos.exe remcos.exe PID 2608 set thread context of 1000 2608 remcos.exe svchost.exe PID 2608 set thread context of 4484 2608 remcos.exe svchost.exe PID 2608 set thread context of 4780 2608 remcos.exe svchost.exe PID 2608 set thread context of 3808 2608 remcos.exe svchost.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\bececfec-e470-42da-9f7a-f249f72f16c4.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221202191033.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 2 IoCs
Processes:
1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exemsedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4580 msedge.exe 4580 msedge.exe 676 msedge.exe 676 msedge.exe 5012 identity_helper.exe 5012 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
Processes:
msedge.exepid process 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 676 msedge.exe 676 msedge.exe 676 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 2608 remcos.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exeWScript.execmd.exeremcos.exeremcos.exesvchost.exemsedge.exedescription pid process target process PID 2800 wrote to memory of 64 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe schtasks.exe PID 2800 wrote to memory of 64 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe schtasks.exe PID 2800 wrote to memory of 64 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe schtasks.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 2800 wrote to memory of 4084 2800 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe PID 4084 wrote to memory of 4396 4084 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe WScript.exe PID 4084 wrote to memory of 4396 4084 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe WScript.exe PID 4084 wrote to memory of 4396 4084 1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe WScript.exe PID 4396 wrote to memory of 3500 4396 WScript.exe cmd.exe PID 4396 wrote to memory of 3500 4396 WScript.exe cmd.exe PID 4396 wrote to memory of 3500 4396 WScript.exe cmd.exe PID 3500 wrote to memory of 4888 3500 cmd.exe remcos.exe PID 3500 wrote to memory of 4888 3500 cmd.exe remcos.exe PID 3500 wrote to memory of 4888 3500 cmd.exe remcos.exe PID 4888 wrote to memory of 3872 4888 remcos.exe schtasks.exe PID 4888 wrote to memory of 3872 4888 remcos.exe schtasks.exe PID 4888 wrote to memory of 3872 4888 remcos.exe schtasks.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 4888 wrote to memory of 2608 4888 remcos.exe remcos.exe PID 2608 wrote to memory of 1000 2608 remcos.exe svchost.exe PID 2608 wrote to memory of 1000 2608 remcos.exe svchost.exe PID 2608 wrote to memory of 1000 2608 remcos.exe svchost.exe PID 2608 wrote to memory of 1000 2608 remcos.exe svchost.exe PID 2608 wrote to memory of 1000 2608 remcos.exe svchost.exe PID 2608 wrote to memory of 1000 2608 remcos.exe svchost.exe PID 2608 wrote to memory of 1000 2608 remcos.exe svchost.exe PID 2608 wrote to memory of 1000 2608 remcos.exe svchost.exe PID 1000 wrote to memory of 676 1000 svchost.exe msedge.exe PID 1000 wrote to memory of 676 1000 svchost.exe msedge.exe PID 676 wrote to memory of 3176 676 msedge.exe msedge.exe PID 676 wrote to memory of 3176 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe PID 676 wrote to memory of 4188 676 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe"C:\Users\Admin\AppData\Local\Temp\1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOqvUC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9376.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f.exe"{path}"2⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOqvUC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5109.tmp"6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"{path}"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.08⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbdca846f8,0x7ffbdca84708,0x7ffbdca847189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:39⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4924 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5624 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings9⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ff7ee8d5460,0x7ff7ee8d5470,0x7ff7ee8d548010⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:89⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7176 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,12000099845767066860,5943159726551986867,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.08⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdca846f8,0x7ffbdca84708,0x7ffbdca847189⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.08⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdca846f8,0x7ffbdca84708,0x7ffbdca847189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.08⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdca846f8,0x7ffbdca84708,0x7ffbdca847189⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.08⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdca846f8,0x7ffbdca84708,0x7ffbdca847189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.08⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffbdca846f8,0x7ffbdca84708,0x7ffbdca847189⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59cc113cab81df2ff66421c3dd6bf4d31
SHA1c1e1b1e2f007732c8c79eedac889b7312b08990e
SHA25648438eda8d47a465f7aa67c36937ec174be450bea6b501e2fc1cc929c917e2ea
SHA512e069f0cbd04f3fc91824df48f247e1542c6858cc3cf3dd4f16c26258beac2f7aa256bad6cdda3b2cef916afd186b269375a43013138fbc795f22c1367c799a2b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59cc113cab81df2ff66421c3dd6bf4d31
SHA1c1e1b1e2f007732c8c79eedac889b7312b08990e
SHA25648438eda8d47a465f7aa67c36937ec174be450bea6b501e2fc1cc929c917e2ea
SHA512e069f0cbd04f3fc91824df48f247e1542c6858cc3cf3dd4f16c26258beac2f7aa256bad6cdda3b2cef916afd186b269375a43013138fbc795f22c1367c799a2b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59cc113cab81df2ff66421c3dd6bf4d31
SHA1c1e1b1e2f007732c8c79eedac889b7312b08990e
SHA25648438eda8d47a465f7aa67c36937ec174be450bea6b501e2fc1cc929c917e2ea
SHA512e069f0cbd04f3fc91824df48f247e1542c6858cc3cf3dd4f16c26258beac2f7aa256bad6cdda3b2cef916afd186b269375a43013138fbc795f22c1367c799a2b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59cc113cab81df2ff66421c3dd6bf4d31
SHA1c1e1b1e2f007732c8c79eedac889b7312b08990e
SHA25648438eda8d47a465f7aa67c36937ec174be450bea6b501e2fc1cc929c917e2ea
SHA512e069f0cbd04f3fc91824df48f247e1542c6858cc3cf3dd4f16c26258beac2f7aa256bad6cdda3b2cef916afd186b269375a43013138fbc795f22c1367c799a2b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59cc113cab81df2ff66421c3dd6bf4d31
SHA1c1e1b1e2f007732c8c79eedac889b7312b08990e
SHA25648438eda8d47a465f7aa67c36937ec174be450bea6b501e2fc1cc929c917e2ea
SHA512e069f0cbd04f3fc91824df48f247e1542c6858cc3cf3dd4f16c26258beac2f7aa256bad6cdda3b2cef916afd186b269375a43013138fbc795f22c1367c799a2b
-
C:\Users\Admin\AppData\Local\Temp\install.vbsFilesize
418B
MD5b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Local\Temp\tmp5109.tmpFilesize
1KB
MD5de343f9e1e447f21004bcfb2f20145c0
SHA1dd38b7ff2a5f197a51ae48b9392d448c8bf0c686
SHA25623ddad95d7e34eff8f22099b3b4bac9c14aecc4ba4ad25d070471c620614d8fa
SHA5125c8e06421a0eddb3a7bdcfd82ba4e7d5c4b0428e86ea3f91498e430577b2b5cac170d73f25943656af4f93e16b6b5571f50991094ee4856d34b14837286302ff
-
C:\Users\Admin\AppData\Local\Temp\tmp9376.tmpFilesize
1KB
MD5de343f9e1e447f21004bcfb2f20145c0
SHA1dd38b7ff2a5f197a51ae48b9392d448c8bf0c686
SHA25623ddad95d7e34eff8f22099b3b4bac9c14aecc4ba4ad25d070471c620614d8fa
SHA5125c8e06421a0eddb3a7bdcfd82ba4e7d5c4b0428e86ea3f91498e430577b2b5cac170d73f25943656af4f93e16b6b5571f50991094ee4856d34b14837286302ff
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeFilesize
893KB
MD5e62c6746f84f89027d8924786fbe3280
SHA11b5c55ebe31f1588d0d677e81d68bb11a48be894
SHA2561dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f
SHA5124233989e6594ab17d20d2d9b7397552e652028ab99b081fde885067904d0e949e564a5d9131dcd5a4b2a2cc3573437047dc29d0bfb385e88b8685f203001cb99
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeFilesize
893KB
MD5e62c6746f84f89027d8924786fbe3280
SHA11b5c55ebe31f1588d0d677e81d68bb11a48be894
SHA2561dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f
SHA5124233989e6594ab17d20d2d9b7397552e652028ab99b081fde885067904d0e949e564a5d9131dcd5a4b2a2cc3573437047dc29d0bfb385e88b8685f203001cb99
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeFilesize
893KB
MD5e62c6746f84f89027d8924786fbe3280
SHA11b5c55ebe31f1588d0d677e81d68bb11a48be894
SHA2561dacdded73c4cf1270303e47ce3f12a5acdf7881eea7487231115e2be20aea5f
SHA5124233989e6594ab17d20d2d9b7397552e652028ab99b081fde885067904d0e949e564a5d9131dcd5a4b2a2cc3573437047dc29d0bfb385e88b8685f203001cb99
-
\??\pipe\LOCAL\crashpad_676_MGSMVMSLOCQRLFRQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/64-137-0x0000000000000000-mapping.dmp
-
memory/372-217-0x0000000000000000-mapping.dmp
-
memory/408-181-0x0000000000000000-mapping.dmp
-
memory/428-172-0x0000000000000000-mapping.dmp
-
memory/448-192-0x0000000000000000-mapping.dmp
-
memory/616-184-0x0000000000000000-mapping.dmp
-
memory/676-161-0x0000000000000000-mapping.dmp
-
memory/1000-158-0x0000000000000000-mapping.dmp
-
memory/1152-213-0x0000000000000000-mapping.dmp
-
memory/1604-196-0x0000000000000000-mapping.dmp
-
memory/1888-202-0x0000000000000000-mapping.dmp
-
memory/2144-210-0x0000000000000000-mapping.dmp
-
memory/2156-212-0x0000000000000000-mapping.dmp
-
memory/2492-211-0x0000000000000000-mapping.dmp
-
memory/2608-177-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2608-156-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2608-160-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2608-153-0x0000000000000000-mapping.dmp
-
memory/2608-157-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/2800-135-0x0000000005810000-0x000000000581A000-memory.dmpFilesize
40KB
-
memory/2800-134-0x0000000005820000-0x00000000058B2000-memory.dmpFilesize
584KB
-
memory/2800-133-0x0000000005E80000-0x0000000006424000-memory.dmpFilesize
5.6MB
-
memory/2800-132-0x0000000000EB0000-0x0000000000F96000-memory.dmpFilesize
920KB
-
memory/2800-136-0x0000000008B30000-0x0000000008BCC000-memory.dmpFilesize
624KB
-
memory/3176-162-0x0000000000000000-mapping.dmp
-
memory/3220-190-0x0000000000000000-mapping.dmp
-
memory/3412-179-0x0000000000000000-mapping.dmp
-
memory/3412-207-0x0000000000000000-mapping.dmp
-
memory/3452-228-0x0000000000000000-mapping.dmp
-
memory/3460-185-0x0000000000000000-mapping.dmp
-
memory/3476-200-0x0000000000000000-mapping.dmp
-
memory/3500-147-0x0000000000000000-mapping.dmp
-
memory/3568-201-0x0000000000000000-mapping.dmp
-
memory/3808-221-0x0000000000000000-mapping.dmp
-
memory/3872-151-0x0000000000000000-mapping.dmp
-
memory/3892-220-0x0000000000000000-mapping.dmp
-
memory/4076-222-0x0000000000000000-mapping.dmp
-
memory/4084-143-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4084-141-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4084-140-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4084-145-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4084-139-0x0000000000000000-mapping.dmp
-
memory/4084-142-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4176-174-0x0000000000000000-mapping.dmp
-
memory/4188-164-0x0000000000000000-mapping.dmp
-
memory/4252-168-0x0000000000000000-mapping.dmp
-
memory/4292-183-0x0000000000000000-mapping.dmp
-
memory/4380-219-0x0000000000000000-mapping.dmp
-
memory/4396-144-0x0000000000000000-mapping.dmp
-
memory/4484-186-0x0000000000000000-mapping.dmp
-
memory/4580-165-0x0000000000000000-mapping.dmp
-
memory/4664-170-0x0000000000000000-mapping.dmp
-
memory/4680-176-0x0000000000000000-mapping.dmp
-
memory/4680-209-0x0000000000000000-mapping.dmp
-
memory/4680-226-0x0000000000000000-mapping.dmp
-
memory/4780-204-0x0000000000000000-mapping.dmp
-
memory/4888-148-0x0000000000000000-mapping.dmp
-
memory/4980-193-0x0000000000000000-mapping.dmp
-
memory/5012-215-0x0000000000000000-mapping.dmp
-
memory/5092-198-0x0000000000000000-mapping.dmp