Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 14:31
Static task
static1
Behavioral task
behavioral1
Sample
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe
Resource
win10v2004-20240412-en
General
-
Target
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe
-
Size
984KB
-
MD5
3f6158f27ef80630313026f52cac93f4
-
SHA1
ba374eb42010c5cf44fdc259983dc44442cb0753
-
SHA256
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b
-
SHA512
7ce1b216d055a6ae8491d93fab07502646b1a1939e2796005005875405e65ae5a2d97fc7607690ba2d38683678d22206529ad57d26c243e76c695da5b67faaf0
-
SSDEEP
24576:4Nxc5Gjn6R/TiWtnTS65ox40AjuCDLym06vQvyi3B:CxfjnkOYJ5cbuLyZ9
Malware Config
Extracted
remcos
RemoteHost
paygateme.net:2286
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BDTHCE
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3544-97-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral2/memory/3544-100-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3356-91-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/3356-104-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3356-91-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/3544-97-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/3836-101-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/3544-100-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/3836-102-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/3356-104-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe -
Drops file in System32 directory 9 IoCs
Processes:
dxdiag.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF dxdiag.exe File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF dxdiag.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exedescription pid process target process PID 1100 set thread context of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 set thread context of 3356 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 set thread context of 3544 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 set thread context of 3836 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dxdiag.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dxdiag.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs dxdiag.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 36 IoCs
Processes:
dxdiag.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1 dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32 dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dxdiagn.dll" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1132431369-515282257-1998160155-1000\{6D414C6A-6ED1-494A-B5A1-2D0D5D7608A7} dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1 dxdiag.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1132431369-515282257-1998160155-1000\{F059B9C9-893F-4C47-8122-3365BBC998E7} dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B} dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7} dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32 dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider dxdiag.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exepowershell.exe839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exedxdiag.exepid process 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 2908 powershell.exe 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 2908 powershell.exe 3356 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 3356 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 3836 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 3836 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 3356 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 3356 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 1540 dxdiag.exe 1540 dxdiag.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exepid process 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exepid process 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exepowershell.exe839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exedescription pid process Token: SeDebugPrivilege 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe Token: SeDebugPrivilege 2908 powershell.exe Token: SeDebugPrivilege 3836 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exedxdiag.exepid process 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 1540 dxdiag.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exedescription pid process target process PID 1100 wrote to memory of 2908 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe powershell.exe PID 1100 wrote to memory of 2908 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe powershell.exe PID 1100 wrote to memory of 2908 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe powershell.exe PID 1100 wrote to memory of 4752 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe schtasks.exe PID 1100 wrote to memory of 4752 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe schtasks.exe PID 1100 wrote to memory of 4752 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe schtasks.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 1100 wrote to memory of 2788 1100 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 1160 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 1160 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 1160 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 388 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 388 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 388 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3356 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3356 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3356 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3356 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3556 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3556 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3556 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 1276 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 1276 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 1276 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3544 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3544 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3544 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3544 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3836 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3836 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3836 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 3836 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe PID 2788 wrote to memory of 1540 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe dxdiag.exe PID 2788 wrote to memory of 1540 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe dxdiag.exe PID 2788 wrote to memory of 1540 2788 839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe dxdiag.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe"C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\opYxqsS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\opYxqsS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A33.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe"C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exeC:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe /stext "C:\Users\Admin\AppData\Local\Temp\zqvirlmqyzmazsxettzueztl"3⤵
-
C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exeC:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe /stext "C:\Users\Admin\AppData\Local\Temp\zqvirlmqyzmazsxettzueztl"3⤵
-
C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exeC:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe /stext "C:\Users\Admin\AppData\Local\Temp\zqvirlmqyzmazsxettzueztl"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exeC:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe /stext "C:\Users\Admin\AppData\Local\Temp\csaasexsmhefcytiddmvpmoctnt"3⤵
-
C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exeC:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe /stext "C:\Users\Admin\AppData\Local\Temp\csaasexsmhefcytiddmvpmoctnt"3⤵
-
C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exeC:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe /stext "C:\Users\Admin\AppData\Local\Temp\csaasexsmhefcytiddmvpmoctnt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exeC:\Users\Admin\AppData\Local\Temp\839be5e2a653b3fbd43370403d066b16e4dd22d867997b5156de621f44bf072b.exe /stext "C:\Users\Admin\AppData\Local\Temp\mmftswilapwsmmhmuogpsrjlctcyuw"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dxdiag.exe"C:\Windows\System32\dxdiag.exe" /t C:\Users\Admin\AppData\Local\Temp\sysinfo.txt3⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD55700c31e31095efd1738c35a38db6689
SHA194b40de6fa7ff0339b145447db5d796372da3e32
SHA256bdf94f697a6290e0cb02d52110eb3a2a1577e1045b1c4dd7f1a95e0b8566f6c5
SHA512cc94ac03b62a8e4ac27b8d46496aa10e6f9b3aa77938cfb05bbe3a26e069e4fde198010ba5e49aa203b94e8aef5c696ab02f6f87b623d1849350cb424d55cf17
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_piobjlgv.zmy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\sysinfo.txtFilesize
62KB
MD540980e269347e87c53921375c32cba95
SHA1d072e7b577fd054b5d64d9e81483ecd94da14487
SHA2560aa87a24026017f74fddb3296165ab18df88f96f1a271579b003a5dadc544801
SHA5129912f7677bf99cd80b93d90438092a38b2c735f61564f1485c09359667e15f31ac148b216b699a3e0f31954288368140c79fc72418a15eeb44b73eeb07f78ef4
-
C:\Users\Admin\AppData\Local\Temp\sysinfo.txtFilesize
84KB
MD5c2bbd6acddef5f8e4194f4011075b2a6
SHA1f82ce4f551c2d25d2a739edad34e23dc830e4d13
SHA256f7364f4b16d0c712ccc25a238c2f57972c4bd84ce54a86b5acfc7f6c6768a583
SHA512b3407dfe7b6cf7d6c68450e5cf214e88d4f8bda35d36948645f322be18e9455aee75f779d0c0b4e51d335a4abafaab67c40382fbf205a142ea7d562dbb2b4cfc
-
C:\Users\Admin\AppData\Local\Temp\tmp6A33.tmpFilesize
1KB
MD55efe61958437b14b189c363d2aa20bee
SHA1c14a68d0baa2b716e21c4cc882a91d80958983ee
SHA256b95fdcaebcd3f713d33aea91ab4631a23ce26d9e73c0405070476fcaf2943217
SHA5129187516dca9d302061a81f97c2822c08d016dc982374829f8c94c5407d2960958d3f35e916a4975d1257b65ca34e30e07dd63d0ebb6251026cc408ce5694b839
-
C:\Users\Admin\AppData\Local\Temp\zqvirlmqyzmazsxettzueztlFilesize
4KB
MD5758a04b957a9e217fe0f6a62bbd3c29e
SHA1aca18d2a0f1847d49245cbc59a46c9fb8aab123a
SHA256698768bf8e771c459d87a836723028bcf3e464a48961ca36cfa2d7d7ebbd5b1c
SHA5121d15756acdb1e64dad35ed5808a9669b3157d65b8e93a5c9d9bcf4e014ccaa639db9c65c5514cc0e9067291566ae858a46c4649039187bfe59725139b6cc147e
-
memory/1100-4-0x00000000059B0000-0x00000000059C0000-memory.dmpFilesize
64KB
-
memory/1100-1-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/1100-8-0x0000000005B90000-0x0000000005B9E000-memory.dmpFilesize
56KB
-
memory/1100-9-0x0000000006AE0000-0x0000000006BA0000-memory.dmpFilesize
768KB
-
memory/1100-10-0x0000000006CA0000-0x0000000006D3C000-memory.dmpFilesize
624KB
-
memory/1100-2-0x0000000005C70000-0x0000000006214000-memory.dmpFilesize
5.6MB
-
memory/1100-6-0x0000000005B50000-0x0000000005B64000-memory.dmpFilesize
80KB
-
memory/1100-33-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/1100-0-0x0000000000C80000-0x0000000000D7C000-memory.dmpFilesize
1008KB
-
memory/1100-3-0x0000000005760000-0x00000000057F2000-memory.dmpFilesize
584KB
-
memory/1100-5-0x0000000005910000-0x000000000591A000-memory.dmpFilesize
40KB
-
memory/1100-7-0x0000000005B80000-0x0000000005B8A000-memory.dmpFilesize
40KB
-
memory/1540-132-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1540-130-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1540-128-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1540-131-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1540-129-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1540-133-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1540-123-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1540-124-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1540-122-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1540-134-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/2788-111-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2788-42-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-165-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-164-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-157-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-156-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-155-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2788-151-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-21-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-23-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-32-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-39-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-44-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-121-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-120-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-117-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-68-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-69-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-70-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-71-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-116-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-115-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-114-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-112-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-77-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-109-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2788-81-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-82-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2788-110-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2788-106-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2788-43-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2908-20-0x0000000004730000-0x0000000004740000-memory.dmpFilesize
64KB
-
memory/2908-61-0x0000000006AC0000-0x0000000006B63000-memory.dmpFilesize
652KB
-
memory/2908-45-0x0000000005AB0000-0x0000000005ACE000-memory.dmpFilesize
120KB
-
memory/2908-46-0x0000000005B00000-0x0000000005B4C000-memory.dmpFilesize
304KB
-
memory/2908-47-0x000000007F0E0000-0x000000007F0F0000-memory.dmpFilesize
64KB
-
memory/2908-48-0x0000000006A80000-0x0000000006AB2000-memory.dmpFilesize
200KB
-
memory/2908-67-0x0000000007000000-0x0000000007011000-memory.dmpFilesize
68KB
-
memory/2908-49-0x0000000071A90000-0x0000000071ADC000-memory.dmpFilesize
304KB
-
memory/2908-66-0x0000000007080000-0x0000000007116000-memory.dmpFilesize
600KB
-
memory/2908-59-0x00000000060A0000-0x00000000060BE000-memory.dmpFilesize
120KB
-
memory/2908-17-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/2908-19-0x0000000004730000-0x0000000004740000-memory.dmpFilesize
64KB
-
memory/2908-80-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/2908-40-0x0000000005500000-0x0000000005854000-memory.dmpFilesize
3.3MB
-
memory/2908-75-0x0000000007120000-0x0000000007128000-memory.dmpFilesize
32KB
-
memory/2908-74-0x0000000007140000-0x000000000715A000-memory.dmpFilesize
104KB
-
memory/2908-73-0x0000000007040000-0x0000000007054000-memory.dmpFilesize
80KB
-
memory/2908-65-0x0000000006E70000-0x0000000006E7A000-memory.dmpFilesize
40KB
-
memory/2908-18-0x0000000004D70000-0x0000000005398000-memory.dmpFilesize
6.2MB
-
memory/2908-15-0x00000000021B0000-0x00000000021E6000-memory.dmpFilesize
216KB
-
memory/2908-72-0x0000000007030000-0x000000000703E000-memory.dmpFilesize
56KB
-
memory/2908-64-0x0000000006E00000-0x0000000006E1A000-memory.dmpFilesize
104KB
-
memory/2908-63-0x0000000007440000-0x0000000007ABA000-memory.dmpFilesize
6.5MB
-
memory/2908-62-0x0000000004730000-0x0000000004740000-memory.dmpFilesize
64KB
-
memory/2908-30-0x0000000005490000-0x00000000054F6000-memory.dmpFilesize
408KB
-
memory/2908-60-0x0000000004730000-0x0000000004740000-memory.dmpFilesize
64KB
-
memory/2908-24-0x0000000004CC0000-0x0000000004D26000-memory.dmpFilesize
408KB
-
memory/2908-22-0x0000000004B20000-0x0000000004B42000-memory.dmpFilesize
136KB
-
memory/3356-91-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3356-84-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3356-87-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3356-104-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3544-100-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/3544-90-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/3544-86-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/3544-97-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/3836-102-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3836-99-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3836-101-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3836-92-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB