remcos | 402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Size

1.2MB
MD5

08b5fa6876e0dc8d5c226597d89e646b
SHA1

4b5f7b0dd2303c81427f9ab47ff9046c43718552
SHA256

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361
SHA512

4f20a03dbcb5e16c4e934e67455eb48bf7bd9681b5fdc731bf278409c78e698527ee125ac2ed0e3f09bc1551a2684e16ba3e34613da9a1eb32bca781b85ea48c
SSDEEP

24576:IPMpzxWvSQVw/BSCDyBSvbSFMySqL1fjv4G4uKZ0PU:JWvxiSCWBSzsVL1fktec

Score

10^/10

remcos remotehost discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

154.216.16.54:6092

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YJ70D0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
true
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

4084 powershell.exe
3180 powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

remcos.exe402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	remcos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

Executes dropped EXE 2 IoCs

Processes:

remcos.exeremcos.exe

pid process

4296 remcos.exe
616 remcos.exe

pid	process
4296	remcos.exe
616	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

remcos.exe402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-YJ70D0 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-YJ70D0 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-YJ70D0 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-YJ70D0 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exeremcos.exeremcos.exe

description	pid	process	target process
PID 4988 set thread context of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 4296 set thread context of 616	4296	remcos.exe	remcos.exe
PID 616 set thread context of 2380	616	remcos.exe	iexplore.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

remcos.exeiexplore.exepowershell.exe402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exepowershell.exeremcos.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exeremcos.exepowershell.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4084	powershell.exe
4084	powershell.exe
616	remcos.exe
616	remcos.exe
3180	powershell.exe
3180	powershell.exe
3204	msedge.exe
3204	msedge.exe
3712	msedge.exe
3712	msedge.exe
452	identity_helper.exe
452	identity_helper.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

remcos.exe

pid process

616 remcos.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3712 msedge.exe
3712 msedge.exe
3712 msedge.exe
3712 msedge.exe
3712 msedge.exe
3712 msedge.exe
3712 msedge.exe
3712 msedge.exe
3712 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4084 powershell.exe
Token: SeDebugPrivilege 3180 powershell.exe

pid	process
616	remcos.exe

description	pid	process
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exeremcos.exeremcos.exeiexplore.exemsedge.exe

description	pid	process	target process
PID 4988 wrote to memory of 4084	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	powershell.exe
PID 4988 wrote to memory of 4084	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	powershell.exe
PID 4988 wrote to memory of 4084	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	powershell.exe
PID 4988 wrote to memory of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 4988 wrote to memory of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 4988 wrote to memory of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 4988 wrote to memory of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 4988 wrote to memory of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 4988 wrote to memory of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 4988 wrote to memory of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 4988 wrote to memory of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 4988 wrote to memory of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 4988 wrote to memory of 404	4988	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
PID 404 wrote to memory of 4296	404	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	remcos.exe
PID 404 wrote to memory of 4296	404	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	remcos.exe
PID 404 wrote to memory of 4296	404	402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe	remcos.exe
PID 4296 wrote to memory of 3180	4296	remcos.exe	powershell.exe
PID 4296 wrote to memory of 3180	4296	remcos.exe	powershell.exe
PID 4296 wrote to memory of 3180	4296	remcos.exe	powershell.exe
PID 4296 wrote to memory of 616	4296	remcos.exe	remcos.exe
PID 4296 wrote to memory of 616	4296	remcos.exe	remcos.exe
PID 4296 wrote to memory of 616	4296	remcos.exe	remcos.exe
PID 4296 wrote to memory of 616	4296	remcos.exe	remcos.exe
PID 4296 wrote to memory of 616	4296	remcos.exe	remcos.exe
PID 4296 wrote to memory of 616	4296	remcos.exe	remcos.exe
PID 4296 wrote to memory of 616	4296	remcos.exe	remcos.exe
PID 4296 wrote to memory of 616	4296	remcos.exe	remcos.exe
PID 4296 wrote to memory of 616	4296	remcos.exe	remcos.exe
PID 4296 wrote to memory of 616	4296	remcos.exe	remcos.exe
PID 616 wrote to memory of 2380	616	remcos.exe	iexplore.exe
PID 616 wrote to memory of 2380	616	remcos.exe	iexplore.exe
PID 616 wrote to memory of 2380	616	remcos.exe	iexplore.exe
PID 616 wrote to memory of 2380	616	remcos.exe	iexplore.exe
PID 2380 wrote to memory of 3712	2380	iexplore.exe	msedge.exe
PID 2380 wrote to memory of 3712	2380	iexplore.exe	msedge.exe
PID 3712 wrote to memory of 1016	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 1016	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe
PID 3712 wrote to memory of 912	3712	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
"C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe
  "C:\Users\Admin\AppData\Local\Temp\402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3180
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:616
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8081d46f8,0x7ff8081d4708,0x7ff8081d4718
        7⤵
        
        PID:1016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
        7⤵
        
        PID:912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
        7⤵
        
        PID:3648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        7⤵
        
        PID:1092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
        7⤵
        
        PID:1768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
        7⤵
        
        PID:1124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
        7⤵
        
        PID:804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
        7⤵
        
        PID:408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
        7⤵
        
        PID:864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
        7⤵
        
        PID:532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
        7⤵
        
        PID:1384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
        7⤵
        
        PID:1584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9345911282511538794,2204864619711657251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
        7⤵
        
        PID:3048
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8081d46f8,0x7ff8081d4708,0x7ff8081d4718
        7⤵
        
        PID:1292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\remcos.exe

Filesize
1.2MB

MD5
08b5fa6876e0dc8d5c226597d89e646b

SHA1
4b5f7b0dd2303c81427f9ab47ff9046c43718552

SHA256
402dc87138121e2ac00c7bc65bbdd39a9ab0091c3a1b163066924887a20ab361

SHA512
4f20a03dbcb5e16c4e934e67455eb48bf7bd9681b5fdc731bf278409c78e698527ee125ac2ed0e3f09bc1551a2684e16ba3e34613da9a1eb32bca781b85ea48c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
3ebf42d2092b0681dc28c16c59235165

SHA1
7129d9f2b742870b6a2372607042b68839ec3acc

SHA256
3c8a66913a2df595669fab575fbb4b84385e5a5ae3ce35d6573b68ea8fa68b43

SHA512
3da4da85ca4d7b73a14139e4799879c2b09c97190e21b5a4cbe185e5a20379e518f6b95936bce141ccba8d2395cd0e78c36582f03789a78be7af5d98c22f4710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d76cce79c74091d1dd1a53ba497fcc2

SHA1
a09fee8c4a264bdd9a49a8de7bb46ecdf161c870

SHA256
6edec49c9c2e7267a7579dfe72e9aa76eef8eadc158ad8a487bda206e0801b1a

SHA512
a90f6d7fcf4de7ba209ba0f38fefe6cfefdf9e5f78ecd0be49bc1b86402aad447b2bc9de19dec277194808ce7f57e8fed459cc6a80ff6183abae797676766803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df83827d6e639cd355eb3bedab29bc79

SHA1
e8e1fd2d060369b2a72e7f03626f58ee073b1514

SHA256
aa5e5d38bc96f55651eb32b57f4922837139e88c0044eaa9506c3901a3251445

SHA512
d0fd86776c703a3ead57adf55eecf1c21184c8091aaa24491ea681af9bd2cd9b5f5e57d553cef97b5c34832e9cfedf44dbb817a170c7b94b814f25248d4d2bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5434da631b721792d63731e09414bb5d

SHA1
7cf06d0bbe9394c32291f3bdb6096a21bd2d3b24

SHA256
63f1fd2f7c7a3229d050140b621e59c97e340d63e2e5fb29cce7cd7bf114f7df

SHA512
c3b95a206788fd9bd4880987366db46947d9edc9c53c95a7beed4c4c599d33cb0bcf9d5460f509e9cf3a07212f5af7ac2a621833f4d56796d4f7df2721179dc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
ed825ec1c151d92da0f9c1755331754b

SHA1
1ea7aa1973e1d8b9667bc53b81c48f57336bd737

SHA256
c0316e5539dd842d6bc4fbf0a2ae98f955e4b6bba16ddcaebe004c8533267be1

SHA512
82605fd2795d0aad96f71afdcb2f5f7bc11579581bafda33e19e552ca9b72b581890ecf40c6da103b4851a11751bee8493581833f2da018c4ac0f30e5508e00d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5951c0.TMP

Filesize
371B

MD5
15057d47840ef9ad6f58164b81405726

SHA1
00e17b4620dadda7466dd9d7c949486ba7c4ebde

SHA256
ba37c1fa406c54783fec97bce59df22d4d54f9e9ab078fd974806127f0a39975

SHA512
6b06be14a1944728e5dd689ef5d7fbba6ad769e38c5a719e6108fe29ca1b83f66c31d4d78e0e749282c5e660ca35c500254e26fc2e84fe8940b730ecc410cccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
900551f840b359687140be6ad3eef550

SHA1
1968a2ea9ce11caf4b5ca3a1a76467f5e543b823

SHA256
eebf47ad48c98edef6321ed0c748f1628dcee6f55487f2e08c43054fd9aa7e3f

SHA512
d4aac5818a6fc8d7f354f86b1ab61a5b080049a872b309a513c37ac97db4bfcf3695f4444a32afa2f2c4ce98a6a364e7df44cfc138c05e2e828579fdc22f9bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
8b728d9a87cf5b689b7451976ff845f5

SHA1
37e6f906f0645afa3fcd5b1eb09e7c9763e1a619

SHA256
9e68f5e3d02dc8295a2e2038a219556d0f27ef154c0466861897a58799a15f5e

SHA512
0821987594fc98d13c4b6b1228b3c50af1984af0a33e3f52eea65db99b2242702b38918efd98edb3151921080f76ef26be7653e9f2d7f16ecd568a9d24208ddf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fatgj24p.4s5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_3712_MKSWDDVAFTUOKAAR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/404-12-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/404-13-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/404-16-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/404-11-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/404-36-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/616-77-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2380-79-0x0000000000770000-0x00000000008A0000-memory.dmp

Filesize
1.2MB

Download
memory/3180-93-0x0000000070460000-0x00000000704AC000-memory.dmp

Filesize
304KB

Download
memory/3180-90-0x0000000006310000-0x0000000006664000-memory.dmp

Filesize
3.3MB

Download
memory/3180-92-0x00000000067E0000-0x000000000682C000-memory.dmp

Filesize
304KB

Download
memory/3180-103-0x00000000079D0000-0x0000000007A73000-memory.dmp

Filesize
652KB

Download
memory/3180-104-0x0000000007CB0000-0x0000000007CC1000-memory.dmp

Filesize
68KB

Download
memory/3180-105-0x0000000007CF0000-0x0000000007D04000-memory.dmp

Filesize
80KB

Download
memory/4084-17-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/4084-33-0x0000000005080000-0x00000000050E6000-memory.dmp

Filesize
408KB

Download
memory/4084-49-0x0000000006FB0000-0x0000000006FE2000-memory.dmp

Filesize
200KB

Download
memory/4084-50-0x0000000070360000-0x00000000703AC000-memory.dmp

Filesize
304KB

Download
memory/4084-60-0x0000000006F90000-0x0000000006FAE000-memory.dmp

Filesize
120KB

Download
memory/4084-61-0x0000000006FF0000-0x0000000007093000-memory.dmp

Filesize
652KB

Download
memory/4084-62-0x0000000007990000-0x000000000800A000-memory.dmp

Filesize
6.5MB

Download
memory/4084-63-0x0000000007350000-0x000000000736A000-memory.dmp

Filesize
104KB

Download
memory/4084-64-0x00000000073C0000-0x00000000073CA000-memory.dmp

Filesize
40KB

Download
memory/4084-65-0x00000000075D0000-0x0000000007666000-memory.dmp

Filesize
600KB

Download
memory/4084-66-0x0000000007550000-0x0000000007561000-memory.dmp

Filesize
68KB

Download
memory/4084-67-0x0000000007580000-0x000000000758E000-memory.dmp

Filesize
56KB

Download
memory/4084-68-0x0000000007590000-0x00000000075A4000-memory.dmp

Filesize
80KB

Download
memory/4084-69-0x0000000007690000-0x00000000076AA000-memory.dmp

Filesize
104KB

Download
memory/4084-70-0x0000000007670000-0x0000000007678000-memory.dmp

Filesize
32KB

Download
memory/4084-73-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4084-18-0x0000000004A90000-0x0000000004AC6000-memory.dmp

Filesize
216KB

Download
memory/4084-47-0x0000000006000000-0x000000000601E000-memory.dmp

Filesize
120KB

Download
memory/4084-46-0x0000000005AD0000-0x0000000005E24000-memory.dmp

Filesize
3.3MB

Download
memory/4084-48-0x0000000006040000-0x000000000608C000-memory.dmp

Filesize
304KB

Download
memory/4084-32-0x0000000005010000-0x0000000005076000-memory.dmp

Filesize
408KB

Download
memory/4084-30-0x0000000004F70000-0x0000000004F92000-memory.dmp

Filesize
136KB

Download
memory/4084-28-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4084-29-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4084-27-0x0000000005100000-0x0000000005728000-memory.dmp

Filesize
6.2MB

Download
memory/4296-74-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/4988-7-0x0000000005270000-0x0000000005282000-memory.dmp

Filesize
72KB

Download
memory/4988-0-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/4988-10-0x00000000055F0000-0x00000000056B4000-memory.dmp

Filesize
784KB

Download
memory/4988-9-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4988-8-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/4988-19-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4988-6-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4988-5-0x00000000053D0000-0x000000000546C000-memory.dmp

Filesize
624KB

Download
memory/4988-4-0x0000000005110000-0x000000000511A000-memory.dmp

Filesize
40KB

Download
memory/4988-3-0x0000000005140000-0x00000000051D2000-memory.dmp

Filesize
584KB

Download
memory/4988-2-0x00000000056F0000-0x0000000005C94000-memory.dmp

Filesize
5.6MB

Download
memory/4988-1-0x00000000005F0000-0x0000000000720000-memory.dmp

Filesize
1.2MB

Download