remcos | ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
Size

1.2MB
MD5

e2f45f4dad343940e2c06b901b71a864
SHA1

72223201c29be62eabac3f798ced2b8b762d833e
SHA256

ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce
SHA512

b5364557140c5cd4bfab75bd9ce237dd6366d19e2a6a174cc7b432e981f93928540280f251698e0b935af04fde851073b6607f60cc6c90a133aa0e7b8892d98c
SSDEEP

24576:IPMpzxWvSQVw/BSCDyBSvbSFMySqL1fjv4G4uKZ0PU:JWvxiSCWBSzsVL1fktec

Score

10^/10

remcos remotehost discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

154.216.16.54:6092

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-YJ70D0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
true
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

560 powershell.exe
1384 powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exeff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exeremcos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	remcos.exe

Executes dropped EXE 4 IoCs

Processes:

remcos.exeremcos.exeremcos.exeremcos.exe

pid process

3756 remcos.exe
4252 remcos.exe
648 remcos.exe
4488 remcos.exe

pid	process
3756	remcos.exe
4252	remcos.exe
648	remcos.exe
4488	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exeremcos.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-YJ70D0 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-YJ70D0 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-YJ70D0 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-YJ70D0 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exeremcos.exeremcos.exe

description	pid	process	target process
PID 4744 set thread context of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 3756 set thread context of 4488	3756	remcos.exe	remcos.exe
PID 4488 set thread context of 3304	4488	remcos.exe	iexplore.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exeff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exepowershell.exeremcos.exeremcos.exeiexplore.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

powershell.exeremcos.exeremcos.exepowershell.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
560	powershell.exe
560	powershell.exe
3756	remcos.exe
3756	remcos.exe
3756	remcos.exe
3756	remcos.exe
4488	remcos.exe
4488	remcos.exe
1384	powershell.exe
1384	powershell.exe
5040	msedge.exe
5040	msedge.exe
1748	msedge.exe
1748	msedge.exe
3532	identity_helper.exe
3532	identity_helper.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

remcos.exe

pid process

4488 remcos.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1748 msedge.exe
1748 msedge.exe
1748 msedge.exe
1748 msedge.exe
1748 msedge.exe
1748 msedge.exe
1748 msedge.exe
1748 msedge.exe
1748 msedge.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeremcos.exepowershell.exe

description pid process

Token: SeDebugPrivilege 560 powershell.exe
Token: SeDebugPrivilege 3756 remcos.exe
Token: SeDebugPrivilege 1384 powershell.exe

pid	process
4488	remcos.exe

description	pid	process
Token: SeDebugPrivilege	560	powershell.exe
Token: SeDebugPrivilege	3756	remcos.exe
Token: SeDebugPrivilege	1384	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exeff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exeremcos.exeremcos.exeiexplore.exemsedge.exe

description	pid	process	target process
PID 4744 wrote to memory of 560	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	powershell.exe
PID 4744 wrote to memory of 560	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	powershell.exe
PID 4744 wrote to memory of 560	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	powershell.exe
PID 4744 wrote to memory of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 4744 wrote to memory of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 4744 wrote to memory of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 4744 wrote to memory of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 4744 wrote to memory of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 4744 wrote to memory of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 4744 wrote to memory of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 4744 wrote to memory of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 4744 wrote to memory of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 4744 wrote to memory of 4480	4744	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
PID 4480 wrote to memory of 3756	4480	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	remcos.exe
PID 4480 wrote to memory of 3756	4480	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	remcos.exe
PID 4480 wrote to memory of 3756	4480	ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe	remcos.exe
PID 3756 wrote to memory of 1384	3756	remcos.exe	powershell.exe
PID 3756 wrote to memory of 1384	3756	remcos.exe	powershell.exe
PID 3756 wrote to memory of 1384	3756	remcos.exe	powershell.exe
PID 3756 wrote to memory of 4252	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4252	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4252	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 648	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 648	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 648	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4488	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4488	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4488	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4488	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4488	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4488	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4488	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4488	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4488	3756	remcos.exe	remcos.exe
PID 3756 wrote to memory of 4488	3756	remcos.exe	remcos.exe
PID 4488 wrote to memory of 3304	4488	remcos.exe	iexplore.exe
PID 4488 wrote to memory of 3304	4488	remcos.exe	iexplore.exe
PID 4488 wrote to memory of 3304	4488	remcos.exe	iexplore.exe
PID 4488 wrote to memory of 3304	4488	remcos.exe	iexplore.exe
PID 3304 wrote to memory of 1748	3304	iexplore.exe	msedge.exe
PID 3304 wrote to memory of 1748	3304	iexplore.exe	msedge.exe
PID 1748 wrote to memory of 3396	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 3396	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe
PID 1748 wrote to memory of 2416	1748	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
"C:\Users\Admin\AppData\Local\Temp\ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:560
- C:\Users\Admin\AppData\Local\Temp\ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe
  "C:\Users\Admin\AppData\Local\Temp\ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1384
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:4252
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:648
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4488
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8e8646f8,0x7ffd8e864708,0x7ffd8e864718
        7⤵
        
        PID:3396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        7⤵
        
        PID:2416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
        7⤵
        
        PID:2896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
        7⤵
        
        PID:3520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        7⤵
        
        PID:3944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
        7⤵
        
        PID:800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 /prefetch:8
        7⤵
        
        PID:1680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
        7⤵
        
        PID:4524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
        7⤵
        
        PID:4468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
        7⤵
        
        PID:1052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
        7⤵
        
        PID:1384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
        7⤵
        
        PID:3336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11299038692929679452,8977027150298317539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
        7⤵
        
        PID:2500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:1396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8e8646f8,0x7ffd8e864708,0x7ffd8e864718
        7⤵
        
        PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\remcos.exe

Filesize
1.2MB

MD5
e2f45f4dad343940e2c06b901b71a864

SHA1
72223201c29be62eabac3f798ced2b8b762d833e

SHA256
ff639f1953e0e7896b18dc804ee0ed11f965d6cc60907fd454812c1a8846a2ce

SHA512
b5364557140c5cd4bfab75bd9ce237dd6366d19e2a6a174cc7b432e981f93928540280f251698e0b935af04fde851073b6607f60cc6c90a133aa0e7b8892d98c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0e2496be-a8ce-4a20-910e-d634cfd1d255.tmp

Filesize
6KB

MD5
dc0831e54ebf8c32fb4b3554cd1d405a

SHA1
73b5f274825a69b36213d7497f0f5dd9681ef5dc

SHA256
c279ef20980592946ea36de39157b7918bae2867deb49ed8365eb331ef513148

SHA512
25f8bbaa82b8f489f5983e1d5a3a407be48a7ded9b9289a95745a5170a3454f5015bd27d1f86d225b2c7f19fb250fc2e7e93f5f3d8301e773ed464bfd132e1eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
9261f28abd32627f07489995c5f8a4cb

SHA1
c1205dcb0662daa5dff1f01139f258c120d77f34

SHA256
552b2f3e1da8f82b9c8c86a149d0ece61efed848750e836e8a2ecd5dd8fcac34

SHA512
3e79880c13a5529dee5801f5f3a60f263a95b87b1680fc68df53b3728b0d532538d418c4c071cff0fc29a0e337c9d0dafdfaeeffbc853a9115fe93b7e2e76286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9ddecf34d5b06897550182818f8bbea2

SHA1
92f7c67afde4995426e998327b9f180736c7128f

SHA256
7b080063a8854a777e8cde4e5624555a91091d8d738d94a6f79a96eefcff6b00

SHA512
937b9c4bdbd9a43c94e6a37df47f14e67b6bd868116448eac79873430419fd199919018def2d1b545dd0517a11265dbcbad410b7f24a677db4f6a544a1078b4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eda893b0393b6078a7060dd0e0c5f956

SHA1
6b131bb463bad7bbc1281ca59ee80993ac2f2c1b

SHA256
ef81e0666bda533cbe1863c8689e4dd97571fa34923fb217f1e0b5c569a7092b

SHA512
df4aa2f121e1ef409c9f743382fd271c64ec380c8b2953bb9748c9aa04c2afbd39f8ee4bdc5ac1eb89cc388371eff539b2b902e4d15603398965c197dc29bc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a2de2fd5b74b4a30db6eb18a2196e684

SHA1
690df006df23f380436362c679a20f10222f662b

SHA256
a91c4777e6102c5b3b52f37d3360638823aa04e625151f25ac2b50b19a36f708

SHA512
5ca1fc38e80226adf316ae0370f834fefb80c24a71e349a3abe90fe05821b19849271dae0f79d3b99846404a58e050c57c9242be1a39e11b70ce7b5e913adf08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe595857.TMP

Filesize
371B

MD5
7d84e06b1a642fdcbd92271744351595

SHA1
0882d35b3b7650632260283343779fdfa978ecfc

SHA256
30f78f65d981a6c10d956e93428d1d56afd58ef01802e6ab19e7274f8824a876

SHA512
ff511cadeb0326ff5ff868bb55b2ed9747377735cf9a5274e7cd909414790eca9caf24bd30c60c61fbbf50a7caac6f94a8d4c329631bd2a82e2e6fc52129e11e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
659364c887d49d232ca02b2f7fe5a4bf

SHA1
ef28d1fc627521b3ce00cf705df2b8cdbe81c556

SHA256
7c359cb565f44f6a29fbb43b2ea750dfbbf8be989f3ecfedc1f7c4e6c3cdc0f7

SHA512
a4ce58c7f3ae18317eae55594d28bbce28aa16124021ef535b6b40c1b4b69f20bbe43730714770bd398822b19b83bfc8e7826031822e2c535c52f609c6fa3428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
517d91a01c89c17a63ff2c160ed7c0ac

SHA1
b27b284de77621ffe9766922868a9acd1fae0ffc

SHA256
c50c355edfdd1415686b045b8b990c7a299ea15d69bea93990ae517f2bd095d2

SHA512
b7879f04ca6e723d46b7713c2dc1834dbab4c90a02a7076c60787fc338ff910a95de5f193f957b34fda52cb229ab50a5bb3f76b5a602e714290fa059880c4a7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o3ti3zol.yw1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_1748_UZQCTQXMXQDCTJHK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/560-30-0x0000000073E70000-0x0000000074620000-memory.dmp

Filesize
7.7MB

Download
memory/560-68-0x0000000007AD0000-0x0000000007AE4000-memory.dmp

Filesize
80KB

Download
memory/560-73-0x0000000073E70000-0x0000000074620000-memory.dmp

Filesize
7.7MB

Download
memory/560-70-0x0000000007BB0000-0x0000000007BB8000-memory.dmp

Filesize
32KB

Download
memory/560-32-0x0000000073E70000-0x0000000074620000-memory.dmp

Filesize
7.7MB

Download
memory/560-25-0x0000000073E7E000-0x0000000073E7F000-memory.dmp

Filesize
4KB

Download
memory/560-33-0x0000000005640000-0x0000000005C68000-memory.dmp

Filesize
6.2MB

Download
memory/560-26-0x0000000004FD0000-0x0000000005006000-memory.dmp

Filesize
216KB

Download
memory/560-34-0x0000000005590000-0x00000000055B2000-memory.dmp

Filesize
136KB

Download
memory/560-35-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Filesize
408KB

Download
memory/560-36-0x0000000005F00000-0x0000000005F66000-memory.dmp

Filesize
408KB

Download
memory/560-69-0x0000000007BD0000-0x0000000007BEA000-memory.dmp

Filesize
104KB

Download
memory/560-46-0x0000000006070000-0x00000000063C4000-memory.dmp

Filesize
3.3MB

Download
memory/560-47-0x0000000006560000-0x000000000657E000-memory.dmp

Filesize
120KB

Download
memory/560-48-0x0000000006AD0000-0x0000000006B1C000-memory.dmp

Filesize
304KB

Download
memory/560-49-0x0000000007530000-0x0000000007562000-memory.dmp

Filesize
200KB

Download
memory/560-60-0x0000000006B40000-0x0000000006B5E000-memory.dmp

Filesize
120KB

Download
memory/560-50-0x0000000074650000-0x000000007469C000-memory.dmp

Filesize
304KB

Download
memory/560-61-0x0000000007770000-0x0000000007813000-memory.dmp

Filesize
652KB

Download
memory/560-62-0x0000000007ED0000-0x000000000854A000-memory.dmp

Filesize
6.5MB

Download
memory/560-63-0x0000000007890000-0x00000000078AA000-memory.dmp

Filesize
104KB

Download
memory/560-64-0x0000000007900000-0x000000000790A000-memory.dmp

Filesize
40KB

Download
memory/560-65-0x0000000007B10000-0x0000000007BA6000-memory.dmp

Filesize
600KB

Download
memory/560-66-0x0000000007A90000-0x0000000007AA1000-memory.dmp

Filesize
68KB

Download
memory/560-67-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

Filesize
56KB

Download
memory/1384-83-0x0000000005840000-0x0000000005B94000-memory.dmp

Filesize
3.3MB

Download
memory/1384-107-0x0000000007470000-0x0000000007484000-memory.dmp

Filesize
80KB

Download
memory/1384-106-0x0000000007430000-0x0000000007441000-memory.dmp

Filesize
68KB

Download
memory/1384-105-0x0000000007170000-0x0000000007213000-memory.dmp

Filesize
652KB

Download
memory/1384-95-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

Filesize
304KB

Download
memory/1384-94-0x00000000064E0000-0x000000000652C000-memory.dmp

Filesize
304KB

Download
memory/3304-81-0x0000000001200000-0x0000000001330000-memory.dmp

Filesize
1.2MB

Download
memory/3756-74-0x0000000005190000-0x00000000051A2000-memory.dmp

Filesize
72KB

Download
memory/4480-11-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4480-31-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4480-12-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4480-14-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4480-15-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4488-79-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4744-0-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/4744-8-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/4744-1-0x0000000000D90000-0x0000000000EC0000-memory.dmp

Filesize
1.2MB

Download
memory/4744-9-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/4744-17-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/4744-7-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/4744-6-0x0000000005BD0000-0x0000000005C6C000-memory.dmp

Filesize
624KB

Download
memory/4744-5-0x00000000058B0000-0x00000000058BA000-memory.dmp

Filesize
40KB

Download
memory/4744-4-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/4744-3-0x0000000005930000-0x00000000059C2000-memory.dmp

Filesize
584KB

Download
memory/4744-2-0x0000000005E40000-0x00000000063E4000-memory.dmp

Filesize
5.6MB

Download
memory/4744-10-0x0000000005C80000-0x0000000005D44000-memory.dmp

Filesize
784KB

Download