hawkeye | 00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e

Resubmissions

21/03/2024, 08:04

240321-jydgaagd5x 10

13/03/2024, 17:04

240313-vlgtqaad4y 10

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vencord.exe
Size

469KB
MD5

e206c8908d5c24a3dda14322807d8e50
SHA1

144d9d69ba30e08dbe79ac3fae47e7c88aedb448
SHA256

00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e
SHA512

9c2ab2d8b6b5b72029ee2c8b34648abde2fa8166fcdd0c0532a720eeb908ad75cb99bbf4e747c314321f7872f92ba8657000c1231084c08a058f24035b752479
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS5n9:uiLJbpI7I2WhQqZ759

Score

10^/10

hawkeye remcos vencord keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

VenCord

147.185.221.18:52136

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
scvhost.exe
copy_folder
System64
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
yh?0J?xxu¢iw)>zqn*'^?^^_wh+ru?*&~2yzwL\"s?>yhi)?0J?xxuz,-QZL639
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
DiscordUpdate
take_screenshot_option
false
take_screenshot_time
5

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Vencord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Vencord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
5036	scvhost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	dxdiag.exe
File opened for modification	C:\Windows\SysWOW64\System64\scvhost.exe	Vencord.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	dxdiag.exe
File created	C:\Windows\SysWOW64\System64\scvhost.exe	Vencord.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 5036 set thread context of 860	5036	scvhost.exe	96
PID 860 set thread context of 1120	860	iexplore.exe	97
PID 860 set thread context of 3436	860	iexplore.exe	98
PID 860 set thread context of 1332	860	iexplore.exe	99
PID 860 set thread context of 4960	860	iexplore.exe	100
PID 860 set thread context of 4408	860	iexplore.exe	101
PID 860 set thread context of 4480	860	iexplore.exe	102
PID 860 set thread context of 436	860	iexplore.exe	103
PID 860 set thread context of 4400	860	iexplore.exe	104
PID 860 set thread context of 1116	860	iexplore.exe	105
PID 860 set thread context of 3624	860	iexplore.exe	106
PID 860 set thread context of 4720	860	iexplore.exe	108
PID 860 set thread context of 4344	860	iexplore.exe	110
PID 860 set thread context of 3880	860	iexplore.exe	111
PID 860 set thread context of 4388	860	iexplore.exe	112
PID 860 set thread context of 4464	860	iexplore.exe	118
PID 860 set thread context of 2464	860	iexplore.exe	120
PID 860 set thread context of 1556	860	iexplore.exe	122
PID 860 set thread context of 3828	860	iexplore.exe	125
PID 860 set thread context of 3480	860	iexplore.exe	126
PID 860 set thread context of 4432	860	iexplore.exe	127
PID 860 set thread context of 1668	860	iexplore.exe	128
PID 860 set thread context of 4440	860	iexplore.exe	130
PID 860 set thread context of 3988	860	iexplore.exe	131
PID 860 set thread context of 1404	860	iexplore.exe	132
PID 860 set thread context of 4240	860	iexplore.exe	133
PID 860 set thread context of 1012	860	iexplore.exe	134
PID 860 set thread context of 4604	860	iexplore.exe	135
PID 860 set thread context of 1464	860	iexplore.exe	136
PID 860 set thread context of 2348	860	iexplore.exe	137
PID 860 set thread context of 380	860	iexplore.exe	138
PID 860 set thread context of 4000	860	iexplore.exe	139
PID 860 set thread context of 1600	860	iexplore.exe	140
PID 860 set thread context of 4508	860	iexplore.exe	141
PID 860 set thread context of 2368	860	iexplore.exe	143
PID 860 set thread context of 1360	860	iexplore.exe	144
PID 860 set thread context of 1788	860	iexplore.exe	145
PID 860 set thread context of 1408	860	iexplore.exe	146
PID 860 set thread context of 2356	860	iexplore.exe	148
PID 860 set thread context of 4376	860	iexplore.exe	149
PID 860 set thread context of 460	860	iexplore.exe	150
PID 860 set thread context of 4976	860	iexplore.exe	151
PID 860 set thread context of 4500	860	iexplore.exe	152
PID 860 set thread context of 1524	860	iexplore.exe	153
PID 860 set thread context of 2032	860	iexplore.exe	154
PID 860 set thread context of 3688	860	iexplore.exe	155
PID 860 set thread context of 2768	860	iexplore.exe	156
PID 860 set thread context of 920	860	iexplore.exe	157
PID 860 set thread context of 4668	860	iexplore.exe	158
PID 860 set thread context of 1660	860	iexplore.exe	159
PID 860 set thread context of 952	860	iexplore.exe	160
PID 860 set thread context of 3336	860	iexplore.exe	161
PID 860 set thread context of 4184	860	iexplore.exe	162
PID 860 set thread context of 3968	860	iexplore.exe	163
PID 860 set thread context of 4940	860	iexplore.exe	166
PID 860 set thread context of 4676	860	iexplore.exe	169
PID 860 set thread context of 1192	860	iexplore.exe	170
PID 860 set thread context of 3012	860	iexplore.exe	171
PID 860 set thread context of 2820	860	iexplore.exe	172
PID 860 set thread context of 4348	860	iexplore.exe	174
PID 860 set thread context of 4320	860	iexplore.exe	176
PID 860 set thread context of 5216	860	iexplore.exe	177
PID 860 set thread context of 5248	860	iexplore.exe	178
PID 860 set thread context of 5296	860	iexplore.exe	179

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-566096764-1992588923-1249862864-1000\{7EFE0085-4A31-4438-BE28-0E22D0639361}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dxdiagn.dll"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-566096764-1992588923-1249862864-1000\{89AE66F2-02AE-4FB5-BCA3-13136139F9ED}	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	Vencord.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	dxdiag.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5036	scvhost.exe
5036	scvhost.exe
888	dxdiag.exe
888	dxdiag.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
860	iexplore.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
5036	scvhost.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe
860	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
888	dxdiag.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4692	4732	Vencord.exe	88
PID 4732 wrote to memory of 4692	4732	Vencord.exe	88
PID 4732 wrote to memory of 4692	4732	Vencord.exe	88
PID 4692 wrote to memory of 2028	4692	WScript.exe	93
PID 4692 wrote to memory of 2028	4692	WScript.exe	93
PID 4692 wrote to memory of 2028	4692	WScript.exe	93
PID 2028 wrote to memory of 5036	2028	cmd.exe	95
PID 2028 wrote to memory of 5036	2028	cmd.exe	95
PID 2028 wrote to memory of 5036	2028	cmd.exe	95
PID 5036 wrote to memory of 860	5036	scvhost.exe	96
PID 5036 wrote to memory of 860	5036	scvhost.exe	96
PID 5036 wrote to memory of 860	5036	scvhost.exe	96
PID 5036 wrote to memory of 860	5036	scvhost.exe	96
PID 860 wrote to memory of 1120	860	iexplore.exe	97
PID 860 wrote to memory of 1120	860	iexplore.exe	97
PID 860 wrote to memory of 1120	860	iexplore.exe	97
PID 860 wrote to memory of 1120	860	iexplore.exe	97
PID 860 wrote to memory of 3436	860	iexplore.exe	98
PID 860 wrote to memory of 3436	860	iexplore.exe	98
PID 860 wrote to memory of 3436	860	iexplore.exe	98
PID 860 wrote to memory of 3436	860	iexplore.exe	98
PID 860 wrote to memory of 1332	860	iexplore.exe	99
PID 860 wrote to memory of 1332	860	iexplore.exe	99
PID 860 wrote to memory of 1332	860	iexplore.exe	99
PID 860 wrote to memory of 1332	860	iexplore.exe	99
PID 860 wrote to memory of 4960	860	iexplore.exe	100
PID 860 wrote to memory of 4960	860	iexplore.exe	100
PID 860 wrote to memory of 4960	860	iexplore.exe	100
PID 860 wrote to memory of 4960	860	iexplore.exe	100
PID 860 wrote to memory of 4408	860	iexplore.exe	101
PID 860 wrote to memory of 4408	860	iexplore.exe	101
PID 860 wrote to memory of 4408	860	iexplore.exe	101
PID 860 wrote to memory of 4408	860	iexplore.exe	101
PID 860 wrote to memory of 4480	860	iexplore.exe	102
PID 860 wrote to memory of 4480	860	iexplore.exe	102
PID 860 wrote to memory of 4480	860	iexplore.exe	102
PID 860 wrote to memory of 4480	860	iexplore.exe	102
PID 860 wrote to memory of 436	860	iexplore.exe	103
PID 860 wrote to memory of 436	860	iexplore.exe	103
PID 860 wrote to memory of 436	860	iexplore.exe	103
PID 860 wrote to memory of 436	860	iexplore.exe	103
PID 860 wrote to memory of 4400	860	iexplore.exe	104
PID 860 wrote to memory of 4400	860	iexplore.exe	104
PID 860 wrote to memory of 4400	860	iexplore.exe	104
PID 860 wrote to memory of 4400	860	iexplore.exe	104
PID 860 wrote to memory of 1116	860	iexplore.exe	105
PID 860 wrote to memory of 1116	860	iexplore.exe	105
PID 860 wrote to memory of 1116	860	iexplore.exe	105
PID 860 wrote to memory of 1116	860	iexplore.exe	105
PID 860 wrote to memory of 3624	860	iexplore.exe	106
PID 860 wrote to memory of 3624	860	iexplore.exe	106
PID 860 wrote to memory of 3624	860	iexplore.exe	106
PID 860 wrote to memory of 3624	860	iexplore.exe	106
PID 860 wrote to memory of 4720	860	iexplore.exe	108
PID 860 wrote to memory of 4720	860	iexplore.exe	108
PID 860 wrote to memory of 4720	860	iexplore.exe	108
PID 860 wrote to memory of 4720	860	iexplore.exe	108
PID 860 wrote to memory of 4344	860	iexplore.exe	110
PID 860 wrote to memory of 4344	860	iexplore.exe	110
PID 860 wrote to memory of 4344	860	iexplore.exe	110
PID 860 wrote to memory of 4344	860	iexplore.exe	110
PID 860 wrote to memory of 3880	860	iexplore.exe	111
PID 860 wrote to memory of 3880	860	iexplore.exe	111
PID 860 wrote to memory of 3880	860	iexplore.exe	111

C:\Users\Admin\AppData\Local\Temp\Vencord.exe
"C:\Users\Admin\AppData\Local\Temp\Vencord.exe"
1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\System64\scvhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\SysWOW64\System64\scvhost.exe
      C:\Windows\SysWOW64\System64\scvhost.exe
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5036
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:860
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1120
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3436
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1332
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4960
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4408
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4480
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:436
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4400
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1116
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3624
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4720
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4344
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3880
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4388
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4464
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2464
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1556
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3828
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3480
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4432
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1668
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4440
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3988
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1404
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4240
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1012
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4604
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1464
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2348
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:380
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4000
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1600
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4508
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2368
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1360
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1788
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1408
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2356
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4376
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:460
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4976
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4500
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1524
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2032
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3688
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2768
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:920
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4668
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1660
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:952
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3336
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4184
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3968
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4940
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4676
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1192
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3012
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2820
      - C:\Windows\SysWOW64\dxdiag.exe
        
        "C:\Windows\System32\dxdiag.exe" /t C:\Users\Admin\AppData\Local\Temp\sysinfo.txt
        6⤵
        Drops file in System32 directory
        Checks SCSI registry key(s)
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:888
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4348
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4320
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5216
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5248
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5296
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5372
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5428
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5460
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5500
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5556
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5616
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5656
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5708
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5764
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5936
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:6056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
402B

MD5
aa3bb02fdbe0aed95d2adf0ef033c2be

SHA1
002f7db7d5e7d368d27d7b1efd1a4f571fac1740

SHA256
d2f9e454aa3a7e614f38219f333420f2ac7963fffafccf3105929c280274de59

SHA512
3a49dfd9d827efdab3abf6220375ba921dde0772bba2b0674ed2562da27853f0df0b786f26c233ca96d8d89c1c95489330c3aea07e62c0b0a6ed716324d8c913

Download Submit
C:\Users\Admin\AppData\Local\Temp\sysinfo.txt

Filesize
84KB

MD5
aaf3cbd5374b60659b7bffd7acff830d

SHA1
51f2e87d311a403f120cb13209e5c4760d492102

SHA256
abba4e7a4c175a5d68834802c3d8c5e333e0f7c6f332e905e85d169cef98aacb

SHA512
2e6445b1b9aab107b692f45fc8af00158cc453e4b7c132bb8fcca39c9ce3cb625a388f499ba4b47c7e840cd4ade9c7cbbf0b90fa6e9c5e97e6113924a2909ab5

Download Submit
C:\Windows\SysWOW64\System64\scvhost.exe

Filesize
469KB

MD5
e206c8908d5c24a3dda14322807d8e50

SHA1
144d9d69ba30e08dbe79ac3fae47e7c88aedb448

SHA256
00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e

SHA512
9c2ab2d8b6b5b72029ee2c8b34648abde2fa8166fcdd0c0532a720eeb908ad75cb99bbf4e747c314321f7872f92ba8657000c1231084c08a058f24035b752479

Download Submit
memory/380-163-0x0000000001290000-0x000000000130F000-memory.dmp

Filesize
508KB

Download
memory/436-48-0x0000000000680000-0x00000000006FF000-memory.dmp

Filesize
508KB

Download
memory/436-49-0x0000000000680000-0x00000000006FF000-memory.dmp

Filesize
508KB

Download
memory/436-50-0x0000000000680000-0x00000000006FF000-memory.dmp

Filesize
508KB

Download
memory/436-47-0x0000000000680000-0x00000000006FF000-memory.dmp

Filesize
508KB

Download
memory/460-209-0x0000000000110000-0x000000000018F000-memory.dmp

Filesize
508KB

Download
memory/860-34-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-10-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-46-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-8-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-40-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-9-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-51-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-23-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-24-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-25-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-15-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-65-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-35-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-11-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-13-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/860-52-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/920-241-0x0000000000770000-0x00000000007EF000-memory.dmp

Filesize
508KB

Download
memory/952-258-0x0000000001260000-0x00000000012DF000-memory.dmp

Filesize
508KB

Download
memory/1012-147-0x0000000000A00000-0x0000000000A7F000-memory.dmp

Filesize
508KB

Download
memory/1116-60-0x00000000008A0000-0x000000000091F000-memory.dmp

Filesize
508KB

Download
memory/1116-57-0x00000000008A0000-0x000000000091F000-memory.dmp

Filesize
508KB

Download
memory/1116-59-0x00000000008A0000-0x000000000091F000-memory.dmp

Filesize
508KB

Download
memory/1116-58-0x00000000008A0000-0x000000000091F000-memory.dmp

Filesize
508KB

Download
memory/1120-70-0x0000000000A40000-0x0000000000ABF000-memory.dmp

Filesize
508KB

Download
memory/1120-17-0x0000000000A40000-0x0000000000ABF000-memory.dmp

Filesize
508KB

Download
memory/1120-14-0x0000000000A40000-0x0000000000ABF000-memory.dmp

Filesize
508KB

Download
memory/1120-16-0x0000000000A40000-0x0000000000ABF000-memory.dmp

Filesize
508KB

Download
memory/1120-18-0x0000000000A40000-0x0000000000ABF000-memory.dmp

Filesize
508KB

Download
memory/1192-295-0x00000000006F0000-0x000000000076F000-memory.dmp

Filesize
508KB

Download
memory/1332-28-0x0000000001030000-0x00000000010AF000-memory.dmp

Filesize
508KB

Download
memory/1332-26-0x0000000001030000-0x00000000010AF000-memory.dmp

Filesize
508KB

Download
memory/1332-27-0x0000000001030000-0x00000000010AF000-memory.dmp

Filesize
508KB

Download
memory/1332-29-0x0000000001030000-0x00000000010AF000-memory.dmp

Filesize
508KB

Download
memory/1360-187-0x0000000000E00000-0x0000000000E7F000-memory.dmp

Filesize
508KB

Download
memory/1404-139-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/1408-197-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/1464-155-0x0000000000B00000-0x0000000000B7F000-memory.dmp

Filesize
508KB

Download
memory/1524-221-0x0000000001270000-0x00000000012EF000-memory.dmp

Filesize
508KB

Download
memory/1556-94-0x00000000009D0000-0x0000000000A4F000-memory.dmp

Filesize
508KB

Download
memory/1600-171-0x0000000000A40000-0x0000000000ABF000-memory.dmp

Filesize
508KB

Download
memory/1660-254-0x0000000000E10000-0x0000000000E8F000-memory.dmp

Filesize
508KB

Download
memory/1668-119-0x0000000001230000-0x00000000012AF000-memory.dmp

Filesize
508KB

Download
memory/1788-193-0x0000000000780000-0x00000000007FF000-memory.dmp

Filesize
508KB

Download
memory/2032-225-0x0000000001000000-0x000000000107F000-memory.dmp

Filesize
508KB

Download
memory/2348-159-0x0000000000470000-0x00000000004EF000-memory.dmp

Filesize
508KB

Download
memory/2356-201-0x0000000000E00000-0x0000000000E7F000-memory.dmp

Filesize
508KB

Download
memory/2368-181-0x00000000008B0000-0x000000000092F000-memory.dmp

Filesize
508KB

Download
memory/2464-87-0x0000000000EB0000-0x0000000000F2F000-memory.dmp

Filesize
508KB

Download
memory/2464-88-0x0000000000EB0000-0x0000000000F2F000-memory.dmp

Filesize
508KB

Download
memory/2464-89-0x0000000000EB0000-0x0000000000F2F000-memory.dmp

Filesize
508KB

Download
memory/2464-90-0x0000000000EB0000-0x0000000000F2F000-memory.dmp

Filesize
508KB

Download
memory/2768-233-0x0000000000140000-0x00000000001BF000-memory.dmp

Filesize
508KB

Download
memory/2820-307-0x0000000000970000-0x00000000009EF000-memory.dmp

Filesize
508KB

Download
memory/3012-299-0x0000000001030000-0x00000000010AF000-memory.dmp

Filesize
508KB

Download
memory/3336-262-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3436-21-0x0000000000570000-0x00000000005EF000-memory.dmp

Filesize
508KB

Download
memory/3436-19-0x0000000000570000-0x00000000005EF000-memory.dmp

Filesize
508KB

Download
memory/3436-22-0x0000000000570000-0x00000000005EF000-memory.dmp

Filesize
508KB

Download
memory/3436-20-0x0000000000570000-0x00000000005EF000-memory.dmp

Filesize
508KB

Download
memory/3480-106-0x0000000000EF0000-0x0000000000F6F000-memory.dmp

Filesize
508KB

Download
memory/3624-63-0x0000000001080000-0x00000000010FF000-memory.dmp

Filesize
508KB

Download
memory/3624-61-0x0000000001080000-0x00000000010FF000-memory.dmp

Filesize
508KB

Download
memory/3624-62-0x0000000001080000-0x00000000010FF000-memory.dmp

Filesize
508KB

Download
memory/3624-64-0x0000000001080000-0x00000000010FF000-memory.dmp

Filesize
508KB

Download
memory/3688-229-0x0000000000B20000-0x0000000000B9F000-memory.dmp

Filesize
508KB

Download
memory/3828-100-0x0000000001000000-0x000000000107F000-memory.dmp

Filesize
508KB

Download
memory/3880-133-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3880-78-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3880-77-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3880-76-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3880-75-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3968-270-0x0000000000AC0000-0x0000000000B3F000-memory.dmp

Filesize
508KB

Download
memory/3988-132-0x0000000000AC0000-0x0000000000B3F000-memory.dmp

Filesize
508KB

Download
memory/4000-167-0x00000000012B0000-0x000000000132F000-memory.dmp

Filesize
508KB

Download
memory/4184-266-0x0000000000D80000-0x0000000000DFF000-memory.dmp

Filesize
508KB

Download
memory/4240-143-0x0000000000E10000-0x0000000000E8F000-memory.dmp

Filesize
508KB

Download
memory/4320-345-0x0000000000170000-0x00000000001EF000-memory.dmp

Filesize
508KB

Download
memory/4344-73-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4344-71-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4344-74-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4344-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4348-315-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4376-205-0x0000000000E00000-0x0000000000E7F000-memory.dmp

Filesize
508KB

Download
memory/4388-80-0x0000000000740000-0x00000000007BF000-memory.dmp

Filesize
508KB

Download
memory/4388-82-0x0000000000740000-0x00000000007BF000-memory.dmp

Filesize
508KB

Download
memory/4388-81-0x0000000000740000-0x00000000007BF000-memory.dmp

Filesize
508KB

Download
memory/4388-79-0x0000000000740000-0x00000000007BF000-memory.dmp

Filesize
508KB

Download
memory/4400-56-0x0000000001090000-0x000000000110F000-memory.dmp

Filesize
508KB

Download
memory/4400-55-0x0000000001090000-0x000000000110F000-memory.dmp

Filesize
508KB

Download
memory/4400-54-0x0000000001090000-0x000000000110F000-memory.dmp

Filesize
508KB

Download
memory/4400-53-0x0000000001090000-0x000000000110F000-memory.dmp

Filesize
508KB

Download
memory/4408-39-0x0000000000D20000-0x0000000000D9F000-memory.dmp

Filesize
508KB

Download
memory/4408-36-0x0000000000D20000-0x0000000000D9F000-memory.dmp

Filesize
508KB

Download
memory/4408-37-0x0000000000D20000-0x0000000000D9F000-memory.dmp

Filesize
508KB

Download
memory/4408-38-0x0000000000D20000-0x0000000000D9F000-memory.dmp

Filesize
508KB

Download
memory/4432-115-0x0000000000F20000-0x0000000000F9F000-memory.dmp

Filesize
508KB

Download
memory/4440-126-0x0000000000D60000-0x0000000000DDF000-memory.dmp

Filesize
508KB

Download
memory/4464-84-0x0000000000B20000-0x0000000000B9F000-memory.dmp

Filesize
508KB

Download
memory/4464-86-0x0000000000B20000-0x0000000000B9F000-memory.dmp

Filesize
508KB

Download
memory/4464-85-0x0000000000B20000-0x0000000000B9F000-memory.dmp

Filesize
508KB

Download
memory/4464-83-0x0000000000B20000-0x0000000000B9F000-memory.dmp

Filesize
508KB

Download
memory/4480-43-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4480-44-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4480-42-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/4500-217-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4508-177-0x0000000001060000-0x00000000010DF000-memory.dmp

Filesize
508KB

Download
memory/4604-151-0x0000000000310000-0x000000000038F000-memory.dmp

Filesize
508KB

Download
memory/4668-250-0x00000000010D0000-0x000000000114F000-memory.dmp

Filesize
508KB

Download
memory/4676-281-0x0000000000E40000-0x0000000000EBF000-memory.dmp

Filesize
508KB

Download
memory/4720-67-0x0000000000A60000-0x0000000000ADF000-memory.dmp

Filesize
508KB

Download
memory/4720-66-0x0000000000A60000-0x0000000000ADF000-memory.dmp

Filesize
508KB

Download
memory/4720-68-0x0000000000A60000-0x0000000000ADF000-memory.dmp

Filesize
508KB

Download
memory/4720-69-0x0000000000A60000-0x0000000000ADF000-memory.dmp

Filesize
508KB

Download
memory/4940-274-0x0000000001000000-0x000000000107F000-memory.dmp

Filesize
508KB

Download
memory/4960-33-0x00000000006F0000-0x000000000076F000-memory.dmp

Filesize
508KB

Download
memory/4960-32-0x00000000006F0000-0x000000000076F000-memory.dmp

Filesize
508KB

Download
memory/4960-31-0x00000000006F0000-0x000000000076F000-memory.dmp

Filesize
508KB

Download
memory/4960-30-0x00000000006F0000-0x000000000076F000-memory.dmp

Filesize
508KB

Download
memory/4976-213-0x0000000000E00000-0x0000000000E7F000-memory.dmp

Filesize
508KB

Download
memory/5216-352-0x00000000006A0000-0x000000000071F000-memory.dmp

Filesize
508KB

Download