remcos | 00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e

Resubmissions

21-03-2024 08:04

240321-jydgaagd5x 10

13-03-2024 17:04

240313-vlgtqaad4y 10

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vencord.exe
Size

469KB
MD5

e206c8908d5c24a3dda14322807d8e50
SHA1

144d9d69ba30e08dbe79ac3fae47e7c88aedb448
SHA256

00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e
SHA512

9c2ab2d8b6b5b72029ee2c8b34648abde2fa8166fcdd0c0532a720eeb908ad75cb99bbf4e747c314321f7872f92ba8657000c1231084c08a058f24035b752479
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS5n9:uiLJbpI7I2WhQqZ759

Score

10^/10

remcos vencord persistence rat

Malware Config

Extracted

Family

remcos

Botnet

VenCord

147.185.221.18:52136

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
scvhost.exe
copy_folder
System64
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
yh?0J?xxu¢iw)>zqn*'^?^^_wh+ru?*&~2yzwL\"s?>yhi)?0J?xxuz,-QZL639
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
DiscordUpdate
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Vencord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iexplore.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Vencord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
4772	scvhost.exe
4880	scvhost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	Vencord.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	scvhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiscordUpdate = "\"C:\\Windows\\SysWOW64\\System64\\scvhost.exe\""	iexplore.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System64\scvhost.exe	Vencord.exe
File opened for modification	C:\Windows\SysWOW64\System64\scvhost.exe	Vencord.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4772 set thread context of 1564	4772	scvhost.exe	96
PID 1564 set thread context of 1348	1564	iexplore.exe	97
PID 1564 set thread context of 3144	1564	iexplore.exe	98
PID 1564 set thread context of 3948	1564	iexplore.exe	99
PID 1564 set thread context of 2444	1564	iexplore.exe	102
PID 1564 set thread context of 4476	1564	iexplore.exe	107
PID 1564 set thread context of 3684	1564	iexplore.exe	108
PID 1564 set thread context of 1536	1564	iexplore.exe	110
PID 1564 set thread context of 4560	1564	iexplore.exe	113
PID 1564 set thread context of 4324	1564	iexplore.exe	114
PID 1564 set thread context of 440	1564	iexplore.exe	115
PID 1564 set thread context of 2740	1564	iexplore.exe	116
PID 1564 set thread context of 536	1564	iexplore.exe	117
PID 1564 set thread context of 1496	1564	iexplore.exe	119
PID 1564 set thread context of 3152	1564	iexplore.exe	120
PID 1564 set thread context of 4444	1564	iexplore.exe	126
PID 1564 set thread context of 1388	1564	iexplore.exe	127
PID 1564 set thread context of 3112	1564	iexplore.exe	129
PID 1564 set thread context of 4792	1564	iexplore.exe	130
PID 1564 set thread context of 3876	1564	iexplore.exe	131
PID 1564 set thread context of 4200	1564	iexplore.exe	132
PID 1564 set thread context of 4244	1564	iexplore.exe	133
PID 1564 set thread context of 4984	1564	iexplore.exe	134
PID 1564 set thread context of 2920	1564	iexplore.exe	135
PID 1564 set thread context of 1156	1564	iexplore.exe	136
PID 1564 set thread context of 4948	1564	iexplore.exe	137
PID 1564 set thread context of 752	1564	iexplore.exe	138
PID 1564 set thread context of 1948	1564	iexplore.exe	139
PID 1564 set thread context of 3104	1564	iexplore.exe	140
PID 1564 set thread context of 2548	1564	iexplore.exe	141
PID 1564 set thread context of 4904	1564	iexplore.exe	142
PID 1564 set thread context of 3968	1564	iexplore.exe	143
PID 1564 set thread context of 4128	1564	iexplore.exe	144
PID 1564 set thread context of 3008	1564	iexplore.exe	147
PID 1564 set thread context of 4960	1564	iexplore.exe	148
PID 1564 set thread context of 2340	1564	iexplore.exe	149
PID 1564 set thread context of 4064	1564	iexplore.exe	150
PID 1564 set thread context of 4892	1564	iexplore.exe	151
PID 1564 set thread context of 2620	1564	iexplore.exe	152
PID 1564 set thread context of 3400	1564	iexplore.exe	153
PID 1564 set thread context of 3860	1564	iexplore.exe	155
PID 1564 set thread context of 2772	1564	iexplore.exe	156
PID 1564 set thread context of 2496	1564	iexplore.exe	157
PID 1564 set thread context of 3996	1564	iexplore.exe	158
PID 1564 set thread context of 4652	1564	iexplore.exe	159
PID 1564 set thread context of 3536	1564	iexplore.exe	160
PID 1564 set thread context of 4752	1564	iexplore.exe	161
PID 1564 set thread context of 3704	1564	iexplore.exe	162
PID 1564 set thread context of 740	1564	iexplore.exe	163
PID 1564 set thread context of 3456	1564	iexplore.exe	166
PID 1564 set thread context of 1704	1564	iexplore.exe	174
PID 1564 set thread context of 4020	1564	iexplore.exe	176
PID 1564 set thread context of 1336	1564	iexplore.exe	177
PID 1564 set thread context of 1600	1564	iexplore.exe	178
PID 1564 set thread context of 1812	1564	iexplore.exe	179
PID 1564 set thread context of 4988	1564	iexplore.exe	180
PID 1564 set thread context of 1060	1564	iexplore.exe	181
PID 1564 set thread context of 1980	1564	iexplore.exe	182
PID 1564 set thread context of 1252	1564	iexplore.exe	183
PID 1564 set thread context of 2452	1564	iexplore.exe	184
PID 1564 set thread context of 5016	1564	iexplore.exe	185
PID 1564 set thread context of 2892	1564	iexplore.exe	186
PID 1564 set thread context of 4992	1564	iexplore.exe	187
PID 1564 set thread context of 2588	1564	iexplore.exe	188

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	Vencord.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4772	scvhost.exe
4772	scvhost.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4772	scvhost.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe
1564	iexplore.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3944	taskmgr.exe
Token: SeSystemProfilePrivilege	3944	taskmgr.exe
Token: SeCreateGlobalPrivilege	3944	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe
3944	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 3008	3052	Vencord.exe	92
PID 3052 wrote to memory of 3008	3052	Vencord.exe	92
PID 3052 wrote to memory of 3008	3052	Vencord.exe	92
PID 3008 wrote to memory of 3608	3008	WScript.exe	93
PID 3008 wrote to memory of 3608	3008	WScript.exe	93
PID 3008 wrote to memory of 3608	3008	WScript.exe	93
PID 3608 wrote to memory of 4772	3608	cmd.exe	95
PID 3608 wrote to memory of 4772	3608	cmd.exe	95
PID 3608 wrote to memory of 4772	3608	cmd.exe	95
PID 4772 wrote to memory of 1564	4772	scvhost.exe	96
PID 4772 wrote to memory of 1564	4772	scvhost.exe	96
PID 4772 wrote to memory of 1564	4772	scvhost.exe	96
PID 4772 wrote to memory of 1564	4772	scvhost.exe	96
PID 1564 wrote to memory of 1348	1564	iexplore.exe	97
PID 1564 wrote to memory of 1348	1564	iexplore.exe	97
PID 1564 wrote to memory of 1348	1564	iexplore.exe	97
PID 1564 wrote to memory of 1348	1564	iexplore.exe	97
PID 1564 wrote to memory of 3144	1564	iexplore.exe	98
PID 1564 wrote to memory of 3144	1564	iexplore.exe	98
PID 1564 wrote to memory of 3144	1564	iexplore.exe	98
PID 1564 wrote to memory of 3144	1564	iexplore.exe	98
PID 1564 wrote to memory of 3948	1564	iexplore.exe	99
PID 1564 wrote to memory of 3948	1564	iexplore.exe	99
PID 1564 wrote to memory of 3948	1564	iexplore.exe	99
PID 1564 wrote to memory of 3948	1564	iexplore.exe	99
PID 1564 wrote to memory of 2444	1564	iexplore.exe	102
PID 1564 wrote to memory of 2444	1564	iexplore.exe	102
PID 1564 wrote to memory of 2444	1564	iexplore.exe	102
PID 1564 wrote to memory of 2444	1564	iexplore.exe	102
PID 1564 wrote to memory of 4476	1564	iexplore.exe	107
PID 1564 wrote to memory of 4476	1564	iexplore.exe	107
PID 1564 wrote to memory of 4476	1564	iexplore.exe	107
PID 1564 wrote to memory of 4476	1564	iexplore.exe	107
PID 1564 wrote to memory of 3684	1564	iexplore.exe	108
PID 1564 wrote to memory of 3684	1564	iexplore.exe	108
PID 1564 wrote to memory of 3684	1564	iexplore.exe	108
PID 1564 wrote to memory of 3684	1564	iexplore.exe	108
PID 1564 wrote to memory of 1536	1564	iexplore.exe	110
PID 1564 wrote to memory of 1536	1564	iexplore.exe	110
PID 1564 wrote to memory of 1536	1564	iexplore.exe	110
PID 1564 wrote to memory of 1536	1564	iexplore.exe	110
PID 1564 wrote to memory of 4560	1564	iexplore.exe	113
PID 1564 wrote to memory of 4560	1564	iexplore.exe	113
PID 1564 wrote to memory of 4560	1564	iexplore.exe	113
PID 1564 wrote to memory of 4560	1564	iexplore.exe	113
PID 1564 wrote to memory of 4324	1564	iexplore.exe	114
PID 1564 wrote to memory of 4324	1564	iexplore.exe	114
PID 1564 wrote to memory of 4324	1564	iexplore.exe	114
PID 1564 wrote to memory of 4324	1564	iexplore.exe	114
PID 1564 wrote to memory of 440	1564	iexplore.exe	115
PID 1564 wrote to memory of 440	1564	iexplore.exe	115
PID 1564 wrote to memory of 440	1564	iexplore.exe	115
PID 1564 wrote to memory of 440	1564	iexplore.exe	115
PID 1564 wrote to memory of 2740	1564	iexplore.exe	116
PID 1564 wrote to memory of 2740	1564	iexplore.exe	116
PID 1564 wrote to memory of 2740	1564	iexplore.exe	116
PID 1564 wrote to memory of 2740	1564	iexplore.exe	116
PID 1564 wrote to memory of 536	1564	iexplore.exe	117
PID 1564 wrote to memory of 536	1564	iexplore.exe	117
PID 1564 wrote to memory of 536	1564	iexplore.exe	117
PID 1564 wrote to memory of 536	1564	iexplore.exe	117
PID 1564 wrote to memory of 1496	1564	iexplore.exe	119
PID 1564 wrote to memory of 1496	1564	iexplore.exe	119
PID 1564 wrote to memory of 1496	1564	iexplore.exe	119

C:\Users\Admin\AppData\Local\Temp\Vencord.exe
"C:\Users\Admin\AppData\Local\Temp\Vencord.exe"
1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\System64\scvhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\SysWOW64\System64\scvhost.exe
      C:\Windows\SysWOW64\System64\scvhost.exe
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4772
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        Adds policy Run key to start application
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1564
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1348
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3144
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3948
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2444
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4476
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3684
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1536
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4560
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4324
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:440
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2740
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:536
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1496
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3152
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4444
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1388
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3112
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4792
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3876
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4200
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4244
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4984
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2920
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1156
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4948
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:752
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1948
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3104
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2548
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4904
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3968
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4128
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3008
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4960
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2340
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4064
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4892
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2620
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3400
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3860
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2772
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2496
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3996
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4652
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3536
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4752
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3704
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:740
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3456
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1704
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4020
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1336
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1600
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1812
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4988
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1060
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1980
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1252
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2452
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:5016
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2892
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4992
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2588
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1160
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4104
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3068
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2300
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3240
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3040
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2600
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3092
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:1228
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:4828
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3232

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3100

C:\Windows\System32\wezuc9.exe
"C:\Windows\System32\wezuc9.exe"
1⤵
PID:3300

C:\Windows\SysWOW64\System64\scvhost.exe
"C:\Windows\SysWOW64\System64\scvhost.exe"
1⤵
- Executes dropped EXE
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
402B

MD5
aa3bb02fdbe0aed95d2adf0ef033c2be

SHA1
002f7db7d5e7d368d27d7b1efd1a4f571fac1740

SHA256
d2f9e454aa3a7e614f38219f333420f2ac7963fffafccf3105929c280274de59

SHA512
3a49dfd9d827efdab3abf6220375ba921dde0772bba2b0674ed2562da27853f0df0b786f26c233ca96d8d89c1c95489330c3aea07e62c0b0a6ed716324d8c913

Download Submit
C:\Windows\SysWOW64\System64\scvhost.exe

Filesize
469KB

MD5
e206c8908d5c24a3dda14322807d8e50

SHA1
144d9d69ba30e08dbe79ac3fae47e7c88aedb448

SHA256
00ce6c60c382436b7c8b9ddb94fbcf88e940c1ab94706555949393718bc1752e

SHA512
9c2ab2d8b6b5b72029ee2c8b34648abde2fa8166fcdd0c0532a720eeb908ad75cb99bbf4e747c314321f7872f92ba8657000c1231084c08a058f24035b752479

Download Submit
memory/440-52-0x0000000000E80000-0x0000000000EFF000-memory.dmp

Filesize
508KB

Download
memory/440-51-0x0000000000E80000-0x0000000000EFF000-memory.dmp

Filesize
508KB

Download
memory/440-55-0x0000000000E80000-0x0000000000EFF000-memory.dmp

Filesize
508KB

Download
memory/440-53-0x0000000000E80000-0x0000000000EFF000-memory.dmp

Filesize
508KB

Download
memory/536-65-0x0000000000610000-0x000000000068F000-memory.dmp

Filesize
508KB

Download
memory/536-64-0x0000000000610000-0x000000000068F000-memory.dmp

Filesize
508KB

Download
memory/536-63-0x0000000000610000-0x000000000068F000-memory.dmp

Filesize
508KB

Download
memory/536-62-0x0000000000610000-0x000000000068F000-memory.dmp

Filesize
508KB

Download
memory/740-230-0x0000000000AF0000-0x0000000000B6F000-memory.dmp

Filesize
508KB

Download
memory/752-125-0x0000000000D60000-0x0000000000DDF000-memory.dmp

Filesize
508KB

Download
memory/1060-264-0x0000000000EA0000-0x0000000000F1F000-memory.dmp

Filesize
508KB

Download
memory/1156-117-0x00000000012D0000-0x000000000134F000-memory.dmp

Filesize
508KB

Download
memory/1252-272-0x0000000000900000-0x000000000097F000-memory.dmp

Filesize
508KB

Download
memory/1336-246-0x0000000000E00000-0x0000000000E7F000-memory.dmp

Filesize
508KB

Download
memory/1348-18-0x0000000000180000-0x00000000001FF000-memory.dmp

Filesize
508KB

Download
memory/1348-17-0x0000000000180000-0x00000000001FF000-memory.dmp

Filesize
508KB

Download
memory/1348-16-0x0000000000180000-0x00000000001FF000-memory.dmp

Filesize
508KB

Download
memory/1348-14-0x0000000000180000-0x00000000001FF000-memory.dmp

Filesize
508KB

Download
memory/1388-80-0x0000000000E10000-0x0000000000E8F000-memory.dmp

Filesize
508KB

Download
memory/1388-79-0x0000000000E10000-0x0000000000E8F000-memory.dmp

Filesize
508KB

Download
memory/1388-82-0x0000000000E10000-0x0000000000E8F000-memory.dmp

Filesize
508KB

Download
memory/1388-81-0x0000000000E10000-0x0000000000E8F000-memory.dmp

Filesize
508KB

Download
memory/1496-66-0x0000000000EC0000-0x0000000000F3F000-memory.dmp

Filesize
508KB

Download
memory/1496-67-0x0000000000EC0000-0x0000000000F3F000-memory.dmp

Filesize
508KB

Download
memory/1496-69-0x0000000000EC0000-0x0000000000F3F000-memory.dmp

Filesize
508KB

Download
memory/1496-68-0x0000000000EC0000-0x0000000000F3F000-memory.dmp

Filesize
508KB

Download
memory/1536-42-0x0000000000B70000-0x0000000000BEF000-memory.dmp

Filesize
508KB

Download
memory/1536-39-0x0000000000B70000-0x0000000000BEF000-memory.dmp

Filesize
508KB

Download
memory/1536-41-0x0000000000B70000-0x0000000000BEF000-memory.dmp

Filesize
508KB

Download
memory/1536-40-0x0000000000B70000-0x0000000000BEF000-memory.dmp

Filesize
508KB

Download
memory/1564-60-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1564-15-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1564-61-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1564-54-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1564-13-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1564-11-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1564-10-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1564-9-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1564-8-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1600-250-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1704-238-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/1812-254-0x0000000000370000-0x00000000003EF000-memory.dmp

Filesize
508KB

Download
memory/1948-129-0x0000000000C20000-0x0000000000C9F000-memory.dmp

Filesize
508KB

Download
memory/1980-268-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2340-176-0x0000000000C90000-0x0000000000D0F000-memory.dmp

Filesize
508KB

Download
memory/2444-27-0x0000000000ED0000-0x0000000000F4F000-memory.dmp

Filesize
508KB

Download
memory/2444-29-0x0000000000ED0000-0x0000000000F4F000-memory.dmp

Filesize
508KB

Download
memory/2444-30-0x0000000000ED0000-0x0000000000F4F000-memory.dmp

Filesize
508KB

Download
memory/2444-28-0x0000000000ED0000-0x0000000000F4F000-memory.dmp

Filesize
508KB

Download
memory/2452-276-0x0000000000950000-0x00000000009CF000-memory.dmp

Filesize
508KB

Download
memory/2496-204-0x0000000000A80000-0x0000000000AFF000-memory.dmp

Filesize
508KB

Download
memory/2548-137-0x0000000000530000-0x00000000005AF000-memory.dmp

Filesize
508KB

Download
memory/2620-188-0x0000000000110000-0x000000000018F000-memory.dmp

Filesize
508KB

Download
memory/2740-59-0x0000000000A40000-0x0000000000ABF000-memory.dmp

Filesize
508KB

Download
memory/2740-58-0x0000000000A40000-0x0000000000ABF000-memory.dmp

Filesize
508KB

Download
memory/2740-57-0x0000000000A40000-0x0000000000ABF000-memory.dmp

Filesize
508KB

Download
memory/2740-56-0x0000000000A40000-0x0000000000ABF000-memory.dmp

Filesize
508KB

Download
memory/2772-200-0x0000000000870000-0x00000000008EF000-memory.dmp

Filesize
508KB

Download
memory/2920-113-0x0000000000450000-0x00000000004CF000-memory.dmp

Filesize
508KB

Download
memory/3008-166-0x00000000004A0000-0x000000000051F000-memory.dmp

Filesize
508KB

Download
memory/3104-133-0x0000000000F10000-0x0000000000F8F000-memory.dmp

Filesize
508KB

Download
memory/3112-86-0x0000000000DF0000-0x0000000000E6F000-memory.dmp

Filesize
508KB

Download
memory/3112-85-0x0000000000DF0000-0x0000000000E6F000-memory.dmp

Filesize
508KB

Download
memory/3112-84-0x0000000000DF0000-0x0000000000E6F000-memory.dmp

Filesize
508KB

Download
memory/3112-83-0x0000000000DF0000-0x0000000000E6F000-memory.dmp

Filesize
508KB

Download
memory/3144-22-0x0000000000420000-0x000000000049F000-memory.dmp

Filesize
508KB

Download
memory/3144-21-0x0000000000420000-0x000000000049F000-memory.dmp

Filesize
508KB

Download
memory/3144-20-0x0000000000420000-0x000000000049F000-memory.dmp

Filesize
508KB

Download
memory/3144-19-0x0000000000420000-0x000000000049F000-memory.dmp

Filesize
508KB

Download
memory/3152-71-0x0000000000D10000-0x0000000000D8F000-memory.dmp

Filesize
508KB

Download
memory/3152-74-0x0000000000D10000-0x0000000000D8F000-memory.dmp

Filesize
508KB

Download
memory/3152-73-0x0000000000D10000-0x0000000000D8F000-memory.dmp

Filesize
508KB

Download
memory/3152-72-0x0000000000D10000-0x0000000000D8F000-memory.dmp

Filesize
508KB

Download
memory/3400-192-0x0000000000E00000-0x0000000000E7F000-memory.dmp

Filesize
508KB

Download
memory/3456-234-0x00000000012A0000-0x000000000131F000-memory.dmp

Filesize
508KB

Download
memory/3456-277-0x00000000012A0000-0x000000000131F000-memory.dmp

Filesize
508KB

Download
memory/3536-218-0x0000000000110000-0x000000000018F000-memory.dmp

Filesize
508KB

Download
memory/3684-36-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/3684-35-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/3684-38-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/3684-37-0x0000000000800000-0x000000000087F000-memory.dmp

Filesize
508KB

Download
memory/3704-226-0x0000000000E00000-0x0000000000E7F000-memory.dmp

Filesize
508KB

Download
memory/3860-196-0x0000000000600000-0x000000000067F000-memory.dmp

Filesize
508KB

Download
memory/3876-95-0x0000000000CE0000-0x0000000000D5F000-memory.dmp

Filesize
508KB

Download
memory/3876-92-0x0000000000CE0000-0x0000000000D5F000-memory.dmp

Filesize
508KB

Download
memory/3948-26-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3948-24-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3948-70-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3948-25-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3948-23-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/3968-145-0x0000000000600000-0x000000000067F000-memory.dmp

Filesize
508KB

Download
memory/3996-208-0x0000000000E00000-0x0000000000E7F000-memory.dmp

Filesize
508KB

Download
memory/4020-242-0x0000000000410000-0x000000000048F000-memory.dmp

Filesize
508KB

Download
memory/4064-180-0x0000000000760000-0x00000000007DF000-memory.dmp

Filesize
508KB

Download
memory/4128-149-0x0000000000600000-0x000000000067F000-memory.dmp

Filesize
508KB

Download
memory/4200-99-0x0000000000E00000-0x0000000000E7F000-memory.dmp

Filesize
508KB

Download
memory/4244-103-0x0000000001200000-0x000000000127F000-memory.dmp

Filesize
508KB

Download
memory/4324-48-0x0000000000ED0000-0x0000000000F4F000-memory.dmp

Filesize
508KB

Download
memory/4324-49-0x0000000000ED0000-0x0000000000F4F000-memory.dmp

Filesize
508KB

Download
memory/4324-50-0x0000000000ED0000-0x0000000000F4F000-memory.dmp

Filesize
508KB

Download
memory/4444-76-0x0000000001240000-0x00000000012BF000-memory.dmp

Filesize
508KB

Download
memory/4444-77-0x0000000001240000-0x00000000012BF000-memory.dmp

Filesize
508KB

Download
memory/4444-75-0x0000000001240000-0x00000000012BF000-memory.dmp

Filesize
508KB

Download
memory/4444-78-0x0000000001240000-0x00000000012BF000-memory.dmp

Filesize
508KB

Download
memory/4476-31-0x0000000000C00000-0x0000000000C7F000-memory.dmp

Filesize
508KB

Download
memory/4476-32-0x0000000000C00000-0x0000000000C7F000-memory.dmp

Filesize
508KB

Download
memory/4476-33-0x0000000000C00000-0x0000000000C7F000-memory.dmp

Filesize
508KB

Download
memory/4476-34-0x0000000000C00000-0x0000000000C7F000-memory.dmp

Filesize
508KB

Download
memory/4560-90-0x0000000000730000-0x00000000007AF000-memory.dmp

Filesize
508KB

Download
memory/4560-45-0x0000000000730000-0x00000000007AF000-memory.dmp

Filesize
508KB

Download
memory/4560-43-0x0000000000730000-0x00000000007AF000-memory.dmp

Filesize
508KB

Download
memory/4560-44-0x0000000000730000-0x00000000007AF000-memory.dmp

Filesize
508KB

Download
memory/4560-46-0x0000000000730000-0x00000000007AF000-memory.dmp

Filesize
508KB

Download
memory/4652-212-0x00000000012E0000-0x000000000135F000-memory.dmp

Filesize
508KB

Download
memory/4752-222-0x0000000000D90000-0x0000000000E0F000-memory.dmp

Filesize
508KB

Download
memory/4792-89-0x0000000000EC0000-0x0000000000F3F000-memory.dmp

Filesize
508KB

Download
memory/4792-88-0x0000000000EC0000-0x0000000000F3F000-memory.dmp

Filesize
508KB

Download
memory/4792-91-0x0000000000EC0000-0x0000000000F3F000-memory.dmp

Filesize
508KB

Download
memory/4892-184-0x0000000000810000-0x000000000088F000-memory.dmp

Filesize
508KB

Download
memory/4904-141-0x0000000000A60000-0x0000000000ADF000-memory.dmp

Filesize
508KB

Download
memory/4948-121-0x0000000000A00000-0x0000000000A7F000-memory.dmp

Filesize
508KB

Download
memory/4960-172-0x0000000000470000-0x00000000004EF000-memory.dmp

Filesize
508KB

Download
memory/4984-107-0x0000000000920000-0x000000000099F000-memory.dmp

Filesize
508KB

Download
memory/4988-258-0x0000000000D20000-0x0000000000D9F000-memory.dmp

Filesize
508KB

Download
memory/5016-281-0x0000000000B70000-0x0000000000BEF000-memory.dmp

Filesize
508KB

Download