remcos | f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
Size

967KB
MD5

6d53853d0d56802e6ad845407f61eee7
SHA1

3cfb6e47d65afb417444d23908e28163ab83a341
SHA256

f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2
SHA512

20279d70d086aec743a7c6df92384fe5100e4a9e9f7cb710ac3c947b2a36a0a3b307638a0f3dfcd93cf26ba2172db1d546ffa311939ebc28c5b3988d0b6b00e5
SSDEEP

24576:Zo5Cx4T0Nq036gAfCwpOypJ4k4ZS3yWw:C5Cx4QN/OCypJ4ZZSCWw

Score

10^/10

remcos buddy collection rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

BUDDY

192.210.201.57:52499

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LMLI87
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 23 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3364-11-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-13-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-15-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-16-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-17-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-19-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-20-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-21-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-22-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-23-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-24-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-25-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-27-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-57-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-60-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-63-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-64-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-72-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-73-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-80-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-81-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-88-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/3364-89-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables built or packed with MPress PE compressor 17 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4304-29-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4304-33-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4348-30-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/668-35-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4348-38-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4304-37-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4348-34-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/668-43-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/668-45-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4348-46-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/668-47-0x0000000000400000-0x0000000000424000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4304-49-0x0000000000400000-0x0000000000478000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3364-51-0x0000000010000000-0x0000000010019000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3364-54-0x0000000010000000-0x0000000010019000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3364-55-0x0000000010000000-0x0000000010019000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3364-56-0x0000000010000000-0x0000000010019000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3364-66-0x0000000010000000-0x0000000010019000-memory.dmp	INDICATOR_EXE_Packed_MPress

Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4900-8-0x0000000004CA0000-0x0000000004CAC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4348-38-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/4348-46-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4348-38-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral2/memory/4348-46-0x0000000000400000-0x0000000000462000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4348-38-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/4348-46-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/4304-37-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4304-49-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4348-38-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4304-37-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/668-45-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4348-46-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/668-47-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4304-49-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exef5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

description	pid	process	target process
PID 4900 set thread context of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 set thread context of 4304	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 set thread context of 4348	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 set thread context of 668	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exef5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

pid	process
4304	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
4304	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
668	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
668	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
4304	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
4304	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

pid	process
3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

description pid process

Token: SeDebugPrivilege 668 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

pid process

3364 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

description	pid	process
Token: SeDebugPrivilege	668	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exef5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe

C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
"C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4900

C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
"C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364

C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe /stext "C:\Users\Admin\AppData\Local\Temp\qxdipixuwhqhqfpvm"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4304

C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe /stext "C:\Users\Admin\AppData\Local\Temp\aziaqtiwkpiualdzweje"
3⤵
- Accesses Microsoft Outlook accounts
PID:4348

C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe /stext "C:\Users\Admin\AppData\Local\Temp\ctntrlspxxbzcrrdfowfprlz"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat
Filesize
144B

MD5
6bdc1e446947f135e70c6b26c882c9ed

SHA1
a0e18c03d664dd2200e04dc5fdf3f76c7b6bfbe1

SHA256
f07c099880a60ccc5d4f3a20990d35946fe3c028a1276397323b50f27a899015

SHA512
6ef39c90371e98054355492a4a4c4bfc6e875a9138909257490cd6843452190f6bb04b49b2450dd0259e389de4cc3cefb10d56901248632beb1642cfe1fbe265

Download Submit
C:\Users\Admin\AppData\Local\Temp\qxdipixuwhqhqfpvm
Filesize
4KB

MD5
6ce0d7e05372ea44324b080558be28f0

SHA1
7a9a7949c794caa4d5ef725fa07ea984db1f5154

SHA256
6dde4db7ef166c3f452320088dfdd5c4bcc00323dbecc6836f80951a5c122540

SHA512
9e1d935c4993e59bea7501f6f756e74d178ed7752e67f805bf040ee38b3734a402aa5478c1f9358038129ae9e8f4d5f9ab0e274f2efbe96274d25dd1a0392964

Download Submit
memory/668-35-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/668-47-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/668-45-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/668-43-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3364-54-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3364-55-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3364-89-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-81-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-80-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-66-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3364-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3364-56-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3364-51-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4304-29-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4304-49-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4304-33-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4304-37-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4348-34-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4348-30-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4348-46-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4348-38-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4900-0-0x0000000000790000-0x0000000000888000-memory.dmp

Filesize
992KB

Download
memory/4900-4-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/4900-1-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/4900-7-0x0000000005830000-0x0000000005838000-memory.dmp

Filesize
32KB

Download
memory/4900-6-0x0000000005810000-0x000000000582C000-memory.dmp

Filesize
112KB

Download
memory/4900-5-0x0000000005430000-0x000000000543A000-memory.dmp

Filesize
40KB

Download
memory/4900-2-0x0000000005840000-0x0000000005DE4000-memory.dmp

Filesize
5.6MB

Download
memory/4900-3-0x0000000005290000-0x0000000005322000-memory.dmp

Filesize
584KB

Download
memory/4900-14-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/4900-10-0x00000000080C0000-0x000000000815C000-memory.dmp

Filesize
624KB

Download
memory/4900-9-0x0000000006C40000-0x0000000006D00000-memory.dmp

Filesize
768KB

Download
memory/4900-8-0x0000000004CA0000-0x0000000004CAC000-memory.dmp

Filesize
48KB

Download

description	pid	process	target process
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 4900 wrote to memory of 3364	4900	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 4304	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 4304	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 4304	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 4304	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 4348	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 4348	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 4348	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 4348	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 668	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 668	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 668	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
PID 3364 wrote to memory of 668	3364	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe	f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe