remcos | 560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
Size

1.4MB
MD5

c7fc0cee8ca35d709ed276e9f88ddbed
SHA1

ceea9d76bf0429872f4d7420addd0abdb5e8f4dc
SHA256

560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e
SHA512

a1b93c9cb87993f77f2decf0e4ee33277567651d7fb664b579f3e293f97c6b198ce701c02cffd9d295b3e40f62cd6500f55bc252212c5ec81ac9e257831273da
SSDEEP

24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8aIHo9Hi9Yc1St1R1M9p09oMMhDIGL0:2TvC/MTQYxsWR7aIHEC+coJ1OpwoMMhv

Score

10^/10

remcos main discovery rat

Malware Config

Extracted

Family

remcos

Botnet

Main

84.38.132.103:7001

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FR1M2R
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs	RegAsymX.exe

Executes dropped EXE 1 IoCs

pid	Process
2892	RegAsymX.exe

AutoIT Executable 51 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000b000000023375-14.dat	autoit_exe
behavioral2/memory/2164-40-0x0000000001010000-0x0000000001172000-memory.dmp	autoit_exe
behavioral2/memory/2164-41-0x0000000001010000-0x0000000001172000-memory.dmp	autoit_exe
behavioral2/memory/2164-39-0x0000000001010000-0x0000000001172000-memory.dmp	autoit_exe
behavioral2/memory/2164-42-0x0000000001010000-0x0000000001172000-memory.dmp	autoit_exe
behavioral2/memory/1476-43-0x00000000012B0000-0x0000000001412000-memory.dmp	autoit_exe
behavioral2/memory/1476-44-0x00000000012B0000-0x0000000001412000-memory.dmp	autoit_exe
behavioral2/memory/1476-45-0x00000000012B0000-0x0000000001412000-memory.dmp	autoit_exe
behavioral2/memory/1476-46-0x00000000012B0000-0x0000000001412000-memory.dmp	autoit_exe
behavioral2/memory/4020-47-0x0000000000C30000-0x0000000000D92000-memory.dmp	autoit_exe
behavioral2/memory/4020-48-0x0000000000C30000-0x0000000000D92000-memory.dmp	autoit_exe
behavioral2/memory/1572-51-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe
behavioral2/memory/1572-50-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe
behavioral2/memory/2304-52-0x0000000000890000-0x00000000009F2000-memory.dmp	autoit_exe
behavioral2/memory/2304-53-0x0000000000890000-0x00000000009F2000-memory.dmp	autoit_exe
behavioral2/memory/1404-56-0x0000000000400000-0x0000000000562000-memory.dmp	autoit_exe
behavioral2/memory/1404-57-0x0000000000400000-0x0000000000562000-memory.dmp	autoit_exe
behavioral2/memory/4320-58-0x0000000000E00000-0x0000000000F62000-memory.dmp	autoit_exe
behavioral2/memory/4320-59-0x0000000000E00000-0x0000000000F62000-memory.dmp	autoit_exe
behavioral2/memory/5020-60-0x00000000012D0000-0x0000000001432000-memory.dmp	autoit_exe
behavioral2/memory/5020-61-0x00000000012D0000-0x0000000001432000-memory.dmp	autoit_exe
behavioral2/memory/3208-63-0x0000000000610000-0x0000000000772000-memory.dmp	autoit_exe
behavioral2/memory/3208-64-0x0000000000610000-0x0000000000772000-memory.dmp	autoit_exe
behavioral2/memory/2416-65-0x0000000001270000-0x00000000013D2000-memory.dmp	autoit_exe
behavioral2/memory/2416-66-0x0000000001270000-0x00000000013D2000-memory.dmp	autoit_exe
behavioral2/memory/3660-68-0x0000000000640000-0x00000000007A2000-memory.dmp	autoit_exe
behavioral2/memory/3660-69-0x0000000000640000-0x00000000007A2000-memory.dmp	autoit_exe
behavioral2/memory/3684-72-0x00000000006D0000-0x0000000000832000-memory.dmp	autoit_exe
behavioral2/memory/3684-73-0x00000000006D0000-0x0000000000832000-memory.dmp	autoit_exe
behavioral2/memory/3808-74-0x0000000000A00000-0x0000000000B62000-memory.dmp	autoit_exe
behavioral2/memory/3808-75-0x0000000000A00000-0x0000000000B62000-memory.dmp	autoit_exe
behavioral2/memory/964-77-0x00000000012E0000-0x0000000001442000-memory.dmp	autoit_exe
behavioral2/memory/964-78-0x00000000012E0000-0x0000000001442000-memory.dmp	autoit_exe
behavioral2/memory/4920-79-0x0000000000E70000-0x0000000000FD2000-memory.dmp	autoit_exe
behavioral2/memory/4920-80-0x0000000000E70000-0x0000000000FD2000-memory.dmp	autoit_exe
behavioral2/memory/2720-82-0x0000000000A20000-0x0000000000B82000-memory.dmp	autoit_exe
behavioral2/memory/2720-83-0x0000000000A20000-0x0000000000B82000-memory.dmp	autoit_exe
behavioral2/memory/4112-85-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe
behavioral2/memory/3140-86-0x0000000000C00000-0x0000000000D62000-memory.dmp	autoit_exe
behavioral2/memory/3140-87-0x0000000000C00000-0x0000000000D62000-memory.dmp	autoit_exe
behavioral2/memory/5088-89-0x00000000010A0000-0x0000000001202000-memory.dmp	autoit_exe
behavioral2/memory/5088-90-0x00000000010A0000-0x0000000001202000-memory.dmp	autoit_exe
behavioral2/memory/2156-92-0x0000000000A00000-0x0000000000B62000-memory.dmp	autoit_exe
behavioral2/memory/3700-94-0x00000000004B0000-0x0000000000612000-memory.dmp	autoit_exe
behavioral2/memory/2944-96-0x0000000000C30000-0x0000000000D92000-memory.dmp	autoit_exe
behavioral2/memory/1820-99-0x0000000000CC0000-0x0000000000E22000-memory.dmp	autoit_exe
behavioral2/memory/1820-100-0x0000000000CC0000-0x0000000000E22000-memory.dmp	autoit_exe
behavioral2/memory/4008-102-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/4008-103-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/552-104-0x0000000000470000-0x00000000005D2000-memory.dmp	autoit_exe
behavioral2/memory/552-105-0x0000000000470000-0x00000000005D2000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2892 set thread context of 2164	2892	RegAsymX.exe	88
PID 2892 set thread context of 1476	2892	RegAsymX.exe	96
PID 2892 set thread context of 4020	2892	RegAsymX.exe	99
PID 2892 set thread context of 1572	2892	RegAsymX.exe	103
PID 2892 set thread context of 2304	2892	RegAsymX.exe	108
PID 2892 set thread context of 1404	2892	RegAsymX.exe	111
PID 2892 set thread context of 4320	2892	RegAsymX.exe	114
PID 2892 set thread context of 5020	2892	RegAsymX.exe	117
PID 2892 set thread context of 3208	2892	RegAsymX.exe	120
PID 2892 set thread context of 2416	2892	RegAsymX.exe	123
PID 2892 set thread context of 3660	2892	RegAsymX.exe	126
PID 2892 set thread context of 3684	2892	RegAsymX.exe	129
PID 2892 set thread context of 3808	2892	RegAsymX.exe	132
PID 2892 set thread context of 964	2892	RegAsymX.exe	135
PID 2892 set thread context of 4920	2892	RegAsymX.exe	139
PID 2892 set thread context of 2720	2892	RegAsymX.exe	143
PID 2892 set thread context of 4112	2892	RegAsymX.exe	146
PID 2892 set thread context of 3140	2892	RegAsymX.exe	149
PID 2892 set thread context of 5088	2892	RegAsymX.exe	152
PID 2892 set thread context of 2156	2892	RegAsymX.exe	155
PID 2892 set thread context of 3700	2892	RegAsymX.exe	158
PID 2892 set thread context of 2944	2892	RegAsymX.exe	161
PID 2892 set thread context of 1820	2892	RegAsymX.exe	164
PID 2892 set thread context of 4008	2892	RegAsymX.exe	167
PID 2892 set thread context of 552	2892	RegAsymX.exe	170
PID 2892 set thread context of 1440	2892	RegAsymX.exe	173
PID 2892 set thread context of 4228	2892	RegAsymX.exe	176
PID 2892 set thread context of 2524	2892	RegAsymX.exe	179
PID 2892 set thread context of 5044	2892	RegAsymX.exe	182
PID 2892 set thread context of 1208	2892	RegAsymX.exe	185
PID 2892 set thread context of 3872	2892	RegAsymX.exe	188
PID 2892 set thread context of 3220	2892	RegAsymX.exe	191
PID 2892 set thread context of 4252	2892	RegAsymX.exe	194
PID 2892 set thread context of 5068	2892	RegAsymX.exe	197
PID 2892 set thread context of 2044	2892	RegAsymX.exe	200
PID 2892 set thread context of 1052	2892	RegAsymX.exe	203
PID 2892 set thread context of 2352	2892	RegAsymX.exe	206
PID 2892 set thread context of 3904	2892	RegAsymX.exe	209
PID 2892 set thread context of 1812	2892	RegAsymX.exe	212
PID 2892 set thread context of 3712	2892	RegAsymX.exe	215
PID 2892 set thread context of 4844	2892	RegAsymX.exe	218
PID 2892 set thread context of 4684	2892	RegAsymX.exe	221
PID 2892 set thread context of 4368	2892	RegAsymX.exe	224
PID 2892 set thread context of 2508	2892	RegAsymX.exe	227
PID 2892 set thread context of 3212	2892	RegAsymX.exe	230
PID 2892 set thread context of 4568	2892	RegAsymX.exe	233
PID 2892 set thread context of 4656	2892	RegAsymX.exe	236
PID 2892 set thread context of 4912	2892	RegAsymX.exe	239
PID 2892 set thread context of 4012	2892	RegAsymX.exe	242
PID 2892 set thread context of 1688	2892	RegAsymX.exe	245
PID 2892 set thread context of 4248	2892	RegAsymX.exe	248
PID 2892 set thread context of 4104	2892	RegAsymX.exe	251
PID 2892 set thread context of 2288	2892	RegAsymX.exe	254
PID 2892 set thread context of 4492	2892	RegAsymX.exe	257
PID 2892 set thread context of 560	2892	RegAsymX.exe	260
PID 2892 set thread context of 4572	2892	RegAsymX.exe	263
PID 2892 set thread context of 4052	2892	RegAsymX.exe	266
PID 2892 set thread context of 960	2892	RegAsymX.exe	269
PID 2892 set thread context of 532	2892	RegAsymX.exe	272
PID 2892 set thread context of 4408	2892	RegAsymX.exe	275
PID 2892 set thread context of 4584	2892	RegAsymX.exe	278
PID 2892 set thread context of 3508	2892	RegAsymX.exe	281
PID 2892 set thread context of 3080	2892	RegAsymX.exe	284
PID 2892 set thread context of 3760	2892	RegAsymX.exe	287

Program crash 64 IoCs

pid	pid_target	Process	procid_target
3388	2164	WerFault.exe	88
936	1476	WerFault.exe	96
1368	4020	WerFault.exe	99
3648	1572	WerFault.exe	103
4960	2304	WerFault.exe	108
4136	1404	WerFault.exe	111
1596	4320	WerFault.exe	114
408	5020	WerFault.exe	117
1820	3208	WerFault.exe	120
4784	2416	WerFault.exe	123
1004	3660	WerFault.exe	126
228	3684	WerFault.exe	129
3680	3808	WerFault.exe	132
1156	964	WerFault.exe	135
5044	4920	WerFault.exe	139
2124	2720	WerFault.exe	143
2488	4112	WerFault.exe	146
4200	3140	WerFault.exe	149
856	5088	WerFault.exe	152
4084	2156	WerFault.exe	155
2460	3700	WerFault.exe	158
432	2944	WerFault.exe	161
2232	1820	WerFault.exe	164
1084	4008	WerFault.exe	167
2012	552	WerFault.exe	170
3608	1440	WerFault.exe	173
2932	4228	WerFault.exe	176
3372	2524	WerFault.exe	179
4840	5044	WerFault.exe	182
5052	1208	WerFault.exe	185
388	3872	WerFault.exe	188
544	3220	WerFault.exe	191
4120	4252	WerFault.exe	194
1688	5068	WerFault.exe	197
2516	2044	WerFault.exe	200
872	1052	WerFault.exe	203
4044	2352	WerFault.exe	206
664	3904	WerFault.exe	209
4572	1812	WerFault.exe	212
2064	3712	WerFault.exe	215
228	4844	WerFault.exe	218
2932	4684	WerFault.exe	221
1700	4368	WerFault.exe	224
3004	2508	WerFault.exe	227
936	3212	WerFault.exe	230
4752	4568	WerFault.exe	233
4172	4656	WerFault.exe	236
1832	4912	WerFault.exe	239
4964	4012	WerFault.exe	242
3600	1688	WerFault.exe	245
2948	4248	WerFault.exe	248
1272	4104	WerFault.exe	251
2168	2288	WerFault.exe	254
1656	4492	WerFault.exe	257
676	560	WerFault.exe	260
2012	4572	WerFault.exe	263
620	4052	WerFault.exe	266
2208	960	WerFault.exe	269
3840	532	WerFault.exe	272
3424	4408	WerFault.exe	275
1080	4584	WerFault.exe	278
1364	3508	WerFault.exe	281
4200	3080	WerFault.exe	284
4816	3760	WerFault.exe	287

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe
2892	RegAsymX.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2472	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2472	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2892	RegAsymX.exe
2892	RegAsymX.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2472	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2472	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2892	RegAsymX.exe
2892	RegAsymX.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2892	2472	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	86
PID 2472 wrote to memory of 2892	2472	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	86
PID 2472 wrote to memory of 2892	2472	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	86
PID 2892 wrote to memory of 2164	2892	RegAsymX.exe	88
PID 2892 wrote to memory of 2164	2892	RegAsymX.exe	88
PID 2892 wrote to memory of 2164	2892	RegAsymX.exe	88
PID 2892 wrote to memory of 2164	2892	RegAsymX.exe	88
PID 2892 wrote to memory of 1476	2892	RegAsymX.exe	96
PID 2892 wrote to memory of 1476	2892	RegAsymX.exe	96
PID 2892 wrote to memory of 1476	2892	RegAsymX.exe	96
PID 2892 wrote to memory of 1476	2892	RegAsymX.exe	96
PID 2892 wrote to memory of 4020	2892	RegAsymX.exe	99
PID 2892 wrote to memory of 4020	2892	RegAsymX.exe	99
PID 2892 wrote to memory of 4020	2892	RegAsymX.exe	99
PID 2892 wrote to memory of 4020	2892	RegAsymX.exe	99
PID 2892 wrote to memory of 1572	2892	RegAsymX.exe	103
PID 2892 wrote to memory of 1572	2892	RegAsymX.exe	103
PID 2892 wrote to memory of 1572	2892	RegAsymX.exe	103
PID 2892 wrote to memory of 1572	2892	RegAsymX.exe	103
PID 2892 wrote to memory of 2304	2892	RegAsymX.exe	108
PID 2892 wrote to memory of 2304	2892	RegAsymX.exe	108
PID 2892 wrote to memory of 2304	2892	RegAsymX.exe	108
PID 2892 wrote to memory of 2304	2892	RegAsymX.exe	108
PID 2892 wrote to memory of 1404	2892	RegAsymX.exe	111
PID 2892 wrote to memory of 1404	2892	RegAsymX.exe	111
PID 2892 wrote to memory of 1404	2892	RegAsymX.exe	111
PID 2892 wrote to memory of 1404	2892	RegAsymX.exe	111
PID 2892 wrote to memory of 4320	2892	RegAsymX.exe	114
PID 2892 wrote to memory of 4320	2892	RegAsymX.exe	114
PID 2892 wrote to memory of 4320	2892	RegAsymX.exe	114
PID 2892 wrote to memory of 4320	2892	RegAsymX.exe	114
PID 2892 wrote to memory of 5020	2892	RegAsymX.exe	117
PID 2892 wrote to memory of 5020	2892	RegAsymX.exe	117
PID 2892 wrote to memory of 5020	2892	RegAsymX.exe	117
PID 2892 wrote to memory of 5020	2892	RegAsymX.exe	117
PID 2892 wrote to memory of 3208	2892	RegAsymX.exe	120
PID 2892 wrote to memory of 3208	2892	RegAsymX.exe	120
PID 2892 wrote to memory of 3208	2892	RegAsymX.exe	120
PID 2892 wrote to memory of 3208	2892	RegAsymX.exe	120
PID 2892 wrote to memory of 2416	2892	RegAsymX.exe	123
PID 2892 wrote to memory of 2416	2892	RegAsymX.exe	123
PID 2892 wrote to memory of 2416	2892	RegAsymX.exe	123
PID 2892 wrote to memory of 2416	2892	RegAsymX.exe	123
PID 2892 wrote to memory of 3660	2892	RegAsymX.exe	126
PID 2892 wrote to memory of 3660	2892	RegAsymX.exe	126
PID 2892 wrote to memory of 3660	2892	RegAsymX.exe	126
PID 2892 wrote to memory of 3660	2892	RegAsymX.exe	126
PID 2892 wrote to memory of 3684	2892	RegAsymX.exe	129
PID 2892 wrote to memory of 3684	2892	RegAsymX.exe	129
PID 2892 wrote to memory of 3684	2892	RegAsymX.exe	129
PID 2892 wrote to memory of 3684	2892	RegAsymX.exe	129
PID 2892 wrote to memory of 3808	2892	RegAsymX.exe	132
PID 2892 wrote to memory of 3808	2892	RegAsymX.exe	132
PID 2892 wrote to memory of 3808	2892	RegAsymX.exe	132
PID 2892 wrote to memory of 3808	2892	RegAsymX.exe	132
PID 2892 wrote to memory of 964	2892	RegAsymX.exe	135
PID 2892 wrote to memory of 964	2892	RegAsymX.exe	135
PID 2892 wrote to memory of 964	2892	RegAsymX.exe	135
PID 2892 wrote to memory of 964	2892	RegAsymX.exe	135
PID 2892 wrote to memory of 4920	2892	RegAsymX.exe	139
PID 2892 wrote to memory of 4920	2892	RegAsymX.exe	139
PID 2892 wrote to memory of 4920	2892	RegAsymX.exe	139
PID 2892 wrote to memory of 4920	2892	RegAsymX.exe	139
PID 2892 wrote to memory of 2720	2892	RegAsymX.exe	143

C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
"C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
  "C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 560
      4⤵
      Program crash
      PID:3388
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 560
      4⤵
      Program crash
      PID:936
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 208
      4⤵
      Program crash
      PID:1368
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 560
      4⤵
      Program crash
      PID:3648
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 560
      4⤵
      Program crash
      PID:4960
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 560
      4⤵
      Program crash
      PID:4136
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 560
      4⤵
      Program crash
      PID:1596
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 572
      4⤵
      Program crash
      PID:408
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 560
      4⤵
      Program crash
      PID:1820
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 564
      4⤵
      Program crash
      PID:4784
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 564
      4⤵
      Program crash
      PID:1004
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 200
      4⤵
      Program crash
      PID:228
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 560
      4⤵
      Program crash
      PID:3680
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 192
      4⤵
      Program crash
      PID:1156
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 200
      4⤵
      Program crash
      PID:5044
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 560
      4⤵
      Program crash
      PID:2124
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 560
      4⤵
      Program crash
      PID:2488
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 568
      4⤵
      Program crash
      PID:4200
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 560
      4⤵
      Program crash
      PID:856
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 568
      4⤵
      Program crash
      PID:4084
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 560
      4⤵
      Program crash
      PID:2460
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 564
      4⤵
      Program crash
      PID:432
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 560
      4⤵
      Program crash
      PID:2232
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 560
      4⤵
      Program crash
      PID:1084
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 560
      4⤵
      Program crash
      PID:2012
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 560
      4⤵
      Program crash
      PID:3608
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 208
      4⤵
      Program crash
      PID:2932
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 560
      4⤵
      Program crash
      PID:3372
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 572
      4⤵
      Program crash
      PID:4840
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 560
      4⤵
      Program crash
      PID:5052
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 204
      4⤵
      Program crash
      PID:388
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 596
      4⤵
      Program crash
      PID:544
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 560
      4⤵
      Program crash
      PID:4120
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 208
      4⤵
      Program crash
      PID:1688
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 212
      4⤵
      Program crash
      PID:2516
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 564
      4⤵
      Program crash
      PID:872
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 568
      4⤵
      Program crash
      PID:4044
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 568
      4⤵
      Program crash
      PID:664
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 560
      4⤵
      Program crash
      PID:4572
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 200
      4⤵
      Program crash
      PID:2064
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 208
      4⤵
      Program crash
      PID:228
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 568
      4⤵
      Program crash
      PID:2932
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 208
      4⤵
      Program crash
      PID:1700
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 572
      4⤵
      Program crash
      PID:3004
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 560
      4⤵
      Program crash
      PID:936
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 560
      4⤵
      Program crash
      PID:4752
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 560
      4⤵
      Program crash
      PID:4172
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 572
      4⤵
      Program crash
      PID:1832
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 560
      4⤵
      Program crash
      PID:4964
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 560
      4⤵
      Program crash
      PID:3600
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 576
      4⤵
      Program crash
      PID:2948
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 192
      4⤵
      Program crash
      PID:1272
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 560
      4⤵
      Program crash
      PID:2168
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 560
      4⤵
      Program crash
      PID:1656
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 560
      4⤵
      Program crash
      PID:676
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 212
      4⤵
      Program crash
      PID:2012
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 560
      4⤵
      Program crash
      PID:620
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 576
      4⤵
      Program crash
      PID:2208
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 568
      4⤵
      Program crash
      PID:3840
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 560
      4⤵
      Program crash
      PID:3424
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 568
      4⤵
      Program crash
      PID:1080
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 560
      4⤵
      Program crash
      PID:1364
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 564
      4⤵
      Program crash
      PID:4200
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 560
      4⤵
      Program crash
      PID:4816
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 200
      4⤵
      PID:368
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 196
      4⤵
      PID:2588
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 228
      4⤵
      PID:2168
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 560
      4⤵
      PID:2060
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 572
      4⤵
      PID:632
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 228
      4⤵
      PID:4212
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 192
      4⤵
      PID:2820
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 560
      4⤵
      PID:4740
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 204
      4⤵
      PID:1292
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 576
      4⤵
      PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2164 -ip 2164
1⤵
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1476 -ip 1476
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4020 -ip 4020
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1572 -ip 1572
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2304 -ip 2304
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1404 -ip 1404
1⤵
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4320 -ip 4320
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5020 -ip 5020
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3208 -ip 3208
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2416 -ip 2416
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3660 -ip 3660
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3684 -ip 3684
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3808 -ip 3808
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 964 -ip 964
1⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4920 -ip 4920
1⤵
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2720 -ip 2720
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4112 -ip 4112
1⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3140 -ip 3140
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5088 -ip 5088
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2156 -ip 2156
1⤵
PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3700 -ip 3700
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2944 -ip 2944
1⤵
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1820 -ip 1820
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4008 -ip 4008
1⤵
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 552 -ip 552
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1440 -ip 1440
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4228 -ip 4228
1⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2524 -ip 2524
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5044 -ip 5044
1⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1208 -ip 1208
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3872 -ip 3872
1⤵
PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3220 -ip 3220
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4252 -ip 4252
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5068 -ip 5068
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2044 -ip 2044
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1052 -ip 1052
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2352 -ip 2352
1⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3904 -ip 3904
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1812 -ip 1812
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3712 -ip 3712
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4844 -ip 4844
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4684 -ip 4684
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4368 -ip 4368
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2508 -ip 2508
1⤵
PID:608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3212 -ip 3212
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4568 -ip 4568
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4656 -ip 4656
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4912 -ip 4912
1⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4012 -ip 4012
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1688 -ip 1688
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4248 -ip 4248
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4104 -ip 4104
1⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2288 -ip 2288
1⤵
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4492 -ip 4492
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 560 -ip 560
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4572 -ip 4572
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4052 -ip 4052
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 960 -ip 960
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 532 -ip 532
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4408 -ip 4408
1⤵
PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4584 -ip 4584
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3508 -ip 3508
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 3080 -ip 3080
1⤵
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3760 -ip 3760
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4344 -ip 4344
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 828 -ip 828
1⤵
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 432 -ip 432
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3828 -ip 3828
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1660 -ip 1660
1⤵
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2284 -ip 2284
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 1360 -ip 1360
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 1304 -ip 1304
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 608 -ip 608
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 936 -ip 936
1⤵
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
4a230b52b63e10e7d0a0f53085bcd8b8

SHA1
b9afa9637b7eb32872dba7ee0df07d448139f1c0

SHA256
44b39530f0fc1b7497ad05732867413f0b047af4551e3bc401bdbe85fc5e4b25

SHA512
b5dccda7daf8e2079a7bcb4f6de4396ad1388fb887637d38bf6c00d3e1a76d2182d9218b682988a771468df2c3166c0e881551b3946e9644735fd7298a72bf8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lymnaeidae

Filesize
84KB

MD5
e9d80ff6fcd8ceeb2f0c63b6d84354fd

SHA1
9e697f748635834b3b88f33fbb77323261b325b0

SHA256
91f5f7478ffcd500ad50e86ada1faffc60979b449af4d56b3bf1f71bb7da0a3d

SHA512
aba78fb40aae7238b20ba9fbe9d975481da595896a651962c41b89f6bea323a7040afaf35a33f0608a4f2d0aaf899537a5e1cc37887afc6ece0e468f9916b343

Download Submit
C:\Users\Admin\AppData\Local\Temp\ophiolatrous

Filesize
483KB

MD5
89669f54c2cf58a12e6eb05f0b0c8b45

SHA1
9dd08035fb240b2d8c284c31786f20c04e4d871a

SHA256
7367a34c0b9d0c68678b8bd5bd02a54c94d7a60000aabc0525079b641c0f5e03

SHA512
000188de8af2c2886ab5085890835e29cf0e65f6c9fc01a52f47a709650d8c9f411bb8931e545c27edc132ee14fa685ec063d5681bffd9ece56a52473e9f2686

Download Submit
C:\Users\Admin\AppData\Local\directory\RegAsymX.exe

Filesize
1.4MB

MD5
c7fc0cee8ca35d709ed276e9f88ddbed

SHA1
ceea9d76bf0429872f4d7420addd0abdb5e8f4dc

SHA256
560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e

SHA512
a1b93c9cb87993f77f2decf0e4ee33277567651d7fb664b579f3e293f97c6b198ce701c02cffd9d295b3e40f62cd6500f55bc252212c5ec81ac9e257831273da

Download Submit
memory/552-105-0x0000000000470000-0x00000000005D2000-memory.dmp

Filesize
1.4MB

Download
memory/552-104-0x0000000000470000-0x00000000005D2000-memory.dmp

Filesize
1.4MB

Download
memory/964-77-0x00000000012E0000-0x0000000001442000-memory.dmp

Filesize
1.4MB

Download
memory/964-78-0x00000000012E0000-0x0000000001442000-memory.dmp

Filesize
1.4MB

Download
memory/1404-57-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/1404-56-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/1476-46-0x00000000012B0000-0x0000000001412000-memory.dmp

Filesize
1.4MB

Download
memory/1476-43-0x00000000012B0000-0x0000000001412000-memory.dmp

Filesize
1.4MB

Download
memory/1476-44-0x00000000012B0000-0x0000000001412000-memory.dmp

Filesize
1.4MB

Download
memory/1476-45-0x00000000012B0000-0x0000000001412000-memory.dmp

Filesize
1.4MB

Download
memory/1572-50-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/1572-51-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/1820-100-0x0000000000CC0000-0x0000000000E22000-memory.dmp

Filesize
1.4MB

Download
memory/1820-99-0x0000000000CC0000-0x0000000000E22000-memory.dmp

Filesize
1.4MB

Download
memory/2156-92-0x0000000000A00000-0x0000000000B62000-memory.dmp

Filesize
1.4MB

Download
memory/2164-42-0x0000000001010000-0x0000000001172000-memory.dmp

Filesize
1.4MB

Download
memory/2164-39-0x0000000001010000-0x0000000001172000-memory.dmp

Filesize
1.4MB

Download
memory/2164-41-0x0000000001010000-0x0000000001172000-memory.dmp

Filesize
1.4MB

Download
memory/2164-40-0x0000000001010000-0x0000000001172000-memory.dmp

Filesize
1.4MB

Download
memory/2304-52-0x0000000000890000-0x00000000009F2000-memory.dmp

Filesize
1.4MB

Download
memory/2304-53-0x0000000000890000-0x00000000009F2000-memory.dmp

Filesize
1.4MB

Download
memory/2416-66-0x0000000001270000-0x00000000013D2000-memory.dmp

Filesize
1.4MB

Download
memory/2416-65-0x0000000001270000-0x00000000013D2000-memory.dmp

Filesize
1.4MB

Download
memory/2472-11-0x0000000004300000-0x0000000004304000-memory.dmp

Filesize
16KB

Download
memory/2720-82-0x0000000000A20000-0x0000000000B82000-memory.dmp

Filesize
1.4MB

Download
memory/2720-83-0x0000000000A20000-0x0000000000B82000-memory.dmp

Filesize
1.4MB

Download
memory/2892-97-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2892-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2892-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2892-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2892-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2892-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2892-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2892-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2892-98-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2892-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2944-96-0x0000000000C30000-0x0000000000D92000-memory.dmp

Filesize
1.4MB

Download
memory/3140-87-0x0000000000C00000-0x0000000000D62000-memory.dmp

Filesize
1.4MB

Download
memory/3140-86-0x0000000000C00000-0x0000000000D62000-memory.dmp

Filesize
1.4MB

Download
memory/3208-63-0x0000000000610000-0x0000000000772000-memory.dmp

Filesize
1.4MB

Download
memory/3208-64-0x0000000000610000-0x0000000000772000-memory.dmp

Filesize
1.4MB

Download
memory/3660-69-0x0000000000640000-0x00000000007A2000-memory.dmp

Filesize
1.4MB

Download
memory/3660-68-0x0000000000640000-0x00000000007A2000-memory.dmp

Filesize
1.4MB

Download
memory/3684-73-0x00000000006D0000-0x0000000000832000-memory.dmp

Filesize
1.4MB

Download
memory/3684-72-0x00000000006D0000-0x0000000000832000-memory.dmp

Filesize
1.4MB

Download
memory/3700-94-0x00000000004B0000-0x0000000000612000-memory.dmp

Filesize
1.4MB

Download
memory/3808-75-0x0000000000A00000-0x0000000000B62000-memory.dmp

Filesize
1.4MB

Download
memory/3808-74-0x0000000000A00000-0x0000000000B62000-memory.dmp

Filesize
1.4MB

Download
memory/4008-102-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/4008-103-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/4020-47-0x0000000000C30000-0x0000000000D92000-memory.dmp

Filesize
1.4MB

Download
memory/4020-48-0x0000000000C30000-0x0000000000D92000-memory.dmp

Filesize
1.4MB

Download
memory/4112-85-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/4320-58-0x0000000000E00000-0x0000000000F62000-memory.dmp

Filesize
1.4MB

Download
memory/4320-59-0x0000000000E00000-0x0000000000F62000-memory.dmp

Filesize
1.4MB

Download
memory/4920-80-0x0000000000E70000-0x0000000000FD2000-memory.dmp

Filesize
1.4MB

Download
memory/4920-79-0x0000000000E70000-0x0000000000FD2000-memory.dmp

Filesize
1.4MB

Download
memory/5020-61-0x00000000012D0000-0x0000000001432000-memory.dmp

Filesize
1.4MB

Download
memory/5020-60-0x00000000012D0000-0x0000000001432000-memory.dmp

Filesize
1.4MB

Download
memory/5088-90-0x00000000010A0000-0x0000000001202000-memory.dmp

Filesize
1.4MB

Download
memory/5088-89-0x00000000010A0000-0x0000000001202000-memory.dmp

Filesize
1.4MB

Download