remcos | 560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
Size

1.4MB
MD5

c7fc0cee8ca35d709ed276e9f88ddbed
SHA1

ceea9d76bf0429872f4d7420addd0abdb5e8f4dc
SHA256

560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e
SHA512

a1b93c9cb87993f77f2decf0e4ee33277567651d7fb664b579f3e293f97c6b198ce701c02cffd9d295b3e40f62cd6500f55bc252212c5ec81ac9e257831273da
SSDEEP

24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8aIHo9Hi9Yc1St1R1M9p09oMMhDIGL0:2TvC/MTQYxsWR7aIHEC+coJ1OpwoMMhv

Score

10^/10

remcos main discovery rat

Malware Config

Extracted

Family

remcos

Botnet

Main

84.38.132.103:7001

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FR1M2R
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs	RegAsymX.exe

Executes dropped EXE 1 IoCs

pid	Process
808	RegAsymX.exe

AutoIT Executable 48 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00060000000226c6-14.dat	autoit_exe
behavioral2/memory/4516-39-0x0000000000C00000-0x0000000000D62000-memory.dmp	autoit_exe
behavioral2/memory/4516-41-0x0000000000C00000-0x0000000000D62000-memory.dmp	autoit_exe
behavioral2/memory/4516-42-0x0000000000C00000-0x0000000000D62000-memory.dmp	autoit_exe
behavioral2/memory/4516-40-0x0000000000C00000-0x0000000000D62000-memory.dmp	autoit_exe
behavioral2/memory/4428-43-0x0000000000E00000-0x0000000000F62000-memory.dmp	autoit_exe
behavioral2/memory/4428-44-0x0000000000E00000-0x0000000000F62000-memory.dmp	autoit_exe
behavioral2/memory/4428-45-0x0000000000E00000-0x0000000000F62000-memory.dmp	autoit_exe
behavioral2/memory/4428-46-0x0000000000E00000-0x0000000000F62000-memory.dmp	autoit_exe
behavioral2/memory/4708-47-0x0000000000800000-0x0000000000962000-memory.dmp	autoit_exe
behavioral2/memory/4708-48-0x0000000000800000-0x0000000000962000-memory.dmp	autoit_exe
behavioral2/memory/4304-50-0x00000000008D0000-0x0000000000A32000-memory.dmp	autoit_exe
behavioral2/memory/4304-51-0x00000000008D0000-0x0000000000A32000-memory.dmp	autoit_exe
behavioral2/memory/2672-53-0x0000000000800000-0x0000000000962000-memory.dmp	autoit_exe
behavioral2/memory/764-56-0x0000000000AB0000-0x0000000000C12000-memory.dmp	autoit_exe
behavioral2/memory/764-57-0x0000000000AB0000-0x0000000000C12000-memory.dmp	autoit_exe
behavioral2/memory/692-58-0x0000000001020000-0x0000000001182000-memory.dmp	autoit_exe
behavioral2/memory/692-59-0x0000000001020000-0x0000000001182000-memory.dmp	autoit_exe
behavioral2/memory/2884-60-0x00000000006D0000-0x0000000000832000-memory.dmp	autoit_exe
behavioral2/memory/2884-61-0x00000000006D0000-0x0000000000832000-memory.dmp	autoit_exe
behavioral2/memory/3936-63-0x0000000000160000-0x00000000002C2000-memory.dmp	autoit_exe
behavioral2/memory/3936-64-0x0000000000160000-0x00000000002C2000-memory.dmp	autoit_exe
behavioral2/memory/4228-65-0x0000000000810000-0x0000000000972000-memory.dmp	autoit_exe
behavioral2/memory/4228-66-0x0000000000810000-0x0000000000972000-memory.dmp	autoit_exe
behavioral2/memory/4444-68-0x0000000001060000-0x00000000011C2000-memory.dmp	autoit_exe
behavioral2/memory/4444-69-0x0000000001060000-0x00000000011C2000-memory.dmp	autoit_exe
behavioral2/memory/2868-72-0x0000000000C40000-0x0000000000DA2000-memory.dmp	autoit_exe
behavioral2/memory/2868-73-0x0000000000C40000-0x0000000000DA2000-memory.dmp	autoit_exe
behavioral2/memory/3204-74-0x0000000000A30000-0x0000000000B92000-memory.dmp	autoit_exe
behavioral2/memory/3204-75-0x0000000000A30000-0x0000000000B92000-memory.dmp	autoit_exe
behavioral2/memory/4232-78-0x0000000000800000-0x0000000000962000-memory.dmp	autoit_exe
behavioral2/memory/3440-79-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/3440-80-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/4492-82-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe
behavioral2/memory/4492-83-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe
behavioral2/memory/1900-85-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe
behavioral2/memory/4824-87-0x0000000000800000-0x0000000000962000-memory.dmp	autoit_exe
behavioral2/memory/4448-89-0x0000000001280000-0x00000000013E2000-memory.dmp	autoit_exe
behavioral2/memory/4448-90-0x0000000001280000-0x00000000013E2000-memory.dmp	autoit_exe
behavioral2/memory/2284-92-0x0000000000C00000-0x0000000000D62000-memory.dmp	autoit_exe
behavioral2/memory/3548-95-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe
behavioral2/memory/3400-96-0x0000000000A00000-0x0000000000B62000-memory.dmp	autoit_exe
behavioral2/memory/3400-97-0x0000000000A00000-0x0000000000B62000-memory.dmp	autoit_exe
behavioral2/memory/4328-101-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe
behavioral2/memory/5028-103-0x0000000000ED0000-0x0000000001032000-memory.dmp	autoit_exe
behavioral2/memory/5028-104-0x0000000000ED0000-0x0000000001032000-memory.dmp	autoit_exe
behavioral2/memory/3224-105-0x0000000001030000-0x0000000001192000-memory.dmp	autoit_exe
behavioral2/memory/3224-106-0x0000000001030000-0x0000000001192000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 808 set thread context of 4516	808	RegAsymX.exe	95
PID 808 set thread context of 4428	808	RegAsymX.exe	103
PID 808 set thread context of 4708	808	RegAsymX.exe	107
PID 808 set thread context of 4304	808	RegAsymX.exe	111
PID 808 set thread context of 2672	808	RegAsymX.exe	116
PID 808 set thread context of 764	808	RegAsymX.exe	119
PID 808 set thread context of 692	808	RegAsymX.exe	122
PID 808 set thread context of 2884	808	RegAsymX.exe	125
PID 808 set thread context of 3936	808	RegAsymX.exe	128
PID 808 set thread context of 4228	808	RegAsymX.exe	131
PID 808 set thread context of 4444	808	RegAsymX.exe	134
PID 808 set thread context of 2868	808	RegAsymX.exe	137
PID 808 set thread context of 3204	808	RegAsymX.exe	140
PID 808 set thread context of 4232	808	RegAsymX.exe	143
PID 808 set thread context of 3440	808	RegAsymX.exe	147
PID 808 set thread context of 4492	808	RegAsymX.exe	150
PID 808 set thread context of 1900	808	RegAsymX.exe	154
PID 808 set thread context of 4824	808	RegAsymX.exe	157
PID 808 set thread context of 4448	808	RegAsymX.exe	160
PID 808 set thread context of 2284	808	RegAsymX.exe	163
PID 808 set thread context of 3548	808	RegAsymX.exe	166
PID 808 set thread context of 3400	808	RegAsymX.exe	169
PID 808 set thread context of 4328	808	RegAsymX.exe	172
PID 808 set thread context of 5028	808	RegAsymX.exe	175
PID 808 set thread context of 3224	808	RegAsymX.exe	178
PID 808 set thread context of 1300	808	RegAsymX.exe	181
PID 808 set thread context of 2500	808	RegAsymX.exe	184
PID 808 set thread context of 1968	808	RegAsymX.exe	187
PID 808 set thread context of 4704	808	RegAsymX.exe	190
PID 808 set thread context of 4856	808	RegAsymX.exe	193
PID 808 set thread context of 2968	808	RegAsymX.exe	196
PID 808 set thread context of 752	808	RegAsymX.exe	199
PID 808 set thread context of 2636	808	RegAsymX.exe	202
PID 808 set thread context of 416	808	RegAsymX.exe	205
PID 808 set thread context of 4696	808	RegAsymX.exe	208
PID 808 set thread context of 4904	808	RegAsymX.exe	211
PID 808 set thread context of 1896	808	RegAsymX.exe	214
PID 808 set thread context of 3600	808	RegAsymX.exe	217
PID 808 set thread context of 2132	808	RegAsymX.exe	220
PID 808 set thread context of 2400	808	RegAsymX.exe	223
PID 808 set thread context of 4316	808	RegAsymX.exe	226
PID 808 set thread context of 244	808	RegAsymX.exe	229
PID 808 set thread context of 4056	808	RegAsymX.exe	232
PID 808 set thread context of 3812	808	RegAsymX.exe	235
PID 808 set thread context of 2688	808	RegAsymX.exe	238
PID 808 set thread context of 1444	808	RegAsymX.exe	241
PID 808 set thread context of 3968	808	RegAsymX.exe	244
PID 808 set thread context of 4820	808	RegAsymX.exe	247
PID 808 set thread context of 1540	808	RegAsymX.exe	250
PID 808 set thread context of 4564	808	RegAsymX.exe	253
PID 808 set thread context of 2180	808	RegAsymX.exe	256
PID 808 set thread context of 3492	808	RegAsymX.exe	259
PID 808 set thread context of 536	808	RegAsymX.exe	262
PID 808 set thread context of 1572	808	RegAsymX.exe	265
PID 808 set thread context of 3656	808	RegAsymX.exe	268
PID 808 set thread context of 2232	808	RegAsymX.exe	271
PID 808 set thread context of 1984	808	RegAsymX.exe	274
PID 808 set thread context of 1732	808	RegAsymX.exe	277
PID 808 set thread context of 2864	808	RegAsymX.exe	280
PID 808 set thread context of 3868	808	RegAsymX.exe	283
PID 808 set thread context of 2032	808	RegAsymX.exe	286
PID 808 set thread context of 3892	808	RegAsymX.exe	289
PID 808 set thread context of 4508	808	RegAsymX.exe	292
PID 808 set thread context of 2064	808	RegAsymX.exe	295

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2884	4516	WerFault.exe	95
2180	4428	WerFault.exe	103
4180	4708	WerFault.exe	107
1800	4304	WerFault.exe	111
3540	2672	WerFault.exe	116
1968	764	WerFault.exe	119
420	692	WerFault.exe	122
2032	2884	WerFault.exe	125
1880	3936	WerFault.exe	128
1740	4228	WerFault.exe	131
4460	4444	WerFault.exe	134
4448	2868	WerFault.exe	137
1624	3204	WerFault.exe	140
4548	4232	WerFault.exe	143
244	3440	WerFault.exe	147
1880	4492	WerFault.exe	150
3528	1900	WerFault.exe	154
4912	4824	WerFault.exe	157
1296	4448	WerFault.exe	160
852	2284	WerFault.exe	163
2988	3548	WerFault.exe	166
3372	3400	WerFault.exe	169
2636	4328	WerFault.exe	172
416	5028	WerFault.exe	175
4556	3224	WerFault.exe	178
3036	1300	WerFault.exe	181
3532	2500	WerFault.exe	184
5088	1968	WerFault.exe	187
228	4704	WerFault.exe	190
5000	4856	WerFault.exe	193
1160	2968	WerFault.exe	196
2128	752	WerFault.exe	199
4124	2636	WerFault.exe	202
1800	416	WerFault.exe	205
4912	4696	WerFault.exe	208
4968	4904	WerFault.exe	211
2912	1896	WerFault.exe	214
892	3600	WerFault.exe	217
3220	2132	WerFault.exe	220
2644	2400	WerFault.exe	223
1600	4316	WerFault.exe	226
1812	244	WerFault.exe	229
4652	4056	WerFault.exe	232
3540	3812	WerFault.exe	235
208	2688	WerFault.exe	238
3412	1444	WerFault.exe	241
2776	3968	WerFault.exe	244
2592	4820	WerFault.exe	247
4852	1540	WerFault.exe	250
1812	4564	WerFault.exe	253
4656	2180	WerFault.exe	256
4352	3492	WerFault.exe	259
3644	536	WerFault.exe	262
4372	1572	WerFault.exe	265
4292	3656	WerFault.exe	268
3608	2232	WerFault.exe	271
2508	1984	WerFault.exe	274
1744	1732	WerFault.exe	277
1600	2864	WerFault.exe	280
1908	3868	WerFault.exe	283
1396	2032	WerFault.exe	286
2780	3892	WerFault.exe	289
1008	4508	WerFault.exe	292
2288	2064	WerFault.exe	295

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe
808	RegAsymX.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1868	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
1868	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
808	RegAsymX.exe
808	RegAsymX.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1868	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
1868	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
808	RegAsymX.exe
808	RegAsymX.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 808	1868	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	93
PID 1868 wrote to memory of 808	1868	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	93
PID 1868 wrote to memory of 808	1868	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	93
PID 808 wrote to memory of 4516	808	RegAsymX.exe	95
PID 808 wrote to memory of 4516	808	RegAsymX.exe	95
PID 808 wrote to memory of 4516	808	RegAsymX.exe	95
PID 808 wrote to memory of 4516	808	RegAsymX.exe	95
PID 808 wrote to memory of 4428	808	RegAsymX.exe	103
PID 808 wrote to memory of 4428	808	RegAsymX.exe	103
PID 808 wrote to memory of 4428	808	RegAsymX.exe	103
PID 808 wrote to memory of 4428	808	RegAsymX.exe	103
PID 808 wrote to memory of 4708	808	RegAsymX.exe	107
PID 808 wrote to memory of 4708	808	RegAsymX.exe	107
PID 808 wrote to memory of 4708	808	RegAsymX.exe	107
PID 808 wrote to memory of 4708	808	RegAsymX.exe	107
PID 808 wrote to memory of 4304	808	RegAsymX.exe	111
PID 808 wrote to memory of 4304	808	RegAsymX.exe	111
PID 808 wrote to memory of 4304	808	RegAsymX.exe	111
PID 808 wrote to memory of 4304	808	RegAsymX.exe	111
PID 808 wrote to memory of 2672	808	RegAsymX.exe	116
PID 808 wrote to memory of 2672	808	RegAsymX.exe	116
PID 808 wrote to memory of 2672	808	RegAsymX.exe	116
PID 808 wrote to memory of 2672	808	RegAsymX.exe	116
PID 808 wrote to memory of 764	808	RegAsymX.exe	119
PID 808 wrote to memory of 764	808	RegAsymX.exe	119
PID 808 wrote to memory of 764	808	RegAsymX.exe	119
PID 808 wrote to memory of 764	808	RegAsymX.exe	119
PID 808 wrote to memory of 692	808	RegAsymX.exe	122
PID 808 wrote to memory of 692	808	RegAsymX.exe	122
PID 808 wrote to memory of 692	808	RegAsymX.exe	122
PID 808 wrote to memory of 692	808	RegAsymX.exe	122
PID 808 wrote to memory of 2884	808	RegAsymX.exe	125
PID 808 wrote to memory of 2884	808	RegAsymX.exe	125
PID 808 wrote to memory of 2884	808	RegAsymX.exe	125
PID 808 wrote to memory of 2884	808	RegAsymX.exe	125
PID 808 wrote to memory of 3936	808	RegAsymX.exe	128
PID 808 wrote to memory of 3936	808	RegAsymX.exe	128
PID 808 wrote to memory of 3936	808	RegAsymX.exe	128
PID 808 wrote to memory of 3936	808	RegAsymX.exe	128
PID 808 wrote to memory of 4228	808	RegAsymX.exe	131
PID 808 wrote to memory of 4228	808	RegAsymX.exe	131
PID 808 wrote to memory of 4228	808	RegAsymX.exe	131
PID 808 wrote to memory of 4228	808	RegAsymX.exe	131
PID 808 wrote to memory of 4444	808	RegAsymX.exe	134
PID 808 wrote to memory of 4444	808	RegAsymX.exe	134
PID 808 wrote to memory of 4444	808	RegAsymX.exe	134
PID 808 wrote to memory of 4444	808	RegAsymX.exe	134
PID 808 wrote to memory of 2868	808	RegAsymX.exe	137
PID 808 wrote to memory of 2868	808	RegAsymX.exe	137
PID 808 wrote to memory of 2868	808	RegAsymX.exe	137
PID 808 wrote to memory of 2868	808	RegAsymX.exe	137
PID 808 wrote to memory of 3204	808	RegAsymX.exe	140
PID 808 wrote to memory of 3204	808	RegAsymX.exe	140
PID 808 wrote to memory of 3204	808	RegAsymX.exe	140
PID 808 wrote to memory of 3204	808	RegAsymX.exe	140
PID 808 wrote to memory of 4232	808	RegAsymX.exe	143
PID 808 wrote to memory of 4232	808	RegAsymX.exe	143
PID 808 wrote to memory of 4232	808	RegAsymX.exe	143
PID 808 wrote to memory of 4232	808	RegAsymX.exe	143
PID 808 wrote to memory of 3440	808	RegAsymX.exe	147
PID 808 wrote to memory of 3440	808	RegAsymX.exe	147
PID 808 wrote to memory of 3440	808	RegAsymX.exe	147
PID 808 wrote to memory of 3440	808	RegAsymX.exe	147
PID 808 wrote to memory of 4492	808	RegAsymX.exe	150

C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
"C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
  "C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 560
      4⤵
      Program crash
      PID:2884
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 560
      4⤵
      Program crash
      PID:2180
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 564
      4⤵
      Program crash
      PID:4180
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 196
      4⤵
      Program crash
      PID:1800
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 560
      4⤵
      Program crash
      PID:3540
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 560
      4⤵
      Program crash
      PID:1968
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 212
      4⤵
      Program crash
      PID:420
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2884
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 212
      4⤵
      Program crash
      PID:2032
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 560
      4⤵
      Program crash
      PID:1880
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 560
      4⤵
      Program crash
      PID:1740
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 560
      4⤵
      Program crash
      PID:4460
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 560
      4⤵
      Program crash
      PID:4448
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 560
      4⤵
      Program crash
      PID:1624
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 560
      4⤵
      Program crash
      PID:4548
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 560
      4⤵
      Program crash
      PID:244
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 560
      4⤵
      Program crash
      PID:1880
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 564
      4⤵
      Program crash
      PID:3528
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 584
      4⤵
      Program crash
      PID:4912
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 560
      4⤵
      Program crash
      PID:1296
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 216
      4⤵
      Program crash
      PID:852
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 560
      4⤵
      Program crash
      PID:2988
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 560
      4⤵
      Program crash
      PID:3372
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 560
      4⤵
      Program crash
      PID:2636
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 560
      4⤵
      Program crash
      PID:416
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 560
      4⤵
      Program crash
      PID:4556
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 224
      4⤵
      Program crash
      PID:3036
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 560
      4⤵
      Program crash
      PID:3532
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 560
      4⤵
      Program crash
      PID:5088
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 560
      4⤵
      Program crash
      PID:228
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 560
      4⤵
      Program crash
      PID:5000
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 576
      4⤵
      Program crash
      PID:1160
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 560
      4⤵
      Program crash
      PID:2128
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 192
      4⤵
      Program crash
      PID:4124
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 560
      4⤵
      Program crash
      PID:1800
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 560
      4⤵
      Program crash
      PID:4912
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 560
      4⤵
      Program crash
      PID:4968
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 560
      4⤵
      Program crash
      PID:2912
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 560
      4⤵
      Program crash
      PID:892
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 192
      4⤵
      Program crash
      PID:3220
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 560
      4⤵
      Program crash
      PID:2644
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 560
      4⤵
      Program crash
      PID:1600
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 560
      4⤵
      Program crash
      PID:1812
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 560
      4⤵
      Program crash
      PID:4652
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 200
      4⤵
      Program crash
      PID:3540
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 560
      4⤵
      Program crash
      PID:208
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 560
      4⤵
      Program crash
      PID:3412
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 560
      4⤵
      Program crash
      PID:2776
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 560
      4⤵
      Program crash
      PID:2592
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 560
      4⤵
      Program crash
      PID:4852
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 200
      4⤵
      Program crash
      PID:1812
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 560
      4⤵
      Program crash
      PID:4656
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 212
      4⤵
      Program crash
      PID:4352
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 200
      4⤵
      Program crash
      PID:3644
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 192
      4⤵
      Program crash
      PID:4372
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 572
      4⤵
      Program crash
      PID:4292
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 204
      4⤵
      Program crash
      PID:3608
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 196
      4⤵
      Program crash
      PID:2508
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 196
      4⤵
      Program crash
      PID:1744
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 200
      4⤵
      Program crash
      PID:1600
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 204
      4⤵
      Program crash
      PID:1908
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 560
      4⤵
      Program crash
      PID:1396
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 560
      4⤵
      Program crash
      PID:2780
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 204
      4⤵
      Program crash
      PID:1008
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 572
      4⤵
      Program crash
      PID:2288
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 560
      4⤵
      PID:1588
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 560
      4⤵
      PID:4440
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 564
      4⤵
      PID:3836
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 560
      4⤵
      PID:4996
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 192
      4⤵
      PID:2716
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 200
      4⤵
      PID:676
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 564
      4⤵
      PID:4672
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 228
      4⤵
      PID:3644
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 560
      4⤵
      PID:5084
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 576
      4⤵
      PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4516 -ip 4516
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4428 -ip 4428
1⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
1⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4708 -ip 4708
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4304 -ip 4304
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2672 -ip 2672
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 764 -ip 764
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 692 -ip 692
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2884 -ip 2884
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3936 -ip 3936
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4228 -ip 4228
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4444 -ip 4444
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2868 -ip 2868
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3204 -ip 3204
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4232 -ip 4232
1⤵
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3440 -ip 3440
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4492 -ip 4492
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1900 -ip 1900
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4824 -ip 4824
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4448 -ip 4448
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2284 -ip 2284
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3548 -ip 3548
1⤵
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3400 -ip 3400
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4328 -ip 4328
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5028 -ip 5028
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3224 -ip 3224
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1300 -ip 1300
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2500 -ip 2500
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1968 -ip 1968
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4704 -ip 4704
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4856 -ip 4856
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2968 -ip 2968
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 752 -ip 752
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2636 -ip 2636
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 416 -ip 416
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4696 -ip 4696
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4904 -ip 4904
1⤵
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1896 -ip 1896
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3600 -ip 3600
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2132 -ip 2132
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2400 -ip 2400
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4316 -ip 4316
1⤵
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 244 -ip 244
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4056 -ip 4056
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3812 -ip 3812
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2688 -ip 2688
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1444 -ip 1444
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3968 -ip 3968
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4820 -ip 4820
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1540 -ip 1540
1⤵
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4564 -ip 4564
1⤵
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2180 -ip 2180
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3492 -ip 3492
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 536 -ip 536
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1572 -ip 1572
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3656 -ip 3656
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2232 -ip 2232
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1984 -ip 1984
1⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1732 -ip 1732
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2864 -ip 2864
1⤵
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3868 -ip 3868
1⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2032 -ip 2032
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3892 -ip 3892
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4508 -ip 4508
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2064 -ip 2064
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 788 -ip 788
1⤵
PID:472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3352 -ip 3352
1⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3220 -ip 3220
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3380 -ip 3380
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1600 -ip 1600
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5036 -ip 5036
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2872 -ip 2872
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3528 -ip 3528
1⤵
PID:520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2152 -ip 2152
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4920 -ip 4920
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
915d9292d3617520271504becb5650dc

SHA1
5473b0b482ed16ac7ad4adc347b0f94eae550bef

SHA256
63dfea6b6930059da5e0099e81e9d823b4647796a2214bc99b8cde62878645d6

SHA512
ef2e8b213d6f418171579b32959d4195f3ccd43c7b9df7d002956d2056aa29cd4fae55215d24c28a84cd668ec2c60defdc1e22fca34272f41701dcd9e21de28c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lymnaeidae

Filesize
84KB

MD5
e9d80ff6fcd8ceeb2f0c63b6d84354fd

SHA1
9e697f748635834b3b88f33fbb77323261b325b0

SHA256
91f5f7478ffcd500ad50e86ada1faffc60979b449af4d56b3bf1f71bb7da0a3d

SHA512
aba78fb40aae7238b20ba9fbe9d975481da595896a651962c41b89f6bea323a7040afaf35a33f0608a4f2d0aaf899537a5e1cc37887afc6ece0e468f9916b343

Download Submit
C:\Users\Admin\AppData\Local\Temp\ophiolatrous

Filesize
483KB

MD5
89669f54c2cf58a12e6eb05f0b0c8b45

SHA1
9dd08035fb240b2d8c284c31786f20c04e4d871a

SHA256
7367a34c0b9d0c68678b8bd5bd02a54c94d7a60000aabc0525079b641c0f5e03

SHA512
000188de8af2c2886ab5085890835e29cf0e65f6c9fc01a52f47a709650d8c9f411bb8931e545c27edc132ee14fa685ec063d5681bffd9ece56a52473e9f2686

Download Submit
C:\Users\Admin\AppData\Local\directory\RegAsymX.exe

Filesize
1.4MB

MD5
c7fc0cee8ca35d709ed276e9f88ddbed

SHA1
ceea9d76bf0429872f4d7420addd0abdb5e8f4dc

SHA256
560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e

SHA512
a1b93c9cb87993f77f2decf0e4ee33277567651d7fb664b579f3e293f97c6b198ce701c02cffd9d295b3e40f62cd6500f55bc252212c5ec81ac9e257831273da

Download Submit
memory/692-59-0x0000000001020000-0x0000000001182000-memory.dmp

Filesize
1.4MB

Download
memory/692-58-0x0000000001020000-0x0000000001182000-memory.dmp

Filesize
1.4MB

Download
memory/764-57-0x0000000000AB0000-0x0000000000C12000-memory.dmp

Filesize
1.4MB

Download
memory/764-56-0x0000000000AB0000-0x0000000000C12000-memory.dmp

Filesize
1.4MB

Download
memory/808-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-98-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/808-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1868-11-0x00000000009E0000-0x00000000009E4000-memory.dmp

Filesize
16KB

Download
memory/1900-85-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/2284-92-0x0000000000C00000-0x0000000000D62000-memory.dmp

Filesize
1.4MB

Download
memory/2672-53-0x0000000000800000-0x0000000000962000-memory.dmp

Filesize
1.4MB

Download
memory/2868-73-0x0000000000C40000-0x0000000000DA2000-memory.dmp

Filesize
1.4MB

Download
memory/2868-72-0x0000000000C40000-0x0000000000DA2000-memory.dmp

Filesize
1.4MB

Download
memory/2884-61-0x00000000006D0000-0x0000000000832000-memory.dmp

Filesize
1.4MB

Download
memory/2884-60-0x00000000006D0000-0x0000000000832000-memory.dmp

Filesize
1.4MB

Download
memory/3204-75-0x0000000000A30000-0x0000000000B92000-memory.dmp

Filesize
1.4MB

Download
memory/3204-74-0x0000000000A30000-0x0000000000B92000-memory.dmp

Filesize
1.4MB

Download
memory/3224-106-0x0000000001030000-0x0000000001192000-memory.dmp

Filesize
1.4MB

Download
memory/3224-105-0x0000000001030000-0x0000000001192000-memory.dmp

Filesize
1.4MB

Download
memory/3400-96-0x0000000000A00000-0x0000000000B62000-memory.dmp

Filesize
1.4MB

Download
memory/3400-97-0x0000000000A00000-0x0000000000B62000-memory.dmp

Filesize
1.4MB

Download
memory/3440-79-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/3440-80-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/3548-95-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/3936-64-0x0000000000160000-0x00000000002C2000-memory.dmp

Filesize
1.4MB

Download
memory/3936-63-0x0000000000160000-0x00000000002C2000-memory.dmp

Filesize
1.4MB

Download
memory/4228-66-0x0000000000810000-0x0000000000972000-memory.dmp

Filesize
1.4MB

Download
memory/4228-65-0x0000000000810000-0x0000000000972000-memory.dmp

Filesize
1.4MB

Download
memory/4232-78-0x0000000000800000-0x0000000000962000-memory.dmp

Filesize
1.4MB

Download
memory/4304-51-0x00000000008D0000-0x0000000000A32000-memory.dmp

Filesize
1.4MB

Download
memory/4304-50-0x00000000008D0000-0x0000000000A32000-memory.dmp

Filesize
1.4MB

Download
memory/4328-101-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/4428-45-0x0000000000E00000-0x0000000000F62000-memory.dmp

Filesize
1.4MB

Download
memory/4428-46-0x0000000000E00000-0x0000000000F62000-memory.dmp

Filesize
1.4MB

Download
memory/4428-43-0x0000000000E00000-0x0000000000F62000-memory.dmp

Filesize
1.4MB

Download
memory/4428-44-0x0000000000E00000-0x0000000000F62000-memory.dmp

Filesize
1.4MB

Download
memory/4444-68-0x0000000001060000-0x00000000011C2000-memory.dmp

Filesize
1.4MB

Download
memory/4444-69-0x0000000001060000-0x00000000011C2000-memory.dmp

Filesize
1.4MB

Download
memory/4448-89-0x0000000001280000-0x00000000013E2000-memory.dmp

Filesize
1.4MB

Download
memory/4448-90-0x0000000001280000-0x00000000013E2000-memory.dmp

Filesize
1.4MB

Download
memory/4492-83-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/4492-82-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/4516-39-0x0000000000C00000-0x0000000000D62000-memory.dmp

Filesize
1.4MB

Download
memory/4516-41-0x0000000000C00000-0x0000000000D62000-memory.dmp

Filesize
1.4MB

Download
memory/4516-42-0x0000000000C00000-0x0000000000D62000-memory.dmp

Filesize
1.4MB

Download
memory/4516-40-0x0000000000C00000-0x0000000000D62000-memory.dmp

Filesize
1.4MB

Download
memory/4708-47-0x0000000000800000-0x0000000000962000-memory.dmp

Filesize
1.4MB

Download
memory/4708-48-0x0000000000800000-0x0000000000962000-memory.dmp

Filesize
1.4MB

Download
memory/4824-87-0x0000000000800000-0x0000000000962000-memory.dmp

Filesize
1.4MB

Download
memory/5028-103-0x0000000000ED0000-0x0000000001032000-memory.dmp

Filesize
1.4MB

Download
memory/5028-104-0x0000000000ED0000-0x0000000001032000-memory.dmp

Filesize
1.4MB

Download