remcos | 560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
Size

1.4MB
MD5

c7fc0cee8ca35d709ed276e9f88ddbed
SHA1

ceea9d76bf0429872f4d7420addd0abdb5e8f4dc
SHA256

560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e
SHA512

a1b93c9cb87993f77f2decf0e4ee33277567651d7fb664b579f3e293f97c6b198ce701c02cffd9d295b3e40f62cd6500f55bc252212c5ec81ac9e257831273da
SSDEEP

24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8aIHo9Hi9Yc1St1R1M9p09oMMhDIGL0:2TvC/MTQYxsWR7aIHEC+coJ1OpwoMMhv

Score

10^/10

remcos main discovery rat

Malware Config

Extracted

Family

remcos

Botnet

Main

84.38.132.103:7001

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FR1M2R
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RegAsymX.vbs	RegAsymX.exe

Executes dropped EXE 1 IoCs

pid	Process
2192	RegAsymX.exe

AutoIT Executable 46 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000500000001db2f-14.dat	autoit_exe
behavioral2/memory/1912-39-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/1912-40-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/1912-41-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/1912-42-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/2936-43-0x0000000000860000-0x00000000009C2000-memory.dmp	autoit_exe
behavioral2/memory/2936-44-0x0000000000860000-0x00000000009C2000-memory.dmp	autoit_exe
behavioral2/memory/2936-45-0x0000000000860000-0x00000000009C2000-memory.dmp	autoit_exe
behavioral2/memory/2936-46-0x0000000000860000-0x00000000009C2000-memory.dmp	autoit_exe
behavioral2/memory/1236-47-0x0000000000800000-0x0000000000962000-memory.dmp	autoit_exe
behavioral2/memory/1236-48-0x0000000000800000-0x0000000000962000-memory.dmp	autoit_exe
behavioral2/memory/3528-50-0x0000000000F70000-0x00000000010D2000-memory.dmp	autoit_exe
behavioral2/memory/3528-51-0x0000000000F70000-0x00000000010D2000-memory.dmp	autoit_exe
behavioral2/memory/4412-52-0x0000000001220000-0x0000000001382000-memory.dmp	autoit_exe
behavioral2/memory/4412-53-0x0000000001220000-0x0000000001382000-memory.dmp	autoit_exe
behavioral2/memory/4272-57-0x0000000000800000-0x0000000000962000-memory.dmp	autoit_exe
behavioral2/memory/3320-59-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/3148-60-0x0000000000C50000-0x0000000000DB2000-memory.dmp	autoit_exe
behavioral2/memory/3148-61-0x0000000000C50000-0x0000000000DB2000-memory.dmp	autoit_exe
behavioral2/memory/2528-63-0x00000000004B0000-0x0000000000612000-memory.dmp	autoit_exe
behavioral2/memory/2528-64-0x00000000004B0000-0x0000000000612000-memory.dmp	autoit_exe
behavioral2/memory/4320-66-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/5088-68-0x0000000000400000-0x0000000000562000-memory.dmp	autoit_exe
behavioral2/memory/5088-69-0x0000000000400000-0x0000000000562000-memory.dmp	autoit_exe
behavioral2/memory/2228-72-0x0000000000C40000-0x0000000000DA2000-memory.dmp	autoit_exe
behavioral2/memory/2228-73-0x0000000000C40000-0x0000000000DA2000-memory.dmp	autoit_exe
behavioral2/memory/4696-75-0x0000000001200000-0x0000000001362000-memory.dmp	autoit_exe
behavioral2/memory/1296-77-0x0000000000C00000-0x0000000000D62000-memory.dmp	autoit_exe
behavioral2/memory/1296-78-0x0000000000C00000-0x0000000000D62000-memory.dmp	autoit_exe
behavioral2/memory/1000-80-0x0000000000F70000-0x00000000010D2000-memory.dmp	autoit_exe
behavioral2/memory/2036-82-0x0000000000410000-0x0000000000572000-memory.dmp	autoit_exe
behavioral2/memory/2036-83-0x0000000000410000-0x0000000000572000-memory.dmp	autoit_exe
behavioral2/memory/3136-85-0x0000000000400000-0x0000000000562000-memory.dmp	autoit_exe
behavioral2/memory/3860-87-0x0000000000F70000-0x00000000010D2000-memory.dmp	autoit_exe
behavioral2/memory/4580-89-0x0000000000D30000-0x0000000000E92000-memory.dmp	autoit_exe
behavioral2/memory/4580-90-0x0000000000D30000-0x0000000000E92000-memory.dmp	autoit_exe
behavioral2/memory/4628-91-0x0000000000850000-0x00000000009B2000-memory.dmp	autoit_exe
behavioral2/memory/4628-92-0x0000000000850000-0x00000000009B2000-memory.dmp	autoit_exe
behavioral2/memory/3940-94-0x00000000004E0000-0x0000000000642000-memory.dmp	autoit_exe
behavioral2/memory/3940-95-0x00000000004E0000-0x0000000000642000-memory.dmp	autoit_exe
behavioral2/memory/2696-96-0x00000000008C0000-0x0000000000A22000-memory.dmp	autoit_exe
behavioral2/memory/2696-97-0x00000000008C0000-0x0000000000A22000-memory.dmp	autoit_exe
behavioral2/memory/396-100-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe
behavioral2/memory/396-101-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe
behavioral2/memory/852-104-0x0000000000800000-0x0000000000962000-memory.dmp	autoit_exe
behavioral2/memory/1500-106-0x0000000000600000-0x0000000000762000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2192 set thread context of 1912	2192	RegAsymX.exe	90
PID 2192 set thread context of 2936	2192	RegAsymX.exe	96
PID 2192 set thread context of 1236	2192	RegAsymX.exe	101
PID 2192 set thread context of 3528	2192	RegAsymX.exe	105
PID 2192 set thread context of 4412	2192	RegAsymX.exe	108
PID 2192 set thread context of 4272	2192	RegAsymX.exe	113
PID 2192 set thread context of 3320	2192	RegAsymX.exe	116
PID 2192 set thread context of 3148	2192	RegAsymX.exe	119
PID 2192 set thread context of 2528	2192	RegAsymX.exe	122
PID 2192 set thread context of 4320	2192	RegAsymX.exe	125
PID 2192 set thread context of 5088	2192	RegAsymX.exe	128
PID 2192 set thread context of 2228	2192	RegAsymX.exe	131
PID 2192 set thread context of 4696	2192	RegAsymX.exe	134
PID 2192 set thread context of 1296	2192	RegAsymX.exe	137
PID 2192 set thread context of 1000	2192	RegAsymX.exe	141
PID 2192 set thread context of 2036	2192	RegAsymX.exe	144
PID 2192 set thread context of 3136	2192	RegAsymX.exe	148
PID 2192 set thread context of 3860	2192	RegAsymX.exe	151
PID 2192 set thread context of 4580	2192	RegAsymX.exe	154
PID 2192 set thread context of 4628	2192	RegAsymX.exe	157
PID 2192 set thread context of 3940	2192	RegAsymX.exe	160
PID 2192 set thread context of 2696	2192	RegAsymX.exe	163
PID 2192 set thread context of 396	2192	RegAsymX.exe	166
PID 2192 set thread context of 852	2192	RegAsymX.exe	169
PID 2192 set thread context of 1500	2192	RegAsymX.exe	172
PID 2192 set thread context of 1544	2192	RegAsymX.exe	175
PID 2192 set thread context of 4432	2192	RegAsymX.exe	178
PID 2192 set thread context of 4944	2192	RegAsymX.exe	181
PID 2192 set thread context of 1760	2192	RegAsymX.exe	184
PID 2192 set thread context of 4996	2192	RegAsymX.exe	187
PID 2192 set thread context of 3420	2192	RegAsymX.exe	190
PID 2192 set thread context of 2720	2192	RegAsymX.exe	193
PID 2192 set thread context of 3752	2192	RegAsymX.exe	196
PID 2192 set thread context of 3384	2192	RegAsymX.exe	199
PID 2192 set thread context of 4488	2192	RegAsymX.exe	202
PID 2192 set thread context of 3500	2192	RegAsymX.exe	205
PID 2192 set thread context of 4404	2192	RegAsymX.exe	208
PID 2192 set thread context of 4584	2192	RegAsymX.exe	211
PID 2192 set thread context of 1268	2192	RegAsymX.exe	214
PID 2192 set thread context of 872	2192	RegAsymX.exe	217
PID 2192 set thread context of 2704	2192	RegAsymX.exe	220
PID 2192 set thread context of 4204	2192	RegAsymX.exe	223
PID 2192 set thread context of 4748	2192	RegAsymX.exe	226
PID 2192 set thread context of 2656	2192	RegAsymX.exe	229
PID 2192 set thread context of 4976	2192	RegAsymX.exe	232
PID 2192 set thread context of 1248	2192	RegAsymX.exe	235
PID 2192 set thread context of 2908	2192	RegAsymX.exe	238
PID 2192 set thread context of 5012	2192	RegAsymX.exe	241
PID 2192 set thread context of 4636	2192	RegAsymX.exe	244
PID 2192 set thread context of 456	2192	RegAsymX.exe	247
PID 2192 set thread context of 4936	2192	RegAsymX.exe	250
PID 2192 set thread context of 4680	2192	RegAsymX.exe	253
PID 2192 set thread context of 4896	2192	RegAsymX.exe	256
PID 2192 set thread context of 2748	2192	RegAsymX.exe	259
PID 2192 set thread context of 4592	2192	RegAsymX.exe	262
PID 2192 set thread context of 4220	2192	RegAsymX.exe	265
PID 2192 set thread context of 2968	2192	RegAsymX.exe	268
PID 2192 set thread context of 2044	2192	RegAsymX.exe	271
PID 2192 set thread context of 2016	2192	RegAsymX.exe	274
PID 2192 set thread context of 3240	2192	RegAsymX.exe	277
PID 2192 set thread context of 4084	2192	RegAsymX.exe	280
PID 2192 set thread context of 4436	2192	RegAsymX.exe	283
PID 2192 set thread context of 2332	2192	RegAsymX.exe	286
PID 2192 set thread context of 2100	2192	RegAsymX.exe	289

Program crash 64 IoCs

pid	pid_target	Process	procid_target
820	1912	WerFault.exe	90
2992	2936	WerFault.exe	96
400	1236	WerFault.exe	101
2216	3528	WerFault.exe	105
2464	4412	WerFault.exe	108
1320	4272	WerFault.exe	113
2740	3320	WerFault.exe	116
2508	3148	WerFault.exe	119
3576	2528	WerFault.exe	122
1540	4320	WerFault.exe	125
1252	5088	WerFault.exe	128
4484	2228	WerFault.exe	131
4504	4696	WerFault.exe	134
4220	1296	WerFault.exe	137
4060	1000	WerFault.exe	141
548	2036	WerFault.exe	144
1652	3136	WerFault.exe	148
2200	3860	WerFault.exe	151
3536	4580	WerFault.exe	154
3312	4628	WerFault.exe	157
2504	3940	WerFault.exe	160
2072	2696	WerFault.exe	163
1028	396	WerFault.exe	166
2240	852	WerFault.exe	169
4968	1500	WerFault.exe	172
1404	1544	WerFault.exe	175
3328	4432	WerFault.exe	178
2608	4944	WerFault.exe	181
2484	1760	WerFault.exe	184
4524	4996	WerFault.exe	187
3240	3420	WerFault.exe	190
2232	2720	WerFault.exe	193
4292	3752	WerFault.exe	196
1996	3384	WerFault.exe	199
3496	4488	WerFault.exe	202
3452	3500	WerFault.exe	205
4224	4404	WerFault.exe	208
4544	4584	WerFault.exe	211
4592	1268	WerFault.exe	214
1012	872	WerFault.exe	217
2024	2704	WerFault.exe	220
3028	4204	WerFault.exe	223
4804	4748	WerFault.exe	226
3024	2656	WerFault.exe	229
440	4976	WerFault.exe	232
3244	1248	WerFault.exe	235
3224	2908	WerFault.exe	238
1400	5012	WerFault.exe	241
2124	4636	WerFault.exe	244
2504	456	WerFault.exe	247
4916	4936	WerFault.exe	250
2468	4680	WerFault.exe	253
3848	4896	WerFault.exe	256
4508	2748	WerFault.exe	259
1644	4592	WerFault.exe	262
1356	4220	WerFault.exe	265
2004	2968	WerFault.exe	268
1828	2044	WerFault.exe	271
4848	2016	WerFault.exe	274
5112	3240	WerFault.exe	277
4904	4084	WerFault.exe	280
4516	4436	WerFault.exe	283
4324	2332	WerFault.exe	286
4916	2100	WerFault.exe	289

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsymX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe
2192	RegAsymX.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2376	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2376	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2192	RegAsymX.exe
2192	RegAsymX.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2376	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2376	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
2192	RegAsymX.exe
2192	RegAsymX.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2192	2376	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	88
PID 2376 wrote to memory of 2192	2376	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	88
PID 2376 wrote to memory of 2192	2376	560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe	88
PID 2192 wrote to memory of 1912	2192	RegAsymX.exe	90
PID 2192 wrote to memory of 1912	2192	RegAsymX.exe	90
PID 2192 wrote to memory of 1912	2192	RegAsymX.exe	90
PID 2192 wrote to memory of 1912	2192	RegAsymX.exe	90
PID 2192 wrote to memory of 2936	2192	RegAsymX.exe	96
PID 2192 wrote to memory of 2936	2192	RegAsymX.exe	96
PID 2192 wrote to memory of 2936	2192	RegAsymX.exe	96
PID 2192 wrote to memory of 2936	2192	RegAsymX.exe	96
PID 2192 wrote to memory of 1236	2192	RegAsymX.exe	101
PID 2192 wrote to memory of 1236	2192	RegAsymX.exe	101
PID 2192 wrote to memory of 1236	2192	RegAsymX.exe	101
PID 2192 wrote to memory of 1236	2192	RegAsymX.exe	101
PID 2192 wrote to memory of 3528	2192	RegAsymX.exe	105
PID 2192 wrote to memory of 3528	2192	RegAsymX.exe	105
PID 2192 wrote to memory of 3528	2192	RegAsymX.exe	105
PID 2192 wrote to memory of 3528	2192	RegAsymX.exe	105
PID 2192 wrote to memory of 4412	2192	RegAsymX.exe	108
PID 2192 wrote to memory of 4412	2192	RegAsymX.exe	108
PID 2192 wrote to memory of 4412	2192	RegAsymX.exe	108
PID 2192 wrote to memory of 4412	2192	RegAsymX.exe	108
PID 2192 wrote to memory of 4272	2192	RegAsymX.exe	113
PID 2192 wrote to memory of 4272	2192	RegAsymX.exe	113
PID 2192 wrote to memory of 4272	2192	RegAsymX.exe	113
PID 2192 wrote to memory of 4272	2192	RegAsymX.exe	113
PID 2192 wrote to memory of 3320	2192	RegAsymX.exe	116
PID 2192 wrote to memory of 3320	2192	RegAsymX.exe	116
PID 2192 wrote to memory of 3320	2192	RegAsymX.exe	116
PID 2192 wrote to memory of 3320	2192	RegAsymX.exe	116
PID 2192 wrote to memory of 3148	2192	RegAsymX.exe	119
PID 2192 wrote to memory of 3148	2192	RegAsymX.exe	119
PID 2192 wrote to memory of 3148	2192	RegAsymX.exe	119
PID 2192 wrote to memory of 3148	2192	RegAsymX.exe	119
PID 2192 wrote to memory of 2528	2192	RegAsymX.exe	122
PID 2192 wrote to memory of 2528	2192	RegAsymX.exe	122
PID 2192 wrote to memory of 2528	2192	RegAsymX.exe	122
PID 2192 wrote to memory of 2528	2192	RegAsymX.exe	122
PID 2192 wrote to memory of 4320	2192	RegAsymX.exe	125
PID 2192 wrote to memory of 4320	2192	RegAsymX.exe	125
PID 2192 wrote to memory of 4320	2192	RegAsymX.exe	125
PID 2192 wrote to memory of 4320	2192	RegAsymX.exe	125
PID 2192 wrote to memory of 5088	2192	RegAsymX.exe	128
PID 2192 wrote to memory of 5088	2192	RegAsymX.exe	128
PID 2192 wrote to memory of 5088	2192	RegAsymX.exe	128
PID 2192 wrote to memory of 5088	2192	RegAsymX.exe	128
PID 2192 wrote to memory of 2228	2192	RegAsymX.exe	131
PID 2192 wrote to memory of 2228	2192	RegAsymX.exe	131
PID 2192 wrote to memory of 2228	2192	RegAsymX.exe	131
PID 2192 wrote to memory of 2228	2192	RegAsymX.exe	131
PID 2192 wrote to memory of 4696	2192	RegAsymX.exe	134
PID 2192 wrote to memory of 4696	2192	RegAsymX.exe	134
PID 2192 wrote to memory of 4696	2192	RegAsymX.exe	134
PID 2192 wrote to memory of 4696	2192	RegAsymX.exe	134
PID 2192 wrote to memory of 1296	2192	RegAsymX.exe	137
PID 2192 wrote to memory of 1296	2192	RegAsymX.exe	137
PID 2192 wrote to memory of 1296	2192	RegAsymX.exe	137
PID 2192 wrote to memory of 1296	2192	RegAsymX.exe	137
PID 2192 wrote to memory of 1000	2192	RegAsymX.exe	141
PID 2192 wrote to memory of 1000	2192	RegAsymX.exe	141
PID 2192 wrote to memory of 1000	2192	RegAsymX.exe	141
PID 2192 wrote to memory of 1000	2192	RegAsymX.exe	141
PID 2192 wrote to memory of 2036	2192	RegAsymX.exe	144

C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe
"C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\directory\RegAsymX.exe
  "C:\Users\Admin\AppData\Local\Temp\560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:1912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 560
      4⤵
      Program crash
      PID:820
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 560
      4⤵
      Program crash
      PID:2992
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 560
      4⤵
      Program crash
      PID:400
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 584
      4⤵
      Program crash
      PID:2216
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 560
      4⤵
      Program crash
      PID:2464
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 564
      4⤵
      Program crash
      PID:1320
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 208
      4⤵
      Program crash
      PID:2740
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 200
      4⤵
      Program crash
      PID:2508
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 560
      4⤵
      Program crash
      PID:3576
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 568
      4⤵
      Program crash
      PID:1540
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 560
      4⤵
      Program crash
      PID:1252
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 568
      4⤵
      Program crash
      PID:4484
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 560
      4⤵
      Program crash
      PID:4504
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 560
      4⤵
      Program crash
      PID:4220
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 568
      4⤵
      Program crash
      PID:4060
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 560
      4⤵
      Program crash
      PID:548
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 216
      4⤵
      Program crash
      PID:1652
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 560
      4⤵
      Program crash
      PID:2200
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 560
      4⤵
      Program crash
      PID:3536
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 572
      4⤵
      Program crash
      PID:3312
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:3940
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 560
      4⤵
      Program crash
      PID:2504
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 560
      4⤵
      Program crash
      PID:2072
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 204
      4⤵
      Program crash
      PID:1028
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 196
      4⤵
      Program crash
      PID:2240
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 208
      4⤵
      Program crash
      PID:4968
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 568
      4⤵
      Program crash
      PID:1404
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 560
      4⤵
      Program crash
      PID:3328
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 560
      4⤵
      Program crash
      PID:2608
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 560
      4⤵
      Program crash
      PID:2484
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 560
      4⤵
      Program crash
      PID:4524
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 560
      4⤵
      Program crash
      PID:3240
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 560
      4⤵
      Program crash
      PID:2232
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 564
      4⤵
      Program crash
      PID:4292
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 208
      4⤵
      Program crash
      PID:1996
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4488
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 564
      4⤵
      Program crash
      PID:3496
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 560
      4⤵
      Program crash
      PID:3452
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 568
      4⤵
      Program crash
      PID:4224
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 576
      4⤵
      Program crash
      PID:4544
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 560
      4⤵
      Program crash
      PID:4592
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 560
      4⤵
      Program crash
      PID:1012
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 576
      4⤵
      Program crash
      PID:2024
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 568
      4⤵
      Program crash
      PID:3028
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 568
      4⤵
      Program crash
      PID:4804
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 192
      4⤵
      Program crash
      PID:3024
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 572
      4⤵
      Program crash
      PID:440
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 196
      4⤵
      Program crash
      PID:3244
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 560
      4⤵
      Program crash
      PID:3224
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 212
      4⤵
      Program crash
      PID:1400
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 560
      4⤵
      Program crash
      PID:2124
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 560
      4⤵
      Program crash
      PID:2504
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 576
      4⤵
      Program crash
      PID:4916
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 208
      4⤵
      Program crash
      PID:2468
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 560
      4⤵
      Program crash
      PID:3848
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 560
      4⤵
      Program crash
      PID:4508
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 568
      4⤵
      Program crash
      PID:1644
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 560
      4⤵
      Program crash
      PID:1356
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 192
      4⤵
      Program crash
      PID:2004
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 576
      4⤵
      Program crash
      PID:1828
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 576
      4⤵
      Program crash
      PID:4848
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 216
      4⤵
      Program crash
      PID:5112
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 192
      4⤵
      Program crash
      PID:4904
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 560
      4⤵
      Program crash
      PID:4516
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 192
      4⤵
      Program crash
      PID:4324
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 576
      4⤵
      Program crash
      PID:4916
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 196
      4⤵
      PID:1200
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:64
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 200
      4⤵
      PID:3396
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 572
      4⤵
      PID:3436
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 196
      4⤵
      PID:812
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 580
      4⤵
      PID:5108
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 196
      4⤵
      PID:640
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 192
      4⤵
      PID:2020
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 580
      4⤵
      PID:2548
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 200
      4⤵
      PID:1564
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 560
      4⤵
      PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1912 -ip 1912
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2936 -ip 2936
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1236 -ip 1236
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3528 -ip 3528
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4412 -ip 4412
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4272 -ip 4272
1⤵
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3320 -ip 3320
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3148 -ip 3148
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2528 -ip 2528
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4320 -ip 4320
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5088 -ip 5088
1⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2228 -ip 2228
1⤵
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4696 -ip 4696
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1296 -ip 1296
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1000 -ip 1000
1⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2036 -ip 2036
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3136 -ip 3136
1⤵
PID:264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3860 -ip 3860
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4580 -ip 4580
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4628 -ip 4628
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3940 -ip 3940
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2696 -ip 2696
1⤵
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 396 -ip 396
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 852 -ip 852
1⤵
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1500 -ip 1500
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1544 -ip 1544
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4432 -ip 4432
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4944 -ip 4944
1⤵
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1760 -ip 1760
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4996 -ip 4996
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3420 -ip 3420
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2720 -ip 2720
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3752 -ip 3752
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3384 -ip 3384
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4488 -ip 4488
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3500 -ip 3500
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4404 -ip 4404
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4584 -ip 4584
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1268 -ip 1268
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 872 -ip 872
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2704 -ip 2704
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4204 -ip 4204
1⤵
PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4748 -ip 4748
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2656 -ip 2656
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4976 -ip 4976
1⤵
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1248 -ip 1248
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2908 -ip 2908
1⤵
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5012 -ip 5012
1⤵
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4636 -ip 4636
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 456 -ip 456
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4936 -ip 4936
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4680 -ip 4680
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4896 -ip 4896
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2748 -ip 2748
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4592 -ip 4592
1⤵
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4220 -ip 4220
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2968 -ip 2968
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2044 -ip 2044
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2016 -ip 2016
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3240 -ip 3240
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4084 -ip 4084
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4436 -ip 4436
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2332 -ip 2332
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2100 -ip 2100
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1480 -ip 1480
1⤵
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 64 -ip 64
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2296 -ip 2296
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4364 -ip 4364
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2588 -ip 2588
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4764 -ip 4764
1⤵
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5052 -ip 5052
1⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 772 -ip 772
1⤵
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3112 -ip 3112
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4848 -ip 4848
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
c4bee477c973f056211a3db12a9621fb

SHA1
b3a3db469353e1e100099f0a533f13e99b242787

SHA256
96c7394fd2f10603b5bda310000f9116415230875b75085bd4fb162f822e9459

SHA512
9687e6356bbbb3b480bf71c2776e4d56fffa97d391b74df4c908f3d6f173d83dcdf15609c4d718953bed9c3e408c522c50242f90ee8439030cd56120af52924f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lymnaeidae

Filesize
84KB

MD5
e9d80ff6fcd8ceeb2f0c63b6d84354fd

SHA1
9e697f748635834b3b88f33fbb77323261b325b0

SHA256
91f5f7478ffcd500ad50e86ada1faffc60979b449af4d56b3bf1f71bb7da0a3d

SHA512
aba78fb40aae7238b20ba9fbe9d975481da595896a651962c41b89f6bea323a7040afaf35a33f0608a4f2d0aaf899537a5e1cc37887afc6ece0e468f9916b343

Download Submit
C:\Users\Admin\AppData\Local\Temp\ophiolatrous

Filesize
483KB

MD5
89669f54c2cf58a12e6eb05f0b0c8b45

SHA1
9dd08035fb240b2d8c284c31786f20c04e4d871a

SHA256
7367a34c0b9d0c68678b8bd5bd02a54c94d7a60000aabc0525079b641c0f5e03

SHA512
000188de8af2c2886ab5085890835e29cf0e65f6c9fc01a52f47a709650d8c9f411bb8931e545c27edc132ee14fa685ec063d5681bffd9ece56a52473e9f2686

Download Submit
C:\Users\Admin\AppData\Local\directory\RegAsymX.exe

Filesize
1.4MB

MD5
c7fc0cee8ca35d709ed276e9f88ddbed

SHA1
ceea9d76bf0429872f4d7420addd0abdb5e8f4dc

SHA256
560def626fc69a10e4979b67107efaad102e2a01ce4733d005003dd47437a30e

SHA512
a1b93c9cb87993f77f2decf0e4ee33277567651d7fb664b579f3e293f97c6b198ce701c02cffd9d295b3e40f62cd6500f55bc252212c5ec81ac9e257831273da

Download Submit
memory/396-101-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/396-100-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/852-104-0x0000000000800000-0x0000000000962000-memory.dmp

Filesize
1.4MB

Download
memory/1000-80-0x0000000000F70000-0x00000000010D2000-memory.dmp

Filesize
1.4MB

Download
memory/1236-47-0x0000000000800000-0x0000000000962000-memory.dmp

Filesize
1.4MB

Download
memory/1236-48-0x0000000000800000-0x0000000000962000-memory.dmp

Filesize
1.4MB

Download
memory/1296-78-0x0000000000C00000-0x0000000000D62000-memory.dmp

Filesize
1.4MB

Download
memory/1296-77-0x0000000000C00000-0x0000000000D62000-memory.dmp

Filesize
1.4MB

Download
memory/1500-106-0x0000000000600000-0x0000000000762000-memory.dmp

Filesize
1.4MB

Download
memory/1912-41-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/1912-40-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/1912-39-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/1912-42-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/2036-83-0x0000000000410000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/2036-82-0x0000000000410000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/2192-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2192-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2192-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2192-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2192-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2192-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2192-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2192-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2192-98-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2192-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2228-72-0x0000000000C40000-0x0000000000DA2000-memory.dmp

Filesize
1.4MB

Download
memory/2228-73-0x0000000000C40000-0x0000000000DA2000-memory.dmp

Filesize
1.4MB

Download
memory/2376-11-0x00000000017A0000-0x00000000017A4000-memory.dmp

Filesize
16KB

Download
memory/2528-63-0x00000000004B0000-0x0000000000612000-memory.dmp

Filesize
1.4MB

Download
memory/2528-64-0x00000000004B0000-0x0000000000612000-memory.dmp

Filesize
1.4MB

Download
memory/2696-96-0x00000000008C0000-0x0000000000A22000-memory.dmp

Filesize
1.4MB

Download
memory/2696-97-0x00000000008C0000-0x0000000000A22000-memory.dmp

Filesize
1.4MB

Download
memory/2936-43-0x0000000000860000-0x00000000009C2000-memory.dmp

Filesize
1.4MB

Download
memory/2936-46-0x0000000000860000-0x00000000009C2000-memory.dmp

Filesize
1.4MB

Download
memory/2936-45-0x0000000000860000-0x00000000009C2000-memory.dmp

Filesize
1.4MB

Download
memory/2936-44-0x0000000000860000-0x00000000009C2000-memory.dmp

Filesize
1.4MB

Download
memory/3136-85-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/3148-60-0x0000000000C50000-0x0000000000DB2000-memory.dmp

Filesize
1.4MB

Download
memory/3148-61-0x0000000000C50000-0x0000000000DB2000-memory.dmp

Filesize
1.4MB

Download
memory/3320-59-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/3528-51-0x0000000000F70000-0x00000000010D2000-memory.dmp

Filesize
1.4MB

Download
memory/3528-50-0x0000000000F70000-0x00000000010D2000-memory.dmp

Filesize
1.4MB

Download
memory/3860-87-0x0000000000F70000-0x00000000010D2000-memory.dmp

Filesize
1.4MB

Download
memory/3940-94-0x00000000004E0000-0x0000000000642000-memory.dmp

Filesize
1.4MB

Download
memory/3940-95-0x00000000004E0000-0x0000000000642000-memory.dmp

Filesize
1.4MB

Download
memory/4272-57-0x0000000000800000-0x0000000000962000-memory.dmp

Filesize
1.4MB

Download
memory/4320-66-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/4412-53-0x0000000001220000-0x0000000001382000-memory.dmp

Filesize
1.4MB

Download
memory/4412-52-0x0000000001220000-0x0000000001382000-memory.dmp

Filesize
1.4MB

Download
memory/4580-89-0x0000000000D30000-0x0000000000E92000-memory.dmp

Filesize
1.4MB

Download
memory/4580-90-0x0000000000D30000-0x0000000000E92000-memory.dmp

Filesize
1.4MB

Download
memory/4628-92-0x0000000000850000-0x00000000009B2000-memory.dmp

Filesize
1.4MB

Download
memory/4628-91-0x0000000000850000-0x00000000009B2000-memory.dmp

Filesize
1.4MB

Download
memory/4696-75-0x0000000001200000-0x0000000001362000-memory.dmp

Filesize
1.4MB

Download
memory/5088-69-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/5088-68-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download