remcos | e5bccb979fef3945c64622c6ad4461947eca123465f2989d9f4af879fd467890

Resubmissions

30/07/2026, 17:30

260730-v3eexsdp5v10

30/07/2026, 17:29

260730-v232wswzes10

25/07/2026, 06:55

260725-hp5nqsep7w10

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.2MB
Sample260730-v3eexsdp5v
SHA256 e5bccb979fef3945c64622c6ad4461947eca123465f2989d9f4af879fd467890
MD5 cc7e9ae7f054d90355af2dd379625ec3
SHA1 af381a40b1babd7f65f118608a958fc1aa48f115
SHA512 522c2af9cc67e4d3a76d0ae5ed234f273d3221155df0e8788ed5b96692ac3d186dabf68424d58347ac51f0cb8522e10aa727362039c04b178fef2127885b1f92
SSDEEP 12288:F0vDZDrODKXnas0hitTDlQzbW/wYEGOfg13u0LOoGg2Fd5bxWU:FOUDWnrtNQXvG31lyotStWU
TLSH
T197452353A1F7EEB2F965B835221AAE04F31F75BA022743D21B96415A4613F11FE3C326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

lods132 remcos persistence rat

Malware Config

Extracted

Family

remcos

Version

7.2.6 Pro

Botnet

lods132

58.96.75.176:15151

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
75
connect_interval
7
copy_file
microsip.exe
copy_folder
9qcn.tmp
delete_file
true
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
libdat.d
keylog_flag
false
keylog_folder
libTlgprod
keylog_path
%AppData%
mouse_option
false
mutex
66389GGR1R-JWD72O
screenshot_crypt
true
screenshot_flag
false
screenshot_folder
9qsem.tmp
screenshot_path
%Temp%
screenshot_time
10
startup_value
take_screenshot_option
true
take_screenshot_time
8
take_screenshot_title
seed;PayPal;Login;Bank;Crypto;Coin;2FA;private;phrase;pnemonic;wallet;

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\	microsip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\66389GGR1R-JWD72O = "\"C:\\Users\\Admin\\AppData\\Roaming\\9qcn.tmp\\microsip.exe\""	microsip.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\66389GGR1R-JWD72O = "\"C:\\Users\\Admin\\AppData\\Roaming\\9qcn.tmp\\microsip.exe\""	file.exe

Deletes itself 1 IoCs

pid	Process
484	microsip.exe

Executes dropped EXE 1 IoCs

pid	Process
484	microsip.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\66389GGR1R-JWD72O = "\"C:\\Users\\Admin\\AppData\\Roaming\\9qcn.tmp\\microsip.exe\""	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\66389GGR1R-JWD72O = "\"C:\\Users\\Admin\\AppData\\Roaming\\9qcn.tmp\\microsip.exe\""	microsip.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 484 set thread context of 2816	484	microsip.exe	91
PID 484 set thread context of 5496	484	microsip.exe	92
PID 484 set thread context of 96	484	microsip.exe	93
PID 484 set thread context of 4320	484	microsip.exe	94
PID 484 set thread context of 4540	484	microsip.exe	95
PID 484 set thread context of 4744	484	microsip.exe	96
PID 484 set thread context of 3460	484	microsip.exe	97
PID 484 set thread context of 2924	484	microsip.exe	98
PID 484 set thread context of 3452	484	microsip.exe	99
PID 484 set thread context of 4176	484	microsip.exe	100
PID 484 set thread context of 4872	484	microsip.exe	101
PID 484 set thread context of 1972	484	microsip.exe	102
PID 484 set thread context of 4696	484	microsip.exe	103
PID 484 set thread context of 4080	484	microsip.exe	104
PID 484 set thread context of 5784	484	microsip.exe	105
PID 484 set thread context of 5380	484	microsip.exe	107
PID 484 set thread context of 2976	484	microsip.exe	108
PID 484 set thread context of 5568	484	microsip.exe	109
PID 484 set thread context of 2264	484	microsip.exe	110
PID 484 set thread context of 2356	484	microsip.exe	111
PID 484 set thread context of 2840	484	microsip.exe	112
PID 484 set thread context of 4788	484	microsip.exe	113
PID 484 set thread context of 5660	484	microsip.exe	114
PID 484 set thread context of 1080	484	microsip.exe	115
PID 484 set thread context of 1308	484	microsip.exe	116
PID 484 set thread context of 756	484	microsip.exe	117
PID 484 set thread context of 4836	484	microsip.exe	118
PID 484 set thread context of 3144	484	microsip.exe	119
PID 484 set thread context of 2376	484	microsip.exe	120
PID 484 set thread context of 2588	484	microsip.exe	121
PID 484 set thread context of 2936	484	microsip.exe	122
PID 484 set thread context of 5408	484	microsip.exe	123
PID 484 set thread context of 2348	484	microsip.exe	124
PID 484 set thread context of 5288	484	microsip.exe	125
PID 484 set thread context of 4968	484	microsip.exe	126
PID 484 set thread context of 3128	484	microsip.exe	127
PID 484 set thread context of 4712	484	microsip.exe	128
PID 484 set thread context of 3872	484	microsip.exe	129
PID 484 set thread context of 2388	484	microsip.exe	130
PID 484 set thread context of 1076	484	microsip.exe	131
PID 484 set thread context of 1556	484	microsip.exe	132
PID 484 set thread context of 2392	484	microsip.exe	133
PID 484 set thread context of 5092	484	microsip.exe	134
PID 484 set thread context of 4508	484	microsip.exe	135
PID 484 set thread context of 3060	484	microsip.exe	136
PID 484 set thread context of 4224	484	microsip.exe	137
PID 484 set thread context of 3276	484	microsip.exe	138
PID 484 set thread context of 2008	484	microsip.exe	139
PID 484 set thread context of 5948	484	microsip.exe	140
PID 484 set thread context of 1864	484	microsip.exe	141
PID 484 set thread context of 4512	484	microsip.exe	142
PID 484 set thread context of 4848	484	microsip.exe	143
PID 484 set thread context of 4464	484	microsip.exe	144
PID 484 set thread context of 4976	484	microsip.exe	145
PID 484 set thread context of 4588	484	microsip.exe	146
PID 484 set thread context of 3292	484	microsip.exe	147
PID 484 set thread context of 3180	484	microsip.exe	148
PID 484 set thread context of 3756	484	microsip.exe	149
PID 484 set thread context of 5596	484	microsip.exe	150
PID 484 set thread context of 468	484	microsip.exe	151
PID 484 set thread context of 5304	484	microsip.exe	152
PID 484 set thread context of 824	484	microsip.exe	153
PID 484 set thread context of 3544	484	microsip.exe	154
PID 484 set thread context of 2100	484	microsip.exe	155

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
484	microsip.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 484	1052	file.exe	90
PID 484 wrote to memory of 2816	484	microsip.exe	91
PID 484 wrote to memory of 5496	484	microsip.exe	92
PID 484 wrote to memory of 96	484	microsip.exe	93
PID 484 wrote to memory of 4320	484	microsip.exe	94
PID 484 wrote to memory of 4540	484	microsip.exe	95
PID 484 wrote to memory of 4744	484	microsip.exe	96
PID 484 wrote to memory of 3460	484	microsip.exe	97
PID 484 wrote to memory of 2924	484	microsip.exe	98
PID 484 wrote to memory of 3452	484	microsip.exe	99
PID 484 wrote to memory of 4176	484	microsip.exe	100
PID 484 wrote to memory of 4872	484	microsip.exe	101
PID 484 wrote to memory of 1972	484	microsip.exe	102
PID 484 wrote to memory of 4696	484	microsip.exe	103
PID 484 wrote to memory of 4080	484	microsip.exe	104
PID 484 wrote to memory of 5784	484	microsip.exe	105
PID 484 wrote to memory of 5380	484	microsip.exe	107
PID 484 wrote to memory of 2976	484	microsip.exe	108
PID 484 wrote to memory of 5568	484	microsip.exe	109
PID 484 wrote to memory of 2264	484	microsip.exe	110
PID 484 wrote to memory of 2356	484	microsip.exe	111
PID 484 wrote to memory of 2840	484	microsip.exe	112
PID 484 wrote to memory of 4788	484	microsip.exe	113
PID 484 wrote to memory of 5660	484	microsip.exe	114
PID 484 wrote to memory of 1080	484	microsip.exe	115
PID 484 wrote to memory of 1308	484	microsip.exe	116
PID 484 wrote to memory of 756	484	microsip.exe	117
PID 484 wrote to memory of 4836	484	microsip.exe	118
PID 484 wrote to memory of 3144	484	microsip.exe	119
PID 484 wrote to memory of 2376	484	microsip.exe	120
PID 484 wrote to memory of 2588	484	microsip.exe	121
PID 484 wrote to memory of 2936	484	microsip.exe	122
PID 484 wrote to memory of 5408	484	microsip.exe	123
PID 484 wrote to memory of 2348	484	microsip.exe	124
PID 484 wrote to memory of 5288	484	microsip.exe	125
PID 484 wrote to memory of 4968	484	microsip.exe	126
PID 484 wrote to memory of 3128	484	microsip.exe	127
PID 484 wrote to memory of 4712	484	microsip.exe	128
PID 484 wrote to memory of 3872	484	microsip.exe	129
PID 484 wrote to memory of 2388	484	microsip.exe	130
PID 484 wrote to memory of 1076	484	microsip.exe	131
PID 484 wrote to memory of 1556	484	microsip.exe	132
PID 484 wrote to memory of 2392	484	microsip.exe	133
PID 484 wrote to memory of 5092	484	microsip.exe	134
PID 484 wrote to memory of 4508	484	microsip.exe	135
PID 484 wrote to memory of 3060	484	microsip.exe	136
PID 484 wrote to memory of 4224	484	microsip.exe	137
PID 484 wrote to memory of 3276	484	microsip.exe	138
PID 484 wrote to memory of 2008	484	microsip.exe	139
PID 484 wrote to memory of 5948	484	microsip.exe	140
PID 484 wrote to memory of 1864	484	microsip.exe	141
PID 484 wrote to memory of 4512	484	microsip.exe	142
PID 484 wrote to memory of 4848	484	microsip.exe	143
PID 484 wrote to memory of 4464	484	microsip.exe	144
PID 484 wrote to memory of 4976	484	microsip.exe	145
PID 484 wrote to memory of 4588	484	microsip.exe	146
PID 484 wrote to memory of 3292	484	microsip.exe	147
PID 484 wrote to memory of 3180	484	microsip.exe	148
PID 484 wrote to memory of 3756	484	microsip.exe	149
PID 484 wrote to memory of 5596	484	microsip.exe	150
PID 484 wrote to memory of 468	484	microsip.exe	151
PID 484 wrote to memory of 5304	484	microsip.exe	152
PID 484 wrote to memory of 824	484	microsip.exe	153
PID 484 wrote to memory of 3544	484	microsip.exe	154

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Roaming\9qcn.tmp\microsip.exe
  "C:\Users\Admin\AppData\Roaming\9qcn.tmp\microsip.exe"
  2⤵
  - Adds policy Run key to start application
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:484
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2816
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5496
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:96
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4320
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4540
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4744
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3460
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2924
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3452
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4176
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4872
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:1972
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4696
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4080
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5784
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5380
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2976
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5568
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2264
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2356
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2840
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4788
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5660
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:1080
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:1308
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:756
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4836
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3144
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2376
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2588
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2936
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5408
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2348
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5288
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4968
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3128
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4712
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3872
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2388
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:1076
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:1556
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2392
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5092
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4508
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3060
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4224
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3276
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2008
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5948
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:1864
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4512
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4848
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4464
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4976
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4588
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3292
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3180
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3756
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5596
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:468
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5304
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:824
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3544
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2100
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5220
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4416
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:1412
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2852
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3444
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2512
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:2664
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:1356
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsip.exe

Path C:\Users\Admin\AppData\Roaming\9qcn.tmp\microsip.exe
Size 1.2MB
SHA256 e5bccb979fef3945c64622c6ad4461947eca123465f2989d9f4af879fd467890
MD5 cc7e9ae7f054d90355af2dd379625ec3
SHA1 af381a40b1babd7f65f118608a958fc1aa48f115
SHA512 522c2af9cc67e4d3a76d0ae5ed234f273d3221155df0e8788ed5b96692ac3d186dabf68424d58347ac51f0cb8522e10aa727362039c04b178fef2127885b1f92
SSDEEP 12288:F0vDZDrODKXnas0hitTDlQzbW/wYEGOfg13u0LOoGg2Fd5bxWU:FOUDWnrtNQXvG31lyotStWU
TLSH
T197452353A1F7EEB2F965B835221AAE04F31F75BA022743D21B96415A4613F11FE3C326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/96-22-0x00007FF748020000-0x00007FF748028000-memory.dmp

Download

memory/484-59-0x000002C53F600000-0x000002C53F6A7000-memory.dmp

Download

memory/484-74-0x000002C53F600000-0x000002C53F6A7000-memory.dmp

Download

memory/484-15-0x000002C53F600000-0x000002C53F6A7000-memory.dmp

Download

memory/484-64-0x000002C53F600000-0x000002C53F6A7000-memory.dmp

Download

memory/484-78-0x000002C53F600000-0x000002C53F6A7000-memory.dmp

Download

memory/484-8-0x000002C53F600000-0x000002C53F6A7000-memory.dmp

Download

memory/484-57-0x000002C53F600000-0x000002C53F6A7000-memory.dmp

Download

memory/484-17-0x000002C53F600000-0x000002C53F6A7000-memory.dmp

Download

memory/484-67-0x000002C53F600000-0x000002C53F6A7000-memory.dmp

Download

memory/484-71-0x000002C53F600000-0x000002C53F6A7000-memory.dmp

Download

memory/756-45-0x00007FF73D240000-0x00007FF73D248000-memory.dmp

Download

memory/1052-1-0x000002D8B2640000-0x000002D8B26E7000-memory.dmp

Download

memory/1076-61-0x00007FF6BD8E0000-0x00007FF6BD8E8000-memory.dmp

Download

memory/1080-43-0x00007FF7F2900000-0x00007FF7F2908000-memory.dmp

Download

memory/1308-44-0x00007FF6E9700000-0x00007FF6E9708000-memory.dmp

Download

memory/1556-62-0x00007FF6060A0000-0x00007FF6060A8000-memory.dmp

Download

memory/1864-75-0x00007FF718880000-0x00007FF718888000-memory.dmp

Download

memory/1972-31-0x00007FF7F6120000-0x00007FF7F6128000-memory.dmp

Download

memory/2008-72-0x00007FF72EEB0000-0x00007FF72EEB8000-memory.dmp

Download

memory/2264-38-0x00007FF6D9350000-0x00007FF6D9358000-memory.dmp

Download

memory/2348-52-0x00007FF791730000-0x00007FF791738000-memory.dmp

Download

memory/2356-39-0x00007FF74C5C0000-0x00007FF74C5C8000-memory.dmp

Download

memory/2376-48-0x00007FF79D3C0000-0x00007FF79D3C8000-memory.dmp

Download

memory/2388-60-0x00007FF604C10000-0x00007FF604C18000-memory.dmp

Download

memory/2392-63-0x00007FF61B420000-0x00007FF61B428000-memory.dmp

Download

memory/2588-49-0x00007FF6A95B0000-0x00007FF6A95B8000-memory.dmp

Download

memory/2816-20-0x00007FF624AA0000-0x00007FF624AA8000-memory.dmp

Download

memory/2840-40-0x00007FF67F0C0000-0x00007FF67F0C8000-memory.dmp

Download

memory/2924-27-0x00007FF7E6170000-0x00007FF7E6178000-memory.dmp

Download

memory/2936-50-0x00007FF67FCD0000-0x00007FF67FCD8000-memory.dmp

Download

memory/2976-36-0x00007FF696FF0000-0x00007FF696FF8000-memory.dmp

Download

memory/3060-68-0x00007FF7218C0000-0x00007FF7218C8000-memory.dmp

Download

memory/3128-55-0x00007FF668130000-0x00007FF668138000-memory.dmp

Download

memory/3144-47-0x00007FF646870000-0x00007FF646878000-memory.dmp

Download

memory/3276-70-0x00007FF632F30000-0x00007FF632F38000-memory.dmp

Download

memory/3452-28-0x00007FF784150000-0x00007FF784158000-memory.dmp

Download

memory/3460-26-0x00007FF679BA0000-0x00007FF679BA8000-memory.dmp

Download

memory/3872-58-0x00007FF612C20000-0x00007FF612C28000-memory.dmp

Download

memory/4080-33-0x00007FF79A6D0000-0x00007FF79A6D8000-memory.dmp

Download

memory/4176-29-0x00007FF606110000-0x00007FF606118000-memory.dmp

Download

memory/4224-69-0x00007FF7E97D0000-0x00007FF7E97D8000-memory.dmp

Download

memory/4320-23-0x00007FF75F690000-0x00007FF75F698000-memory.dmp

Download

memory/4464-79-0x00007FF762AC0000-0x00007FF762AC8000-memory.dmp

Download

memory/4508-66-0x00007FF7E7D10000-0x00007FF7E7D18000-memory.dmp

Download

memory/4512-76-0x00007FF6D6940000-0x00007FF6D6948000-memory.dmp

Download

memory/4540-24-0x00007FF6B7F90000-0x00007FF6B7F98000-memory.dmp

Download

memory/4696-32-0x00007FF6A32C0000-0x00007FF6A32C8000-memory.dmp

Download

memory/4712-56-0x00007FF68A340000-0x00007FF68A348000-memory.dmp

Download

memory/4744-25-0x00007FF76A620000-0x00007FF76A628000-memory.dmp

Download

memory/4788-41-0x00007FF60D900000-0x00007FF60D908000-memory.dmp

Download

memory/4836-46-0x00007FF746A60000-0x00007FF746A68000-memory.dmp

Download

memory/4848-77-0x00007FF79CF80000-0x00007FF79CF88000-memory.dmp

Download

memory/4872-30-0x00007FF76F740000-0x00007FF76F748000-memory.dmp

Download

memory/4968-54-0x00007FF660DB0000-0x00007FF660DB8000-memory.dmp

Download

memory/5092-65-0x00007FF7A21B0000-0x00007FF7A21B8000-memory.dmp

Download

memory/5288-53-0x00007FF7E92A0000-0x00007FF7E92A8000-memory.dmp

Download

memory/5380-35-0x00007FF7E74E0000-0x00007FF7E74E8000-memory.dmp

Download

memory/5408-51-0x00007FF792720000-0x00007FF792728000-memory.dmp

Download

memory/5496-21-0x00007FF7B54C0000-0x00007FF7B54C8000-memory.dmp

Download

memory/5568-37-0x00007FF692960000-0x00007FF692968000-memory.dmp

Download

memory/5660-42-0x00007FF621C80000-0x00007FF621C88000-memory.dmp

Download

memory/5784-34-0x00007FF73AAC0000-0x00007FF73AAC8000-memory.dmp

Download

memory/5948-73-0x00007FF791190000-0x00007FF791198000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads