remcos | f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
Size

1.1MB
MD5

28f77c9af8cb3ea886714bbfc8326635
SHA1

f6f02b22cd5a272c71a5afa66efd3b237fe4f24f
SHA256

f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35
SHA512

03508e0f3f68696f4f7b64aa737d40e8bd24b69ea7860a8fabee997d238454929605fe5b1ea0880af14cf3a89763d46e1fdeb9a526700d570b0d672330b5f82d
SSDEEP

24576:VcNkX126Z/zxDzTVt8Pyt1KjrJonp0+M+gw/gvXIw/qbw4:NX126zxvxt8P0IepJM+Tzk4

Score

10^/10

remcos spittt collection execution rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

sPITTT

antfly50.sytes.net:1980

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-BW3KDF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients

Processes:

resource yara_rule

behavioral1/memory/1044-111-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers

Processes:

resource yara_rule

behavioral1/memory/2760-109-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView

resource	yara_rule
behavioral1/memory/1044-111-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

resource	yara_rule
behavioral1/memory/2760-109-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2692-117-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1044-111-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/2760-109-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

4004 powershell.exe
1492 powershell.exe

pid	process
4004	powershell.exe
1492	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exef251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

description	pid	process	target process
PID 2368 set thread context of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 set thread context of 2760	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 set thread context of 1044	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 set thread context of 2692	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1480 schtasks.exe

pid	process
1480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exepowershell.exepowershell.exef251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exef251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

pid	process
2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
4004	powershell.exe
4004	powershell.exe
1492	powershell.exe
1492	powershell.exe
2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
4004	powershell.exe
1492	powershell.exe
2760	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
2760	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
2692	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
2692	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
2760	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
2760	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

pid	process
3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exepowershell.exepowershell.exef251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

description	pid	process
Token: SeDebugPrivilege	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	2692	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

pid process

3536 f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exef251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe

C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
"C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\znlzneAxBVd.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\znlzneAxBVd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp89F0.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
"C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536

C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe /stext "C:\Users\Admin\AppData\Local\Temp\knoqidcnmalcoclquqtaurkvifnldr"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2760

C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe /stext "C:\Users\Admin\AppData\Local\Temp\uhtiivmhaiepzihcebobfwemqtfuwcvcv"
3⤵
- Accesses Microsoft Outlook accounts
PID:1044

C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe /stext "C:\Users\Admin\AppData\Local\Temp\fkztj"
3⤵
PID:1628

C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
C:\Users\Admin\AppData\Local\Temp\f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe /stext "C:\Users\Admin\AppData\Local\Temp\fkztj"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat
Filesize
144B

MD5
702b0a1c83f45b929b084f3402d594e2

SHA1
0d1a748132169c7da9ba52e2437857dd2d883e34

SHA256
f6539e247dc8d5db9a7436cc8bfd94760232c818d99c24874cb65b6cdcf6d5ea

SHA512
3dd3ee9ffa575b233b276de0a56c9f8cf5d6219c45a4951df4fd6d237a511dc76cb77c1e68d9ec27866754ea17b42cd362b5b8c3b4f317d6d55450d75a4fd28c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
cf10d08c4843fda65ba5ea820eaa9d14

SHA1
dfdc6691136ba4bd98188caba40737f9bf79bbb8

SHA256
042ad5e9a998b00abd62700317e803e67d8ca3453be4d9bfa4cbbf70eef1901a

SHA512
264dea4ae8e09199a3fe9589f35c065ff2526dd19f6a41777f473acfb5e7fb0a2bdc1f4e52598851083368c038b7bcda0deb35604fbfb953fc918862f781c10c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dmpgfcyt.fiu.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\knoqidcnmalcoclquqtaurkvifnldr
Filesize
4KB

MD5
9c0e2939e93726f02c6d63773936b035

SHA1
98538d412084fdec0e31adbc57ccc1d1cbd6ba5b

SHA256
55d03b2840cdb4e449d9eebf11828e9220045eb181084c67f71669e5c4221707

SHA512
af500eef5d7de38bae6ce75099e7618260dfabba686cc9918064436771b95955a28f208e164cd9c1630b38467bf6f8f3de7173dfd1593a62ec5f500efbe26cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp89F0.tmp
Filesize
1KB

MD5
b2843e2cf6c48890a8dc8aefe7ea301e

SHA1
b7f106d1a8fbc14bb3643b409018015fd412d1b6

SHA256
3d451299fe1159cebfd5e2cdc502d6ba7d54b310430822f76a40b6d31ec8d9d2

SHA512
87603a9252ec41abd54ea4552f23b84f1df33c17638621ba4310f4837106eced9c0229bc615b19cca9cd3033e71bb02986ff92ee888d99ba337b092a50991aea

Download Submit
memory/1044-108-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1044-111-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1044-110-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1492-29-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/1492-22-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/1492-78-0x0000000075A70000-0x0000000075ABC000-memory.dmp

Filesize
304KB

Download
memory/1492-100-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/1492-44-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/2368-9-0x0000000006220000-0x00000000062BC000-memory.dmp

Filesize
624KB

Download
memory/2368-8-0x00000000063E0000-0x00000000064A0000-memory.dmp

Filesize
768KB

Download
memory/2368-0-0x00000000751CE000-0x00000000751CF000-memory.dmp

Filesize
4KB

Download
memory/2368-4-0x00000000055F0000-0x00000000055FA000-memory.dmp

Filesize
40KB

Download
memory/2368-3-0x0000000005540000-0x00000000055D2000-memory.dmp

Filesize
584KB

Download
memory/2368-7-0x00000000058E0000-0x00000000058EC000-memory.dmp

Filesize
48KB

Download
memory/2368-2-0x0000000005BD0000-0x0000000006174000-memory.dmp

Filesize
5.6MB

Download
memory/2368-6-0x00000000058C0000-0x00000000058D0000-memory.dmp

Filesize
64KB

Download
memory/2368-1-0x0000000000A50000-0x0000000000B68000-memory.dmp

Filesize
1.1MB

Download
memory/2368-53-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/2368-5-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/2692-117-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2692-116-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2692-115-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2760-106-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2760-107-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2760-109-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3536-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-155-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-139-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-138-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-130-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-126-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-124-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3536-125-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3536-121-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3536-102-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-131-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-89-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-90-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-91-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-154-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-96-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3536-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4004-77-0x0000000007700000-0x0000000007708000-memory.dmp

Filesize
32KB

Download
memory/4004-19-0x0000000005100000-0x0000000005122000-memory.dmp

Filesize
136KB

Download
memory/4004-94-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/4004-76-0x0000000007720000-0x000000000773A000-memory.dmp

Filesize
104KB

Download
memory/4004-18-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/4004-75-0x0000000007620000-0x0000000007634000-memory.dmp

Filesize
80KB

Download
memory/4004-20-0x0000000005220000-0x0000000005286000-memory.dmp

Filesize
408KB

Download
memory/4004-74-0x0000000007610000-0x000000000761E000-memory.dmp

Filesize
56KB

Download
memory/4004-16-0x0000000005300000-0x0000000005928000-memory.dmp

Filesize
6.2MB

Download
memory/4004-21-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Filesize
408KB

Download
memory/4004-17-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/4004-68-0x00000000070B0000-0x0000000007153000-memory.dmp

Filesize
652KB

Download
memory/4004-15-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/4004-57-0x0000000075A70000-0x0000000075ABC000-memory.dmp

Filesize
304KB

Download
memory/4004-55-0x0000000006150000-0x000000000619C000-memory.dmp

Filesize
304KB

Download
memory/4004-73-0x00000000075E0000-0x00000000075F1000-memory.dmp

Filesize
68KB

Download
memory/4004-72-0x0000000007660000-0x00000000076F6000-memory.dmp

Filesize
600KB

Download
memory/4004-71-0x0000000007450000-0x000000000745A000-memory.dmp

Filesize
40KB

Download
memory/4004-14-0x00000000027E0000-0x0000000002816000-memory.dmp

Filesize
216KB

Download
memory/4004-34-0x0000000005B10000-0x0000000005E64000-memory.dmp

Filesize
3.3MB

Download
memory/4004-69-0x0000000007A30000-0x00000000080AA000-memory.dmp

Filesize
6.5MB

Download
memory/4004-70-0x00000000073E0000-0x00000000073FA000-memory.dmp

Filesize
104KB

Download
memory/4004-56-0x0000000007070000-0x00000000070A2000-memory.dmp

Filesize
200KB

Download
memory/4004-67-0x0000000006690000-0x00000000066AE000-memory.dmp

Filesize
120KB

Download
memory/4004-54-0x00000000060C0000-0x00000000060DE000-memory.dmp

Filesize
120KB

Download

description	pid	process	target process
PID 2368 wrote to memory of 4004	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	powershell.exe
PID 2368 wrote to memory of 4004	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	powershell.exe
PID 2368 wrote to memory of 4004	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	powershell.exe
PID 2368 wrote to memory of 1492	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	powershell.exe
PID 2368 wrote to memory of 1492	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	powershell.exe
PID 2368 wrote to memory of 1492	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	powershell.exe
PID 2368 wrote to memory of 1480	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	schtasks.exe
PID 2368 wrote to memory of 1480	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	schtasks.exe
PID 2368 wrote to memory of 1480	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	schtasks.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 2368 wrote to memory of 3536	2368	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 2760	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 2760	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 2760	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 2760	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 1044	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 1044	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 1044	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 1044	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 1628	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 1628	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 1628	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 2692	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 2692	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 2692	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe
PID 3536 wrote to memory of 2692	3536	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe	f251fe71103ef7bc4cbdbcfe9c1d7c4a595f831e51cf4064f2bfa595f47bda35.exe