Analysis
- max time kernel
52s - max time network
152s - platform
windows10_x64 - resource
win10v20210410 - submitted
22/05/2021, 19:03
General
- Target 7268e57a354c49482b14d239632cfd73.exe
- Size 381KB
- Sample210522-ep9csynfz6
- SHA256 a28956c03af41c83a80a84889bd4b2528c3842f14ca44d7c2d3362cbaa036b8d
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
BBS1
C2
-
87.251.71.193:80
Signatures
- ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Blocklisted process makes network request 11 IoCs
- Creates new service(s) 1 TTPs
- Downloads MZ/PE file
- Drops file in Drivers directory 2 IoCs
- Executes dropped EXE 52 IoCs
- Modifies Windows Firewall 1 TTPs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 50 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 8 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 33 IoCs
- Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 16 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Script User-Agent 26 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
C:\Users\Admin\AppData\Local\Temp\7268e57a354c49482b14d239632cfd73.exe"C:\Users\Admin\AppData\Local\Temp\7268e57a354c49482b14d239632cfd73.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9MIQ1.tmp\7268e57a354c49482b14d239632cfd73.tmp"C:\Users\Admin\AppData\Local\Temp\is-9MIQ1.tmp\7268e57a354c49482b14d239632cfd73.tmp" /SL5="$5002E,138429,56832,C:\Users\Admin\AppData\Local\Temp\7268e57a354c49482b14d239632cfd73.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KU7KT.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-KU7KT.tmp\Setup.exe" /Verysilent3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im RunWW.exe /f6⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 66⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\Versium.exe"C:\Program Files (x86)\Data Finder\Versium Research\Versium.exe" /Verysilent4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-72E2E.tmp\Versium.tmp"C:\Users\Admin\AppData\Local\Temp\is-72E2E.tmp\Versium.tmp" /SL5="$30228,138429,56832,C:\Program Files (x86)\Data Finder\Versium Research\Versium.exe" /Verysilent5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MEFEE.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-MEFEE.tmp\Setup.exe" /Verysilent6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe7⤵
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\6046326.exe"C:\Users\Admin\AppData\Roaming\6046326.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\5880758.exe"C:\Users\Admin\AppData\Roaming\5880758.exe"5⤵
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\3708586.exe"C:\Users\Admin\AppData\Roaming\3708586.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 20846⤵
- Program crash
-
-
-
-
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BSTBJ.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-BSTBJ.tmp\LabPicV3.tmp" /SL5="$20252,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-787AK.tmp\3316505.exe"C:\Users\Admin\AppData\Local\Temp\is-787AK.tmp\3316505.exe" /S /UID=lab2142⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Reference Assemblies\ZNIPNUVKZY\prolab.exe"C:\Program Files\Reference Assemblies\ZNIPNUVKZY\prolab.exe" /VERYSILENT3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-K0CNT.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-K0CNT.tmp\prolab.tmp" /SL5="$40260,575243,216576,C:\Program Files\Reference Assemblies\ZNIPNUVKZY\prolab.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\6e-c0360-ec9-b5ca4-c36d8e121f337\Vaezhalyqypy.exe"C:\Users\Admin\AppData\Local\Temp\6e-c0360-ec9-b5ca4-c36d8e121f337\Vaezhalyqypy.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\12-0258c-52f-c96a4-1015417e2eed2\ZHowoqaeqami.exe"C:\Users\Admin\AppData\Local\Temp\12-0258c-52f-c96a4-1015417e2eed2\ZHowoqaeqami.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xkk3sodf.wfp\001.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\xkk3sodf.wfp\001.exeC:\Users\Admin\AppData\Local\Temp\xkk3sodf.wfp\001.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g5ygt4ad.nxx\GcleanerEU.exe /eufive & exit4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1eaprzja.5mr\installer.exe /qn CAMPAIGN="654" & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\1eaprzja.5mr\installer.exeC:\Users\Admin\AppData\Local\Temp\1eaprzja.5mr\installer.exe /qn CAMPAIGN="654"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\1eaprzja.5mr\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\1eaprzja.5mr\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1621451165 /qn CAMPAIGN=""654"" " CAMPAIGN="654"6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\flpumjdl.b4c\hbggg.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\flpumjdl.b4c\hbggg.exeC:\Users\Admin\AppData\Local\Temp\flpumjdl.b4c\hbggg.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pa0bimfx.qfg\Setup3310.exe /Verysilent /subid=623 & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\pa0bimfx.qfg\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\pa0bimfx.qfg\Setup3310.exe /Verysilent /subid=6235⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-SFEKI.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-SFEKI.tmp\Setup3310.tmp" /SL5="$103E2,138429,56832,C:\Users\Admin\AppData\Local\Temp\pa0bimfx.qfg\Setup3310.exe" /Verysilent /subid=6236⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-47JEJ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-47JEJ.tmp\Setup.exe" /Verysilent7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\johpwgqz.fsf\google-game.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\johpwgqz.fsf\google-game.exeC:\Users\Admin\AppData\Local\Temp\johpwgqz.fsf\google-game.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",getname6⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vn4lmtcc.0v5\setup.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\vn4lmtcc.0v5\setup.exeC:\Users\Admin\AppData\Local\Temp\vn4lmtcc.0v5\setup.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\vn4lmtcc.0v5\setup.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30007⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k3iaodq0.dd1\GcleanerWW.exe /mixone & exit4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o5l0gk0v.2nk\005.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\o5l0gk0v.2nk\005.exeC:\Users\Admin\AppData\Local\Temp\o5l0gk0v.2nk\005.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qk153inn.kn0\toolspab1.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\qk153inn.kn0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\qk153inn.kn0\toolspab1.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\qk153inn.kn0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\qk153inn.kn0\toolspab1.exe6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3bicmo5x.0rz\702564a0.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\3bicmo5x.0rz\702564a0.exeC:\Users\Admin\AppData\Local\Temp\3bicmo5x.0rz\702564a0.exe5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\py5kkaip.q02\installer.exe /qn CAMPAIGN="654" & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\py5kkaip.q02\installer.exeC:\Users\Admin\AppData\Local\Temp\py5kkaip.q02\installer.exe /qn CAMPAIGN="654"5⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\py5kkaip.q02\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\py5kkaip.q02\ EXE_CMD_LINE="/forcecleanup /wintime 1621451165 /qn CAMPAIGN=""654"" " CAMPAIGN="654"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-OO1UR.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-OO1UR.tmp\lylal220.tmp" /SL5="$201F8,237286,153600,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NABEL.tmp\4_177039.exe"C:\Users\Admin\AppData\Local\Temp\is-NABEL.tmp\4_177039.exe" /S /UID=lylal2202⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\MSBuild\FFAPFUVHMT\irecord.exe"C:\Program Files\MSBuild\FFAPFUVHMT\irecord.exe" /VERYSILENT3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-OT4HG.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-OT4HG.tmp\irecord.tmp" /SL5="$2029C,6139911,56832,C:\Program Files\MSBuild\FFAPFUVHMT\irecord.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\recording\i-record.exe"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\45-26094-cd8-b2b92-ed986fc38f6ff\Cifuzhashamo.exe"C:\Users\Admin\AppData\Local\Temp\45-26094-cd8-b2b92-ed986fc38f6ff\Cifuzhashamo.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\91-ed0b4-1cc-19f97-1f61aaadf108f\Dawubyqugi.exe"C:\Users\Admin\AppData\Local\Temp\91-ed0b4-1cc-19f97-1f61aaadf108f\Dawubyqugi.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kxto2v4d.c2c\001.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\kxto2v4d.c2c\001.exeC:\Users\Admin\AppData\Local\Temp\kxto2v4d.c2c\001.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\v3vuzdmf.0tm\GcleanerEU.exe /eufive & exit4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qadtn1o2.nyr\installer.exe /qn CAMPAIGN="654" & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\qadtn1o2.nyr\installer.exeC:\Users\Admin\AppData\Local\Temp\qadtn1o2.nyr\installer.exe /qn CAMPAIGN="654"5⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sabwnyzn.gy0\hbggg.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\sabwnyzn.gy0\hbggg.exeC:\Users\Admin\AppData\Local\Temp\sabwnyzn.gy0\hbggg.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\krpdi1bx.led\Setup3310.exe /Verysilent /subid=623 & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\krpdi1bx.led\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\krpdi1bx.led\Setup3310.exe /Verysilent /subid=6235⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-NQOJJ.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-NQOJJ.tmp\Setup3310.tmp" /SL5="$10482,138429,56832,C:\Users\Admin\AppData\Local\Temp\krpdi1bx.led\Setup3310.exe" /Verysilent /subid=6236⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-H8HA0.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-H8HA0.tmp\Setup.exe" /Verysilent7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ehih0oyu.3j0\google-game.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\ehih0oyu.3j0\google-game.exeC:\Users\Admin\AppData\Local\Temp\ehih0oyu.3j0\google-game.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",getname6⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kvidnyr3.tae\setup.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\kvidnyr3.tae\setup.exeC:\Users\Admin\AppData\Local\Temp\kvidnyr3.tae\setup.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\kvidnyr3.tae\setup.exe"6⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30007⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0qd44pb3.0b4\GcleanerWW.exe /mixone & exit4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uanp2d1f.rtp\005.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\uanp2d1f.rtp\005.exeC:\Users\Admin\AppData\Local\Temp\uanp2d1f.rtp\005.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4d32anjd.ofc\toolspab1.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\4d32anjd.ofc\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\4d32anjd.ofc\toolspab1.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\4d32anjd.ofc\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\4d32anjd.ofc\toolspab1.exe6⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sodhl50s.aeo\702564a0.exe & exit4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\sodhl50s.aeo\702564a0.exeC:\Users\Admin\AppData\Local\Temp\sodhl50s.aeo\702564a0.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 4846⤵
- Program crash
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gh5yzaey.gts\installer.exe /qn CAMPAIGN="654" & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\gh5yzaey.gts\installer.exeC:\Users\Admin\AppData\Local\Temp\gh5yzaey.gts\installer.exe /qn CAMPAIGN="654"5⤵
-
-
-
-
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C1D8C71298FD2A61159D57769F05013C C2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F803331F3D18859C7BA50D11628D33052⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C1C77C404A771B8220E987876CB297A1 E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 22E24BAE8C58D2ED93E0480B95A332A4 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6AEEA1111565F2831E1024DA6797C4502⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2548F462F92DB8E924CF2A265CA48ADB E Global\MSI00002⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\F425.exeC:\Users\Admin\AppData\Local\Temp\F425.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nuoehtgk\2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ejtoiurt.exe" C:\Windows\SysWOW64\nuoehtgk\2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create nuoehtgk binPath= "C:\Windows\SysWOW64\nuoehtgk\ejtoiurt.exe /d\"C:\Users\Admin\AppData\Local\Temp\F425.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description nuoehtgk "wifi internet conection"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start nuoehtgk2⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\F7FE.exeC:\Users\Admin\AppData\Local\Temp\F7FE.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\FB0C.exeC:\Users\Admin\AppData\Local\Temp\FB0C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Perennials.exe"C:\Users\Admin\AppData\Local\Temp\Perennials.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8C.exeC:\Users\Admin\AppData\Local\Temp\8C.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\nuoehtgk\ejtoiurt.exeC:\Windows\SysWOW64\nuoehtgk\ejtoiurt.exe /d"C:\Users\Admin\AppData\Local\Temp\F425.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\49BB.exeC:\Users\Admin\AppData\Local\Temp\49BB.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/964-280-0x0000028D5D180000-0x0000028D5D1F0000-memory.dmp
memory/1008-231-0x00000133CC560000-0x00000133CC5D0000-memory.dmp
memory/1064-270-0x0000021D7A270000-0x0000021D7A2E0000-memory.dmp
memory/1084-186-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/1084-159-0x0000000000740000-0x0000000000741000-memory.dmp
memory/1084-171-0x0000000000E50000-0x0000000000E51000-memory.dmp
memory/1084-185-0x0000000000E70000-0x0000000000E90000-memory.dmp
memory/1084-187-0x0000000000EC0000-0x0000000000EC2000-memory.dmp
memory/1308-157-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1500-128-0x0000000005060000-0x0000000005061000-memory.dmp
memory/1500-133-0x00000000050B0000-0x00000000050B1000-memory.dmp
memory/1500-123-0x0000000005010000-0x0000000005011000-memory.dmp
memory/1500-121-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/1500-125-0x0000000005030000-0x0000000005031000-memory.dmp
memory/1500-124-0x0000000005020000-0x0000000005021000-memory.dmp
memory/1500-119-0x0000000003940000-0x000000000397C000-memory.dmp
memory/1500-127-0x0000000005050000-0x0000000005051000-memory.dmp
memory/1500-126-0x0000000005040000-0x0000000005041000-memory.dmp
memory/1500-129-0x0000000005070000-0x0000000005071000-memory.dmp
memory/1500-139-0x0000000005110000-0x0000000005111000-memory.dmp
memory/1500-138-0x0000000005100000-0x0000000005101000-memory.dmp
memory/1500-131-0x0000000005090000-0x0000000005091000-memory.dmp
memory/1500-137-0x00000000050F0000-0x00000000050F1000-memory.dmp
memory/1500-136-0x00000000050E0000-0x00000000050E1000-memory.dmp
memory/1500-130-0x0000000005080000-0x0000000005081000-memory.dmp
memory/1500-122-0x0000000005000000-0x0000000005001000-memory.dmp
memory/1500-132-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/1500-135-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/1500-134-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/1908-177-0x00000000001C0000-0x000000000081F000-memory.dmp
memory/2336-258-0x0000023ABF850000-0x0000023ABF8C0000-memory.dmp
memory/2376-241-0x000001565C440000-0x000001565C4B0000-memory.dmp
memory/2396-162-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2536-224-0x0000018121CD0000-0x0000018121D40000-memory.dmp
memory/3824-245-0x0000000005090000-0x0000000005091000-memory.dmp
memory/3824-192-0x0000000005010000-0x0000000005011000-memory.dmp
memory/3824-211-0x0000000005070000-0x0000000005071000-memory.dmp
memory/3824-256-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/3824-239-0x0000000005080000-0x0000000005081000-memory.dmp
memory/3824-199-0x0000000005040000-0x0000000005041000-memory.dmp
memory/3824-203-0x0000000005060000-0x0000000005061000-memory.dmp
memory/3824-190-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3824-194-0x0000000005020000-0x0000000005021000-memory.dmp
memory/3824-195-0x0000000005030000-0x0000000005031000-memory.dmp
memory/3824-182-0x0000000003930000-0x000000000396C000-memory.dmp
memory/3824-191-0x0000000005000000-0x0000000005001000-memory.dmp
memory/3824-284-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/3824-272-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/3824-267-0x00000000050B0000-0x00000000050B1000-memory.dmp
memory/3824-202-0x0000000005050000-0x0000000005051000-memory.dmp
memory/3888-188-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3896-209-0x000001D020F50000-0x000001D020F9B000-memory.dmp
memory/3896-214-0x000001D021010000-0x000001D021080000-memory.dmp
memory/3940-189-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3976-114-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4008-165-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4368-205-0x0000000004F9E000-0x000000000509F000-memory.dmp
memory/4368-206-0x0000000004E30000-0x0000000004E8C000-memory.dmp
memory/4456-215-0x0000000002B70000-0x0000000002B72000-memory.dmp
memory/4528-226-0x00000220281D0000-0x0000022028240000-memory.dmp
memory/4604-230-0x0000000002690000-0x0000000002692000-memory.dmp
memory/4716-244-0x00000000004B0000-0x00000000004B1000-memory.dmp
memory/4716-287-0x00000000025E0000-0x0000000002611000-memory.dmp
memory/4716-291-0x0000000002630000-0x0000000002631000-memory.dmp
memory/4716-260-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/4748-305-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4776-265-0x0000000000F00000-0x0000000000F09000-memory.dmp
memory/4776-261-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/4776-250-0x0000000000620000-0x0000000000621000-memory.dmp
memory/4804-271-0x0000000002FB0000-0x0000000002FB1000-memory.dmp
memory/4804-282-0x000000000E670000-0x000000000E671000-memory.dmp
memory/4804-279-0x0000000002FC0000-0x0000000002FD0000-memory.dmp
memory/4804-290-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/4804-277-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
memory/4804-257-0x0000000000DB0000-0x0000000000DB1000-memory.dmp
memory/4804-286-0x000000000E250000-0x000000000E251000-memory.dmp
memory/4968-299-0x0000000002710000-0x0000000002711000-memory.dmp
memory/4968-297-0x0000000004BF0000-0x0000000004C2A000-memory.dmp
memory/4968-276-0x00000000004E0000-0x00000000004E1000-memory.dmp
memory/4968-288-0x0000000000ED0000-0x0000000000ED1000-memory.dmp