Analysis
- max time kernel
83s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
23/01/2024, 16:27
General
- Target SecuriteInfo.com.Win64.Evo-gen.16085.20859.exe
- Size 3.7MB
- Sample240123-tx31naccar
- SHA256 07fc70e17fc81a62cce3afd89755eb174e090bb3c0f170ea23a55ac7cdda1820
Malware Config
Extracted
-
djvu
-
http://habrafa.com/test2/get.php
-
extension
.cdtt
-
offline_id
Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1
- payload_url
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0845OSkw
Extracted
-
stealc
-
http://185.172.128.24
-
url_path
/40d570f44e84a4�4.php
Extracted
-
smokeloader
-
pub3
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Extracted
-
redline
-
LogsDiller Cloud (Telegram: @logsdillabot)
-
45.15.156.60:12050
Extracted
-
fabookie
-
http://app.alie3ksgaa.com/check/safe
Signatures
- Detect Fabookie payload 1 IoCs
- Detect ZGRat V1 7 IoCs
- Detected Djvu ransomware 5 IoCs
- Djvu Ransomware
Ransomware which is a variant of the STOP family.
- Fabookie
Fabookie is facebook account info stealer.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Creates new service(s) 1 TTPs
- Downloads MZ/PE file
- Stops running service(s) 3 TTPs
- .NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 24 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 29 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 16 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 12 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 24 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.16085.20859.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.16085.20859.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\GuardFox\qizZt7Bur6z1txTH4YXbihzk.exe"C:\Users\Admin\Documents\GuardFox\qizZt7Bur6z1txTH4YXbihzk.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\GuardFox\YKK0vMV080jyVNM0bgr2l5L5.exe"C:\Users\Admin\Documents\GuardFox\YKK0vMV080jyVNM0bgr2l5L5.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\Documents\GuardFox\KZH0_ViJLjDh1uYJKXnz_kpG.exe"C:\Users\Admin\Documents\GuardFox\KZH0_ViJLjDh1uYJKXnz_kpG.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 3403⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\GuardFox\cOJ7wsghBeakoo5SG56pGvIV.exe"C:\Users\Admin\Documents\GuardFox\cOJ7wsghBeakoo5SG56pGvIV.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\oPfk.CPL",3⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\oPfk.CPL",4⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\oPfk.CPL",5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\oPfk.CPL",6⤵
-
-
-
-
-
-
C:\Users\Admin\Documents\GuardFox\DoewBw18fNbRUt9tzl2z14d9.exe"C:\Users\Admin\Documents\GuardFox\DoewBw18fNbRUt9tzl2z14d9.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 5123⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\GuardFox\2vg8st5gxt7xVyaMTMyPHcEB.exe"C:\Users\Admin\Documents\GuardFox\2vg8st5gxt7xVyaMTMyPHcEB.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Documents\GuardFox\2vg8st5gxt7xVyaMTMyPHcEB.exe" & del "C:\ProgramData\*.dll"" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 25123⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\GuardFox\0X5ArJglY2ONQo5sIbFdVoVP.exe"C:\Users\Admin\Documents\GuardFox\0X5ArJglY2ONQo5sIbFdVoVP.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PV7AS.tmp\0X5ArJglY2ONQo5sIbFdVoVP.tmp"C:\Users\Admin\AppData\Local\Temp\is-PV7AS.tmp\0X5ArJglY2ONQo5sIbFdVoVP.tmp" /SL5="$601EA,3515248,54272,C:\Users\Admin\Documents\GuardFox\0X5ArJglY2ONQo5sIbFdVoVP.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe"C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe" -i4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe"C:\Users\Admin\AppData\Local\Web Resource Viewer\webresourceviewer.exe" -s4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\Documents\GuardFox\zJ3jMj0GzYgdwDzzw9qRdQOd.exe"C:\Users\Admin\Documents\GuardFox\zJ3jMj0GzYgdwDzzw9qRdQOd.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Documents\GuardFox\p2ALwcMAIBBRoJauOyM6tY_I.exe"C:\Users\Admin\Documents\GuardFox\p2ALwcMAIBBRoJauOyM6tY_I.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\GuardFox\p2ALwcMAIBBRoJauOyM6tY_I.exe"C:\Users\Admin\Documents\GuardFox\p2ALwcMAIBBRoJauOyM6tY_I.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\6b44a039-e4e0-4261-8e4b-372b230f79af" /deny *S-1-1-0:(OI)(CI)(DE,DC)4⤵
- Modifies file permissions
-
-
C:\Users\Admin\Documents\GuardFox\p2ALwcMAIBBRoJauOyM6tY_I.exe"C:\Users\Admin\Documents\GuardFox\p2ALwcMAIBBRoJauOyM6tY_I.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\Documents\GuardFox\p2ALwcMAIBBRoJauOyM6tY_I.exe"C:\Users\Admin\Documents\GuardFox\p2ALwcMAIBBRoJauOyM6tY_I.exe" --Admin IsNotAutoStart IsNotTask5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 5686⤵
- Program crash
-
-
-
-
-
-
C:\Users\Admin\Documents\GuardFox\S4yNXJTJDxFHKlOXMvXdgu88.exe"C:\Users\Admin\Documents\GuardFox\S4yNXJTJDxFHKlOXMvXdgu88.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\GuardFox\ilGyp4NneBqw4pbxzA7S7WGw.exe"C:\Users\Admin\Documents\GuardFox\ilGyp4NneBqw4pbxzA7S7WGw.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe3⤵
-
-
-
C:\Users\Admin\Documents\GuardFox\u1nAJohI9NiVQVIhO_u_9qRV.exe"C:\Users\Admin\Documents\GuardFox\u1nAJohI9NiVQVIhO_u_9qRV.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\Documents\GuardFox\xMUVVLpKRVMcQQBdGWoU2g9b.exe"C:\Users\Admin\Documents\GuardFox\xMUVVLpKRVMcQQBdGWoU2g9b.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Documents\GuardFox\_d_6oqBrYO9oDROynM5zoWeZ.exe"C:\Users\Admin\Documents\GuardFox\_d_6oqBrYO9oDROynM5zoWeZ.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Documents\GuardFox\hQgtvqK8VmQ1LY7m1AXNSeZx.exe"C:\Users\Admin\Documents\GuardFox\hQgtvqK8VmQ1LY7m1AXNSeZx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\Documents\GuardFox\1h5oX6AfKdjA7QKitchLMY7C.exe"C:\Users\Admin\Documents\GuardFox\1h5oX6AfKdjA7QKitchLMY7C.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\GuardFox\g4qp6_JNNhsKXfrdE9lVV56O.exe"C:\Users\Admin\Documents\GuardFox\g4qp6_JNNhsKXfrdE9lVV56O.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN g4qp6_JNNhsKXfrdE9lVV56O.exe /TR "C:\Users\Admin\Documents\GuardFox\g4qp6_JNNhsKXfrdE9lVV56O.exe" /F4⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000113001\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\1000113001\e0cbefcb1af40c7d4aff4aca26621a98.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 3725⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 3885⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 3925⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 6805⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 7205⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 7205⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 7205⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 7485⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 7685⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 8965⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 7645⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 6245⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 8765⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 8805⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 7965⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 8805⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 8285⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 7845⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 8845⤵
- Program crash
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000114001\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000114001\InstallSetup8.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12517⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F7⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\nsk7586.tmpC:\Users\Admin\AppData\Local\Temp\nsk7586.tmp5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000115001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000115001\toolspub1.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000117001\rty27.exe"C:\Users\Admin\AppData\Local\Temp\1000117001\rty27.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000119001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000119001\FirstZ.exe"4⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force5⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart6⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 05⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 05⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 05⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 05⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
-
-
-
-
C:\Users\Admin\Documents\GuardFox\K9064dCxqH0SR5hUFk6wIdGs.exe"C:\Users\Admin\Documents\GuardFox\K9064dCxqH0SR5hUFk6wIdGs.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Documents\GuardFox\3WEhPygXtgmAE0ixSLD2QBPg.exe"C:\Users\Admin\Documents\GuardFox\3WEhPygXtgmAE0ixSLD2QBPg.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca8c79758,0x7ffca8c79768,0x7ffca8c797784⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1788,i,18022069968260728752,11628520543846175679,131072 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1788,i,18022069968260728752,11628520543846175679,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1788,i,18022069968260728752,11628520543846175679,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3280 --field-trial-handle=1788,i,18022069968260728752,11628520543846175679,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3228 --field-trial-handle=1788,i,18022069968260728752,11628520543846175679,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1788,i,18022069968260728752,11628520543846175679,131072 /prefetch:84⤵
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3032 -ip 30321⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 940 -ip 9401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 916 -ip 9161⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 916 -ip 9161⤵
-
C:\Users\Admin\Documents\GuardFox\g4qp6_JNNhsKXfrdE9lVV56O.exeC:\Users\Admin\Documents\GuardFox\g4qp6_JNNhsKXfrdE9lVV56O.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4008 -ip 40081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1716 -ip 17161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 916 -ip 9161⤵
-
C:\Users\Admin\AppData\Local\Temp\BBC4.exeC:\Users\Admin\AppData\Local\Temp\BBC4.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\BBC4.exeC:\Users\Admin\AppData\Local\Temp\BBC4.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 916 -ip 9161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 916 -ip 9161⤵
-
C:\Users\Admin\AppData\Local\Temp\CBE2.exeC:\Users\Admin\AppData\Local\Temp\CBE2.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd /k cmd < Dot & exit2⤵
-
C:\Windows\SysWOW64\cmd.execmd3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\DF2D.exeC:\Users\Admin\AppData\Local\Temp\DF2D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OBNPD.tmp\DF2D.tmp"C:\Users\Admin\AppData\Local\Temp\is-OBNPD.tmp\DF2D.tmp" /SL5="$602C2,3501695,54272,C:\Users\Admin\AppData\Local\Temp\DF2D.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EC2E.exeC:\Users\Admin\AppData\Local\Temp\EC2E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\620.exeC:\Users\Admin\AppData\Local\Temp\620.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\620.exeC:\Users\Admin\AppData\Local\Temp\620.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\620.exe"C:\Users\Admin\AppData\Local\Temp\620.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\620.exe"C:\Users\Admin\AppData\Local\Temp\620.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 5685⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F1A.exeC:\Users\Admin\AppData\Local\Temp\F1A.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3696 -ip 36961⤵
-
C:\Users\Admin\AppData\Local\Temp\27B3.exeC:\Users\Admin\AppData\Local\Temp\27B3.exe1⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\358F.dll1⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\358F.dll2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3A72.exeC:\Users\Admin\AppData\Local\Temp\3A72.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Modify Registry
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
ExpandSave.txt
FHJDBKJK
GCGCBAEC
StepGrant.txt
mozglue.dll
nss3.dll
103621DE9CD5414CC2538780B4B75751
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
A65DBECD82A40019E873CE4ED0A79570
ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
103621DE9CD5414CC2538780B4B75751
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
A65DBECD82A40019E873CE4ED0A79570
ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
932f00dae953ade402a6bc1bf1eb48f5
Network Persistent State
Preferences
Secure Preferences
Local State
data_1
e0cbefcb1af40c7d4aff4aca26621a98.exe
e0cbefcb1af40c7d4aff4aca26621a98.exe
e0cbefcb1af40c7d4aff4aca26621a98.exe
InstallSetup8.exe
InstallSetup8.exe
toolspub1.exe
toolspub1.exe
FirstZ.exe
288c47bbc1871b439df19ff4df68f076.exe
cached-microdesc-consensus.tmp
cached-microdescs.new
InstallSetup9.exe
__PSScriptPolicyTest_u3chcuon.csf.ps1
_shfoldr.dll
_iscrypt.dll
0X5ArJglY2ONQo5sIbFdVoVP.tmp
INetC.dll
oPfk.cpl
is-IM60E.tmp
is-LGG4H.tmp
is-UF072.tmp
webresourceviewer.exe
webresourceviewer.exe
0Cx81LmgTTDIL79OjufUMdUs.exe
0X5ArJglY2ONQo5sIbFdVoVP.exe
0X5ArJglY2ONQo5sIbFdVoVP.exe
0X5ArJglY2ONQo5sIbFdVoVP.exe
1h5oX6AfKdjA7QKitchLMY7C.exe
1h5oX6AfKdjA7QKitchLMY7C.exe
2vg8st5gxt7xVyaMTMyPHcEB.exe
3WEhPygXtgmAE0ixSLD2QBPg.exe
3WEhPygXtgmAE0ixSLD2QBPg.exe
3WEhPygXtgmAE0ixSLD2QBPg.exe
DoewBw18fNbRUt9tzl2z14d9.exe
DoewBw18fNbRUt9tzl2z14d9.exe
K9064dCxqH0SR5hUFk6wIdGs.exe
K9064dCxqH0SR5hUFk6wIdGs.exe
K9064dCxqH0SR5hUFk6wIdGs.exe
K9064dCxqH0SR5hUFk6wIdGs.exe
KZH0_ViJLjDh1uYJKXnz_kpG.exe
S4yNXJTJDxFHKlOXMvXdgu88.exe
S4yNXJTJDxFHKlOXMvXdgu88.exe
S4yNXJTJDxFHKlOXMvXdgu88.exe
YKK0vMV080jyVNM0bgr2l5L5.exe
ZILA72kaOM5pYZfXMY03cnKT.exe
_d_6oqBrYO9oDROynM5zoWeZ.exe
_d_6oqBrYO9oDROynM5zoWeZ.exe
_d_6oqBrYO9oDROynM5zoWeZ.exe
cOJ7wsghBeakoo5SG56pGvIV.exe
g4qp6_JNNhsKXfrdE9lVV56O.exe
hQgtvqK8VmQ1LY7m1AXNSeZx.exe
ilGyp4NneBqw4pbxzA7S7WGw.exe
ilGyp4NneBqw4pbxzA7S7WGw.exe
ilGyp4NneBqw4pbxzA7S7WGw.exe
p2ALwcMAIBBRoJauOyM6tY_I.exe
p2ALwcMAIBBRoJauOyM6tY_I.exe
qizZt7Bur6z1txTH4YXbihzk.exe
tpt8Z_Rgp4UVHKBj0WPdCHra.exe
u1nAJohI9NiVQVIhO_u_9qRV.exe
u1nAJohI9NiVQVIhO_u_9qRV.exe
u1nAJohI9NiVQVIhO_u_9qRV.exe
xMUVVLpKRVMcQQBdGWoU2g9b.exe
xMUVVLpKRVMcQQBdGWoU2g9b.exe
xMUVVLpKRVMcQQBdGWoU2g9b.exe
zJ3jMj0GzYgdwDzzw9qRdQOd.exe
zJ3jMj0GzYgdwDzzw9qRdQOd.exe
GPT.INI
Registry.pol
gpt.ini
memory/556-1162-0x0000000005820000-0x0000000005832000-memory.dmp
memory/556-1195-0x0000000005880000-0x00000000058BC000-memory.dmp
memory/556-826-0x0000000000F30000-0x0000000000F88000-memory.dmp
memory/556-1186-0x00000000057B0000-0x00000000057C0000-memory.dmp
memory/556-1176-0x0000000005950000-0x0000000005A5A000-memory.dmp
memory/556-1144-0x0000000005DE0000-0x00000000063F8000-memory.dmp
memory/560-1172-0x000001F5BC840000-0x000001F5BC94B000-memory.dmp
memory/560-1174-0x000001F5BCA80000-0x000001F5BCBAE000-memory.dmp
memory/560-652-0x00007FF61CC00000-0x00007FF61CC56000-memory.dmp
memory/784-879-0x0000000005670000-0x000000000570C000-memory.dmp
memory/784-841-0x00000000007E0000-0x0000000000D4C000-memory.dmp
memory/824-800-0x0000000000400000-0x0000000000414000-memory.dmp
memory/824-811-0x0000000000400000-0x0000000000414000-memory.dmp
memory/940-890-0x00000000034F0000-0x00000000038F0000-memory.dmp
memory/940-885-0x00000000034F0000-0x00000000038F0000-memory.dmp
memory/940-936-0x00000000034FF000-0x00000000038F0000-memory.dmp
memory/940-894-0x00007FFCC6AB0000-0x00007FFCC6CA5000-memory.dmp
memory/940-830-0x00000000020A0000-0x000000000212B000-memory.dmp
memory/940-934-0x00000000034F0000-0x00000000034FF000-memory.dmp
memory/996-1160-0x0000000000EB0000-0x0000000000EE2000-memory.dmp
memory/996-840-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
memory/996-843-0x0000000000400000-0x0000000000D40000-memory.dmp
memory/1508-881-0x0000000003480000-0x0000000003481000-memory.dmp
memory/1508-1170-0x00000000006A0000-0x0000000000FE7000-memory.dmp
memory/1508-882-0x00000000006A0000-0x0000000000FE7000-memory.dmp
memory/1720-11-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-653-0x00007FFC80010000-0x00007FFC80011000-memory.dmp
memory/1720-8-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-13-0x00007FFCC6AB0000-0x00007FFCC6CA5000-memory.dmp
memory/1720-823-0x00007FFCC46D0000-0x00007FFCC4999000-memory.dmp
memory/1720-10-0x00007FFC80000000-0x00007FFC80002000-memory.dmp
memory/1720-820-0x00007FFCC4FD0000-0x00007FFCC508E000-memory.dmp
memory/1720-12-0x00007FFC80030000-0x00007FFC80031000-memory.dmp
memory/1720-14-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-15-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-1-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-16-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-751-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-17-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-18-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-814-0x00007FFCC6AB0000-0x00007FFCC6CA5000-memory.dmp
memory/1720-19-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-0-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-20-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-28-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-9-0x00007FFCC46D0000-0x00007FFCC4999000-memory.dmp
memory/1720-620-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-806-0x00007FF6018A0000-0x00007FF6022E4000-memory.dmp
memory/1720-7-0x00007FFCC4FD0000-0x00007FFCC508E000-memory.dmp
memory/1720-6-0x00007FFCC46D0000-0x00007FFCC4999000-memory.dmp
memory/3032-795-0x00000000005B0000-0x00000000005BB000-memory.dmp
memory/3032-801-0x0000000000400000-0x000000000043C000-memory.dmp
memory/3032-794-0x00000000005D0000-0x00000000006D0000-memory.dmp
memory/3120-670-0x0000000000670000-0x0000000000B53000-memory.dmp
memory/3120-808-0x0000000000670000-0x0000000000B53000-memory.dmp
memory/3236-1142-0x0000000000400000-0x0000000000889000-memory.dmp
memory/3236-1113-0x0000000000400000-0x0000000000889000-memory.dmp
memory/3512-818-0x00000000022F0000-0x0000000002306000-memory.dmp
memory/3656-786-0x0000000000E60000-0x0000000001B5F000-memory.dmp
memory/3656-1194-0x0000000076460000-0x0000000076550000-memory.dmp
memory/3656-1193-0x0000000076460000-0x0000000076550000-memory.dmp
memory/3656-1207-0x0000000076460000-0x0000000076550000-memory.dmp
memory/3656-860-0x0000000000E60000-0x0000000001B5F000-memory.dmp
memory/3656-1197-0x0000000076460000-0x0000000076550000-memory.dmp
memory/3656-1196-0x0000000076460000-0x0000000076550000-memory.dmp
memory/4008-793-0x0000000000990000-0x00000000009AC000-memory.dmp
memory/4008-817-0x0000000000400000-0x000000000062E000-memory.dmp
memory/4308-862-0x00000000003D0000-0x0000000001383000-memory.dmp
memory/4308-787-0x00000000003D0000-0x0000000001383000-memory.dmp
memory/4308-1171-0x0000000077B14000-0x0000000077B16000-memory.dmp
memory/4772-810-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4772-815-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4772-802-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4772-1184-0x0000000000400000-0x0000000000537000-memory.dmp
memory/5072-796-0x0000000000500000-0x0000000000600000-memory.dmp
memory/5072-824-0x0000000000400000-0x000000000043D000-memory.dmp
memory/5072-798-0x00000000004D0000-0x00000000004DB000-memory.dmp
memory/5136-1161-0x0000000000620000-0x0000000000621000-memory.dmp
memory/5252-1127-0x0000000000400000-0x0000000000454000-memory.dmp
memory/5252-1185-0x0000000074970000-0x0000000075120000-memory.dmp
memory/5252-1169-0x00000000053B0000-0x00000000053BA000-memory.dmp
memory/5448-1106-0x0000000001EFF000-0x00000000022F0000-memory.dmp
memory/5448-1102-0x0000000001EF0000-0x0000000001EFF000-memory.dmp
memory/5712-797-0x00007FFCC6CB0000-0x00007FFCC6CB2000-memory.dmp
memory/5712-1006-0x0000000140000000-0x0000000140876000-memory.dmp
memory/5712-799-0x0000000140000000-0x0000000140876000-memory.dmp
memory/5728-812-0x00000000009B2000-0x0000000000A44000-memory.dmp
memory/5728-792-0x00000000026D0000-0x00000000027EB000-memory.dmp
memory/5792-1143-0x0000000074970000-0x0000000075120000-memory.dmp
memory/5792-903-0x0000000004FE0000-0x0000000005044000-memory.dmp
memory/5792-851-0x0000000004950000-0x00000000049B4000-memory.dmp
memory/5800-791-0x0000000000450000-0x0000000000D64000-memory.dmp
memory/5800-1173-0x0000000076460000-0x0000000076550000-memory.dmp
memory/5800-939-0x00000000053E0000-0x0000000005472000-memory.dmp
memory/5800-1175-0x0000000076460000-0x0000000076550000-memory.dmp
memory/5800-1177-0x0000000076460000-0x0000000076550000-memory.dmp
memory/5800-888-0x0000000005990000-0x0000000005F34000-memory.dmp
memory/5800-877-0x0000000000450000-0x0000000000D64000-memory.dmp
memory/5800-1183-0x0000000076460000-0x0000000076550000-memory.dmp