Analysis
- max time kernel
116s - max time network
267s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
01/04/2024, 04:49
Errors
General
- Target 26607f1a57340c8663f91491c0ce538b44e90ac51e1dea62ce659d6b5bef6280.exe
- Size 1.8MB
- Sample240401-ffnmradh41
- SHA256 26607f1a57340c8663f91491c0ce538b44e90ac51e1dea62ce659d6b5bef6280
Malware Config
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
@OLEH_PSP
-
185.172.128.33:8970
Extracted
-
amadey
-
4.18
-
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
-
redline
-
LiveTraffic
-
4.185.137.132:1632
Extracted
-
lumma
-
https://affordcharmcropwo.shop/api
-
https://enthusiasimtitleow.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 4 IoCs
- Detected google phishing page
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 7 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 30 IoCs
- Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 13 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Drops file in Windows directory 9 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 9 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of FindShellTrayWindow 16 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26607f1a57340c8663f91491c0ce538b44e90ac51e1dea62ce659d6b5bef6280.exe"C:\Users\Admin\AppData\Local\Temp\26607f1a57340c8663f91491c0ce538b44e90ac51e1dea62ce659d6b5bef6280.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\824464007487_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000042001\2e769bcf40.exe"C:\Users\Admin\AppData\Local\Temp\1000042001\2e769bcf40.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
-
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\824464007487_Desktop.zip' -CompressionLevel Optimal6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe"C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\put0nf21svphQTFaxUhsB6d9.exe"C:\Users\Admin\Pictures\put0nf21svphQTFaxUhsB6d9.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u53g.0.exe"C:\Users\Admin\AppData\Local\Temp\u53g.0.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AAKKECFBGI.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\AAKKECFBGI.exe"C:\Users\Admin\AppData\Local\Temp\AAKKECFBGI.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\AAKKECFBGI.exe9⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 300010⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u53g.1.exe"C:\Users\Admin\AppData\Local\Temp\u53g.1.exe"6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD17⤵
-
-
-
-
C:\Users\Admin\Pictures\INBoUdVL2w70COUxF8VDxbOy.exe"C:\Users\Admin\Pictures\INBoUdVL2w70COUxF8VDxbOy.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\INBoUdVL2w70COUxF8VDxbOy.exe"C:\Users\Admin\Pictures\INBoUdVL2w70COUxF8VDxbOy.exe"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"7⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes8⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
-
-
C:\Users\Admin\Pictures\0UZdetSVr9w8l2AildUHV2Yb.exe"C:\Users\Admin\Pictures\0UZdetSVr9w8l2AildUHV2Yb.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\0UZdetSVr9w8l2AildUHV2Yb.exe"C:\Users\Admin\Pictures\0UZdetSVr9w8l2AildUHV2Yb.exe"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"7⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes8⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F8⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f8⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll8⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F8⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)10⤵
- Launches sc.exe
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\REMMTv9IkixwnMoxnKyniLGQ.exe"C:\Users\Admin\Pictures\REMMTv9IkixwnMoxnKyniLGQ.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\REMMTv9IkixwnMoxnKyniLGQ.exe"C:\Users\Admin\Pictures\REMMTv9IkixwnMoxnKyniLGQ.exe"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"7⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes8⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
-
-
C:\Users\Admin\Pictures\gnp6wgZRNYMtZtLfANoNy4z7.exe"C:\Users\Admin\Pictures\gnp6wgZRNYMtZtLfANoNy4z7.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Users\Admin\Pictures\4MrMY2JmTypjjbY7Zb84GMPv.exe"C:\Users\Admin\Pictures\4MrMY2JmTypjjbY7Zb84GMPv.exe" --silent --allusers=05⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Users\Admin\Pictures\4MrMY2JmTypjjbY7Zb84GMPv.exeC:\Users\Admin\Pictures\4MrMY2JmTypjjbY7Zb84GMPv.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6e50e1d0,0x6e50e1dc,0x6e50e1e86⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\4MrMY2JmTypjjbY7Zb84GMPv.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\4MrMY2JmTypjjbY7Zb84GMPv.exe" --version6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Pictures\4MrMY2JmTypjjbY7Zb84GMPv.exe"C:\Users\Admin\Pictures\4MrMY2JmTypjjbY7Zb84GMPv.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6312 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240401045048" --session-guid=2e7c0627-a75c-4827-a320-c3ce4292bd30 --server-tracking-blob=YmZkOTBmNjBmNTY4NTlhNzdkODc5ZjJhMDRmNjczNTg4YjViZTViMjAwMWQ4YTUzMDhjNmEzY2FjYjE2Nzg2ZDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N18xMjMiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE5NDcwMzkuMzExNyIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N18xMjMiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjdmNmQ4MThhLTZhMTMtNDIxMy05ZjdhLWY3YWYzY2IzMTIwOSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=48040000000000006⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Users\Admin\Pictures\4MrMY2JmTypjjbY7Zb84GMPv.exeC:\Users\Admin\Pictures\4MrMY2JmTypjjbY7Zb84GMPv.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2ac,0x2b0,0x2b4,0x27c,0x2b8,0x6db2e1d0,0x6db2e1dc,0x6db2e1e87⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010450481\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010450481\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010450481\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010450481\assistant\assistant_installer.exe" --version6⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010450481\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010450481\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0xac0040,0xac004c,0xac00587⤵
-
-
-
-
C:\Users\Admin\Pictures\ODVBY1rsizV06jKnjDNwDirx.exe"C:\Users\Admin\Pictures\ODVBY1rsizV06jKnjDNwDirx.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
C:\Windows\SYSTEM32\msiexec.exe"msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe"ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"7⤵
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 1323⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 7843⤵
- Program crash
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6108 -s 34082⤵
-
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D3CDB424025823DB6D477F6F539206C82⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding B1E5221051AA0223EC422DCBAD1DBC24 E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 188DA0D98108BACB660949546714B121 M Global\MSI00002⤵
-
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Windows\rss\csrss.exe"C:\Windows\rss\csrss.exe"2⤵
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3aae855 /state1:0x41c64e6d1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
6Credentials In Files
5Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
e5b0464.rbs
Are.docx
mozglue.dll
powershell.exe.log
edgecompatviewlist[1].xml
StartupProfileData-NonInteractive
favicon[1].ico
4Kv5U5b1o3f[1].png
suggestions[1].en-US
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
265C0DEB29181DD1891051371C5F863A_12A01E2DD41364228929C51A0E5AEB57
CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
265C0DEB29181DD1891051371C5F863A_12A01E2DD41364228929C51A0E5AEB57
CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
additional_file0.tmp
opera_package
explorgu.exe
go.exe
amert.exe
Uni400uni.exe
random.exe
alex1234.exe
amadka.exe
redlinepanel.exe
32456.exe
goldprimeldlldf.exe
NewB.exe
swiiiii.exe
koooooo.exe
Opera_installer_2404010450488085208.dll
TmpA090.tmp
__PSScriptPolicyTest_buc42b02.rmc.ps1
ioloDMLog.txt
ioloDMLog.txt
tmpF183.tmp
u53g.0.exe
clip64.dll
cred64.dll
clip64.dll
cred64.dll
Traffic.exe
propro.exe
0UZdetSVr9w8l2AildUHV2Yb.exe
4MrMY2JmTypjjbY7Zb84GMPv.exe
INBoUdVL2w70COUxF8VDxbOy.exe
PNeYFb58qUxIoeYLa7yof5wP.exe
Q2KrB47JZmgjbYQI0asSexYJ.exe
feZGMRZubQOMOXt5vwNzLtG9.exe
gnp6wgZRNYMtZtLfANoNy4z7.exe
put0nf21svphQTFaxUhsB6d9.exe
Google Chrome.lnk
MSI4326.tmp
e5b0461.msi
VBoxDrv.sys
gpt.ini
memory/208-437-0x0000000000190000-0x000000000063E000-memory.dmp
memory/308-488-0x0000000000400000-0x000000000044C000-memory.dmp
memory/308-492-0x0000000000400000-0x000000000044C000-memory.dmp
memory/360-169-0x00007FFC449A0000-0x00007FFC4538C000-memory.dmp
memory/360-168-0x00000000003F0000-0x000000000047C000-memory.dmp
memory/360-187-0x00000000024A0000-0x00000000024B0000-memory.dmp
memory/1072-476-0x0000000000BB0000-0x0000000000F6A000-memory.dmp
memory/1072-161-0x0000000000BB0000-0x0000000000F6A000-memory.dmp
memory/1072-212-0x0000000000BB0000-0x0000000000F6A000-memory.dmp
memory/1072-43-0x0000000000BB0000-0x0000000000F6A000-memory.dmp
memory/1072-44-0x0000000000BB0000-0x0000000000F6A000-memory.dmp
memory/1072-649-0x0000000000BB0000-0x0000000000F6A000-memory.dmp
memory/1824-192-0x00000000069B0000-0x00000000069C2000-memory.dmp
memory/1824-165-0x0000000005320000-0x0000000005330000-memory.dmp
memory/1824-193-0x0000000006A10000-0x0000000006A4E000-memory.dmp
memory/1824-191-0x0000000006A80000-0x0000000006B8A000-memory.dmp
memory/1824-190-0x0000000006F10000-0x0000000007516000-memory.dmp
memory/1824-188-0x00000000066A0000-0x00000000066BE000-memory.dmp
memory/1824-167-0x0000000005510000-0x000000000551A000-memory.dmp
memory/1824-186-0x0000000005F30000-0x0000000005FA6000-memory.dmp
memory/1824-162-0x0000000071F40000-0x000000007262E000-memory.dmp
memory/1824-194-0x0000000006B90000-0x0000000006BDB000-memory.dmp
memory/1824-163-0x00000000057B0000-0x0000000005CAE000-memory.dmp
memory/1824-164-0x0000000005390000-0x0000000005422000-memory.dmp
memory/1824-160-0x0000000000AD0000-0x0000000000B22000-memory.dmp
memory/2560-152-0x0000000071F40000-0x000000007262E000-memory.dmp
memory/2560-145-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2644-151-0x0000000002C60000-0x0000000004C60000-memory.dmp
memory/2644-148-0x0000000071F40000-0x000000007262E000-memory.dmp
memory/2644-141-0x0000000071F40000-0x000000007262E000-memory.dmp
memory/2644-142-0x0000000005140000-0x0000000005150000-memory.dmp
memory/2644-140-0x0000000000750000-0x000000000090C000-memory.dmp
memory/2976-213-0x0000000004B90000-0x0000000004B91000-memory.dmp
memory/2976-215-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/2976-208-0x0000000000230000-0x00000000006E8000-memory.dmp
memory/2976-209-0x0000000000230000-0x00000000006E8000-memory.dmp
memory/2976-214-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/2976-210-0x0000000004B80000-0x0000000004B81000-memory.dmp
memory/2976-232-0x0000000000230000-0x00000000006E8000-memory.dmp
memory/3320-7-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/3320-6-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/3320-16-0x0000000001370000-0x0000000001827000-memory.dmp
memory/3320-8-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/3320-0-0x0000000001370000-0x0000000001827000-memory.dmp
memory/3320-5-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/3320-4-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/3320-3-0x0000000004D50000-0x0000000004D51000-memory.dmp
memory/3320-2-0x0000000001370000-0x0000000001827000-memory.dmp
memory/3320-9-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/3320-1-0x0000000077304000-0x0000000077305000-memory.dmp
memory/3320-11-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/3320-12-0x0000000004D90000-0x0000000004D91000-memory.dmp
memory/3532-27-0x0000000004A20000-0x0000000004A21000-memory.dmp
memory/3532-647-0x00000000003C0000-0x0000000000877000-memory.dmp
memory/3532-90-0x00000000003C0000-0x0000000000877000-memory.dmp
memory/3532-464-0x00000000003C0000-0x0000000000877000-memory.dmp
memory/3532-22-0x00000000049E0000-0x00000000049E1000-memory.dmp
memory/3532-211-0x00000000003C0000-0x0000000000877000-memory.dmp
memory/3532-19-0x00000000003C0000-0x0000000000877000-memory.dmp
memory/3532-20-0x00000000003C0000-0x0000000000877000-memory.dmp
memory/3532-60-0x00000000003C0000-0x0000000000877000-memory.dmp
memory/3532-21-0x00000000049D0000-0x00000000049D1000-memory.dmp
memory/3532-41-0x00000000003C0000-0x0000000000877000-memory.dmp
memory/3532-23-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/3532-26-0x00000000049B0000-0x00000000049B1000-memory.dmp
memory/3532-28-0x0000000004A30000-0x0000000004A31000-memory.dmp
memory/3532-25-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/3532-24-0x0000000004A00000-0x0000000004A01000-memory.dmp
memory/4716-675-0x00000000000C0000-0x0000000000578000-memory.dmp
memory/4716-477-0x00000000000C0000-0x0000000000578000-memory.dmp
memory/5072-117-0x00000171AAB00000-0x00000171AAB0A000-memory.dmp
memory/5072-62-0x00000171AA960000-0x00000171AA982000-memory.dmp
memory/5072-64-0x00000171922B0000-0x00000171922C0000-memory.dmp
memory/5072-126-0x00007FFC44770000-0x00007FFC4515C000-memory.dmp
memory/5072-104-0x00000171AAD90000-0x00000171AADA2000-memory.dmp
memory/5072-91-0x00000171922B0000-0x00000171922C0000-memory.dmp
memory/5072-68-0x00000171AAB10000-0x00000171AAB86000-memory.dmp
memory/5072-65-0x00000171922B0000-0x00000171922C0000-memory.dmp
memory/5072-63-0x00007FFC44770000-0x00007FFC4515C000-memory.dmp
memory/5080-325-0x0000017E26420000-0x0000017E26430000-memory.dmp
memory/5080-809-0x0000017E2CDB0000-0x0000017E2CDB1000-memory.dmp
memory/5080-341-0x0000017E26C00000-0x0000017E26C10000-memory.dmp
memory/5080-360-0x0000017E265B0000-0x0000017E265B2000-memory.dmp
memory/5080-810-0x0000017E2CDE0000-0x0000017E2CDE1000-memory.dmp
memory/5160-403-0x0000000000400000-0x0000000000450000-memory.dmp
memory/5184-762-0x000001C132340000-0x000001C132440000-memory.dmp
memory/5280-531-0x0000000000400000-0x000000000044C000-memory.dmp
memory/5280-546-0x0000000000400000-0x000000000044C000-memory.dmp
memory/5348-525-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5724-772-0x0000026AF8EC0000-0x0000026AF8EC2000-memory.dmp
memory/5724-780-0x0000026AF9250000-0x0000026AF9252000-memory.dmp
memory/5724-778-0x0000026AF8EF0000-0x0000026AF8EF2000-memory.dmp
memory/5828-869-0x0000018048C00000-0x0000018048D00000-memory.dmp
memory/5828-830-0x0000018048640000-0x0000018048660000-memory.dmp
memory/5828-825-0x0000018048920000-0x0000018048A20000-memory.dmp