Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
24/08/2024, 01:38
General
- Target fb76f5758caf02faf947639ea854ac599d14d6beb0ec5e9e09454ef4e2563121.exe
- Size 1.8MB
- Sample240824-b2hamsyfpb
- SHA256 fb76f5758caf02faf947639ea854ac599d14d6beb0ec5e9e09454ef4e2563121
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
redline
-
LiveTraffic
-
95.179.163.21:29257
Extracted
-
redline
-
@CLOUDYTTEAM
-
65.21.18.51:45580
Extracted
-
stealc
-
default2
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
redline
-
14082024
-
185.215.113.67:21405
Extracted
-
redline
-
816FA
-
88.99.151.68:7200
Extracted
-
amadey
-
4.41
-
a51500
-
http://api.garageserviceoperation.com
-
install_dir
0cf505a27f
-
install_file
ednfovi.exe
-
strings_key
0044a8b8e295529eaf3743c9bc3171d2
-
url_paths
/CoreOPT/index.php
Extracted
-
xworm
-
154.216.18.213:7000
-
install_file
USB.exe
Extracted
-
redline
-
cheat
-
62.113.117.95:29928
Extracted
-
lumma
-
https://potentioallykeos.shop/api
-
https://deicedosmzj.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect Xworm Payload 1 IoCs
- Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 8 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Drops startup file 2 IoCs
- Executes dropped EXE 43 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 37 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Enumerates processes with tasklist 1 TTPs 10 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
- Suspicious use of SetThreadContext 7 IoCs
- Drops file in Windows directory 8 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- Program crash 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 13 IoCs
Processor information is often read in order to detect sandboxing environments.
- Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Kills process with taskkill 1 IoCs
- Modifies registry class 5 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 9 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\fb76f5758caf02faf947639ea854ac599d14d6beb0ec5e9e09454ef4e2563121.exe"C:\Users\Admin\AppData\Local\Temp\fb76f5758caf02faf947639ea854ac599d14d6beb0ec5e9e09454ef4e2563121.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Nr5kUM4P0I.exe"C:\Users\Admin\AppData\Roaming\Nr5kUM4P0I.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\xa2ZXwn45N.exe"C:\Users\Admin\AppData\Roaming\xa2ZXwn45N.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\setup2.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\setup2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 2285⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000129001\clcs.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\clcs.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 9085⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000135001\14082024.exe"C:\Users\Admin\AppData\Local\Temp\1000135001\14082024.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000147001\BattleGermany.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\BattleGermany.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Cassette Cassette.cmd & Cassette.cmd & exit5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 1774796⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "FoolBurkeRetainedWait" Drop6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Tracked + ..\Luggage + ..\Prime + ..\Involved + ..\Fluid + ..\Newport + ..\Rod + ..\Society s6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\177479\Community.pifCommunity.pif s6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Capable" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Capable" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST8⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "SkyPilot" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc onlogon /F /RL HIGHEST7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe7⤵
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 156⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit5⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 403656⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "HopeBuildersGeniusIslam" Sonic6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Mr + ..\Minister + ..\Template + ..\Dietary + ..\Speak + ..\Mobile + ..\Zinc + ..\Continue s6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\40365\Beijing.pifBeijing.pif s6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\1000217001\Setup1.exe"C:\Users\Admin\AppData\Local\Temp\1000217001\Setup1.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 9128⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000218001\Setup2.exe"C:\Users\Admin\AppData\Local\Temp\1000218001\Setup2.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 9568⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000219001\GOLD.exe"C:\Users\Admin\AppData\Local\Temp\1000219001\GOLD.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000220001\crypteda.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\yLM1dblrlo.exe"C:\Users\Admin\AppData\Roaming\yLM1dblrlo.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\KLbPmx4Zs7.exe"C:\Users\Admin\AppData\Roaming\KLbPmx4Zs7.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000221001\setup2.exe"C:\Users\Admin\AppData\Local\Temp\1000221001\setup2.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 3568⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000223001\aa51fb9ef7.exe"C:\Users\Admin\AppData\Local\Temp\1000223001\aa51fb9ef7.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 56⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000157001\coreplugin.exe"C:\Users\Admin\AppData\Local\Temp\1000157001\coreplugin.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Anytime Anytime.cmd & Anytime.cmd & exit5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 2971456⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "CorkBkConditionsMoon" Scary6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Dependence + ..\Nsw + ..\Developmental + ..\Shared + ..\Ranges + ..\Notify + ..\Pending + ..\Previously k6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\297145\Cultures.pifCultures.pif k6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 56⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000162001\Indentif.exe"C:\Users\Admin\AppData\Local\Temp\1000162001\Indentif.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1000170001\LummaC22222.exe"C:\Users\Admin\AppData\Local\Temp\1000170001\LummaC22222.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 11245⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe"C:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\onefile_1232_133689371753282010\stub.exeC:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name7⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"6⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"6⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""6⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"7⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""6⤵
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe7⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"6⤵
- Clipboard Data
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard7⤵
- Clipboard Data
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"6⤵
-
C:\Windows\system32\chcp.comchcp7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"6⤵
-
C:\Windows\system32\chcp.comchcp7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles7⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"6⤵
- Network Service Discovery
-
C:\Windows\system32\systeminfo.exesysteminfo7⤵
- Gathers system information
-
-
C:\Windows\system32\HOSTNAME.EXEhostname7⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername7⤵
- Collects information from the system
-
-
C:\Windows\system32\net.exenet user7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user8⤵
-
-
-
C:\Windows\system32\query.exequery user7⤵
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"8⤵
-
-
-
C:\Windows\system32\net.exenet localgroup7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup8⤵
-
-
-
C:\Windows\system32\net.exenet localgroup administrators7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators8⤵
-
-
-
C:\Windows\system32\net.exenet user guest7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest8⤵
-
-
-
C:\Windows\system32\net.exenet user administrator7⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator8⤵
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command7⤵
-
-
C:\Windows\system32\tasklist.exetasklist /svc7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\ipconfig.exeipconfig /all7⤵
- Gathers network information
-
-
C:\Windows\system32\ROUTE.EXEroute print7⤵
-
-
C:\Windows\system32\ARP.EXEarp -a7⤵
- Network Service Discovery
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano7⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Windows\system32\sc.exesc query type= service state= all7⤵
- Launches sc.exe
-
-
C:\Windows\system32\netsh.exenetsh firewall show state7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh firewall show config7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000179001\SеtuÑ€111.exe"C:\Users\Admin\AppData\Local\Temp\1000179001\SеtuÑ€111.exe"4⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 9925⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000184001\WindowsUI.exe"C:\Users\Admin\AppData\Local\Temp\1000184001\WindowsUI.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1000185001\xxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000185001\xxxx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_xxxx.exe"C:\Users\Admin\AppData\Local\Temp\._cache_xxxx.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\XClient_protected.exe"C:\Users\Admin\AppData\Local\Temp\XClient_protected.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\graeto.exe"C:\Users\Admin\AppData\Local\Temp\graeto.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\._cache_RegAsm.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\qwpgzr.exe"C:\Users\Admin\AppData\Local\Temp\qwpgzr.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_qwpgzr.exe"C:\Users\Admin\AppData\Local\Temp\._cache_qwpgzr.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\._cache_RegAsm.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate6⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\XClient_protected.exe"C:\Users\Admin\AppData\Local\Temp\XClient_protected.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & echo URL="C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\297145\Cultures.pifC:\Users\Admin\AppData\Local\Temp\297145\Cultures.pif2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 10163⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 10483⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4092 -ip 40921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1524 -ip 15241⤵
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4600 -ip 46001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4600 -ip 46001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 452 -ip 4521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3576 -ip 35761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4932 -ip 49321⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2160 -ip 21601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1544 -ip 15441⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
8System Information Discovery
10System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
._cache_RegAsm.exe
._cache_qwpgzr.exe
._cache_xxxx.exe
GOLD.exe
crypteda.exe
setup2.exe
stealc_default2.exe
clcs.exe
14082024.exe
BattleGermany.exe
runtime.exe
coreplugin.exe
Indentif.exe
LummaC22222.exe
5PHCENYBS068Y01.exe
Sеtuр111.exe
WindowsUI.exe
xxxx.exe
Setup1.exe
Setup2.exe
aa51fb9ef7.exe
Community.pif
s
s
axplong.exe
Anytime
Cassette
Continue
Continues
Corresponding
Dependence
Dietary
Drop
F8295E00
Fluid
Involved
Luggage
Metal
Minister
Mobile
Mr
Newport
Prime
Rod
Scary
Society
Sonic
Speak
Strikes
Template
Tmp9C11.tmp
Tracked
Web.db
Web.db
XClient_protected.exe
Zinc
__PSScriptPolicyTest_y1gwljvs.kei.ps1
graeto.exe
qwpgzr.exe
tmp98CF.tmp
tmp9910.tmp
tmp9927.tmp
tmp9957.tmp
76b53b3ec448f7ccdda2063b15d2bfc3_6f95b8b4-c02b-43c9-8cd4-016780936b63
Nr5kUM4P0I.exe
xa2ZXwn45N.exe
Microsoft Edge.lnk
Google Chrome.lnk
memory/116-22-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-468-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-19-0x0000000000DD1000-0x0000000000DFF000-memory.dmp
memory/116-557-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-499-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-20-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-317-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-171-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-313-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-184-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-225-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-406-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-21-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-17-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/116-178-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/408-92-0x00000000004B0000-0x00000000005C2000-memory.dmp
memory/432-1243-0x0000000000140000-0x000000000015E000-memory.dmp
memory/640-0-0x0000000000C50000-0x0000000001104000-memory.dmp
memory/640-3-0x0000000000C50000-0x0000000001104000-memory.dmp
memory/640-2-0x0000000000C51000-0x0000000000C7F000-memory.dmp
memory/640-4-0x0000000000C50000-0x0000000001104000-memory.dmp
memory/640-16-0x0000000000C50000-0x0000000001104000-memory.dmp
memory/640-1-0x0000000077404000-0x0000000077406000-memory.dmp
memory/884-271-0x0000000000770000-0x00000000007C2000-memory.dmp
memory/920-514-0x0000000140000000-0x0000000140278000-memory.dmp
memory/920-550-0x0000000140000000-0x0000000140278000-memory.dmp
memory/920-566-0x0000000000400000-0x0000000000E2D000-memory.dmp
memory/920-517-0x0000000140000000-0x0000000140278000-memory.dmp
memory/920-521-0x0000000140000000-0x0000000140278000-memory.dmp
memory/920-518-0x0000000140000000-0x0000000140278000-memory.dmp
memory/920-508-0x0000000140000000-0x0000000140278000-memory.dmp
memory/920-516-0x0000000140000000-0x0000000140278000-memory.dmp
memory/920-515-0x0000000140000000-0x0000000140278000-memory.dmp
memory/920-520-0x0000000140000000-0x0000000140278000-memory.dmp
memory/920-519-0x0000000140000000-0x0000000140278000-memory.dmp
memory/1080-679-0x000002151F0C0000-0x000002151F0E2000-memory.dmp
memory/1524-318-0x0000000000400000-0x000000000106A000-memory.dmp
memory/1524-316-0x0000000000400000-0x000000000106A000-memory.dmp
memory/1880-1072-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/2108-124-0x0000000000F10000-0x0000000000F62000-memory.dmp
memory/2108-232-0x0000000008A00000-0x0000000008A50000-memory.dmp
memory/2820-470-0x0000000000940000-0x0000000000992000-memory.dmp
memory/3312-1065-0x0000000000260000-0x0000000000AD6000-memory.dmp
memory/3312-1119-0x0000000000260000-0x0000000000AD6000-memory.dmp
memory/3312-1120-0x0000000000260000-0x0000000000AD6000-memory.dmp
memory/3312-1131-0x0000000000260000-0x0000000000AD6000-memory.dmp
memory/3312-1140-0x0000000000260000-0x0000000000AD6000-memory.dmp
memory/3360-123-0x0000000000550000-0x00000000005DE000-memory.dmp
memory/3360-183-0x0000000008130000-0x0000000008196000-memory.dmp
memory/3360-185-0x0000000009BF0000-0x0000000009DB2000-memory.dmp
memory/3360-186-0x000000000A2F0000-0x000000000A81C000-memory.dmp
memory/3468-99-0x0000000000400000-0x000000000050D000-memory.dmp
memory/3468-94-0x0000000000400000-0x000000000050D000-memory.dmp
memory/3468-98-0x0000000000400000-0x000000000050D000-memory.dmp
memory/3468-96-0x0000000000400000-0x000000000050D000-memory.dmp
memory/3468-119-0x0000000000400000-0x000000000050D000-memory.dmp
memory/3768-405-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/3768-404-0x0000000000DD0000-0x0000000001284000-memory.dmp
memory/4092-162-0x0000000000400000-0x00000000005EB000-memory.dmp
memory/4164-887-0x00000000009B0000-0x0000000000E76000-memory.dmp
memory/4164-885-0x00000000009B0000-0x0000000000E76000-memory.dmp
memory/4396-1052-0x0000000000260000-0x0000000000AD6000-memory.dmp
memory/4396-1128-0x0000000000260000-0x0000000000AD6000-memory.dmp
memory/4396-1097-0x0000000000260000-0x0000000000AD6000-memory.dmp
memory/4396-1098-0x0000000000260000-0x0000000000AD6000-memory.dmp
memory/4600-541-0x0000000000DB0000-0x0000000000DFC000-memory.dmp
memory/4600-542-0x0000000000DB0000-0x0000000000DFC000-memory.dmp
memory/4600-490-0x0000000000DB0000-0x0000000000DFC000-memory.dmp
memory/4692-735-0x00000000004C0000-0x000000000059A000-memory.dmp
memory/4692-737-0x0000000004F30000-0x0000000004F44000-memory.dmp
memory/4692-738-0x0000000004FF0000-0x000000000508C000-memory.dmp
memory/4836-469-0x0000000000510000-0x0000000000753000-memory.dmp
memory/4836-188-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/4836-180-0x0000000000510000-0x0000000000753000-memory.dmp
memory/4856-547-0x0000000003B80000-0x0000000003BEF000-memory.dmp
memory/4856-549-0x0000000003B80000-0x0000000003BEF000-memory.dmp
memory/4856-545-0x0000000003B80000-0x0000000003BEF000-memory.dmp
memory/4856-544-0x0000000003B80000-0x0000000003BEF000-memory.dmp
memory/4856-543-0x0000000003B80000-0x0000000003BEF000-memory.dmp
memory/4856-548-0x0000000003B80000-0x0000000003BEF000-memory.dmp
memory/4856-546-0x0000000003B80000-0x0000000003BEF000-memory.dmp
memory/4960-41-0x000000007301E000-0x000000007301F000-memory.dmp
memory/4960-42-0x0000000000580000-0x00000000005D4000-memory.dmp
memory/4972-66-0x0000000006B30000-0x0000000006B4E000-memory.dmp
memory/4972-80-0x0000000007090000-0x00000000070CC000-memory.dmp
memory/4972-47-0x0000000005660000-0x00000000056F2000-memory.dmp
memory/4972-69-0x0000000007380000-0x0000000007998000-memory.dmp
memory/4972-44-0x0000000000400000-0x0000000000452000-memory.dmp
memory/4972-46-0x0000000005B70000-0x0000000006114000-memory.dmp
memory/4972-91-0x0000000007200000-0x000000000724C000-memory.dmp
memory/4972-48-0x0000000005610000-0x000000000561A000-memory.dmp
memory/4972-65-0x00000000063A0000-0x0000000006416000-memory.dmp
memory/4972-71-0x0000000007030000-0x0000000007042000-memory.dmp
memory/4972-70-0x00000000070F0000-0x00000000071FA000-memory.dmp
memory/5196-1423-0x0000000000610000-0x0000000000B7A000-memory.dmp
memory/5196-1489-0x0000000000610000-0x0000000000B7A000-memory.dmp
memory/5352-1490-0x00000000005C0000-0x00000000006B6000-memory.dmp
memory/5972-1154-0x0000000000E10000-0x0000000000EEC000-memory.dmp