Malware Analysis Report

2025-04-13 22:08

Sample ID 240825-lvelaaxgjf
Target afa97b6dbd655a5717f6d6a7122d6a40N.exe
SHA256 e60984f9b1bcc7b2159e84525a9fe8121eb0302bc3b3b2e20b7de076e2a6f9bf
Tags
upx discovery persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e60984f9b1bcc7b2159e84525a9fe8121eb0302bc3b3b2e20b7de076e2a6f9bf

Threat Level: Shows suspicious behavior

The file afa97b6dbd655a5717f6d6a7122d6a40N.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx discovery persistence

Checks computer location settings

UPX packed file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-25 09:50

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-25 09:50

Reported

2024-08-25 09:53

Platform

win7-20240704-en

Max time kernel

119s

Max time network

62s

Command Line

"C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindows\\WindowsService.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1052 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 1052 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 1052 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 1052 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 1052 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 1052 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 1052 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 1052 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 3220 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Windows\SysWOW64\cmd.exe
PID 3220 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Windows\SysWOW64\cmd.exe
PID 3220 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Windows\SysWOW64\cmd.exe
PID 3220 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Windows\SysWOW64\cmd.exe
PID 3380 wrote to memory of 3432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3380 wrote to memory of 3432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3380 wrote to memory of 3432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3380 wrote to memory of 3432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3220 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3220 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3220 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3220 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 520 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 520 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 520 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 520 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 520 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 520 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 520 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 520 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 3460 wrote to memory of 3180 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

Processes

C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe

"C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe"

C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe

"C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RNMHQ.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f

C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"

C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"

C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ilovetehpussay.host4star.com udp
DE 185.53.177.50:80 ilovetehpussay.host4star.com tcp
DE 185.53.177.50:80 ilovetehpussay.host4star.com tcp

Files

memory/1052-0-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1052-3-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1052-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/1052-316-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1052-235-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1052-114-0x0000000000408000-0x0000000000409000-memory.dmp

memory/1052-447-0x0000000000400000-0x000000000043C000-memory.dmp

memory/3220-446-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RNMHQ.bat

MD5 f6a90c20834f271a907a4e2bc28184c2
SHA1 36c9d1602b74f622346fbb22693597d7889df48d
SHA256 73f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd
SHA512 39cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804

memory/3220-490-0x0000000000830000-0x000000000086C000-memory.dmp

memory/3220-489-0x0000000000830000-0x000000000086C000-memory.dmp

memory/3220-488-0x0000000000820000-0x000000000085C000-memory.dmp

\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

MD5 d6d4455789a94278bc7b3932cd6cc4ae
SHA1 7c63a71e82eab317b53b4432f3f15f067a0b85d9
SHA256 84b800edda19d3c7b15088dce240e29673d51c265fce031a575e1cd84836c275
SHA512 88aab001c3b2adf66efda0103ef753347beda04f0dd610df281e78b2740ce9416cf08668628536f7ca83ebae58a208191fa3d04a71299d0076637facc5b42bb0

memory/3460-492-0x0000000000400000-0x000000000043C000-memory.dmp

memory/3220-495-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3220-499-0x0000000000830000-0x000000000086C000-memory.dmp

memory/3220-498-0x0000000000830000-0x000000000086C000-memory.dmp

memory/3220-497-0x0000000000820000-0x000000000085C000-memory.dmp

memory/3460-500-0x0000000000400000-0x000000000043C000-memory.dmp

memory/520-1033-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3220-1048-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3460-1045-0x0000000000400000-0x000000000043C000-memory.dmp

memory/520-1053-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-25 09:50

Reported

2024-08-25 09:53

Platform

win10v2004-20240802-en

Max time kernel

118s

Max time network

104s

Command Line

"C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindows\\WindowsService.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2516 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 2516 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 2516 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 2516 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 2516 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 2516 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 2516 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 2516 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe
PID 1540 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Windows\SysWOW64\cmd.exe
PID 1540 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Windows\SysWOW64\cmd.exe
PID 1540 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 3152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4816 wrote to memory of 3152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4816 wrote to memory of 3152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1540 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 1540 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 1540 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
PID 4592 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

Processes

C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe

"C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe"

C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe

"C:\Users\Admin\AppData\Local\Temp\afa97b6dbd655a5717f6d6a7122d6a40N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JBSKG.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f

C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"

C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"

C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 ilovetehpussay.host4star.com udp
DE 185.53.177.50:80 ilovetehpussay.host4star.com tcp
DE 185.53.177.50:80 ilovetehpussay.host4star.com tcp
US 8.8.8.8:53 50.177.53.185.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/2516-0-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2516-3-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

memory/2516-5-0x0000000002C40000-0x0000000002C41000-memory.dmp

memory/2516-4-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1540-6-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1540-8-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2516-10-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1540-11-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\JBSKG.txt

MD5 f6a90c20834f271a907a4e2bc28184c2
SHA1 36c9d1602b74f622346fbb22693597d7889df48d
SHA256 73f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd
SHA512 39cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804

C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

MD5 64430b5e6cf042484f77c8f39035da7f
SHA1 aff7b5c6adab5ec6db97f258a2a2906f3ab29a63
SHA256 75a26fded94692a9cb96ba3ddd191e5a323397f07379e3fe5a998ba2381089a6
SHA512 c3e305af6adc1cee1a65b6a121a9b1dbf0dd13e48091089f1bf4a742b448775c0351febd694a548bdc2a6ced4c33f9046dac2c7dde63c713c2db9fb5d3eacadc

memory/4592-34-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1540-38-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4592-42-0x0000000000400000-0x000000000043C000-memory.dmp

memory/4592-41-0x0000000000400000-0x000000000043C000-memory.dmp

memory/4592-40-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1340-48-0x0000000000400000-0x0000000000417000-memory.dmp

memory/1340-51-0x0000000000400000-0x0000000000417000-memory.dmp

memory/1340-53-0x0000000000400000-0x0000000000417000-memory.dmp

memory/4592-55-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1340-56-0x0000000000400000-0x0000000000417000-memory.dmp

memory/1540-57-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4564-59-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1340-61-0x0000000000400000-0x0000000000417000-memory.dmp