Malware Analysis Report

2024-12-07 10:14

Sample ID 241112-wj7g2a1lgm
Target RNSM00326.7z
SHA256 af262121bcb7ad1a7a17c43ad57bf9febd4f01040841bc7a68f9ee25b2ad4ca8
Tags
discovery persistence ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

af262121bcb7ad1a7a17c43ad57bf9febd4f01040841bc7a68f9ee25b2ad4ca8

Threat Level: Likely malicious

The file RNSM00326.7z was found to be: Likely malicious.

Malicious Activity Summary

discovery persistence ransomware upx

Renames multiple (101) files with added filename extension

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Sets desktop wallpaper using registry

UPX packed file

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies Control Panel

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 17:58

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 17:58

Reported

2024-11-12 17:59

Platform

win7-20240903-en

Max time kernel

61s

Max time network

59s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00326.7z"

Signatures

Renames multiple (101) files with added filename extension

ransomware

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\donut.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe" C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Agent.gen-2f40011df85d75556816ac944d805b6313da44c73c80778af62be5727c005811.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\yyuurujc = "C:\\Users\\Admin\\AppData\\Roaming\\Yuqpzxgi\\ldunqprujc.exe" C:\Windows\SysWOW64\ctfmon.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ctfmon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\WallpaperStyle = "1" C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\TileWallpaper = "1" C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1984 wrote to memory of 1812 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe
PID 1984 wrote to memory of 1812 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe
PID 1984 wrote to memory of 1812 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe
PID 1984 wrote to memory of 1812 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe
PID 1984 wrote to memory of 1812 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe
PID 1984 wrote to memory of 1812 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe
PID 1984 wrote to memory of 1812 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe
PID 1984 wrote to memory of 1812 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe
PID 1984 wrote to memory of 1812 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe
PID 1984 wrote to memory of 1812 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe
PID 1244 wrote to memory of 852 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Agent.gen-2f40011df85d75556816ac944d805b6313da44c73c80778af62be5727c005811.exe C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe
PID 1244 wrote to memory of 852 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Agent.gen-2f40011df85d75556816ac944d805b6313da44c73c80778af62be5727c005811.exe C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe
PID 1244 wrote to memory of 852 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Agent.gen-2f40011df85d75556816ac944d805b6313da44c73c80778af62be5727c005811.exe C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe
PID 1244 wrote to memory of 852 N/A C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Agent.gen-2f40011df85d75556816ac944d805b6313da44c73c80778af62be5727c005811.exe C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe
PID 1716 wrote to memory of 580 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe
PID 1716 wrote to memory of 580 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe
PID 1716 wrote to memory of 580 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe
PID 1716 wrote to memory of 580 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe
PID 1716 wrote to memory of 580 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe
PID 1716 wrote to memory of 580 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe
PID 1716 wrote to memory of 580 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe
PID 1716 wrote to memory of 580 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe
PID 580 wrote to memory of 1740 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Windows\SysWOW64\explorer.exe
PID 580 wrote to memory of 1740 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Windows\SysWOW64\explorer.exe
PID 580 wrote to memory of 1740 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Windows\SysWOW64\explorer.exe
PID 580 wrote to memory of 1740 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Windows\SysWOW64\explorer.exe
PID 580 wrote to memory of 1740 N/A C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe C:\Windows\SysWOW64\explorer.exe
PID 1740 wrote to memory of 2984 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 1740 wrote to memory of 2984 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 1740 wrote to memory of 2984 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 1740 wrote to memory of 2984 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 2984 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 2984 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 2984 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 2984 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 2984 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 2984 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 2984 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 2984 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre
PID 2404 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Windows\SysWOW64\ctfmon.exe
PID 2404 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Windows\SysWOW64\ctfmon.exe
PID 2404 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Windows\SysWOW64\ctfmon.exe
PID 2404 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Windows\SysWOW64\ctfmon.exe
PID 2404 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre C:\Windows\SysWOW64\ctfmon.exe

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00326.7z"

C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Agent.gen-2f40011df85d75556816ac944d805b6313da44c73c80778af62be5727c005811.exe

"C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Agent.gen-2f40011df85d75556816ac944d805b6313da44c73c80778af62be5727c005811.exe"

C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe

"C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe"

C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe

"C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe"

C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe

"C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe"

C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe

"C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe"

C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe

"C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre

C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre

C:\Users\Admin\AppData\Local\Temp\vowetyrjpa.pre

C:\Windows\SysWOW64\ctfmon.exe

ctfmon.exe

Network

Country Destination Domain Proto
DE 88.99.48.80:80 tcp
DE 88.99.48.80:80 tcp
DE 88.99.48.80:80 tcp
US 8.8.8.8:53 nvufvwieg.com udp

Files

C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Agent.gen-2f40011df85d75556816ac944d805b6313da44c73c80778af62be5727c005811.exe

MD5 e76eca2f7d0450c84417a8ac242b424c
SHA1 abdb8a43a6d0bf9c60d9cd4223da787c33b341bb
SHA256 2f40011df85d75556816ac944d805b6313da44c73c80778af62be5727c005811
SHA512 242f6e558fbe5dff48f9ca4776ffe58042741c9569d6b26ef45029dd035b1c61f5ef871d5d1645326fd816a8ef31baf1edac0e55cc4612e6d374bf834c144fa6

C:\Users\Admin\Documents\ImportRedo.xlsx.donut

MD5 19768692b439104395d97c7556931ad7
SHA1 5cde1a8e12d2b80d46164ba8f31cf4e29af686f3
SHA256 6320e4c6e078eaa712948f3da51aea443cc70e759daaea4215b532d3f9f39681
SHA512 da7874402c6a995405e0a4c93d3c6225d324fd16a05b5105a2ed9c6a343dd08d27a4326f4c6cc70d752532f0fb629a97f42e18e131ed41f114b6d641186f043c

C:\Users\Admin\Documents\decrypt.txt

MD5 97595afa89a4d8adb619ab8f6332a4ba
SHA1 a9d230166a8f1d1ce5dc144d9cb4e612867770ca
SHA256 16f9b995526bcfb6f5d4c714ceea9188224fdc00ef250aca848793b3a85bb20f
SHA512 58f18f2eed1d589cd912ed91da6cba6daf11277880d2469900b507cb65d46b31578cc188aad2a6a980c40c7fc4cea1952b3d5aa1df9d4bf86a5861f94a7b27e3

C:\Users\Admin\Desktop\00326\HEUR-Trojan-Ransom.Win32.Generic-eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936.exe

MD5 7043a9b4fd3687dd2ef2e18fd2d53e92
SHA1 ca0dc27097aab46d75876793f2dc94d8cc157ec1
SHA256 eebac7795eb25070116802292a26962fb080356f49eb0865af34365330e28936
SHA512 e9ab84d1c2991a4ba4e0fb009f3ed47b73641461564fbd5a886303f3fcca6db5b628fb0c8e6a9bab7b59c52263870ebd60fa7c79e994a810a9edc86673c390c8

memory/1812-74-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1812-76-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1812-77-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\T7ZKpCH7hbtSXNvQdiNXjUwKyT4lfFgR.exe

MD5 f5289f5e2b26356e63f90a07055d3394
SHA1 b45c93ff2db91b192698d9ac7b6bcabdc6857e3b
SHA256 b7b4a5f4a857b3ae0c9bdd64f5408d562657bf6d993003f50b5d39094dcf476b
SHA512 174c21ed3db973b5fa813950ac436294850e0791a74f945a99bb283a3516ab9eaf2e93b214b4ccb0c0dec131a292e9aea2cde45ba735d5e9d65077f6cf0c8e0d

C:\Users\Admin\Desktop\00326\Trojan-Ransom.Win32.Foreign.cvjo-7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e.exe

MD5 1b2d2a4b97c7c2727d571bbf9376f54f
SHA1 1fc29938ec5c209ba900247d2919069b320d33b0
SHA256 7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e
SHA512 506fc96423e5e2e38078806591e09a6eb3cf924eb748af528f7315aa0b929890823798a3ef2a5809c14023c3ff8a3db36277bc90c7b099218422aafa4e0c2ee0

memory/580-146-0x0000000000400000-0x0000000000414000-memory.dmp

memory/580-143-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/580-141-0x0000000000400000-0x0000000000414000-memory.dmp

memory/580-139-0x0000000000400000-0x0000000000414000-memory.dmp

memory/580-137-0x0000000000400000-0x0000000000414000-memory.dmp

memory/580-147-0x0000000000400000-0x0000000000414000-memory.dmp

memory/580-148-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1740-149-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/1740-151-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/580-152-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2316-163-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2316-164-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/1740-175-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/2404-178-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2948-181-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/2948-184-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/2948-189-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

memory/2316-190-0x0000000140000000-0x00000001405E8000-memory.dmp