Resubmissions
18/07/2025, 23:31
250718-3h1resar8v1018/07/2025, 19:42
250718-ye6faatns21018/07/2025, 10:49
250718-mwn2saykx71011/07/2025, 15:01
250711-sdx5mafr5t10Analysis
- max time kernel
12s - max time network
69s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
18/07/2025, 19:42
General
- Target adfd4e9f51bcd27935f153e44b060b6978f55da9135f34cc62361dbbf2d2db57.exe
- Size 26.1MB
- Sample250718-ye6faatns2
- SHA256 adfd4e9f51bcd27935f153e44b060b6978f55da9135f34cc62361dbbf2d2db57
Malware Config
Extracted
-
C:\Users\Admin\AppData\Roaming\@[email protected]
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
-
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Extracted
-
marsstealer
-
Default
Extracted
-
xworm
-
5.0
-
outside-sand.gl.at.ply.gg:31300
-
uGoUQjcjqoZsiRJZ
-
Install_directory
%AppData%
-
install_file
USB.exe
Extracted
-
C:\Users\Public\Documents\RGNR_1C054946.txt
- Hello VGCARGO ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4 Amount to pay (in Bitcoin): 25 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( [email protected] ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- QWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw== ---RAGNAR SECRET--- ***********************************************************************************
-
1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4
-
https://tox.chat/download.html
Signatures
- Detect Xworm Payload 50 IoCs
- Mars Stealer
An infostealer written in C++ based on other infostealers.
- Marsstealer family
- RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
- Ragnarlocker family
- SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
- Squirrelwaffle family
- Wannacry
WannaCry is a ransomware cryptoworm.
- Wannacry family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (56) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Squirrelwaffle payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 1 IoCs
- Executes dropped EXE 23 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Drops file in Program Files directory 58 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies registry key 1 TTPs 1 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 53 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\adfd4e9f51bcd27935f153e44b060b6978f55da9135f34cc62361dbbf2d2db57.exe"C:\Users\Admin\AppData\Local\Temp\adfd4e9f51bcd27935f153e44b060b6978f55da9135f34cc62361dbbf2d2db57.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\AppData\Roaming\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 190741752867798.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s E:\$RECYCLE3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s E:\$RECYCLE3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Roaming\@[email protected]
-
C:\Users\Admin\AppData\Roaming\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe
-
C:\Users\Admin\AppData\Roaming\@[email protected]
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\taskse.exe
-
-
C:\Users\Admin\AppData\Roaming\@[email protected]
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "psdrnjrrvvwmj544" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\tasksche.exe\"" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "psdrnjrrvvwmj544" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\tasksche.exe\"" /f4⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Roaming\taskdl.exetaskdl.exe3⤵
-
-
C:\Users\Admin\AppData\Roaming\taskdl.exetaskdl.exe3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Cry.exe"C:\Users\Admin\AppData\Roaming\Cry.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\asena.exe"C:\Users\Admin\AppData\Local\Temp\asena.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\notepad.exeC:\Users\Public\Documents\RGNR_1C054946.txt4⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Bomb.exe"C:\Users\Admin\AppData\Local\Temp\Bomb.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\25.exe"C:\Users\Admin\AppData\Local\Temp\25.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\24.exe"C:\Users\Admin\AppData\Local\Temp\24.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\23.exe"C:\Users\Admin\AppData\Local\Temp\23.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\22.exe"C:\Users\Admin\AppData\Local\Temp\22.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\21.exe"C:\Users\Admin\AppData\Local\Temp\21.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\20.exe"C:\Users\Admin\AppData\Local\Temp\20.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\19.exe"C:\Users\Admin\AppData\Local\Temp\19.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\18.exe"C:\Users\Admin\AppData\Local\Temp\18.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\17.exe"C:\Users\Admin\AppData\Local\Temp\17.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\16.exe"C:\Users\Admin\AppData\Local\Temp\16.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\15.exe"C:\Users\Admin\AppData\Local\Temp\15.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\14.exe"C:\Users\Admin\AppData\Local\Temp\14.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\13.exe"C:\Users\Admin\AppData\Local\Temp\13.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\12.exe"C:\Users\Admin\AppData\Local\Temp\12.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11.exe"C:\Users\Admin\AppData\Local\Temp\11.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\11.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '11.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\10.exe"C:\Users\Admin\AppData\Local\Temp\10.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\10.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '10.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\9.exe"C:\Users\Admin\AppData\Local\Temp\9.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8.exe"C:\Users\Admin\AppData\Local\Temp\8.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\7.exe"C:\Users\Admin\AppData\Local\Temp\7.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '3.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\tcping.exe"C:\Users\Admin\AppData\Roaming\tcping.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\paping.exe"C:\Users\Admin\AppData\Roaming\paping.exe"2⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\7848f632\7848f632.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\7848f632\7848f632.exeC:\7848f632\7848f632.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\7848f632.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\7848f632.exeC:\Users\Admin\AppData\Roaming\7848f632.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\tasksche.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
2Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
duplicate.svg
aic_file_icons_retina_thumb.png
remove.svg
s_backarrow_default.svg
s_closereview_18.svg
s_comment_18.svg
s_editpdf_18.svg
s_export_18.svg
s_fillandsign_18.svg
s_move_18.svg
s_newfolder-default.svg
s_nextarrow_default.svg
s_organize_18.svg
s_rename_18.svg
s_sendforsignature_18.svg
s_share_18.svg
selection-actions.png
selection-actions2x.png
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
convertpdf-selector.js
convertpdf-tool-view.js
ui-strings.js
ui-strings.js
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
example_icons.png
example_icons2x.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
ui-strings.js
ui-strings.js
s_checkbox_selected_18.svg
s_checkbox_unselected_18.svg
ui-strings.js
ui-strings.js
ui-strings.js
icons.png
icons_ie8.gif
icons_retina.png
new_icons.png
new_icons_retina.png
ui-strings.js
ui-strings.js
ui-strings.js
bg_pattern_RHP.png
bg_patterns_header.png
illustrations.png
illustrations_retina.png
ui-strings.js
ui-strings.js
main-selector.css
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
en_get.svg
ui-strings.js
ui-strings.js
ui-strings.js
main-selector.css
Download_on_the_App_Store_Badge_cs_135x40.svg
Download_on_the_App_Store_Badge_da_135x40.svg
Download_on_the_App_Store_Badge_de_135x40.svg
Download_on_the_App_Store_Badge_es_135x40.svg
Download_on_the_App_Store_Badge_fi_135x40.svg
Download_on_the_App_Store_Badge_fr_135x40.svg
Download_on_the_App_Store_Badge_it_135x40.svg
Download_on_the_App_Store_Badge_ja_135x40.svg
Download_on_the_App_Store_Badge_ko_135x40.svg
Download_on_the_App_Store_Badge_nb_135x40.svg
Download_on_the_App_Store_Badge_pl_135x40.svg
Download_on_the_App_Store_Badge_pt_135x40.svg
Download_on_the_App_Store_Badge_ru_135x40.svg
Download_on_the_App_Store_Badge_sv_135x40.svg
Download_on_the_App_Store_Badge_tr_135x40.svg
Download_on_the_App_Store_Badge_zh_cn_135x40.svg
Download_on_the_App_Store_Badge_zh_tw_135x40.svg
cs_get.svg
da_get.svg
de_get.svg
es-419_get.svg
fi_get.svg
fr_get.svg
it_get.svg
ko_get.svg
no_get.svg
pl_get.svg
pt-br_get.svg
ru_get.svg
sv_get.svg
tr_get.svg
zh-cn_get.svg
zh-tw_get.svg
ui-strings.js
ui-strings.js
main.css
ui-strings.js
ui-strings.js
ui-strings.js
main-selector.css
faf_icons.png
progress.gif
ui-strings.js
ui-strings.js
ui-strings.js
bun.png
cstm_brand_preview.png
cstm_brand_preview2x.png
dd_arrow_small.png
dd_arrow_small2x.png
illustrations.png
nub.png
s_filter_18.svg
s_listview_18.svg
s_opencarat_18.svg
s_thumbnailview_18.svg
share_icons.png
share_icons2x.png
ui-strings.js
adobe_spinner.gif
adc_logo.png
logo_retina.png
sat_logo.png
sat_logo_2x.png
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
ui-strings.js
DisplayLanguageNames.en_GB_EURO.txt
ad-selection-attestations.dat
manifest.json
Edge.dat
EdgeWebView.dat
external_extensions.json
manifest.json
preloaded_data.pb
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
Staging
manifest.json
Logo.png
LogoBeta.png
LogoCanary.png
LogoDev.png
SmallLogo.png
SmallLogoBeta.png
SmallLogoCanary.png
SmallLogoDev.png
manifest.json
camera_mf_trace.wprp
mf_trace.wprp
resources.pri
identity_helper.Sparse.Internal.msix
vk_swiftshader_icd.json
af.pak
am.pak
ar.pak
as.pak
az.pak
bg.pak
bn-IN.pak
bs.pak
ca-Es-VALENCIA.pak
ca.pak
cs.pak
cy.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
eu.pak
fa.pak
fi.pak
fil.pak
fr-CA.pak
fr.pak
ga.pak
gd.pak
gl.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
is.pak
it.pak
ja.pak
ka.pak
kk.pak
km.pak
kn.pak
ko.pak
kok.pak
lb.pak
lo.pak
lt.pak
lv.pak
mi.pak
mk.pak
ml.pak
mr.pak
ms.pak
mt.pak
nb.pak
ne.pak
nl.pak
nn.pak
or.pak
pa.pak
pl.pak
pt-BR.pak
pt-PT.pak
qu.pak
ro.pak
ru.pak
sk.pak
sl.pak
sq.pak
sr-Cyrl-BA.pak
sr-Latn-RS.pak
sr.pak
sv.pak
ta.pak
te.pak
th.pak
tr.pak
tt.pak
ug.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
widevinecdm.dll.sig
EdgeGameAssist.msix
VERSION
icudtl.dat
beta.identity_helper.exe.manifest
canary.identity_helper.exe.manifest
dev.identity_helper.exe.manifest
internal.identity_helper.exe.manifest
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Canary.msix
msedge.dll.sig
msedge.exe.sig
msedge_100_percent.pak
msedge_200_percent.pak
msedgewebview2.exe.sig
resources.pak
show_third_party_software_licenses.bat
v8_context_snapshot.bin
af.pak.DATA
am.pak.DATA
ar.pak.DATA
as.pak.DATA
az.pak.DATA
bg.pak.DATA
bn-IN.pak.DATA
bs.pak.DATA
ca-Es-VALENCIA.pak.DATA
ca.pak.DATA
cs.pak.DATA
cy.pak.DATA
da.pak.DATA
de.pak.DATA
el.pak.DATA
en-GB.pak.DATA
en-US.pak.DATA
es-419.pak.DATA
es.pak.DATA
et.pak.DATA
eu.pak.DATA
fa.pak.DATA
fi.pak.DATA
fil.pak.DATA
fr-CA.pak.DATA
fr.pak.DATA
ga.pak.DATA
gd.pak.DATA
gl.pak.DATA
gu.pak.DATA
he.pak.DATA
hi.pak.DATA
hr.pak.DATA
hu.pak.DATA
id.pak.DATA
is.pak.DATA
it.pak.DATA
ja.pak.DATA
ka.pak.DATA
kk.pak.DATA
km.pak.DATA
kn.pak.DATA
ko.pak.DATA
kok.pak.DATA
lb.pak.DATA
lo.pak.DATA
lt.pak.DATA
lv.pak.DATA
mi.pak.DATA
mk.pak.DATA
ml.pak.DATA
mr.pak.DATA
ms.pak.DATA
mt.pak.DATA
nb.pak.DATA
ne.pak.DATA
nl.pak.DATA
nn.pak.DATA
or.pak.DATA
pa.pak.DATA
pl.pak.DATA
pt-BR.pak.DATA
pt-PT.pak.DATA
qu.pak.DATA
ro.pak.DATA
ru.pak.DATA
sk.pak.DATA
sl.pak.DATA
sq.pak.DATA
sr-Cyrl-BA.pak.DATA
sr-Latn-RS.pak.DATA
sr.pak.DATA
sv.pak.DATA
ta.pak.DATA
te.pak.DATA
th.pak.DATA
tr.pak.DATA
tt.pak.DATA
ug.pak.DATA
uk.pak.DATA
ur.pak.DATA
vi.pak.DATA
zh-CN.pak.DATA
zh-TW.pak.DATA
EdgeGameAssist.msix.DATA
VERSION.DATA
resources.pak.DATA.ragnar_1C054946
widevinecdm.dll.sig
icudtl.dat
identity_helper.Sparse.Beta.msix
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Dev.msix
msedge.dll.sig
msedge.exe.sig
msedge_100_percent.pak
msedge_200_percent.pak
msedgewebview2.exe.sig
v8_context_snapshot.bin
identity_helper.Sparse.Beta.msix.DATA
identity_helper.Sparse.Dev.msix.DATA
identity_helper.Sparse.Internal.msix
notification_helper.exe.manifest
delegatedWebFeatures.sccd
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl
MSFT_PackageManagement.schema.mfl
win32_LinkNoDrop32x32.gif
COPYRIGHT
LICENSE
THIRDPARTYLICENSEREADME-JAVAFX.txt
THIRDPARTYLICENSEREADME.txt
directshow.md
glib.md
gstreamer.md
icu_web.md
jpeg_fx.md
libffi.md
libxml2.md
libxslt.md
mesa3d.md
public_suffix.md
webkit.md
asm.md
bcel.md
cldr.md
colorimaging.md
cryptix.md
dom.md
dynalink.md
ecc.md
freebxml.md
giflib.md
icu.md
jcup.md
joni.md
jopt-simple.md
jpeg.md
lcms.md
libpng.md
mesa3d.md
pkcs11cryptotoken.md.ragnar_1C054946
pkcs11wrapper.md
relaxngcc.md
relaxngdatatype.md
relaxngom.md
santuario.md
thaidict.md
unicode.md
xalan.md
xerces.md
xmlresolver.md
zlib.md
messages_zh_HK.properties
ClientSub2019_eula.txt
MSOUC_F_COL.HXK
MSOUC_K_COL.HXK
Microsoft.Mashup.Container.NetFX45.exe.config
SIST02.XSL
msgr8fr.dub
pkeyconfig-office.xrm-ms
Informix.xsl
Sybase.xsl
msjet.xsl
sql2000.xsl
sql70.xsl
hive.xsl
vlc.mo
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
USStmp.jtx
CURRENT
MANIFEST-000001
data_0
data_1
data_2
data_3
index
index
product_page.js
strings.json
settings.dat
https___java_com_help
{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe
{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_VideoLAN Website_url
{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe
0.1.filtertrie.intermediate.txt
0.2.filtertrie.intermediate.txt
Apps.index
AppCache133906695515668391.txt
AppCache133906695974068424.txt
AppCache133906702838187001.txt
AppCache133906704804142993.txt
AppCache133906738929150279.txt
1.exe
10.exe
11.exe
12.exe
13.exe
14.exe
15.exe
16.exe
17.exe
18.exe
19.exe
2.exe
20.exe
21.exe
22.exe
23.exe
24.exe
25.exe
3.exe
4.exe
4363463463464363463463463.exe
5.exe
6.exe
7.exe
8.exe
9.exe
Bomb.exe
CryptoWall.exe
02.08.2022.exe
Microsoft .NET Framework 4.7.2 Setup_20250502_143137453.html
__PSScriptPolicyTest_rrinumo4.g2e.ps1
a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
asena.exe
d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167.exe
wct9DC6.tmp
190741752867798.bat
Cry.exe
tor.exe
b.wnry
c.wnry
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
m.vbs
m_bulgarian.wnry
m_chinese (simplified).wnry
m_chinese (traditional).wnry
m_croatian.wnry
m_czech.wnry
m_czech.wnry
m_danish.wnry
m_dutch.wnry
m_english.wnry
m_filipino.wnry
m_finnish.wnry
m_french.wnry
m_german.wnry
m_greek.wnry
m_indonesian.wnry
m_indonesian.wnry
m_italian.wnry
m_japanese.wnry
m_korean.wnry
m_latvian.wnry
m_norwegian.wnry
m_polish.wnry
m_portuguese.wnry
m_romanian.wnry
m_russian.wnry
m_slovak.wnry
m_spanish.wnry
m_swedish.wnry
m_turkish.wnry
m_vietnamese.wnry
paping.exe
r.wnry
s.wnry
t.wnry
taskdl.exe
taskse.exe
tcping.exe
cached-microdescs.new
cached-microdescs.new
u.wnry
RGNR_1C054946.txt
memory/1156-18038-0x0000000000670000-0x000000000096E000-memory.dmp
memory/1156-11103-0x0000000074200000-0x0000000074282000-memory.dmp
memory/1156-26362-0x0000000000670000-0x000000000096E000-memory.dmp
memory/1156-11140-0x00000000740B0000-0x0000000074132000-memory.dmp
memory/1156-11143-0x00000000741B0000-0x00000000741D2000-memory.dmp
memory/1156-11158-0x0000000000670000-0x000000000096E000-memory.dmp
memory/1156-18044-0x0000000073B60000-0x0000000073BD7000-memory.dmp
memory/1156-18039-0x0000000074200000-0x0000000074282000-memory.dmp
memory/1156-26597-0x0000000000670000-0x000000000096E000-memory.dmp
memory/1156-11117-0x0000000073BE0000-0x0000000073DFC000-memory.dmp
memory/1156-18040-0x00000000741E0000-0x00000000741FC000-memory.dmp
memory/1156-18041-0x0000000073BE0000-0x0000000073DFC000-memory.dmp
memory/1156-18042-0x00000000740B0000-0x0000000074132000-memory.dmp
memory/1156-18043-0x00000000741B0000-0x00000000741D2000-memory.dmp
memory/1160-1588-0x0000000000030000-0x0000000000040000-memory.dmp
memory/1180-370-0x0000000001000000-0x0000000001025000-memory.dmp
memory/1180-347-0x0000000001000000-0x0000000001025000-memory.dmp
memory/1640-1510-0x0000000000C00000-0x0000000000C10000-memory.dmp
memory/1760-351-0x00000000003A0000-0x00000000003A8000-memory.dmp
memory/1760-353-0x0000000004C30000-0x0000000004CCC000-memory.dmp
memory/2092-1524-0x00000000007B0000-0x00000000007C0000-memory.dmp
memory/2128-748-0x0000000000010000-0x0000000000020000-memory.dmp
memory/2332-551-0x00000000004B0000-0x00000000004C0000-memory.dmp
memory/2336-1501-0x0000000000E00000-0x0000000000E10000-memory.dmp
memory/2660-795-0x00000000008E0000-0x00000000008F0000-memory.dmp
memory/2708-1871-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2940-938-0x0000000000D90000-0x0000000000DA0000-memory.dmp
memory/3496-1488-0x0000000000240000-0x0000000000250000-memory.dmp
memory/3552-81-0x0000000000F40000-0x0000000000F50000-memory.dmp
memory/3552-82-0x0000000073842000-0x0000000073844000-memory.dmp
memory/3584-1040-0x0000000000200000-0x0000000000210000-memory.dmp
memory/3644-1502-0x0000000000620000-0x0000000000630000-memory.dmp
memory/3688-1863-0x0000000000130000-0x0000000000140000-memory.dmp
memory/3880-905-0x0000000000E60000-0x0000000000E70000-memory.dmp
memory/3952-52-0x0000000010000000-0x0000000010010000-memory.dmp
memory/3968-796-0x0000000000630000-0x0000000000640000-memory.dmp
memory/4004-1499-0x00000000004A0000-0x00000000004B0000-memory.dmp
memory/4104-536-0x0000000000350000-0x0000000000360000-memory.dmp
memory/4388-366-0x0000000001090000-0x00000000010B5000-memory.dmp
memory/4520-544-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4640-1489-0x0000000000C80000-0x0000000000C90000-memory.dmp
memory/4648-881-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/4688-1476-0x0000000000160000-0x0000000000170000-memory.dmp
memory/4756-1580-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/5100-273-0x0000000000400000-0x000000000043D000-memory.dmp
memory/5144-320-0x0000000000630000-0x00000000006A8000-memory.dmp
memory/5676-891-0x00000000004C0000-0x00000000004D0000-memory.dmp
memory/5700-794-0x0000000000930000-0x0000000000940000-memory.dmp
memory/5944-1528-0x0000000000160000-0x0000000000170000-memory.dmp
memory/18016-25942-0x0000028F36ED0000-0x0000028F36EF2000-memory.dmp