Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- max time kernel
94s - max time network
108s - platform
windows11-21h2_x64 - resource
win11-20251229-en - resource tags
- submitted
17/01/2026, 16:48
Errors
General
- Target Synaptics.exe
- Size 764KB
- Sample260117-vbc3sagy6d
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
redline
-
LiveTraffoc
-
4.185.56.82:42687
Extracted
-
blackmatter
-
25.239
Extracted
-
C:\Windows\SysWOW64\Files\!Please Read Me!.txt
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
-
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Extracted
-
C:\Users\Admin\Downloads\!Please Read Me!.txt
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13poh9EisZfuzCQgianG1UDdmUdfCRKLjS Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
-
13poh9EisZfuzCQgianG1UDdmUdfCRKLjS
Extracted
-
mylobot
-
pqrqtaz.ru:9879
-
pickcas.ru:6464
-
quwkbin.ru:3496
-
rkbupij.ru:6653
-
pcqmayq.ru:3629
-
mmuliwe.ru:3541
-
stoizji.ru:5189
-
sfdfrhh.ru:3511
-
ynciazz.ru:4127
-
mkglhnw.ru:1946
-
njeeili.ru:9987
-
dldzeoo.ru:7525
-
tkbiqjq.ru:5145
-
uenosbl.ru:2935
-
faayshc.ru:9865
-
nttfazc.ru:6761
-
nfwsyog.ru:7172
-
uyfusxm.ru:7372
-
hxkclwx.ru:1294
-
zgoysam.ru:2338
Extracted
-
quasar
-
encryption_key
E679E56ABD1A0F53D68F323812B24E67488502F6
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
-
stealc
-
crypt
-
http://196.251.107.23
-
url_path
/7ffc7a279c17c091.php
Extracted
-
C:\Users\Admin\Downloads\!Please Read Me!.txt
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 1N39KVvVK8itaGr7odbrTKnBdbwt4n7PoY Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
-
1N39KVvVK8itaGr7odbrTKnBdbwt4n7PoY
Extracted
-
asyncrat
-
0.5.8
-
Default
-
196.251.107.104:6606
-
196.251.107.104:7707
-
196.251.107.104:8808
-
kqNlEor85bqX
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
- Blackmatter family
- DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
- Deerstealer family
- Detect SalatStealer payload 3 IoCs
- Detects DeerStealer 2 IoCs
- Detects MaskGramStealer payload 1 IoCs
- Detects Mimilove part of Mimikatz 1 IoCs
- Detects SvcStealer Payload 1 IoCs
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Lockbit family
- MaskGramStealer
MaskGramStealer is an information stealer.
- Maskgram_stealer family
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Mimikatz family
- Mylobot
Botnet which first appeared in 2017 written in C++.
- Mylobot family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 3 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Redline family
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- Salatstealer family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Svcstealer family
- Wannacry
WannaCry is a ransomware cryptoworm.
- Wannacry family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Async RAT payload 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 18 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Drops startup file 2 IoCs
- Executes dropped EXE 17 IoCs
- Loads dropped DLL 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 32 IoCs
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 5 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 7 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 6 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Kills process with taskkill 5 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 6 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 49 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\center.exe"C:\Users\Admin\AppData\Local\Temp\Files\center.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe"C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"4⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe"C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 3005⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EFatura.exe"C:\Users\Admin\AppData\Local\Temp\Files\EFatura.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\485.exe"C:\Users\Admin\AppData\Local\Temp\Files\485.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1_240676171.exe"C:\Users\Admin\AppData\Local\Temp\1_240676171.exe"5⤵
-
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"6⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"7⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
-
C:\Users\Admin\AppData\Local\c7iX6htqM0MK.exe"C:\Users\Admin\AppData\Local\c7iX6htqM0MK.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HTH44.tmp\c7iX6htqM0MK.tmp"C:\Users\Admin\AppData\Local\Temp\is-HTH44.tmp\c7iX6htqM0MK.tmp" /SL5="$306EC,2714024,817152,C:\Users\Admin\AppData\Local\c7iX6htqM0MK.exe"8⤵
-
C:\Users\Admin\AppData\Local\c7iX6htqM0MK.exe"C:\Users\Admin\AppData\Local\c7iX6htqM0MK.exe" /VERYSILENT /PASSWORD=c9d4bb30-cb45-43e6-a5a5-0428b46e6eec9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1VEO5.tmp\c7iX6htqM0MK.tmp"C:\Users\Admin\AppData\Local\Temp\is-1VEO5.tmp\c7iX6htqM0MK.tmp" /SL5="$406EC,2714024,817152,C:\Users\Admin\AppData\Local\c7iX6htqM0MK.exe" /VERYSILENT /PASSWORD=c9d4bb30-cb45-43e6-a5a5-0428b46e6eec10⤵
-
C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe"C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding11⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\9uMLRxTr8AIl.exe"C:\Users\Admin\AppData\Local\9uMLRxTr8AIl.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7F5KB.tmp\9uMLRxTr8AIl.tmp"C:\Users\Admin\AppData\Local\Temp\is-7F5KB.tmp\9uMLRxTr8AIl.tmp" /SL5="$406EE,3319519,56832,C:\Users\Admin\AppData\Local\9uMLRxTr8AIl.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start /b "" "C:\ProgramData\cda743a1-2f85-4bc1-be35-0f3b44a4c7fb\FnHotkeyUtility.exe" -Embedding9⤵
-
C:\ProgramData\cda743a1-2f85-4bc1-be35-0f3b44a4c7fb\FnHotkeyUtility.exe"C:\ProgramData\cda743a1-2f85-4bc1-be35-0f3b44a4c7fb\FnHotkeyUtility.exe" -Embedding10⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2_240678671.exe"C:\Users\Admin\AppData\Local\Temp\2_240678671.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-B6UISC8IF0.tmp\2_240678671.tmp"C:\Users\Admin\AppData\Local\Temp\is-B6UISC8IF0.tmp\2_240678671.tmp" /SL5="$205C6,3851360,893440,C:\Users\Admin\AppData\Local\Temp\2_240678671.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\2_240678671.exe"C:\Users\Admin\AppData\Local\Temp\2_240678671.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80987⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NLREMR8U3R.tmp\2_240678671.tmp"C:\Users\Admin\AppData\Local\Temp\is-NLREMR8U3R.tmp\2_240678671.tmp" /SL5="$305C6,3851360,893440,C:\Users\Admin\AppData\Local\Temp\2_240678671.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80988⤵
-
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe"C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe" -Embedding9⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3_240680687.exe"C:\Users\Admin\AppData\Local\Temp\3_240680687.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4_240683843.exe"C:\Users\Admin\AppData\Local\Temp\4_240683843.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5_240687390.exe"C:\Users\Admin\AppData\Local\Temp\5_240687390.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /tn "C5F34EC1514DC9EC" /tr "C:\Users\Admin\AppData\Roaming\C5F34EC1514DC9EC\C5F34EC1514DC9EC.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\6_240688703.exe"C:\Users\Admin\AppData\Local\Temp\6_240688703.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe"C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\script.exe"C:\Users\Admin\AppData\Local\Temp\Files\script.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\666.exe"C:\Users\Admin\AppData\Local\Temp\Files\666.exe"4⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x32c,0x7ffaf547c188,0x7ffaf547c194,0x7ffaf547c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,15093938772512174331,5947837492472857895,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,17003609903188073042,4642312337876909317,262144 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,4619669881942629613,3729785259988644996,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,15328603348556899818,3685274414586845459,2097152 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,14689314599537449629,2784509100962656428,2097152 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,408666449336813307,11741229810829733726,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,15024403331466376988,9354097483503686939,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,2143880192318966415,14965961128004983942,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,11204037808370661408,14502987740651123412,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,11204037808370661408,14502987740651123412,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,3293017956104856252,15381255769918873633,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,435561441415156415,3736115054914454968,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,2409790528131840244,11182208388343755602,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,3783206588289326763,56186719467429710,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,2313870753187550802,11643459240058499476,524288 --field-trial-handle=2288,i,1351062069904923297,1821704724633701262,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:144⤵
-
-
-
C:\Windows\SysWOW64\Files\agent.exe"C:\Windows\System32\Files\agent.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\Files\builder.exe"C:\Windows\System32\Files\builder.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Files\WannaCry.exe"C:\Windows\System32\Files\WannaCry.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 233191768668606.bat4⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs5⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe f4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe c4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v4⤵
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe v5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete7⤵
-
-
-
-
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
-
C:\Windows\SysWOW64\Files\OfferedBuilt.exe"C:\Windows\System32\Files\OfferedBuilt.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Dominant Dominant.cmd & Dominant.cmd4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"5⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 735485⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "EvilTeethMagnificentSub" Shoulder5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Appreciated + Consequences + Atmospheric + Under + Medium + Edt + Launched + Expert + Ready + Korean + Cite + Suspended + Set + Maple 73548\h5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\73548\Mph.pif73548\Mph.pif 73548\h5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "GaiaTrack" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EcoOptimize Solutions\GaiaTrack.js'" /sc onlogon /F /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\timeout.exetimeout 155⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\SysWOW64\Files\CFXBypass.exe"C:\Windows\System32\Files\CFXBypass.exe"3⤵
- Badlisted process makes network request
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Files\t2.exe"C:\Windows\System32\Files\t2.exe"3⤵
-
C:\Windows\SysWOW64\Files\t2.exe"C:\Windows\System32\Files\t2.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\tqg1699uiwak.exe"C:\Windows\System32\Files\tqg1699uiwak.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\zx.exe"C:\Windows\System32\Files\zx.exe"3⤵
-
C:\Windows\SysWOW64\Files\zx.exe"C:\Windows\System32\Files\zx.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\Brontok.exe"C:\Windows\System32\Files\Brontok.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\ZJQPPAJN.exe"C:\Windows\System32\Files\ZJQPPAJN.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"4⤵
-
C:\ProgramData\bnv_Valid\PReflector64.exeC:\ProgramData\bnv_Valid\PReflector64.exe5⤵
-
C:\Users\Admin\AppData\Local\SignHandler.exeC:\Users\Admin\AppData\Local\SignHandler.exe6⤵
-
-
C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe"C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" "C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" /u6⤵
-
-
-
-
-
C:\Windows\SysWOW64\Files\AvamarConsoleMultiple-windows-x86_64-7.2.1-32.exe"C:\Windows\System32\Files\AvamarConsoleMultiple-windows-x86_64-7.2.1-32.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\BruterV3.1.exe"C:\Windows\System32\Files\BruterV3.1.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\kg.exe"C:\Windows\System32\Files\kg.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\cabal.exe"C:\Windows\System32\Files\cabal.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\odbntqhbxd.exe"C:\Users\Admin\AppData\Local\Temp\odbntqhbxd.exe" "C:\Users\Admin\AppData\Local\Temp\dbiqqyivna.exe" "C:\Windows\SysWOW64\Files\cabal.exe"4⤵
-
C:\Windows\SysWOW64\Files\cabal.exe"C:\Windows\SysWOW64\Files\cabal.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\tsxvsxdlok.exeC:\Users\Admin\AppData\Local\Temp\tsxvsxdlok.exe4⤵
-
C:\Windows\System32\cmd.exe/c sc config msdtc obj= LocalSystem5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AlG0mORK.bat"5⤵
-
-
C:\Windows\System32\bindsvc.exe"C:\Windows\System32\bindsvc.exe"5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\client.exe"C:\Windows\System32\Files\client.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exe4⤵
-
C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"5⤵
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns6⤵
- Gathers network information
-
-
-
-
-
C:\Windows\SysWOW64\Files\javaw.exe"C:\Windows\System32\Files\javaw.exe"3⤵
-
C:\Users\Admin\AppData\Local\Comms\OfficeClickToRun.exeC:\Users\Admin\AppData\Local\Comms\OfficeClickToRun.exe4⤵
-
C:\Windows\death.exeC:\Windows\death.exe powershell.exe5⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\OfficeClickToRun.exe"C:\Program Files (x86)\Microsoft\Edge\Application\OfficeClickToRun.exe" -5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\PowerRat.exe"C:\Windows\System32\Files\PowerRat.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\444.exe"C:\Windows\System32\Files\444.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe"4⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE5⤵
- Modifies Windows Firewall
-
-
-
-
C:\Windows\SysWOW64\Files\1.exe"C:\Windows\System32\Files\1.exe"3⤵
-
C:\Windows\SysWOW64\Files\1.exe"C:\Windows\System32\Files\1.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\actu.exe"C:\Windows\System32\Files\actu.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\' -Verb RunAs"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "& {Add-MpPreference -ExclusionPath 'C:\'}"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\death.exeC:\Windows\death.exe "powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -Value 0"4⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Windows\SysWOW64\Files\IMG001.exe"C:\Windows\System32\Files\IMG001.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe5⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\tftp.exe"C:\Users\Admin\AppData\Local\Temp\tftp.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"4⤵
-
C:\Windows\death.exeC:\Windows\death.exe "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe5⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tftp.exe"C:\Users\Admin\AppData\Local\Temp\tftp.exe"5⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ5⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"6⤵
-
-
-
C:\Windows\death.exeC:\Windows\death.exe "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"5⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\death.exeC:\Windows\death.exe "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"5⤵
-
-
C:\Windows\death.exeC:\Windows\death.exe "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0005⤵
- Power Settings
-
-
-
-
C:\Windows\SysWOW64\Files\DiscordNitroGenerator.exe"C:\Windows\System32\Files\DiscordNitroGenerator.exe"3⤵
-
C:\Windows\SysWOW64\Files\DiscordNitroGenerator.exe"C:\Windows\System32\Files\DiscordNitroGenerator.exe"4⤵
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c cls&title [Discord Nitro Generator] By The_G ^| Welcome :)5⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4692 -ip 46921⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\SysWOW64\Files\WannaCry.exe"C:\Windows\SysWOW64\Files\WannaCry.exe" /r1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\wscript.exewscript1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\C5F34EC1514DC9EC\C5F34EC1514DC9EC.exeC:\Users\Admin\AppData\Roaming\C5F34EC1514DC9EC\C5F34EC1514DC9EC.exe1⤵
-
C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exeC:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6268 -s 5082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6268 -ip 62681⤵
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe" ..1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl9.bat1⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\death.exeC:\Windows\death.exe explorer.exe1⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\death.exeC:\Windows\death.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\mbr.exe"C:\Windows\mbr.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\mbr.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\C5F34EC1514DC9EC\C5F34EC1514DC9EC.exeC:\Users\Admin\AppData\Roaming\C5F34EC1514DC9EC\C5F34EC1514DC9EC.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1File Deletion
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
SeetrolClient.exe
Synaptics.exe
is-3KPL6.tmp
9uMLRxTr8AIl.exe
settings.dat
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
the-real-index~RFe589c99.TMP
SiteList-Enterprise.json
HubApps
CURRENT
MANIFEST-000001
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Secure Preferences
the-real-index
the-real-index~RFe587059.TMP
the-real-index
the-real-index~RFe586c23.TMP
the-real-index
the-real-index~RFe588577.TMP
index.txt
the-real-index
the-real-index~RFe588141.TMP
sync_diagnostic.log
default_cloud_config.json
Local State
Local State
Local State
Local State
first_party_sets.db
._cache_Synaptics.exe
1_240676171.exe
2AB75E00
2_240678671.exe
3_240680687.exe
4_240683843.exe
5_240687390.exe
Dominant.cmd
02.08.2022.exe
485.exe
666.exe
EFatura.exe
EmailVerify.exe
RedLineStealer.exe
TempSpoofer.exe
center.exe
mimilove.exe
script.exe
t2.exe
History
CenterRun.exe
SeetrolCenter.exe
Seetrol_Cnt.exe
drmclien.dll
wmasf.dll
wmidx.dll
wmvcore.dll
PReflector64.exe
__PSScriptPolicyTest_fhhuks31.uur.ps1
_isdecmp.dll
odbntqhbxd.exe
tftp.exe
x4Hgxeey.xlsm
c7iX6htqM0MK.exe
trnmg.sdb
RestartInstall.xlsm
!Please Read Me!.txt
!Please Read Me!.txt
!Please Read Me!.txt
!WannaDecryptor!.exe.lnk
00000000.res
02.08.2022.exe
233191768668606.bat
444.exe
AvamarConsoleMultiple-windows-x86_64-7.2.1-32.exe
Brontok.exe
BruterV3.1.exe
CFXBypass.exe
DiscordNitroGenerator.exe
IMG001.exe
OfferedBuilt.exe
PowerRat.exe
WannaCry.exe
ZJQPPAJN.exe
actu.exe
agent.exe
builder.exe
c.vbs
c.wry
cabal.exe
cabal.exe
client.exe
javaw.exe
kg.exe
m.wry
mely.exe
r.wry
t.wry
tqg1699uiwak.exe
u.wry
zx.exe
death.exe
mbr.exe
memory/448-3098-0x0000000000770000-0x0000000000B15000-memory.dmp
memory/752-3034-0x00000000003D0000-0x00000000004B9000-memory.dmp
memory/752-3100-0x00000000003D0000-0x00000000004B9000-memory.dmp
memory/800-3176-0x0000000006FA0000-0x0000000006FE6000-memory.dmp
memory/800-3177-0x0000000006FA0000-0x0000000006FE6000-memory.dmp
memory/800-3175-0x0000000006AC0000-0x0000000006B01000-memory.dmp
memory/1188-3984-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1440-819-0x0000000010000000-0x0000000010012000-memory.dmp
memory/1488-2984-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2971-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-3007-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2962-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2967-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2973-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2974-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2975-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2976-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2977-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2978-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2979-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2980-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2981-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2982-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2983-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1488-2972-0x00007FF78BFF0000-0x00007FF78C0BC000-memory.dmp
memory/1704-370-0x00000000055B0000-0x00000000055BA000-memory.dmp
memory/1704-373-0x0000000006A80000-0x0000000006A92000-memory.dmp
memory/1704-362-0x0000000005600000-0x0000000005692000-memory.dmp
memory/1704-361-0x0000000005BB0000-0x0000000006156000-memory.dmp
memory/1704-360-0x0000000000400000-0x0000000000450000-memory.dmp
memory/1704-371-0x0000000006BD0000-0x00000000071E8000-memory.dmp
memory/1704-372-0x0000000008390000-0x000000000849A000-memory.dmp
memory/1704-374-0x0000000006AE0000-0x0000000006B1C000-memory.dmp
memory/1704-375-0x0000000006B30000-0x0000000006B7C000-memory.dmp
memory/1972-3711-0x00007FF7CCA10000-0x00007FF7CCD14000-memory.dmp
memory/1972-3524-0x00007FF7CCA10000-0x00007FF7CCD14000-memory.dmp
memory/2000-300-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2000-333-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2056-2824-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2208-3725-0x0000000065BA0000-0x0000000065D07000-memory.dmp
memory/2208-3532-0x0000000065BA0000-0x0000000065D07000-memory.dmp
memory/2208-4002-0x0000000005480000-0x0000000005492000-memory.dmp
memory/2216-2883-0x00007FFB1D140000-0x00007FFB1D349000-memory.dmp
memory/2216-2885-0x000000006B4D0000-0x000000006B64D000-memory.dmp
memory/2216-2882-0x000000006B4D0000-0x000000006B64D000-memory.dmp
memory/2440-260-0x00000000031B0000-0x00000000031D2000-memory.dmp
memory/2440-237-0x0000000000EC0000-0x0000000000ED0000-memory.dmp
memory/2460-201-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/2604-3953-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2888-2861-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2888-2870-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2888-2864-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2988-3989-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3132-3363-0x0000000000400000-0x0000000000727000-memory.dmp
memory/3132-3626-0x0000000000400000-0x0000000000727000-memory.dmp
memory/3224-4000-0x0000000000970000-0x00000000014F0000-memory.dmp
memory/3224-3961-0x0000000000970000-0x00000000014F0000-memory.dmp
memory/3596-3033-0x0000000000900000-0x0000000000CA5000-memory.dmp
memory/3640-2867-0x0000000000D80000-0x0000000000DB6000-memory.dmp
memory/3640-2866-0x0000000000D80000-0x0000000000DB6000-memory.dmp
memory/3640-2872-0x0000000000D80000-0x0000000000DB6000-memory.dmp
memory/3640-2865-0x0000000000D80000-0x0000000000DB6000-memory.dmp
memory/3640-2869-0x0000000000D80000-0x0000000000DB6000-memory.dmp
memory/3640-2868-0x0000000000D80000-0x0000000000DB6000-memory.dmp
memory/3700-191-0x00007FFADA7A0000-0x00007FFADA7B0000-memory.dmp
memory/3700-202-0x00007FFADA7A0000-0x00007FFADA7B0000-memory.dmp
memory/3700-188-0x00007FFADD1D0000-0x00007FFADD1E0000-memory.dmp
memory/3700-189-0x00007FFADD1D0000-0x00007FFADD1E0000-memory.dmp
memory/3700-187-0x00007FFADD1D0000-0x00007FFADD1E0000-memory.dmp
memory/3700-190-0x00007FFADD1D0000-0x00007FFADD1E0000-memory.dmp
memory/3700-186-0x00007FFADD1D0000-0x00007FFADD1E0000-memory.dmp
memory/3836-3025-0x00000000003D0000-0x00000000004B9000-memory.dmp
memory/3836-3037-0x00000000003D0000-0x00000000004B9000-memory.dmp
memory/3852-2873-0x00007FFB1D140000-0x00007FFB1D349000-memory.dmp
memory/3852-2860-0x000000006B4D0000-0x000000006B64D000-memory.dmp
memory/3872-338-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3872-131-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3872-2377-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3872-340-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3956-3342-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3956-3365-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3976-3228-0x0000000000400000-0x0000000001FA9000-memory.dmp
memory/3976-2905-0x0000000000400000-0x0000000001FA9000-memory.dmp
memory/4044-3632-0x0000000000780000-0x00000000008FA000-memory.dmp
memory/4044-3229-0x0000000000780000-0x00000000008FA000-memory.dmp
memory/4092-3916-0x0000000000400000-0x0000000000697000-memory.dmp
memory/4212-2871-0x00000000056D0000-0x00000000056D1000-memory.dmp
memory/4212-132-0x00000000001D0000-0x00000000001D8000-memory.dmp
memory/4212-133-0x0000000004AF0000-0x0000000004B8C000-memory.dmp
memory/4376-3853-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4376-3850-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4380-2949-0x000001C91D410000-0x000001C91D42A000-memory.dmp
memory/4380-2948-0x000001C91CE10000-0x000001C91CF64000-memory.dmp
memory/4792-0-0x0000000002460000-0x0000000002461000-memory.dmp
memory/4792-127-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4792-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/4832-3842-0x0000000000400000-0x0000000000697000-memory.dmp
memory/4944-2888-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4944-2889-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4960-2690-0x000002A6364D0000-0x000002A6364D1000-memory.dmp
memory/4960-2938-0x0000000000E30000-0x0000000000E3E000-memory.dmp
memory/5364-3709-0x00000000076F0000-0x000000000770E000-memory.dmp
memory/5364-3730-0x0000000007D40000-0x0000000007D5A000-memory.dmp
memory/5364-3728-0x0000000007C30000-0x0000000007C3E000-memory.dmp
memory/5364-3721-0x0000000007BF0000-0x0000000007C01000-memory.dmp
memory/5364-3720-0x0000000007A50000-0x0000000007A5A000-memory.dmp
memory/5364-3701-0x0000000007710000-0x0000000007744000-memory.dmp
memory/5364-3713-0x0000000008020000-0x000000000869A000-memory.dmp
memory/5364-2430-0x0000000000580000-0x0000000000590000-memory.dmp
memory/5364-3729-0x0000000007C40000-0x0000000007C55000-memory.dmp
memory/5364-3738-0x0000000007D20000-0x0000000007D28000-memory.dmp
memory/5364-3710-0x0000000007760000-0x0000000007804000-memory.dmp
memory/5364-3702-0x000000006BA50000-0x000000006BA9C000-memory.dmp
memory/5364-3694-0x00000000060D0000-0x0000000006427000-memory.dmp
memory/5424-2961-0x0000000000400000-0x0000000000426000-memory.dmp
memory/5424-3341-0x0000000000400000-0x0000000000426000-memory.dmp
memory/5460-3101-0x00007FF6F1DF0000-0x00007FF6F1F44000-memory.dmp
memory/5460-3474-0x00007FFAECF70000-0x00007FFAED1D6000-memory.dmp
memory/5460-3931-0x00007FFAECF70000-0x00007FFAED1D6000-memory.dmp
memory/5460-3099-0x00007FFAECF70000-0x00007FFAED1D6000-memory.dmp
memory/5504-3280-0x0000000000D00000-0x000000000146E000-memory.dmp
memory/5504-3312-0x0000000008830000-0x000000000883E000-memory.dmp
memory/5504-3307-0x0000000008150000-0x0000000008158000-memory.dmp
memory/5504-3311-0x0000000008860000-0x0000000008898000-memory.dmp
memory/5620-3950-0x0000000000400000-0x0000000000697000-memory.dmp
memory/5880-2903-0x0000000000400000-0x0000000000436000-memory.dmp
memory/5880-2902-0x0000000000400000-0x0000000000436000-memory.dmp
memory/5988-331-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/5988-348-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/5988-486-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/5988-347-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/5988-2900-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/5988-2323-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/6032-3920-0x0000000000400000-0x000000000043F000-memory.dmp
memory/6172-3392-0x0000000000CC0000-0x0000000001840000-memory.dmp
memory/6172-3682-0x0000000000CC0000-0x0000000001840000-memory.dmp
memory/6172-3962-0x0000000000CC0000-0x0000000001840000-memory.dmp
memory/6184-3538-0x00007FFAECA30000-0x00007FFAECCE3000-memory.dmp
memory/6184-3539-0x00007FF7B7D70000-0x00007FF7B7EC4000-memory.dmp
memory/6184-3542-0x00007FFAECA30000-0x00007FFAECCE3000-memory.dmp
memory/6228-3731-0x000000006BA50000-0x000000006BA9C000-memory.dmp
memory/6236-3536-0x0000000000630000-0x000000000063A000-memory.dmp
memory/6268-3712-0x0000000065BA0000-0x0000000065D07000-memory.dmp
memory/6352-3986-0x0000000000400000-0x0000000000697000-memory.dmp
memory/6396-3409-0x00000000009C0000-0x0000000000A80000-memory.dmp
memory/6564-3980-0x0000000000400000-0x0000000000697000-memory.dmp
memory/6836-3611-0x0000000006180000-0x000000000619E000-memory.dmp
memory/6836-3607-0x0000000005580000-0x00000000055E6000-memory.dmp
memory/6836-3597-0x0000000002CB0000-0x0000000002CE6000-memory.dmp
memory/6836-3651-0x0000000006560000-0x000000000657A000-memory.dmp
memory/6836-3599-0x00000000055F0000-0x0000000005C1A000-memory.dmp
memory/6836-3652-0x00000000065B0000-0x00000000065D2000-memory.dmp
memory/6836-3610-0x0000000005C90000-0x0000000005FE7000-memory.dmp
memory/6836-3650-0x00000000073D0000-0x0000000007466000-memory.dmp
memory/6836-3608-0x0000000005C20000-0x0000000005C86000-memory.dmp
memory/6836-3606-0x00000000054E0000-0x0000000005502000-memory.dmp
memory/7756-4036-0x0000000000400000-0x0000000000697000-memory.dmp
memory/7780-4039-0x0000000000400000-0x000000000043F000-memory.dmp
memory/8056-4048-0x0000000000400000-0x0000000000697000-memory.dmp
memory/8108-4051-0x0000000000400000-0x000000000043F000-memory.dmp