Analysis
- user interaction
yes - max time kernel
285s - max time network
300s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
14/04/2026, 02:52
General
- Target XClient.exe
- Size 30KB
- Sample260414-dct91set4w
- SHA256 d9c2646994d741962b8baadd890a2acb2fd1becb217cc0a6bc9f2155662c6915
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
3.0
C2
-
subscript-breadth.with.playit.plus:1073
Mutex
-
CGjzT0CboUGQq8a3
aes.plain
Signatures
- Family: XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 5 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 9 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 7 IoCs
- Kills process with taskkill 2 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"1⤵
- UAC bypass
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffa71b5c188,0x7ffa71b5c194,0x7ffa71b5c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,14005597744289171947,8637580078291601804,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,336362489264513068,6206754499439724573,262144 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,4427263045044449783,2363772762742195106,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,10112548642428397039,1159535081564808938,2097152 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,7497044913147665360,3028727454408971954,2097152 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,6738029880986264856,16150054077840378272,2097152 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4128,i,4413529786063714601,14889755825336312109,2097152 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,9384791256926298348,3572308584029450454,2097152 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4140,i,4764675443765590453,18319904921635228649,2097152 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,329022355618087195,15707249198348095743,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,923914575245960776,8823762067425493953,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,6661867838976943225,6783786875955106326,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,2520281708565803589,13487487437470428238,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,7494601127388083663,2636235931450984885,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:143⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11004⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,16852606737429352568,3080585774545915807,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,16852606737429352568,3080585774545915807,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,10896700377004474771,15928788037312814323,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,3843516959521003325,14011493482627718559,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,17369032934395279522,11784275733051909772,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,12493369094313130145,5705631782741687257,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,14039984227005819809,10856090088981359800,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,13875040396745869219,11685502185968279009,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6544,i,9897604223116155788,18134322535527573094,2097152 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,689780443716841244,16233616065863555197,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,6436865594546355649,15591326148271131758,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,635707861436039720,17561843093924503326,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,14397900515075753698,10529284438291559865,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,6824224139773072130,16474656424234468650,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6764,i,9069990507836180365,92884604591099996,262144 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6884,i,17059274102422425777,5807777238824286479,2097152 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,12379911424965074339,15517256624968352455,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,4232637198783115491,16032550683764664798,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3296,i,8482741708223424004,9436968760499839513,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=1144 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1005866697491755464,9652856414379033243,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,8130548931647664409,1210198682912628743,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3296,i,828484653248430345,5044142552416690019,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,5840599394312399742,7431436203241622245,524288 --field-trial-handle=2152,i,7834042285576895778,7731785583199941725,262144 --variations-seed-version --mojo-platform-channel-handle=1140 /prefetch:143⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json2⤵
-
C:\Users\Admin\AppData\Local\Temp\All-In-One.exeAll-In-One.exe OutPut.json3⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://exmple.com/2⤵
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /03⤵
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wuauserv start=disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {bd704045-e153-4897-8e2f-4aabfd81a9ee} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {b87bf6a1-d7ac-4ee1-a44b-1cc5788a348d} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3712 -prefsLen 27323 -prefMapHandle 3716 -prefMapSize 270279 -jsInitHandle 3720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3728 -initialChannelId {41e3925e-175a-4d92-b28b-1b8abb256308} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 27323 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3972 -initialChannelId {497b5d35-2866-488c-8255-f81c2392628a} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2964 -prefsLen 34822 -prefMapHandle 2676 -prefMapSize 270279 -jsInitHandle 2896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3036 -initialChannelId {0507ed55-a547-4ab2-a642-309eeca90571} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3076 -prefsLen 35010 -prefMapHandle 1660 -prefMapSize 270279 -ipcHandle 1684 -initialChannelId {c97f22ea-08ac-4892-9a0f-721a2eb6f396} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5488 -prefsLen 32952 -prefMapHandle 5492 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {1edd2c98-542e-4208-9b09-29af7502d599} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32952 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5420 -initialChannelId {4f73a3f9-9b5a-4cf1-ac5c-4644d3c41e56} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5364 -prefsLen 32952 -prefMapHandle 5388 -prefMapSize 270279 -jsInitHandle 4668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5820 -initialChannelId {cee0a77b-9f5b-40f7-a17c-ca61ad5baed9} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004CC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index
the-real-index~RFe590083.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
e343026e-64a4-4d2c-96b9-aa8ff2aec7d4.tmp
OperationConfig
OperationConfig~RFe599d5f.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
216903a7-9820-43c8-8230-34e1db6d1c38.tmp
iconcache_idx.db
iconcache_idx.db
5faa22bf-6c9c-4b57-8985-cc41934d867e.tmp
All-In-One.exe
api-ms-win-crt-conio-l1-1-0_not.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
freebl3.dll
mozglue.dll
msvcp140.dll
nss3.dll
softokn3.dll
vcruntime140.dll
nspr4.dll
nss3.dll
plc4.dll
plds4.dll
softokn3.dll
License.XenArmor
OutPut.json
XenManager.dll
bbec79fa-e452-49a5-a6d0-e4369c7cc82b.tmp
29b2e181-4e84-4575-920e-0a5e6855d2eb.tmp
content_new.js
settings.db
SP_347A33A9C0904F86B38CA86F7DAE8142.dat
CachedImage_1920_1080_POS4.jpg
data.safe.tmp
data.safe.tmp
events
116eb1ce-8d4e-43f6-be68-451718b7e867
30bd9ac7-7cfb-4f3b-8901-d504118a74e4
a60b6435-31c2-4ac8-b8b7-cc8deed92d05
b2795887-c103-4f75-8e0b-a5c360d15294
fb2ce147-3981-411e-89c1-6aba4704a5e2
prefs.js
prefs.js
sessionCheckpoints.json.tmp
3870112724rsegmnoittet-es.sqlite
BackupCompare.jtx.ENC
BlockDeny.wps.ENC
ClearSubmit.xltm.ENC
CloseSave.contact.ENC
CompareTrace.ex_.ENC
ConvertToTrace.DVR.ENC
CopyRedo.scf.ENC
CopyRemove.txt.ENC
DisconnectDeny.docx.ENC
EditSwitch.sql.ENC
ExitLock.mp3.ENC
FormatApprove.M2V.ENC
How To Decrypt My Files.html
LimitUnregister.mp3.ENC
MergeCopy.docx.ENC
MergeStart.AAC.ENC
Microsoft Edge.lnk.ENC
ProtectImport.gif.ENC
PushSync.pptx.ENC
RenameUse.asf.ENC
ResizeGet.TTS.ENC
SaveRedo.vdx.ENC
SkipAssert.M2V.ENC
StopConvertTo.ex_.ENC
SubmitRemove.shtml.ENC
SuspendClear.shtml.ENC
SuspendRead.mpg.ENC
SwitchUnregister.bmp.ENC
TestRename.wvx.ENC
UnblockWatch.xps.ENC
UnpublishSuspend.rmi.ENC
desktop.ini.ENC
NTUSER.DAT{2fa72cf3-34ca-11ed-acae-cbf1edc82a99}.TMContainer00000000000000000001.regtrans-ms.ENC
manifest.json
manifest.json
manifest.json
manifest.json
memory/2208-1589-0x00000292FBB70000-0x00000292FBB90000-memory.dmp
memory/2208-1783-0x00000289E4DB0000-0x00000289E4DB9000-memory.dmp
memory/2208-1501-0x00000291E7040000-0x00000291E7140000-memory.dmp
memory/2208-1502-0x00000291E7040000-0x00000291E7140000-memory.dmp
memory/2208-1509-0x00000289E6C80000-0x00000289E6D80000-memory.dmp
memory/2208-1563-0x00000291F8E00000-0x00000291F8F00000-memory.dmp
memory/2208-1565-0x00000292FB150000-0x00000292FB170000-memory.dmp
memory/2208-1566-0x00000291FAB30000-0x00000291FAB50000-memory.dmp
memory/2208-1588-0x00000292FC190000-0x00000292FC290000-memory.dmp
memory/3144-1490-0x00000289087B0000-0x00000289087B9000-memory.dmp
memory/3380-1779-0x00000000056C0000-0x00000000056C9000-memory.dmp
memory/3432-1358-0x0000000001370000-0x000000000137E000-memory.dmp
memory/3432-1362-0x000000001E050000-0x000000001E578000-memory.dmp
memory/3432-1115-0x000000001B9A0000-0x000000001B9AA000-memory.dmp
memory/3432-1200-0x000000001D250000-0x000000001D724000-memory.dmp
memory/3432-0-0x0000000000C00000-0x0000000000C0E000-memory.dmp
memory/3432-1455-0x000000001CCF0000-0x000000001CCFB000-memory.dmp
memory/3432-1436-0x000000001BCF0000-0x000000001BD02000-memory.dmp
memory/3432-1454-0x000000001C370000-0x000000001C38E000-memory.dmp
memory/3432-1419-0x0000000001360000-0x000000000136A000-memory.dmp
memory/3432-12-0x0000000002E20000-0x0000000002E2C000-memory.dmp
memory/3432-9-0x0000000002DA0000-0x0000000002DAA000-memory.dmp
memory/3432-4-0x0000000002D90000-0x0000000002DA0000-memory.dmp
memory/3432-1869-0x000000001BCE0000-0x000000001BCEE000-memory.dmp
memory/3432-3-0x0000000002CF0000-0x0000000002CF9000-memory.dmp
memory/3432-2-0x0000000002CD0000-0x0000000002CDC000-memory.dmp
memory/3432-1-0x0000000002D90000-0x0000000002DA0000-memory.dmp