Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
26/04/2026, 08:41
General
- Target a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe
- Size 2.2MB
- Sample260426-klen9aev2l
- SHA256 a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986
Malware Config
Signatures
- Executes dropped EXE 56 IoCs
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 58 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5697.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5752.bat4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5946.bat6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B98.bat8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C83.bat10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D7D.bat12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FBF.bat14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60A9.bat16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a625F.bat18⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a631A.bat20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6481.bat22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65D9.bat24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66F2.bat26⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a680C.bat28⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6935.bat30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A1F.bat32⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B29.bat34⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C42.bat36⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F20.bat38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72AA.bat40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7402.bat42⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a756A.bat44⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7654.bat46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A1D.bat48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B26.bat50⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C5F.bat52⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D68.bat54⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E53.bat56⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F6C.bat58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8028.bat60⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8112.bat62⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"63⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81ED.bat64⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"65⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82B8.bat66⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83D1.bat68⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"69⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a845E.bat70⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84FA.bat72⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"73⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85A6.bat74⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8623.bat76⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8681.bat78⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86FE.bat80⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"81⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a877B.bat82⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"83⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8807.bat84⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88B3.bat86⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"87⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8920.bat88⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a897E.bat90⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89FB.bat92⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A49.bat94⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AD6.bat96⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"97⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B63.bat98⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BEF.bat100⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C3D.bat102⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"103⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CCA.bat104⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D18.bat106⤵
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D85.bat108⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E12.bat110⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"C:\Users\Admin\AppData\Local\Temp\a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe"111⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
$$a5697.bat
$$a5752.bat
$$a5946.bat
$$a5B98.bat
$$a5C83.bat
$$a5D7D.bat
$$a5FBF.bat
$$a60A9.bat
$$a625F.bat
$$a631A.bat
$$a6481.bat
$$a65D9.bat
$$a66F2.bat
$$a680C.bat
$$a6935.bat
$$a6A1F.bat
$$a6B29.bat
$$a6C42.bat
$$a6F20.bat
$$a72AA.bat
$$a7402.bat
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
a57a9ffb8afcae92d767882f663b3d71e1a726a28ea714007f81dc2729e52986.exe.exe
Logo1_.exe
_desktop.ini
memory/412-2445-0x0000000001FC0000-0x000000000207F000-memory.dmp
memory/412-2440-0x0000000000400000-0x0000000000445000-memory.dmp
memory/564-56-0x0000000000590000-0x000000000064F000-memory.dmp
memory/564-55-0x0000000000400000-0x0000000000445000-memory.dmp
memory/640-4202-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1036-4208-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1188-64-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1188-65-0x0000000000550000-0x000000000060F000-memory.dmp
memory/1504-2936-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1504-2940-0x0000000001F30000-0x0000000001FEF000-memory.dmp
memory/1604-142-0x0000000000670000-0x000000000072F000-memory.dmp
memory/1604-141-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1664-1937-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1664-1938-0x0000000001F70000-0x000000000202F000-memory.dmp
memory/1696-3943-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1784-87-0x0000000000710000-0x00000000007CF000-memory.dmp
memory/1784-86-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1796-108-0x00000000006C0000-0x000000000077F000-memory.dmp
memory/1796-107-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2052-4184-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2088-4166-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2200-48-0x0000000002030000-0x00000000020EF000-memory.dmp
memory/2200-47-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2272-1924-0x0000000000590000-0x000000000064F000-memory.dmp
memory/2272-1923-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2324-37-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2324-38-0x0000000002030000-0x00000000020EF000-memory.dmp
memory/2440-4160-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2444-95-0x0000000001F90000-0x000000000204F000-memory.dmp
memory/2444-94-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2920-4154-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2956-1991-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2956-1993-0x0000000001F40000-0x0000000001FFF000-memory.dmp
memory/3004-10-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3004-0-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3004-9-0x0000000002040000-0x00000000020FF000-memory.dmp
memory/3116-512-0x0000000001F30000-0x0000000001FEF000-memory.dmp
memory/3116-511-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3332-4214-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3440-12-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3440-103-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3440-3079-0x0000000001FE0000-0x000000000209F000-memory.dmp
memory/3440-4254-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3440-3076-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3476-4196-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3516-158-0x00000000020D0000-0x000000000218F000-memory.dmp
memory/3516-157-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3712-132-0x0000000001FA0000-0x000000000205F000-memory.dmp
memory/3712-131-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3820-150-0x0000000001FE0000-0x000000000209F000-memory.dmp
memory/3820-149-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3852-165-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3852-166-0x0000000000660000-0x000000000071F000-memory.dmp
memory/4100-4172-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4152-4178-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4376-1932-0x0000000001F80000-0x000000000203F000-memory.dmp
memory/4376-1931-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4400-4190-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4540-116-0x0000000001FF0000-0x00000000020AF000-memory.dmp
memory/4540-115-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4692-78-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4692-79-0x0000000001F70000-0x000000000202F000-memory.dmp
memory/4772-30-0x0000000002090000-0x000000000214F000-memory.dmp
memory/4772-29-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4840-3431-0x0000000002090000-0x000000000214F000-memory.dmp
memory/4840-3428-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4860-21-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4860-22-0x0000000002000000-0x00000000020BF000-memory.dmp
memory/5036-123-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5036-124-0x0000000002010000-0x00000000020CF000-memory.dmp
memory/5152-4148-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5252-4238-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5316-2738-0x00000000020C0000-0x000000000217F000-memory.dmp
memory/5316-2735-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5336-4244-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5344-4118-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5420-4251-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5420-4245-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5456-2252-0x0000000001F00000-0x0000000001FBF000-memory.dmp
memory/5456-2248-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5508-4124-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5536-4142-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5580-4130-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5632-3741-0x0000000002170000-0x000000000222F000-memory.dmp
memory/5632-3738-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5712-4136-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5952-4232-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5964-3199-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5964-3200-0x0000000002040000-0x00000000020FF000-memory.dmp
memory/5984-4226-0x0000000000400000-0x0000000000445000-memory.dmp
memory/6048-3577-0x0000000000400000-0x0000000000445000-memory.dmp
memory/6048-3582-0x0000000001F70000-0x000000000202F000-memory.dmp
memory/6092-4220-0x0000000000400000-0x0000000000445000-memory.dmp