Analysis
- user interaction
yes - max time kernel
1050s - max time network
1051s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
21/06/2026, 08:22
General
- Target 123645.exe
- Size 84KB
- Sample260621-j9kdzads21
- SHA256 45f3b2a158163f09cfbf248a2fa76f2b3b011b8abc35835230ab81597db43802
Malware Config
Extracted
-
xworm
-
7326.info:2686
-
install_file
USB.exe
-
localhost
127.0.0.1
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- UAC bypass 3 TTPs 3 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 19 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 5 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 43 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\123645.exe"C:\Users\Admin\AppData\Local\Temp\123645.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_d5c09d4fd29a42ba87117f86d0516d9c.cs"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES165E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF8B9E422E7D543C9974728E524F6FB35.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe" 7043⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\windows\SysWOW64\cmstp.exe"C:\windows\system32\cmstp.exe" /au C:\windows\temp\vfqnggf3.inf3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -C "& 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_yra5nvwp13i\ezpbpb5ling.ps1' -E 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_yra5nvwp13i\main.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wpz2igxz\wpz2igxz.cmdline"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC19D.tmp" "c:\Users\Admin\AppData\Local\Temp\wpz2igxz\CSC52CFCDB14EBF4065A07AA9D32A16E760.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_yra5nvwp13i\Unzip\main.exe"C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_yra5nvwp13i\Unzip\main.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM brave.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM msedge.exe5⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\SysWOW64\CMD.EXE"CMD.EXE"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" config wuauserv start=disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb6d38c728,0x7ffb6d38c734,0x7ffb6d38c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,4982116116325316472,17365810586255390574,262144 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,18146802161224845061,7138303272376069202,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,13313843044658718658,6622521640077776414,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,17496864006115068541,4088963615243663342,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,2137516429902722488,10388016875243056973,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4716,i,3328941528671474978,10314447053918713427,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4920,i,10806054467167751744,12511905576448549232,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,9996087055356006216,18191301722084896327,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,18305126853883050166,8492927669919114830,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,1101181541321353935,18395646221134836020,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5500,i,14618958963936833734,11472251560844063973,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5544,i,10225972325290115890,10098208796920567184,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5792,i,16948065968012200949,11025270512367401821,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,3675395613649400284,16125521703742811773,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5972,i,12717139842293252779,3741017139012027331,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6208,i,12563033538155103012,13877789724957864047,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6212,i,5406594808673602832,15576730733773862358,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5980,i,1771990246687379318,16326826297571195335,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6048,i,12806452161299197359,2048073696334556457,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,5030701250597516904,4319938083543907227,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,2868151873823053049,13716281177659254864,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5712,i,11788943764739443507,6469394243793118910,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4828,i,297993568998045751,6131460424619123972,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,833487542862674416,11920291749443704895,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,9848350303876797631,11983614811860583620,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,3616003869727629111,8908404162191588170,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5532,i,14445570986039283776,6845671149451370677,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3264,i,15161979807431971372,13398295946169405338,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5544,i,17628860231608464516,16713694582391092785,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6052,i,13282319203095779143,4501672914294755995,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6200,i,3254909895755067625,2642854216021178692,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5592,i,2646249391339714255,9930634294027355629,2097152 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3276,i,4913815965014384785,13019243980101073851,524288 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1180,i,15029208843920168853,7690317412337720258,262144 --field-trial-handle=1796,i,5851115996883035001,121427194674679514,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\VSRemoteControl_1xsq1vy31gh\rlhbsj3yfpx.bat2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 1 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 5 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 1 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cmstp.exe /F2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
1Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
BookmarkMergedSurfaceOrdering
temp-index
messages.json
craw_background.js
CURRENT
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe5bb94a.TMP
Local State
Local State
Local State
Local State
Local State
Local State
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
Cookies
Cookies
Login Data
Login Data
AES.pyc
ChaCha20.pyc
ChaCha20_Poly1305.pyc
_ARC4.pyd
_EKSBlowfish.pyc
_Salsa20.pyd
__init__.pyc
_chacha20.pyd
_mode_cbc.pyc
_mode_ccm.pyc
_mode_cfb.pyc
_mode_ctr.pyc
_mode_eax.pyc
_mode_ecb.pyc
_mode_gcm.pyc
_mode_kw.pyc
_mode_kwp.pyc
_mode_ocb.pyc
_mode_ofb.pyc
_mode_openpgp.pyc
_mode_siv.pyc
_pkcs1_decode.pyd
_raw_aes.pyd
_raw_aesni.pyd
_raw_arc2.pyd
_raw_blowfish.pyd
_raw_cast.pyd
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ctr.pyd
_raw_des.pyd
_raw_des3.pyd
_raw_ecb.pyd
_raw_eksblowfish.pyd
_raw_ocb.pyd
_raw_ofb.pyd
BLAKE2s.pyc
CMAC.pyc
HMAC.pyc
MD5.pyc
Poly1305.pyc
SHA1.pyc
SHA224.pyc
SHA256.pyc
SHA384.pyc
SHA3_224.pyc
SHA3_256.pyc
SHA3_384.pyc
SHA3_512.pyc
SHA512.pyc
_BLAKE2b.pyd
_BLAKE2s.pyd
_MD2.pyd
_MD4.pyd
_MD5.pyd
_RIPEMD160.pyd
_SHA1.pyd
_SHA224.pyd
_SHA384.pyd
_SHA512.pyd
__init__.pyc
_ghash_clmul.pyd
_ghash_portable.pyd
_keccak.pyd
_poly1305.pyd
keccak.pyc
_modexp.pyd
KDF.pyc
__init__.pyc
_scrypt.pyd
_curve25519.pyd
_curve448.pyd
_ec_ws.pyd
_ed25519.pyd
_ed448.pyd
__init__.pyc
__init__.pyc
_cpu_features.pyc
_cpuid_c.pyd
_file_system.pyc
_raw_api.pyc
_strxor.pyd
number.pyc
py3compat.pyc
strxor.pyc
__init__.pyc
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
__init__.pyc
abc.pyc
__init__.pyc
_endian.pyc
util.pyc
wintypes.pyc
__init__.pyc
_encoded_words.pyc
_header_value_parser.pyc
_parseaddr.pyc
_policybase.pyc
architecture.rst
base64mime.pyc
charset.pyc
contentmanager.pyc
encoders.pyc
errors.pyc
feedparser.pyc
generator.pyc
header.pyc
headerregistry.pyc
iterators.pyc
message.pyc
parser.pyc
policy.pyc
quoprimime.pyc
utils.pyc
__init__.pyc
aliases.pyc
ascii.pyc
base64_codec.pyc
big5.pyc
big5hkscs.pyc
bz2_codec.pyc
charmap.pyc
cp037.pyc
cp1006.pyc
cp1026.pyc
cp1125.pyc
cp1140.pyc
cp1250.pyc
cp1251.pyc
cp1252.pyc
cp1253.pyc
cp1254.pyc
cp1255.pyc
cp1256.pyc
cp1257.pyc
cp1258.pyc
cp273.pyc
cp424.pyc
cp437.pyc
cp500.pyc
cp720.pyc
cp737.pyc
cp775.pyc
cp850.pyc
cp852.pyc
cp855.pyc
cp856.pyc
cp857.pyc
cp858.pyc
cp860.pyc
cp861.pyc
cp862.pyc
cp863.pyc
cp864.pyc
cp865.pyc
cp866.pyc
cp869.pyc
cp874.pyc
cp875.pyc
cp932.pyc
cp949.pyc
cp950.pyc
euc_jis_2004.pyc
euc_jisx0213.pyc
euc_jp.pyc
euc_kr.pyc
gb18030.pyc
gb2312.pyc
gbk.pyc
hex_codec.pyc
hp_roman8.pyc
hz.pyc
idna.pyc
iso2022_jp.pyc
iso2022_jp_1.pyc
iso2022_jp_2.pyc
iso2022_jp_2004.pyc
iso2022_jp_3.pyc
iso2022_jp_ext.pyc
iso2022_kr.pyc
iso8859_1.pyc
iso8859_10.pyc
iso8859_11.pyc
iso8859_13.pyc
iso8859_14.pyc
iso8859_15.pyc
iso8859_16.pyc
iso8859_2.pyc
iso8859_3.pyc
iso8859_4.pyc
iso8859_5.pyc
iso8859_6.pyc
iso8859_7.pyc
iso8859_8.pyc
iso8859_9.pyc
johab.pyc
koi8_r.pyc
koi8_t.pyc
koi8_u.pyc
kz1048.pyc
latin_1.pyc
mac_arabic.pyc
mac_croatian.pyc
mac_cyrillic.pyc
mac_farsi.pyc
mac_greek.pyc
mac_iceland.pyc
mac_latin2.pyc
mac_roman.pyc
mac_romanian.pyc
mac_turkish.pyc
mbcs.pyc
oem.pyc
palmos.pyc
ptcp154.pyc
punycode.pyc
quopri_codec.pyc
raw_unicode_escape.pyc
rot_13.pyc
shift_jis.pyc
shift_jis_2004.pyc
shift_jisx0213.pyc
tis_620.pyc
undefined.pyc
unicode_escape.pyc
utf_16.pyc
utf_16_be.pyc
utf_16_le.pyc
utf_32.pyc
utf_32_be.pyc
utf_32_le.pyc
utf_7.pyc
utf_8.pyc
utf_8_sig.pyc
uu_codec.pyc
zlib_codec.pyc
__init__.pyc
entities.pyc
__init__.pyc
client.pyc
cookiejar.pyc
server.pyc
__init__.pyc
_abc.pyc
abc.pyc
machinery.pyc
__init__.pyc
_adapters.pyc
_collections.pyc
_functools.pyc
_itertools.pyc
_meta.pyc
_text.pyc
readers.pyc
__init__.pyc
_adapters.pyc
_common.pyc
_itertools.pyc
_legacy.pyc
abc.pyc
readers.pyc
util.pyc
__init__.pyc
decoder.pyc
encoder.pyc
scanner.pyc
libcrypto-3.dll
libffi-8.dll
library.dat
library.zip
libssl-3.dll
__init__.pyc
__init__.pyc
_pydoc.css
topics.pyc
pyexpat.pyd
__init__.pyc
_casefix.pyc
_compiler.pyc
_constants.pyc
_parser.pyc
select.pyd
sqlite3.dll
__init__.pyc
dbapi2.pyc
dump.pyc
unicodedata.pyd
__init__.pyc
error.pyc
parse.pyc
request.pyc
response.pyc
__init__.pyc
com.pyc
__init__.pyc
binary_string_conversion.pyc
certificate.pyc
cryptmsg.pyc
dpapi.pyc
encrypt_decrypt.pyc
sign_verify.pyc
dbgprint.pyc
__init__.pyc
flag.pyc
interfaces.pyc
meta.pyc
ntstatus.pyc
windef.pyc
winerror.pyc
winfuncs.pyc
winstructs.pyc
hooks.pyc
injection.pyc
__init__.pyc
native_function.pyc
nativeutils.pyc
simple_arm64.pyc
simple_x64.pyc
simple_x86.pyc
pe_parse.pyc
pycompat.pyc
remotectypes.pyc
security.pyc
syswow64.pyc
__init__.pyc
improved_buffer.pyc
pythonutils.pyc
winutils.pyc
__init__.pyc
apisetmap.pyc
bits.pyc
device_manager.pyc
event_log.pyc
event_trace.pyc
exception.pyc
file.pyc
handle.pyc
network.pyc
object_manager.pyc
process.pyc
registry.pyc
service.pyc
system.pyc
system_module.pyc
task_scheduler.pyc
token.pyc
volume.pyc
wmi.pyc
__init__.pyc
apiproxy.pyc
__init__.pyc
advapi32.pyc
cfgmgr32.pyc
crypt32.pyc
cryptui.pyc
dbghelp.pyc
dnsapi.pyc
iphlpapi.pyc
kernel32.pyc
ktmw32.pyc
ncrypt.pyc
netapi32.pyc
ntdll.pyc
ole32.pyc
oleacc.pyc
oleaut32.pyc
psapi.pyc
setupapi.pyc
shell32.pyc
shlwapi.pyc
tdh.pyc
user32.pyc
version.pyc
virtdisk.pyc
wevtapi.pyc
winhttp.pyc
wininet.pyc
wintrust.pyc
ws2_32.pyc
error.pyc
wintrust.pyc
__init__.pyc
NodeFilter.pyc
__init__.pyc
domreg.pyc
expatbuilder.pyc
minicompat.pyc
minidom.pyc
pulldom.pyc
xmlbuilder.pyc
__init__.pyc
expat.pyc
__init__.pyc
_exceptions.pyc
expatreader.pyc
handler.pyc
saxutils.pyc
xmlreader.pyc
main.exe
python311.dll
ezpbpb5ling.ps1
RES165E.tmp
RESC19D.tmp
RegSvcs.exe
rlhbsj3yfpx.bat
Web Data
Web Data
__PSScriptPolicyTest_54wozilp.33m.ps1
messages.json
wpz2igxz.dll
Unconfirmed 545441.crdownload
vfqnggf3.inf
CSCF8B9E422E7D543C9974728E524F6FB35.TMP
guardian_src_d5c09d4fd29a42ba87117f86d0516d9c.cs
CSC52CFCDB14EBF4065A07AA9D32A16E760.TMP
wpz2igxz.0.cs
wpz2igxz.cmdline
memory/460-451-0x0000000070A40000-0x0000000070A8C000-memory.dmp
memory/460-455-0x00000000072E0000-0x0000000007383000-memory.dmp
memory/460-450-0x00000000072A0000-0x00000000072D6000-memory.dmp
memory/460-448-0x0000000006080000-0x000000000609E000-memory.dmp
memory/460-447-0x0000000005BE0000-0x0000000005F3B000-memory.dmp
memory/460-446-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/460-454-0x0000000007260000-0x0000000007280000-memory.dmp
memory/460-449-0x0000000006140000-0x000000000618C000-memory.dmp
memory/460-456-0x0000000007A40000-0x00000000080BC000-memory.dmp
memory/460-457-0x0000000007400000-0x000000000741A000-memory.dmp
memory/460-458-0x0000000007470000-0x000000000747A000-memory.dmp
memory/460-459-0x0000000007670000-0x0000000007706000-memory.dmp
memory/460-445-0x0000000005B00000-0x0000000005B66000-memory.dmp
memory/460-442-0x00000000052B0000-0x00000000052D2000-memory.dmp
memory/460-441-0x00000000054B0000-0x0000000005AFA000-memory.dmp
memory/460-440-0x0000000002860000-0x0000000002896000-memory.dmp
memory/704-4187-0x0000000007A30000-0x0000000007A36000-memory.dmp
memory/704-1613-0x0000000009510000-0x000000000A042000-memory.dmp
memory/704-4186-0x0000000008E80000-0x0000000008EC2000-memory.dmp
memory/704-1602-0x0000000007A80000-0x0000000007ABE000-memory.dmp
memory/704-711-0x0000000008220000-0x000000000826E000-memory.dmp
memory/704-712-0x00000000082E0000-0x00000000082E6000-memory.dmp
memory/704-4223-0x000000000D040000-0x000000000D082000-memory.dmp
memory/704-418-0x0000000005890000-0x000000000592C000-memory.dmp
memory/704-1581-0x0000000007B80000-0x0000000007BBC000-memory.dmp
memory/704-1583-0x0000000007BE0000-0x0000000007BE6000-memory.dmp
memory/704-4224-0x0000000007E20000-0x0000000007E26000-memory.dmp
memory/704-4230-0x0000000005840000-0x0000000005848000-memory.dmp
memory/704-4179-0x0000000005FF0000-0x0000000005FF6000-memory.dmp
memory/704-4178-0x000000000C5B0000-0x000000000C5F0000-memory.dmp
memory/704-1612-0x0000000018420000-0x0000000019284000-memory.dmp
memory/704-417-0x0000000000400000-0x0000000000418000-memory.dmp
memory/704-4229-0x0000000005B30000-0x0000000005BA6000-memory.dmp
memory/704-4167-0x0000000005F80000-0x0000000005F86000-memory.dmp
memory/704-4165-0x000000000A180000-0x000000000A1CC000-memory.dmp
memory/704-4164-0x0000000003310000-0x0000000003316000-memory.dmp
memory/704-1599-0x0000000008380000-0x00000000083C2000-memory.dmp
memory/704-4163-0x000000000A840000-0x000000000A902000-memory.dmp
memory/704-4218-0x0000000008040000-0x0000000008052000-memory.dmp
memory/704-1603-0x00000000019C0000-0x00000000019C6000-memory.dmp
memory/704-1600-0x00000000080F0000-0x00000000080F6000-memory.dmp
memory/928-463-0x0000000005A50000-0x0000000005DAB000-memory.dmp
memory/928-465-0x0000000070A40000-0x0000000070A8C000-memory.dmp
memory/2408-1396-0x00000242061F0000-0x0000024206881000-memory.dmp
memory/2408-702-0x00000242061F0000-0x0000024206881000-memory.dmp
memory/3356-415-0x0000000004CC0000-0x0000000004CDA000-memory.dmp
memory/3356-419-0x0000000074F30000-0x00000000756EC000-memory.dmp
memory/3356-0-0x0000000074F42000-0x0000000074F43000-memory.dmp
memory/3356-4-0x0000000004C70000-0x0000000004C7A000-memory.dmp
memory/3356-3-0x0000000004BA0000-0x0000000004C32000-memory.dmp
memory/3356-2-0x0000000005210000-0x00000000057CA000-memory.dmp
memory/3356-416-0x0000000004F10000-0x0000000004F2E000-memory.dmp
memory/3356-1-0x0000000000080000-0x000000000009C000-memory.dmp
memory/3356-5-0x0000000004D70000-0x0000000004DE6000-memory.dmp
memory/3356-6-0x0000000074F30000-0x00000000756EC000-memory.dmp
memory/3356-7-0x0000000074F42000-0x0000000074F43000-memory.dmp
memory/3356-8-0x0000000074F30000-0x00000000756EC000-memory.dmp
memory/3516-1594-0x00000000005A0000-0x00000000005A8000-memory.dmp
memory/4220-517-0x0000020581C70000-0x0000020581C90000-memory.dmp
memory/4220-507-0x0000020581E50000-0x0000020581F50000-memory.dmp
memory/4220-540-0x00000205941F0000-0x0000020594210000-memory.dmp
memory/4220-506-0x0000020581900000-0x0000020581920000-memory.dmp
memory/4220-494-0x00000205801E0000-0x00000205802E0000-memory.dmp
memory/5844-4068-0x0000000005AA0000-0x0000000005DFB000-memory.dmp
memory/5844-4084-0x0000000006F30000-0x0000000006F38000-memory.dmp
memory/5844-4070-0x0000000005FC0000-0x000000000600C000-memory.dmp
memory/5844-4085-0x00000000071C0000-0x00000000071E2000-memory.dmp