Resubmissions
04/11/2026, 21:57
261104-1txsssvwgz03/11/2026, 22:02
261103-1xxxzazy2l1003/11/2026, 21:57
261103-1t4lcawwes1003/11/2026, 21:50
261103-1p66nsfx2r1003/11/2026, 21:48
261103-1n9keazx5r1026/10/2026, 02:22
261026-ctm2lazv7j1024/10/2026, 06:44
261024-hhl8taxx2r23/10/2026, 16:14
261023-tpvpbatt6q1018/10/2026, 12:47
261018-p1by5acz5n1013/10/2026, 20:22
261013-y5pkfszw5mAnalysis
- max time kernel
829s - max time network
907s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
13/09/2026, 12:17
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260913-pfz58aba39
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
Protocol
ftp
-
Host
sanghyun.nfile.net
-
Port
21
-
Username
anonymous
-
Password
qkdansror-!!
Extracted
-
asyncrat
-
Default
-
delay
1
-
install
true
-
install_file
vortex.exe
-
install_folder
%AppData%
-
local_host
127.0.0.1
Extracted
-
quasar
-
1.4.1
-
DDNS
-
193.161.193.99:32471
-
807f3187-d087-4fff-beff-e73293a32af8
-
encryption_key
81A0C14D4C705B3C678E573C849DE7F6A3671A8B
-
install_name
jusched.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
CachedLogs
-
reconnect_delay
3000
-
startup_key
Java Update Scheduler
-
subdirectory
Java
Extracted
-
blackmatter
-
25.239
Extracted
-
phorphiex
-
178.16.54.109
-
TWIZTPEINF
Extracted
-
njrat
-
0.7d
-
Geforce
-
startitit2-23969.portmap.host:1604
-
b9584a316aeb9ca9b31edd4db18381f5
-
reg_key
b9584a316aeb9ca9b31edd4db18381f5
-
splitter
Y262SUCZ4UJJ
Extracted
-
cobaltstrike
-
100000000
-
http://51.77.77.161:443/sitemap.xml
-
access_type
512
-
beacon_type
2048
-
host
51.77.77.161
-
http_header1
AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAAEAAAABVIb3N0OiB3d3cueWFob28uY28uanAAAAAKAAAAIVJlZmVyZXI6IGh0dHBzOi8vd3d3LnlhaG9vLmNvLmpwLwAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAACgAAADRBY2NlcHQtTGFuZ3VhZ2U6IGphLUpQLGphO3E9MC45LGVuLVVTO3E9MC44LGVuO3E9MC43AAAABwAAAAAAAAANAAAAAgAAAARZU0M9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAAEAAAABVIb3N0OiB3d3cueWFob28uY28uanAAAAAKAAAAJ1JlZmVyZXI6IGh0dHBzOi8vd3d3LnlhaG9vLmNvLmpwL3NlYXJjaAAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAACgAAADRBY2NlcHQtTGFuZ3VhZ2U6IGphLUpQLGphO3E9MC45LGVuLVVTO3E9MC44LGVuO3E9MC43AAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZAAAAAcAAAAAAAAADwAAAA0AAAAFAAAABHlzaWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
45000
-
port_number
443
-
sc_process32
%windir%\syswow64\dllhost.exe
-
sc_process64
%windir%\sysnative\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnrqnRgLeqPpa2wJGQmftPgeWvFyCCFjULPdTAZQEcqNKgdO0HMT0bB67vQA1xgd1gikHOjzLkBeM3aPIwnDvMP5lH8Zxk+5t6qt4OYGlVoU9vBDwTcXRIMVXHuvvABcaH71IjHfEp3Veqqhs0pcTLabHGtzcBqmzfhmfpqFDgWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.24408576e+08
-
unknown2
AAAABAAAAAEAAABVAAAAAgAAAGMAAAANAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/robots.txt
-
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
-
watermark
100000000
Extracted
-
cobaltstrike
-
666666
-
http://117.72.181.104:443/match
-
access_type
512
-
beacon_type
2048
-
host
117.72.181.104
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCbEwcff7VtkHQu5ACuuOMJQmor7lwzDTAqLSHfOSPFtlHiDfv3tLs2egPMohYBjoY7aU101w6KOVwrRcORzhA6qrZDBR/fVvTG+1gyo5Nb5Oa1AgoFG0/Uqa+WMVlHH1Oq3MRR6rO1q1Kx2jqhUvN0yAfFzrvbM3pplozfK9z/lwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; NP07; NP07)
-
watermark
666666
Signatures
- Family: Ammyy Admin
Remote admin tool with various capabilities.
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Family: SharpHound
SharpHound is an open-source tool that collects Active Directory data for BloodHound analysis.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- AmmyyAdmin payload 1 IoCs
- Async RAT payload 1 IoCs
- Detect SalatStealer payload 2 IoCs
- Detects Rhadamanthys Payload 1 IoCs
- Detects SharpHound hacktool 2 IoCs
- Modifies firewall policy service 3 TTPs 4 IoCs
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
- Quasar payload 3 IoCs
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- Downloads MZ/PE file 11 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Signed with revoked ConnectWise certificate 3 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 10 IoCs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
- Drops file in System32 directory 2 IoCs
- SmartAssembly .NET packer 2 IoCs
Detects SmartAssembly .NET packer.
- UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Drops file in Program Files directory 25 IoCs
- Drops file in Windows directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies Control Panel 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies registry class 7 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
- Suspicious use of WriteProcessMemory 31 IoCs
- System policy modification 1 TTPs 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\fscan32.exe"C:\Users\Admin\AppData\Local\Temp\Files\fscan32.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe"C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\sanghyun-guest.exe"C:\Users\Admin\AppData\Local\Temp\Files\sanghyun-guest.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8B93.tmp\sanghyun-guest.bat" "C:\Users\Admin\AppData\Local\Temp\Files\sanghyun-guest.exe""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe"C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\client.exe"C:\Users\Admin\AppData\Local\Temp\Files\client.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ClientRun.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"C:\Program Files (x86)\seetrol\client\SeetrolClient.exe"4⤵
- Modifies firewall policy service
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns5⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe"C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\injector.exe"C:\Users\Admin\AppData\Local\Temp\Files\injector.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\files\injector.exeÂc:\users\admin\appdata\local\temp\files\injector.exeÂ3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe4⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe6⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR7⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe8⤵
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE9⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 17594365⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_3dfa6b71eb1f52a6.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_3dfa6b71eb1f52a6.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"' & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"'4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3731.tmp.bat""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\vortex.exe"C:\Users\Admin\AppData\Roaming\vortex.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\doitallmain.exe"C:\Users\Admin\AppData\Local\Temp\Files\doitallmain.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\d742276196694d20\ScreenConnect.ClientSetup.msi"3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\4.exe"C:\Users\Admin\AppData\Local\Temp\Files\4.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DriverSetup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\DriverSetup.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\devsetup64.exe/install /debug4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ScanPort.exe"C:\Users\Admin\AppData\Local\Temp\Files\ScanPort.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\YHY_Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\YHY_Setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe"C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe"C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svhost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svhost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe"C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Java\jusched.exe"C:\Users\Admin\AppData\Roaming\Java\jusched.exe"4⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\qcoin139.exe"C:\Users\Admin\AppData\Local\Temp\Files\qcoin139.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NJRat.exe"C:\Users\Admin\AppData\Local\Temp\Files\NJRat.exe"2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Files\NJRat.exe" "NJRat.exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\jd145.exe"C:\Users\Admin\AppData\Local\Temp\Files\jd145.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\036d684a34404874843f08d695e15695.exe"C:\Users\Admin\AppData\Local\Temp\Files\036d684a34404874843f08d695e15695.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1210.exe"C:\Users\Admin\AppData\Local\Temp\Files\1210.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe"C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\brbotnet.exe"C:\Users\Admin\AppData\Local\Temp\Files\brbotnet.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_f309f8496f916deb.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_f309f8496f916deb.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bot_x64.exe"C:\Users\Admin\AppData\Local\Temp\Files\bot_x64.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\beacon.exe"C:\Users\Admin\AppData\Local\Temp\Files\beacon.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\123.exe"C:\Users\Admin\AppData\Local\Temp\Files\123.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe"C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"3⤵
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x51c 0x2f81⤵
-
C:\Users\Admin\AppData\Roaming\vortex.exe"C:\Users\Admin\AppData\Roaming\vortex.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2EBD14E825BB72ED72F87580E5E36D43 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3A07.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241515328 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6EABF45EB2AA852E2831EA3A6FE849B42⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fc316959-9441-154e-b625-a62b3d58d7e1}\hw_usbdev.inf" "9" "40aa5d6b7" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{baf8fc87-0a5c-5f4f-aaed-7b6bdee22224}\diagswitchdrv.inf" "9" "4e8d9997f" "0000000000000164" "WinSta0\Default" "000000000000017C" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{14a47468-51c9-5748-8fe2-2c82cb4c949d}\hw_ctrlfakedev.inf" "9" "4a8921833" "000000000000017C" "WinSta0\Default" "0000000000000180" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{469419a8-a664-ab49-88de-92134856d97e}\hw_quser.inf" "9" "4a2ee005b" "0000000000000180" "WinSta0\Default" "0000000000000178" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{944deff6-e35b-7543-9577-d9ca08a0574c}\qu_usb_serial.inf" "9" "41cf79f4b" "0000000000000178" "WinSta0\Default" "0000000000000168" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{700d8b3a-f4cb-2144-9394-f3c37dab7e2a}\hw_goadb.inf" "9" "4de96bd3f" "0000000000000168" "WinSta0\Default" "000000000000017C" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2c9591a6-ea71-5b42-b990-d0cc5c984584}\hw_gohdb.inf" "9" "43b3eccaf" "000000000000017C" "WinSta0\Default" "0000000000000180" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3d5b2c2f-e0a4-6440-9587-279f6b9d43e3}\cdc-acm.inf" "9" "4e2e9b6a7" "0000000000000180" "WinSta0\Default" "0000000000000184" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8d4ecb37-4bf9-2e4b-a997-e9486bdbb640}\hw_usbvcom.inf" "9" "40f19cedf" "0000000000000184" "WinSta0\Default" "000000000000018C" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bb5ba00f-eb8b-b84b-98ff-e2dde6842826}\ew_usbccgpfilter.inf" "9" "43fb94187" "000000000000018C" "WinSta0\Default" "0000000000000174" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe" -service -lunch1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"2⤵
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\Java\jusched.exeC:\Users\Admin\AppData\Roaming\Java\jusched.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\NJRat.exe"C:\Users\Admin\AppData\Local\Temp\Files\NJRat.exe" ..1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1948 -ip 19481⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify System Firewall
2Indicator Removal
1Clear Persistence
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
e6593b1.rbs
365VPN7.exe
sanghyun-guest.bat
%E8%99%9A%E6%8B%9F%E5%85%89%E9%A9%[email protected]
02.08.2022.exe
036d684a34404874843f08d695e15695.exe
1210.exe
123.exe
4.exe
AA_v3.exe
Anap.a.exe
BootstrapperNew.exe
CFXBypass.exe
CritScript.exe
NAMUVPN7.exe
NJRat.exe
ScanPort.exe
ScreenConnect.ClientSetup.exe
SharpHound.exe
UpAgent.exe
YHY_Setup.exe
beacon.exe
bot_x64.exe
brbotnet.exe
builder.exe
client.exe
delfino-g3-sha2.exe
doitallmain.exe
file_3dfa6b71eb1f52a6.exe
file_f309f8496f916deb.exe
fscan32.exe
hack1226.exe
injector.exe
injector.exeÂ
jd145.exe
ntladlklthawd.exe
peinf.exe
pkexU0YtxaR3.exe
qcoin139.exe
sanghyun-guest.exe
scalecalc.exe
setup.exe
steamcmd.exe
support.client.exe
svchost.exe
svhost.exe
update.exe
ClientRun.exe
STClientChat.exe
STUpdate.exe
SeetrolClient.exe
SeetrolMyService.exe
Seetrol_Clt.exe
sas.dll
sthooks.dll
JUSCHED.EXE
MSI3A07.tmp
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
DriverSetup.exe
Install.log
ScreenConnect.ClientSetup.msi
__PSScriptPolicyTest_kfncd1jl.t2f.ps1
tmp3731.tmp.bat
SETB624.tmp
hw_ctrlfakedev.sys
hw_ctrlfakedeva64.cat
hw_gohdb.cat
hw_gohdb.inf
SETBEB1.tmp
mtk_cdc_acm.cat
hw_quser.cat
hw_quser.inf
hw_quusbmdm.sys
SETBB9B.tmp
WdfCoInstaller01009.dll
WinUSBCoInstaller2.dll
androidwinusb.cat
SETBFAD.tmp
hw_usbvcom.cat
hw_usbvcom.sys
qu_usb_serial.cat
qu_usb_serial.inf
qu_usb_serial.sys
SETB516.tmp
diagswitchdrv.sys
diagswitchdrva64.cat
ew_ccgpfilter.cat
ew_usbccgpfilter.inf
ew_usbccgpfilter.sys
hw_usbdev.cat
hw_usbdev.inf
hw_usbdev.sys
MSI95B5.tmp
explorer.exe
icsys.icn.exe
spoolsv.exe
svchost.exe
dberr.txt
memory/412-1339-0x0000000000400000-0x0000000000438000-memory.dmp
memory/540-227-0x0000000000400000-0x000000000041F000-memory.dmp
memory/540-153-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1212-61-0x000000006F680000-0x000000006F690000-memory.dmp
memory/1212-60-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/1212-63-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/1260-330-0x00000000058C0000-0x000000000594C000-memory.dmp
memory/1260-334-0x0000000005B00000-0x0000000005CAA000-memory.dmp
memory/1260-326-0x00000000056B0000-0x00000000056BA000-memory.dmp
memory/1260-321-0x0000000005670000-0x000000000569E000-memory.dmp
memory/1264-1965-0x0000020F79090000-0x0000020F792C2000-memory.dmp
memory/1264-1966-0x0000020F79090000-0x0000020F792C2000-memory.dmp
memory/1264-1954-0x0000020F789A0000-0x0000020F78B2E000-memory.dmp
memory/1360-226-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1360-176-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1500-0-0x0000000000C90000-0x0000000000C98000-memory.dmp
memory/1500-2-0x0000000005890000-0x00000000058A0000-memory.dmp
memory/1500-3-0x0000000005890000-0x00000000058A0000-memory.dmp
memory/1500-1-0x00000000056D0000-0x000000000576C000-memory.dmp
memory/1724-124-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1724-94-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1876-1518-0x0000000000730000-0x000000000126D000-memory.dmp
memory/1876-1372-0x0000000000730000-0x000000000126D000-memory.dmp
memory/1876-1504-0x0000000000730000-0x000000000126D000-memory.dmp
memory/1880-299-0x00000000062D0000-0x0000000006874000-memory.dmp
memory/1880-298-0x0000000005730000-0x00000000058DA000-memory.dmp
memory/1880-297-0x00000000056D0000-0x00000000056F2000-memory.dmp
memory/1880-296-0x0000000005630000-0x00000000056BC000-memory.dmp
memory/1880-295-0x0000000005A30000-0x0000000005D20000-memory.dmp
memory/1880-294-0x0000000003050000-0x0000000003058000-memory.dmp
memory/1948-245-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2240-1539-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1977-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1964-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1969-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1951-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1472-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1943-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1852-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1427-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1983-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1400-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1660-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1649-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1580-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1973-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1554-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1551-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1549-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1546-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1545-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1543-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1459-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1975-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1536-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1532-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1959-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1513-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1979-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1982-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2240-1503-0x0000000170000000-0x0000000170252000-memory.dmp
memory/2248-1483-0x000002604A5A0000-0x000002604A5A2000-memory.dmp
memory/2248-1490-0x0000000180000000-0x0000000180005000-memory.dmp
memory/2368-224-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2436-30-0x0000000000C30000-0x000000000272A000-memory.dmp
memory/2436-21-0x0000000000C30000-0x000000000272A000-memory.dmp
memory/2436-1287-0x00000000007E0000-0x0000000000B04000-memory.dmp
memory/2776-126-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2776-344-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2776-1514-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2776-127-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2776-221-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2776-122-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2776-259-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2776-265-0x0000000000400000-0x0000000000727000-memory.dmp
memory/2836-203-0x000002036E750000-0x000002036E766000-memory.dmp
memory/2836-201-0x000002036DC00000-0x000002036DC26000-memory.dmp
memory/2836-195-0x000002036DBC0000-0x000002036DBF8000-memory.dmp
memory/2836-216-0x000002036E780000-0x000002036E788000-memory.dmp
memory/2836-204-0x000002036DC30000-0x000002036DC3A000-memory.dmp
memory/2836-202-0x000002036DC40000-0x000002036DC48000-memory.dmp
memory/2836-180-0x00000203669A0000-0x00000203669B0000-memory.dmp
memory/2836-212-0x000002036DBB0000-0x000002036DBBA000-memory.dmp
memory/2836-200-0x000002036DBA0000-0x000002036DBAA000-memory.dmp
memory/2836-141-0x0000020366260000-0x00000203665D0000-memory.dmp
memory/2836-182-0x000002036DB40000-0x000002036DB48000-memory.dmp
memory/2836-199-0x000002036E650000-0x000002036E750000-memory.dmp
memory/2836-196-0x000002036DB90000-0x000002036DB9E000-memory.dmp
memory/2980-225-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3248-1502-0x00000000073A0000-0x00000000073A1000-memory.dmp
memory/3248-1541-0x0000000006E40000-0x0000000006E41000-memory.dmp
memory/3256-1538-0x0000000000400000-0x0000000000487000-memory.dmp
memory/3256-1403-0x0000000000400000-0x0000000000487000-memory.dmp
memory/3280-247-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3280-215-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3712-391-0x0000020A5DA00000-0x0000020A5DA3C000-memory.dmp
memory/3712-390-0x0000020A5D540000-0x0000020A5D644000-memory.dmp
memory/3712-393-0x0000020A5F2B0000-0x0000020A5F2E0000-memory.dmp
memory/3712-392-0x0000020A5D9D0000-0x0000020A5D9E0000-memory.dmp
memory/3712-394-0x0000020A77B80000-0x0000020A77BB2000-memory.dmp
memory/3712-395-0x0000020A77BC0000-0x0000020A77C70000-memory.dmp
memory/3752-1388-0x0000000003270000-0x0000000003670000-memory.dmp
memory/3752-1481-0x0000000003270000-0x0000000003670000-memory.dmp
memory/3752-1391-0x0000000076990000-0x0000000076BA5000-memory.dmp
memory/3752-1381-0x00000000013F0000-0x0000000001486000-memory.dmp
memory/3752-1387-0x0000000003270000-0x0000000003670000-memory.dmp
memory/3752-1476-0x00000000040B0000-0x00000000040E7000-memory.dmp
memory/3752-1389-0x00007FFA510B0000-0x00007FFA512A5000-memory.dmp
memory/3752-1482-0x0000000003270000-0x0000000003670000-memory.dmp
memory/3872-167-0x0000000000080000-0x0000000000096000-memory.dmp
memory/3948-1700-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3948-1654-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4068-411-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4068-1289-0x0000000000400000-0x000000000041C000-memory.dmp
memory/4216-571-0x0000000000AC0000-0x0000000000AD0000-memory.dmp
memory/4216-604-0x000000001B700000-0x000000001B722000-memory.dmp
memory/4656-1438-0x00000000051A0000-0x00000000051F0000-memory.dmp
memory/4656-1439-0x0000000005270000-0x00000000052E6000-memory.dmp
memory/4656-1452-0x00000000059E0000-0x00000000059FE000-memory.dmp
memory/4656-1437-0x00000000009A0000-0x00000000009B2000-memory.dmp
memory/5020-1356-0x000000001C4E0000-0x000000001C592000-memory.dmp
memory/5020-1354-0x000000001C3D0000-0x000000001C420000-memory.dmp
memory/5300-1715-0x000002747F860000-0x000002747F9E6000-memory.dmp
memory/5300-1704-0x000002747E5A0000-0x000002747E5A8000-memory.dmp
memory/5372-1519-0x0000000000D50000-0x00000000011C2000-memory.dmp
memory/5372-1517-0x0000000000100000-0x0000000000135000-memory.dmp
memory/5532-1542-0x0000000000400000-0x0000000000582000-memory.dmp
memory/5532-1528-0x0000000000400000-0x0000000000582000-memory.dmp
memory/5532-1529-0x0000000000400000-0x0000000000582000-memory.dmp
memory/5532-1527-0x0000000000400000-0x0000000000582000-memory.dmp
memory/5572-1696-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5828-1563-0x0000000000400000-0x000000000041F000-memory.dmp
memory/5828-1970-0x0000000000400000-0x000000000041F000-memory.dmp