raccoon | 54bcd3308c140c8ec030f98697cc7f0e9d4585d54334a2eb77c58879510d5c8c

Analysis

max time kernel
152s
max time network
152s
platform
windows10_x64
resource
win10-en-20211208
submitted
22/01/2022, 21:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54BCD3308C140C8EC030F98697CC7F0E9D4585D54334A.exe
Size 3.8MB
Sample220122-zvfp8sdcbm
SHA256 54bcd3308c140c8ec030f98697cc7f0e9d4585d54334a2eb77c58879510d5c8c
MD5 325c6021ce7b691f124ec4ee2024ce28
SHA1 673eabe039a32982a47d088342844775822996c8
SHA512 93f9c2eb518e2dd941c2e23133ecdc9637f3f365fd2c64ca5eb33d7162ab0e5c19da7ecd9718266c51b0882c7ebf969c9388a7fa70d67be97895e8afb7c54e4a
MD5 SHA1 SHA512

Score

10^/10

raccoon redline vidar 1114 1bc6116182dfd33bce1052fe9bb0415968161030 26ba8731a23ebe331ca665e334da5a21506c1e2d 4c585dd595f87d872b81110ef04a868eee9e5c6b fie aspackv2 infostealer spyware stealer suricata

Malware Config

Extracted

Family

raccoon

Version

1.8.5

Botnet

4c585dd595f87d872b81110ef04a868eee9e5c6b

Attributes

url4cnc
http://188.166.1.115/vileonv14

http://91.219.236.139/vileonv14

http://194.180.174.147/vileonv14

http://185.3.95.153/vileonv14

http://185.163.204.22/vileonv14

https://t.me/vileonv14

rc4.plain

Extracted

Family

raccoon

Version

1.8.5

Botnet

26ba8731a23ebe331ca665e334da5a21506c1e2d

Attributes

url4cnc
http://91.219.236.133/renmzne

http://194.180.174.145/renmzne

http://188.166.1.115/renmzne

http://91.219.236.139/renmzne

http://194.180.174.147/renmzne

http://185.3.95.153/renmzne

http://185.163.204.22/renmzne

https://t.me/renmzne

rc4.plain

Extracted

Family

redline

Botnet

91.243.59.147:33459

Extracted

Family

vidar

Version

49.7

Botnet

1114

https://mastodon.online/@prophef1
https://koyu.space/@prophef2

Attributes

profile_id
1114

Extracted

Family

raccoon

Version

1.8.5

Botnet

1bc6116182dfd33bce1052fe9bb0415968161030

Attributes

url4cnc
http://91.219.236.133/capibar

http://194.180.174.145/capibar

http://188.166.1.115/capibar

http://91.219.236.139/capibar

http://194.180.174.147/capibar

http://185.3.95.153/capibar

http://185.163.204.22/capibar

https://t.me/capibar

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 14 IoCs

resource	yara_rule
behavioral2/memory/1376-707-0x0000000001190000-0x0000000001273000-memory.dmp	family_redline
behavioral2/memory/3024-728-0x0000000000810000-0x00000000008F2000-memory.dmp	family_redline
behavioral2/memory/3024-749-0x0000000000810000-0x00000000008F2000-memory.dmp	family_redline
behavioral2/memory/3024-782-0x0000000000810000-0x00000000008F2000-memory.dmp	family_redline
behavioral2/memory/4796-833-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/2488-767-0x0000000000070000-0x0000000000146000-memory.dmp	family_redline
behavioral2/memory/1304-745-0x0000000001110000-0x000000000118F000-memory.dmp	family_redline
behavioral2/memory/1376-740-0x0000000001190000-0x0000000001273000-memory.dmp	family_redline
behavioral2/memory/524-739-0x0000000000F30000-0x000000000100E000-memory.dmp	family_redline
behavioral2/memory/2488-718-0x0000000000070000-0x0000000000146000-memory.dmp	family_redline
behavioral2/memory/1304-711-0x0000000001110000-0x000000000118F000-memory.dmp	family_redline
behavioral2/memory/956-710-0x0000000000140000-0x0000000000233000-memory.dmp	family_redline
behavioral2/memory/524-709-0x0000000000F30000-0x000000000100E000-memory.dmp	family_redline
behavioral2/memory/1376-708-0x0000000001190000-0x0000000001273000-memory.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2820 created 2808	2820	WerFault.exe	89

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/1840-815-0x0000000000400000-0x0000000000A66000-memory.dmp	family_vidar

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001ab20-118.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab20-119.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab1f-246.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab1f-248.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab1e-247.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab21-254.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab1e-253.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab21-252.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab1e-250.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
1356	setup_install.exe
3260	c2df147c046a32046.exe
1224	setup_install.exe
3396	Mon10097fa54c.exe
1924	Mon107825d0b235ce.exe
828	Mon103a41b612670a33d.exe
2476	Mon102141234bd378.exe
1744	Mon10301b16494.exe
2808	Mon107113c0972c.exe
1340	Mon10fc1df6897de204.exe
3156	Mon10d65f5baa6.exe
1272	Mon107825d0b235ce.tmp

Loads dropped DLL 13 IoCs

pid	Process
1356	setup_install.exe
1356	setup_install.exe
1356	setup_install.exe
1356	setup_install.exe
1224	setup_install.exe
1224	setup_install.exe
1224	setup_install.exe
1224	setup_install.exe
1224	setup_install.exe
1224	setup_install.exe
1224	setup_install.exe
1224	setup_install.exe
1272	Mon107825d0b235ce.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com
96	ipinfo.io
97	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 19 IoCs

pid	pid_target	Process	procid_target
2668	1224	WerFault.exe	73
1852	2808	WerFault.exe	89
3164	2808	WerFault.exe	89
2776	2808	WerFault.exe	89
524	2808	WerFault.exe	89
3884	2808	WerFault.exe	89
644	2808	WerFault.exe	89
2836	2808	WerFault.exe	89
1428	2808	WerFault.exe	89
1616	2808	WerFault.exe	89
1792	2808	WerFault.exe	89
1512	2808	WerFault.exe	89
816	2808	WerFault.exe	89
1532	2808	WerFault.exe	89
3024	2808	WerFault.exe	89
1272	2808	WerFault.exe	89
2820	2808	WerFault.exe	89
4700	1184	WerFault.exe
4788	1028	WerFault.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000500000001ab60-693.dat	nsis_installer_1
behavioral2/files/0x000500000001ab60-693.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon10097fa54c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon10097fa54c.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon10097fa54c.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Mon107113c0972c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Mon107113c0972c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
4056	powershell.exe
4056	powershell.exe
4056	powershell.exe
3396	Mon10097fa54c.exe
3396	Mon10097fa54c.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
1852	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe
2776	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3396	Mon10097fa54c.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	Mon10d65f5baa6.exe
Token: SeDebugPrivilege	1340	Mon10fc1df6897de204.exe
Token: SeRestorePrivilege	2668	WerFault.exe
Token: SeBackupPrivilege	2668	WerFault.exe
Token: SeDebugPrivilege	2668	WerFault.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	1852	WerFault.exe
Token: SeDebugPrivilege	3164	WerFault.exe
Token: SeDebugPrivilege	2776	WerFault.exe
Token: SeDebugPrivilege	524	WerFault.exe
Token: SeDebugPrivilege	3884	WerFault.exe
Token: SeDebugPrivilege	644	WerFault.exe
Token: SeDebugPrivilege	2836	WerFault.exe
Token: SeDebugPrivilege	1428	WerFault.exe
Token: SeDebugPrivilege	1616	WerFault.exe
Token: SeDebugPrivilege	1792	WerFault.exe
Token: SeDebugPrivilege	1512	WerFault.exe
Token: SeDebugPrivilege	816	WerFault.exe
Token: SeDebugPrivilege	1532	WerFault.exe
Token: SeDebugPrivilege	3024	WerFault.exe
Token: SeDebugPrivilege	1272	WerFault.exe
Token: SeDebugPrivilege	2820	WerFault.exe
Token: SeShutdownPrivilege	3036	Process not Found
Token: SeCreatePagefilePrivilege	3036	Process not Found
Token: SeShutdownPrivilege	3036	Process not Found
Token: SeCreatePagefilePrivilege	3036	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1356	2668	54BCD3308C140C8EC030F98697CC7F0E9D4585D54334A.exe	68
PID 2668 wrote to memory of 1356	2668	54BCD3308C140C8EC030F98697CC7F0E9D4585D54334A.exe	68
PID 2668 wrote to memory of 1356	2668	54BCD3308C140C8EC030F98697CC7F0E9D4585D54334A.exe	68
PID 1356 wrote to memory of 3444	1356	setup_install.exe	71
PID 1356 wrote to memory of 3444	1356	setup_install.exe	71
PID 1356 wrote to memory of 3444	1356	setup_install.exe	71
PID 3444 wrote to memory of 3260	3444	cmd.exe	72
PID 3444 wrote to memory of 3260	3444	cmd.exe	72
PID 3444 wrote to memory of 3260	3444	cmd.exe	72
PID 3260 wrote to memory of 1224	3260	c2df147c046a32046.exe	73
PID 3260 wrote to memory of 1224	3260	c2df147c046a32046.exe	73
PID 3260 wrote to memory of 1224	3260	c2df147c046a32046.exe	73
PID 1224 wrote to memory of 2572	1224	setup_install.exe	75
PID 1224 wrote to memory of 2572	1224	setup_install.exe	75
PID 1224 wrote to memory of 2572	1224	setup_install.exe	75
PID 1224 wrote to memory of 2692	1224	setup_install.exe	95
PID 1224 wrote to memory of 2692	1224	setup_install.exe	95
PID 1224 wrote to memory of 2692	1224	setup_install.exe	95
PID 1224 wrote to memory of 2236	1224	setup_install.exe	90
PID 1224 wrote to memory of 2236	1224	setup_install.exe	90
PID 1224 wrote to memory of 2236	1224	setup_install.exe	90
PID 1224 wrote to memory of 3304	1224	setup_install.exe	85
PID 1224 wrote to memory of 3304	1224	setup_install.exe	85
PID 1224 wrote to memory of 3304	1224	setup_install.exe	85
PID 1224 wrote to memory of 3116	1224	setup_install.exe	84
PID 1224 wrote to memory of 3116	1224	setup_install.exe	84
PID 1224 wrote to memory of 3116	1224	setup_install.exe	84
PID 1224 wrote to memory of 3492	1224	setup_install.exe	82
PID 1224 wrote to memory of 3492	1224	setup_install.exe	82
PID 1224 wrote to memory of 3492	1224	setup_install.exe	82
PID 1224 wrote to memory of 2824	1224	setup_install.exe	80
PID 1224 wrote to memory of 2824	1224	setup_install.exe	80
PID 1224 wrote to memory of 2824	1224	setup_install.exe	80
PID 1224 wrote to memory of 1860	1224	setup_install.exe	79
PID 1224 wrote to memory of 1860	1224	setup_install.exe	79
PID 1224 wrote to memory of 1860	1224	setup_install.exe	79
PID 1224 wrote to memory of 3508	1224	setup_install.exe	76
PID 1224 wrote to memory of 3508	1224	setup_install.exe	76
PID 1224 wrote to memory of 3508	1224	setup_install.exe	76
PID 2236 wrote to memory of 3396	2236	cmd.exe	83
PID 2236 wrote to memory of 3396	2236	cmd.exe	83
PID 2236 wrote to memory of 3396	2236	cmd.exe	83
PID 3492 wrote to memory of 1924	3492	cmd.exe	86
PID 3492 wrote to memory of 1924	3492	cmd.exe	86
PID 3492 wrote to memory of 1924	3492	cmd.exe	86
PID 2692 wrote to memory of 828	2692	cmd.exe	78
PID 2692 wrote to memory of 828	2692	cmd.exe	78
PID 2692 wrote to memory of 828	2692	cmd.exe	78
PID 2824 wrote to memory of 2476	2824	cmd.exe	88
PID 2824 wrote to memory of 2476	2824	cmd.exe	88
PID 2824 wrote to memory of 2476	2824	cmd.exe	88
PID 3304 wrote to memory of 1744	3304	cmd.exe	87
PID 3304 wrote to memory of 1744	3304	cmd.exe	87
PID 3116 wrote to memory of 2808	3116	cmd.exe	89
PID 3116 wrote to memory of 2808	3116	cmd.exe	89
PID 3116 wrote to memory of 2808	3116	cmd.exe	89
PID 1860 wrote to memory of 1340	1860	cmd.exe	81
PID 1860 wrote to memory of 1340	1860	cmd.exe	81
PID 3508 wrote to memory of 3156	3508	cmd.exe	77
PID 3508 wrote to memory of 3156	3508	cmd.exe	77
PID 2572 wrote to memory of 4056	2572	cmd.exe	94
PID 2572 wrote to memory of 4056	2572	cmd.exe	94
PID 2572 wrote to memory of 4056	2572	cmd.exe	94
PID 1924 wrote to memory of 1272	1924	Mon107825d0b235ce.exe	91

C:\Users\Admin\AppData\Local\Temp\54BCD3308C140C8EC030F98697CC7F0E9D4585D54334A.exe
"C:\Users\Admin\AppData\Local\Temp\54BCD3308C140C8EC030F98697CC7F0E9D4585D54334A.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\7zSC6A04826\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC6A04826\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\c2df147c046a32046.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\c2df147c046a32046.exe
      C:\Users\Admin\AppData\Local\Temp\c2df147c046a32046.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\setup_install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\setup_install.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1224
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4056
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Mon10d65f5baa6.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\Mon10d65f5baa6.exe
        
        Mon10d65f5baa6.exe
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Mon10fc1df6897de204.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\Mon10fc1df6897de204.exe
        
        Mon10fc1df6897de204.exe
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Mon102141234bd378.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\Mon102141234bd378.exe
        
        Mon102141234bd378.exe
        7⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Users\Admin\Pictures\Adobe Films\ZwV9lS0aHraIID3wg9EKVKjP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ZwV9lS0aHraIID3wg9EKVKjP.exe"
        8⤵
        
        PID:680
        
        C:\Users\Admin\Pictures\Adobe Films\D6Bte5gilq9hG9UOGl4snrvt.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\D6Bte5gilq9hG9UOGl4snrvt.exe"
        8⤵
        
        PID:1304
        
        C:\Users\Admin\Pictures\Adobe Films\H8atHhF0fGENDS0YURfsA9uO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\H8atHhF0fGENDS0YURfsA9uO.exe"
        8⤵
        
        PID:3792
        
        C:\Users\Admin\Pictures\Adobe Films\cHtclxa4laq3Pq7mkAwrnMU5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\cHtclxa4laq3Pq7mkAwrnMU5.exe"
        8⤵
        
        PID:1172
        
        C:\Users\Admin\Pictures\Adobe Films\5h4hVncy5IK4YGxnhQG1L7Fm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\5h4hVncy5IK4YGxnhQG1L7Fm.exe"
        8⤵
        
        PID:768
        
        C:\Users\Admin\Pictures\Adobe Films\LGLSa9iSKbfU_moQGSbfA86_.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\LGLSa9iSKbfU_moQGSbfA86_.exe"
        8⤵
        
        PID:1216
        
        C:\Users\Admin\Pictures\Adobe Films\sqrpAVhzHN0J_7hnkfZ8By4_.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\sqrpAVhzHN0J_7hnkfZ8By4_.exe"
        8⤵
        
        PID:2060
        
        C:\Users\Admin\Pictures\Adobe Films\d0gUR8ac0F_G5Xbh0g_jm1le.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\d0gUR8ac0F_G5Xbh0g_jm1le.exe"
        8⤵
        
        PID:816
        
        C:\Users\Admin\Pictures\Adobe Films\E4EqTitN9Yfpsd1KE8qscl52.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\E4EqTitN9Yfpsd1KE8qscl52.exe"
        8⤵
        
        PID:2488
        
        C:\Users\Admin\Pictures\Adobe Films\D2upHuT5wcMP_Y9HIiqs8JP8.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\D2upHuT5wcMP_Y9HIiqs8JP8.exe"
        8⤵
        
        PID:524
        
        C:\Users\Admin\Pictures\Adobe Films\JULTEO29PaRebqdjRxnV6Ewf.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\JULTEO29PaRebqdjRxnV6Ewf.exe"
        8⤵
        
        PID:1220
        
        C:\Users\Admin\Pictures\Adobe Films\Y6_M7rtcLlMVABLObzIk2bMA.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Y6_M7rtcLlMVABLObzIk2bMA.exe"
        8⤵
        
        PID:3184
        
        C:\Users\Admin\Pictures\Adobe Films\GurgzQDqKSawLTertSuoq6cY.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\GurgzQDqKSawLTertSuoq6cY.exe"
        8⤵
        
        PID:364
        
        C:\Users\Admin\Pictures\Adobe Films\LTLmbgArWaRx190Y7GEsCH3D.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\LTLmbgArWaRx190Y7GEsCH3D.exe"
        8⤵
        
        PID:1716
        
        C:\Users\Admin\Pictures\Adobe Films\S32VyHzpcT5zhy8FVP_Ea3k5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\S32VyHzpcT5zhy8FVP_Ea3k5.exe"
        8⤵
        
        PID:2324
        
        C:\Users\Admin\Pictures\Adobe Films\EFYqG8pLJNpmsWzeR4n1aROb.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\EFYqG8pLJNpmsWzeR4n1aROb.exe"
        8⤵
        
        PID:2432
        
        C:\Users\Admin\Pictures\Adobe Films\hoJYi4VfcBMpCd0SR2W6q_D2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\hoJYi4VfcBMpCd0SR2W6q_D2.exe"
        8⤵
        
        PID:956
        
        C:\Users\Admin\Pictures\Adobe Films\_2HLVC8fFovRFWUBe9OFpYfV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\_2HLVC8fFovRFWUBe9OFpYfV.exe"
        8⤵
        
        PID:1184
        
        C:\Users\Admin\Pictures\Adobe Films\4P8ICL1CMoCMfJFmzcHL2xv3.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\4P8ICL1CMoCMfJFmzcHL2xv3.exe"
        8⤵
        
        PID:804
        
        C:\Users\Admin\Pictures\Adobe Films\G8vslZ0CfQnyqR5Z1XstarcJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\G8vslZ0CfQnyqR5Z1XstarcJ.exe"
        8⤵
        
        PID:1840
        
        C:\Users\Admin\Pictures\Adobe Films\jMP114gcF86MDRDrJr5Hc3EZ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jMP114gcF86MDRDrJr5Hc3EZ.exe"
        8⤵
        
        PID:1276
        
        C:\Users\Admin\Pictures\Adobe Films\wqLfBMFQeFjZtYY9d78ApAC3.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\wqLfBMFQeFjZtYY9d78ApAC3.exe"
        8⤵
        
        PID:3024
        
        C:\Users\Admin\Pictures\Adobe Films\FrpeGoITf_cd6jokBdABOtMX.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\FrpeGoITf_cd6jokBdABOtMX.exe"
        8⤵
        
        PID:1584
        
        C:\Users\Admin\Pictures\Adobe Films\2YJK7nAc2vd9rP8x01RRGlX6.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2YJK7nAc2vd9rP8x01RRGlX6.exe"
        8⤵
        
        PID:2964
        
        C:\Users\Admin\Pictures\Adobe Films\t_8jaruO6B6YLs2F7Owx4d3S.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\t_8jaruO6B6YLs2F7Owx4d3S.exe"
        8⤵
        
        PID:2864
        
        C:\Users\Admin\Pictures\Adobe Films\pnq6o6_KNNeOvqj4j05NHmbB.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pnq6o6_KNNeOvqj4j05NHmbB.exe"
        8⤵
        
        PID:1844
        
        C:\Users\Admin\Pictures\Adobe Films\DbtBVEe8q744NVEn89spKP0w.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DbtBVEe8q744NVEn89spKP0w.exe"
        8⤵
        
        PID:2680
        
        C:\Users\Admin\Pictures\Adobe Films\w75IvPg1cZTqLxZv0sa6aMpF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\w75IvPg1cZTqLxZv0sa6aMpF.exe"
        8⤵
        
        PID:4016
        
        C:\Users\Admin\Pictures\Adobe Films\gys0Nurlz1m1gFdEZNz_U7D0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\gys0Nurlz1m1gFdEZNz_U7D0.exe"
        8⤵
        
        PID:1532
        
        C:\Users\Admin\Pictures\Adobe Films\Hw4gWlBOGDBAVcwrCW5p7JF_.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Hw4gWlBOGDBAVcwrCW5p7JF_.exe"
        8⤵
        
        PID:2124
        
        C:\Users\Admin\Pictures\Adobe Films\7cejOMW8ZcMgSIQxL4hhgmIj.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7cejOMW8ZcMgSIQxL4hhgmIj.exe"
        8⤵
        
        PID:3892
        
        C:\Users\Admin\Pictures\Adobe Films\7Dotn_ChbmsP_rQPn0qXsVKi.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7Dotn_ChbmsP_rQPn0qXsVKi.exe"
        8⤵
        
        PID:2256
        
        C:\Users\Admin\Pictures\Adobe Films\JHAuZZWPo8L6UvctAbTvmfjI.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\JHAuZZWPo8L6UvctAbTvmfjI.exe"
        8⤵
        
        PID:2628
        
        C:\Users\Admin\Pictures\Adobe Films\brVbkDdYLYBIwkT2_lp7UVH_.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\brVbkDdYLYBIwkT2_lp7UVH_.exe"
        8⤵
        
        PID:4000
        
        C:\Users\Admin\Pictures\Adobe Films\brVbkDdYLYBIwkT2_lp7UVH_.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\brVbkDdYLYBIwkT2_lp7UVH_.exe"
        9⤵
        
        PID:1012
        
        C:\Users\Admin\Pictures\Adobe Films\L1lEa4VDVgk2XpAMAhg6_zil.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\L1lEa4VDVgk2XpAMAhg6_zil.exe"
        8⤵
        
        PID:1028
        
        C:\Users\Admin\Pictures\Adobe Films\UNwPzrfAC3qKlUWvFGPxQHIt.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UNwPzrfAC3qKlUWvFGPxQHIt.exe"
        8⤵
        
        PID:1376
        
        C:\Users\Admin\Pictures\Adobe Films\lAvogM9BqSJMyG4ofSqulRGJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\lAvogM9BqSJMyG4ofSqulRGJ.exe"
        8⤵
        
        PID:3264
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Mon107825d0b235ce.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\Mon107825d0b235ce.exe
        
        Mon107825d0b235ce.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\is-0AMNN.tmp\Mon107825d0b235ce.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-0AMNN.tmp\Mon107825d0b235ce.tmp" /SL5="$60058,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\Mon107825d0b235ce.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1272
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Mon107113c0972c.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\Mon107113c0972c.exe
        
        Mon107113c0972c.exe
        7⤵
        Executes dropped EXE
        Modifies system certificate store
        
        PID:2808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 764
        8⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 816
        8⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 752
        8⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 800
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 960
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:3884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 992
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1100
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1448
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1408
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1656
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1476
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1756
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
        
        C:\Users\Admin\Pictures\Adobe Films\d0gUR8ac0F_G5Xbh0g_jm1le.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\d0gUR8ac0F_G5Xbh0g_jm1le.exe"
        9⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1836
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1912
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 2004
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:1272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 2020
        8⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Mon10301b16494.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\Mon10301b16494.exe
        
        Mon10301b16494.exe
        7⤵
        Executes dropped EXE
        
        PID:1744
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Mon10097fa54c.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 552
        6⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Mon103a41b612670a33d.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2692

C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\Mon103a41b612670a33d.exe
Mon103a41b612670a33d.exe
1⤵
- Executes dropped EXE
PID:828

C:\Users\Admin\AppData\Local\Temp\7zSCBCD8F26\Mon10097fa54c.exe
Mon10097fa54c.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 400
1⤵
- Program crash
PID:4700

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
1⤵
PID:1940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc cABpAG4AZwAgAHkAYQBoAG8AbwAuAGMAbwBtADsAIABwAGkAbgBnACAAeQBhAGgAbwBvAC4AYwBvAG0AOwBwAGkAbgBnACAAeQBhAGgAbwBvAC4AYwBvAG0AOwBwAGkAbgBnACAAeQBhAGgAbwBvAC4AYwBvAG0AOwBwAGkAbgBnACAAeQBhAGgAbwBvAC4AYwBvAG0AOwA=
1⤵
PID:1124

C:\Users\Admin\AppData\Local\Temp\7zSAD2F.tmp\Install.exe
.\Install.exe
1⤵
PID:2736
- C:\Users\Admin\AppData\Local\Temp\7zSDDD4.tmp\Install.exe
  .\Install.exe /S /site_id "525403"
  2⤵
  PID:4992

C:\Users\Admin\AppData\Local\Temp\rtst1039.exe
"C:\Users\Admin\AppData\Local\Temp\rtst1039.exe" end
1⤵
PID:5060

C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe
"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"
1⤵
PID:4588

C:\Program Files (x86)\Company\NewProduct\rtst1039.exe
"C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"
1⤵
PID:4320

C:\Program Files (x86)\Company\NewProduct\inst2.exe
"C:\Program Files (x86)\Company\NewProduct\inst2.exe"
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 400
1⤵
- Program crash
PID:4788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-735-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/364-814-0x0000000000640000-0x000000000064A000-memory.dmp

Download

memory/364-822-0x0000000002310000-0x00000000023A2000-memory.dmp

Download

memory/364-818-0x00000000023F2000-0x00000000023F3000-memory.dmp

Download

memory/364-725-0x0000000000400000-0x00000000004D1000-memory.dmp

Download

memory/524-730-0x0000000074890000-0x0000000074981000-memory.dmp

Download

memory/524-714-0x0000000000050000-0x0000000000051000-memory.dmp

Download

memory/524-739-0x0000000000F30000-0x000000000100E000-memory.dmp

Download

memory/524-720-0x00000000769E0000-0x0000000076BA2000-memory.dmp

Download

memory/524-751-0x0000000073EC0000-0x0000000073F40000-memory.dmp

Download

memory/524-709-0x0000000000F30000-0x000000000100E000-memory.dmp

Download

memory/804-712-0x0000000005290000-0x000000000578E000-memory.dmp

Download

memory/804-704-0x0000000000550000-0x00000000005B2000-memory.dmp

Download

memory/816-706-0x0000000000940000-0x00000000009CA000-memory.dmp

Download

memory/816-741-0x0000000005190000-0x00000000051AE000-memory.dmp

Download

memory/956-838-0x0000000005400000-0x000000000550A000-memory.dmp

Download

memory/956-721-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/956-766-0x0000000073EC0000-0x0000000073F40000-memory.dmp

Download

memory/956-746-0x0000000074890000-0x0000000074981000-memory.dmp

Download

memory/956-710-0x0000000000140000-0x0000000000233000-memory.dmp

Download

memory/956-734-0x00000000769E0000-0x0000000076BA2000-memory.dmp

Download

memory/956-757-0x0000000000140000-0x0000000000233000-memory.dmp

Download

memory/1124-914-0x0000000007620000-0x0000000007970000-memory.dmp

Download

memory/1216-723-0x00000000010E0000-0x0000000001295000-memory.dmp

Download

memory/1216-830-0x00000000010E0000-0x0000000001295000-memory.dmp

Download

memory/1216-743-0x00000000010E0000-0x0000000001295000-memory.dmp

Download

memory/1216-764-0x00000000010D0000-0x00000000010D2000-memory.dmp

Download

memory/1216-732-0x00000000010E0000-0x0000000001295000-memory.dmp

Download

memory/1216-772-0x00000000010E0000-0x0000000001295000-memory.dmp

Download

memory/1220-759-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1224-262-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1224-264-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1224-811-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1224-263-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1224-260-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1224-265-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1224-261-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1224-258-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1224-259-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1304-755-0x0000000073EC0000-0x0000000073F40000-memory.dmp

Download

memory/1304-792-0x0000000005CA0000-0x00000000062A6000-memory.dmp

Download

memory/1304-733-0x0000000074890000-0x0000000074981000-memory.dmp

Download

memory/1304-799-0x0000000005530000-0x0000000005542000-memory.dmp

Download

memory/1304-724-0x00000000769E0000-0x0000000076BA2000-memory.dmp

Download

memory/1304-716-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Download

memory/1304-711-0x0000000001110000-0x000000000118F000-memory.dmp

Download

memory/1304-745-0x0000000001110000-0x000000000118F000-memory.dmp

Download

memory/1340-287-0x0000000000F20000-0x0000000000F4C000-memory.dmp

Download

memory/1340-288-0x0000000001440000-0x000000000145E000-memory.dmp

Download

memory/1356-126-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/1356-125-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/1356-127-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1376-845-0x0000000004F20000-0x0000000004F5E000-memory.dmp

Download

memory/1376-848-0x00000000053C0000-0x0000000005582000-memory.dmp

Download

memory/1376-707-0x0000000001190000-0x0000000001273000-memory.dmp

Download

memory/1376-713-0x00000000003E0000-0x00000000003E1000-memory.dmp

Download

memory/1376-708-0x0000000001190000-0x0000000001273000-memory.dmp

Download

memory/1376-752-0x0000000073EC0000-0x0000000073F40000-memory.dmp

Download

memory/1376-719-0x00000000769E0000-0x0000000076BA2000-memory.dmp

Download

memory/1376-729-0x0000000074890000-0x0000000074981000-memory.dmp

Download

memory/1376-740-0x0000000001190000-0x0000000001273000-memory.dmp

Download

memory/1840-815-0x0000000000400000-0x0000000000A66000-memory.dmp

Download

memory/1924-301-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1924-284-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2060-736-0x0000000001270000-0x0000000001428000-memory.dmp

Download

memory/2060-775-0x00000000769E0000-0x0000000076BA2000-memory.dmp

Download

memory/2060-748-0x00000000003E0000-0x00000000003E2000-memory.dmp

Download

memory/2060-798-0x0000000000CE0000-0x0000000000D2A000-memory.dmp

Download

memory/2060-768-0x0000000001270000-0x0000000001428000-memory.dmp

Download

memory/2060-819-0x0000000001270000-0x0000000001428000-memory.dmp

Download

memory/2060-727-0x0000000001270000-0x0000000001428000-memory.dmp

Download

memory/2060-717-0x0000000001270000-0x0000000001428000-memory.dmp

Download

memory/2060-761-0x0000000001270000-0x0000000001428000-memory.dmp

Download

memory/2324-731-0x0000000000DE0000-0x0000000000FA2000-memory.dmp

Download

memory/2324-742-0x00000000013C0000-0x00000000013C2000-memory.dmp

Download

memory/2324-763-0x0000000000DE0000-0x0000000000FA2000-memory.dmp

Download

memory/2324-715-0x0000000000DE0000-0x0000000000FA2000-memory.dmp

Download

memory/2324-753-0x0000000000DE0000-0x0000000000FA2000-memory.dmp

Download

memory/2324-771-0x00000000769E0000-0x0000000076BA2000-memory.dmp

Download

memory/2324-722-0x0000000000DE0000-0x0000000000FA2000-memory.dmp

Download

memory/2432-756-0x00000000024B0000-0x0000000002510000-memory.dmp

Download

memory/2476-911-0x00000000040C0000-0x0000000004250000-memory.dmp

Download

memory/2488-767-0x0000000000070000-0x0000000000146000-memory.dmp

Download

memory/2488-747-0x00000000769E0000-0x0000000076BA2000-memory.dmp

Download

memory/2488-774-0x0000000073EC0000-0x0000000073F40000-memory.dmp

Download

memory/2488-760-0x0000000074890000-0x0000000074981000-memory.dmp

Download

memory/2488-718-0x0000000000070000-0x0000000000146000-memory.dmp

Download

memory/2488-726-0x0000000000920000-0x0000000000921000-memory.dmp

Download

memory/2808-282-0x0000000001F07000-0x0000000001F6B000-memory.dmp

Download

memory/2864-758-0x00000000024D0000-0x0000000002530000-memory.dmp

Download

memory/3024-749-0x0000000000810000-0x00000000008F2000-memory.dmp

Download

memory/3024-728-0x0000000000810000-0x00000000008F2000-memory.dmp

Download

memory/3024-737-0x0000000000490000-0x0000000000491000-memory.dmp

Download

memory/3024-782-0x0000000000810000-0x00000000008F2000-memory.dmp

Download

memory/3024-769-0x00000000769E0000-0x0000000076BA2000-memory.dmp

Download

memory/3156-285-0x0000000000050000-0x0000000000058000-memory.dmp

Download

memory/3184-705-0x0000000000E80000-0x0000000000E8E000-memory.dmp

Download

memory/3396-277-0x0000000002030000-0x0000000002050000-memory.dmp

Download

memory/3396-393-0x0000000000400000-0x0000000001D81000-memory.dmp

Download

memory/4000-903-0x00000000001E0000-0x00000000001E6000-memory.dmp

Download

memory/4056-304-0x0000000007E70000-0x0000000007E8C000-memory.dmp

Download

memory/4056-294-0x00000000074D0000-0x0000000007AF8000-memory.dmp

Download

memory/4056-305-0x0000000007FD0000-0x000000000801B000-memory.dmp

Download

memory/4056-315-0x0000000009120000-0x0000000009153000-memory.dmp

Download

memory/4056-303-0x0000000007B00000-0x0000000007E50000-memory.dmp

Download

memory/4056-316-0x0000000009100000-0x000000000911E000-memory.dmp

Download

memory/4056-302-0x00000000073D0000-0x0000000007436000-memory.dmp

Download

memory/4056-300-0x0000000007260000-0x00000000072C6000-memory.dmp

Download

memory/4056-298-0x00000000071C0000-0x00000000071E2000-memory.dmp

Download

memory/4056-306-0x00000000082C0000-0x0000000008336000-memory.dmp

Download

memory/4056-292-0x0000000001140000-0x0000000001176000-memory.dmp

Download

memory/4056-521-0x0000000008480000-0x0000000008488000-memory.dmp

Download

memory/4056-321-0x0000000009260000-0x0000000009305000-memory.dmp

Download

memory/4056-322-0x0000000009640000-0x00000000096D4000-memory.dmp

Download

memory/4056-516-0x00000000084A0000-0x00000000084BA000-memory.dmp

Download

memory/4796-833-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4796-864-0x0000000005450000-0x000000000549B000-memory.dmp

Download