valleyrat_s2 | d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
Size 10.1MB
Sample260422-ej24wagx2k
SHA256 d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec
MD5 667d3aa69107eed608b817113c22e968
SHA1 828b7835836013e0b7a6d59c2b3f46efb8be5fb5
SHA512 4d91cf0ff893f64dd014511fc5e07adcfefde87a8b0bc93d8caaa93e2f1c5278cc58d0a3bb732885db3d65f570e36466699776327958815b3e20373c727bf22d
SSDEEP 196608:0V2MgpZB7UpBZZvHS1x7lJqafVRPAyoBlkqWUmt8ZPBs39dzvY8BAB6l2awH2MI:1MgDdUpBZs1xHntRo9mt8Bm9dzvY8ew1
TLSH
T1DBB63301BBF4F9B3CA2116313E90932642793CF9EE7617672B82756E56708D15F20BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor defense_evasion discovery execution valleyrat_s2 persistence spyware

Malware Config

Extracted

Family

valleyrat_s2

Version

v1.0.0

43.98.246.18:3333

Attributes

campaign_date
2026.03.27

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
5284	wudfhost.exe
3756	wudfhost.exe
1092	WUDFHost.exe
5912	WUDFHost.exe
3912	WUDFHost.exe
3852	WUDFHost.exe

Loads dropped DLL 3 IoCs

pid	Process
3756	wudfhost.exe
5912	WUDFHost.exe
3852	WUDFHost.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2492	tasklist.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\en-US\2026od8a.dat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\3.bat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\3.bat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\app-3.16.5\bootfix.bat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\msvcp140.dll	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\vcruntime140.dll	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\app-3.16.5\WUDFHost.exe	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\pdf.ico	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\app-3.16.5\UnityPlayer.dll	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\auto.vbs	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\service.exe.mui	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\US Gold Investment33.pdf	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\WUDFHost.lnk	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\1.bat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\2.bat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\20262f2v.dat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\WUDFHost.lnk	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\db.log	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\service.exe.mui	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\WUDFHost.lnk	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\图标3.ico	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\auto.vbs	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\__tmp_rar_sfx_access_check_240651593	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\20262f2v.dat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\UnityPlayer.dll	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\app-3.16.5\vcruntime140_1.dll	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\vcruntime140_1.dll	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\WUDFHost.exe	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\图标3.ico	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\app-3.16.5	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\app-3.16.5\bootfix.bat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\app-3.16.5\WUDFHost.lnk	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\2.bat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\2026od8a.dat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\app-3.16.5\msvcp140.dll	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\pdf.ico	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\US Gold Investment33.pdf	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\WUDFHost.exe	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File opened for modification	C:\Windows\en-US\1.bat	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\app-3.16.5\vcruntime140.dll	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\db.log	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
File created	C:\Windows\en-US\WUDFHost.exe	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wudfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5944	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	tasklist.exe
Token: SeDebugPrivilege	5944	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe
3888	AcroRd32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4908	4912	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe	85
PID 4912 wrote to memory of 5284	4912	d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe	86
PID 5284 wrote to memory of 3756	5284	wudfhost.exe	88
PID 4908 wrote to memory of 4472	4908	WScript.exe	89
PID 4908 wrote to memory of 896	4908	WScript.exe	91
PID 4908 wrote to memory of 2904	4908	WScript.exe	93
PID 896 wrote to memory of 5944	896	cmd.exe	95
PID 2904 wrote to memory of 2492	2904	cmd.exe	96
PID 2904 wrote to memory of 5236	2904	cmd.exe	97
PID 4472 wrote to memory of 3888	4472	cmd.exe	98
PID 896 wrote to memory of 1092	896	cmd.exe	100
PID 1092 wrote to memory of 5912	1092	WUDFHost.exe	101
PID 2904 wrote to memory of 3748	2904	cmd.exe	102
PID 3912 wrote to memory of 3852	3912	WUDFHost.exe	106
PID 3888 wrote to memory of 3904	3888	AcroRd32.exe	108
PID 3904 wrote to memory of 3316	3904	RdrCEF.exe	109
PID 3904 wrote to memory of 5480	3904	RdrCEF.exe	110
PID 3904 wrote to memory of 5480	3904	RdrCEF.exe	110
PID 3904 wrote to memory of 5640	3904	RdrCEF.exe	112
PID 3904 wrote to memory of 5772	3904	RdrCEF.exe	113
PID 3904 wrote to memory of 5772	3904	RdrCEF.exe	113
PID 3904 wrote to memory of 3452	3904	RdrCEF.exe	114
PID 3904 wrote to memory of 3176	3904	RdrCEF.exe	115

C:\Users\Admin\AppData\Local\Temp\d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe
"C:\Users\Admin\AppData\Local\Temp\d3c22951c0afee38d908480bcc84e8fb5c789c2c158a0f7beba94c6d7ea7f3ec.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\en-US\auto.vbs"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\en-US\auto.vbs\..\1.bat"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\US Gold Investment33.pdf"
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3888
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3904
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AAEE00BCE28706B22313EAF4EEB23BB5 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3316
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F0CBC9A8E35178A1D60413A8C196E9E8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F0CBC9A8E35178A1D60413A8C196E9E8 --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BE83122EF3800E4A40D23D74BBDBDD9A --mojo-platform-channel-handle=2368 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=89DC5A851B48CB617D514171855FB42C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=89DC5A851B48CB617D514171855FB42C --renderer-client-id=5 --mojo-platform-channel-handle=2352 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A6DEE245D802FAD4D745CC1EE0D4297C --mojo-platform-channel-handle=2704 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B8863C8FFEC22A79D2154DE42FD313B7 --mojo-platform-channel-handle=1920 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\en-US\auto.vbs\..\2.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "WUDFHost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5944
  - - C:\Windows\en-US\WUDFHost.exe
      WUDFHost.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Windows\en-US\app-3.16.5\WUDFHost.exe
        
        "C:\Windows\en-US\app-3.16.5\WUDFHost.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\en-US\auto.vbs\..\3.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "IMAGENAME eq QQPCTray.exe"
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2492
  - - C:\Windows\SysWOW64\find.exe
      find "QQPCTray.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5236
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdateHelpUpdates" /tr "C:\Windows\en-US\WUDFHost.exe" /sc onlogon /ru "administrators" /rl highest /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3748
- C:\Windows\en-US\wudfhost.exe
  "C:\Windows\en-US\wudfhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\en-US\app-3.16.5\wudfhost.exe
    "C:\Windows\en-US\app-3.16.5\wudfhost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3756

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c4d2f654-b65f-4593-9646-72a8d68af11b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c80e3685-5419-42e2-8d4f-40a1c67677ae -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-61d6977b-5913-49d6-9b95-68c480becd02 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7637cc9d-418b-4c56-b603-0b96a4cab058 -LifetimeId:021bd7e4-b26e-49d1-87dd-e9fce0c406b7 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1040

C:\Windows\en-US\WUDFHost.exe
C:\Windows\en-US\WUDFHost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\en-US\app-3.16.5\WUDFHost.exe
  "C:\Windows\en-US\app-3.16.5\WUDFHost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 74451bf14c9920c4e413286143647d4297587e71e2ac5d1d44ea2ace780f481f
MD5 e8ae2c461864a2500095a8a454dd04d6
SHA1 163920038eebaa28d4ab18bb59bf1d92cedae33d
SHA512 193bd8171f7dbb00dc0abe9392bf631163aa67da895fc2f69cad8f89b444585b70ff470b7a0d3c5edcdd9266be9ab41202450c00436a7ab05b2798603c1177e7
SSDEEP 384:yekdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:n+eUZsLQCZsL3hUS4
TLSH
T11453CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.bat

Path C:\Windows\en-US\1.bat
Size 121B
SHA256 4147d368d31fb63b87160951ed6e1e75ed2d74013bae9c72fe4459e45f50fddb
MD5 f37b7fc3126cec427f655e09887d69cc
SHA1 64b0b778f3e4711fae76bcd65240e889f68f74c9
SHA512 6ec87734a692687d13d7450efea04b235d76b50d4a19f500e6a590bb9ea9f1beb45f2e2a5bbcaae1ab42bb49070fb9bf4dc0d34e1959b565685e4ee53dc35e31
TLSH
T187B0929B51A31424AA004C45D76950CAFB322EB685C03C01249453127CFBB1AAA43901
MD5 SHA1 SHA512 TLSH

Submit Download

2.bat

Path C:\Windows\en-US\2.bat
Size 54B
SHA256 be1252d456a8f10c21b15028d6e1f21bb9d0a4f67a1a228dd810e090143b4112
MD5 cb50524770f032f6c0d05f8cfa51c1e0
SHA1 fa32c7ecb2561f10647589ca2f84115b65de21d3
SHA512 f1f06c536834e6af0a4857eff6a887544c068346ff73d5a00eba019903f335135159735c2c5ef2a8272c9839198a5c815361d37f061c2c1100e10997965e1bf0
TLSH
T187900243840364309297048651841511BB43C1291C1401802401207D2040948F9DB3EC
MD5 SHA1 SHA512 TLSH

Submit Download

3.bat

Path C:\Windows\en-US\3.bat
Size 392B
SHA256 f4982455d1634ea798684b4da6833ef1d53a4cd76812da91684cd1769eba5694
MD5 ff0dde37ad074849bad307e94af8808e
SHA1 48531f4ea908ae999158dfeef16be8fab67dc47b
SHA512 321d957b0c45c8254f526a244661ec00c8128469d9a73f2d0c82aa494f70d9149e4b4b533d90167f5fbbd399a4b48f5d8093201678c79bc426eb660b6635f80f
TLSH
T15AE06106A015D92386A07D9309454557EB55AB7FA50486C1B48C0164AC1F9D948FF3DD
MD5 SHA1 SHA512 TLSH

Submit Download

US Gold Investment33.pdf

Path C:\Windows\en-US\US Gold Investment33.pdf
Size 4.4MB
SHA256 fc2c156530000eeb44124e5b85c0fc1971522e979c451f8acafdf46cadc971c0
MD5 f70f22f9aa90bfa6c10e780d1018577a
SHA1 6ea1daf1f1a6ae836e73ebcfa5a6c61895b44a8b
SHA512 3633a81177c5802b43270455f9ec2025df2be6be09f0383d65bf122a8ea99c7a965a2f2a8c42de51ec5a7f0bb9b13857063a177c0ab38fec33b0bf8e225b626f
SSDEEP 98304:KBanta70voHweO3LphS/FN6d/AbdoYvl4HZFfl3RDjAvM:KgtadHw/hS/FN6douYixRXAvM
TLSH
T1A6260107DC85194AB432C7E8FB1B6B9C1649BFADE0C438E700294BD73970E1A6E9F855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUDFHost.exe

Path C:\Windows\en-US\WUDFHost.exe
Size 242KB
SHA256 c9e3b700e048840e1fc4d652064bc1a982c82c719cc58f3174a12bfdddf04f1d
MD5 c8fc735e08be71ca1619c1ef50dbf987
SHA1 91f1c39529523046ec2afebf692193af6e1a2f15
SHA512 38d97fbedc92a6cc59f6bcc5166c9855f684c4b4701ccdca04982807cb8bcc5008c635db8eafdcf86a231eecb1c1178d26df04476e30084bfa77671112db709a
SSDEEP 6144:qZzvhs2Z4n1E7g34XtVYAOfTd/z44JsQw7UK:qJ+2Z4nShVY5JUBU
TLSH
T15F348C1175D38472E5B20A3008F4E6B5AA7DFC710E659E7B63D9072E0F702C19A36EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUDFHost.exe

Path C:\Windows\en-US\app-3.16.5\WUDFHost.exe
Size 661KB
SHA256 727d6989e0d368898aad322cd6c72c33843d37d6ff22542780414cc88685d28a
MD5 9f483c51d7debb591ec1ffe1f1e8b648
SHA1 458a35054015603b2820cedb15a5b6f7bd47c020
SHA512 92d64ed3a27b7f4437405c685b74097af7a9333cc88ea0eb2f2d82cf24724cda27f860842a21aec9fb520e42394cb0bc05e40dd6d749d134fbecf65ff17b5cc3
SSDEEP 6144:odLArrY2sJ5MMOmM2nQ7h+leuvvqmG6IaAGZ1RZUfFuAdz:odLAXkDOmMqQ7hWqw7d/Adz
TLSH
T1C3E4A5DE8B74F64CF0A2CD38C21198FA559AADAAD491B2137539BC917F334868C670D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.vbs

Path C:\Windows\en-US\auto.vbs
Size 292B
SHA256 0e6cf668ad4846ce80f70d7a75d8b7f5c8ef8b0cc0060946d360223503b0f84a
MD5 fedc480ae3cdf684cd656c9eb184630c
SHA1 d351569f703200211d42dd20781be8de838c16c5
SHA512 fdc704d611c620fa73fa930bf8f961a8f36bc3b5a5654e8ca44610ddacd4023386f4aa2a52624089a803e69afb5e88af01a14d0815936846ea0dd1861747c8d9
TLSH
T11AE0125BCC5CCC24650E81730A76DD2D4FCCA76E0321E965F50088BDE16D0F00E212E2
MD5 SHA1 SHA512 TLSH

Submit Download

service.exe.mui

Path C:\Windows\en-US\service.exe.mui
Size 257KB
SHA256 c9bffdc0c05a27be93dc30372292833affc67629cd59191bf4cde407eedaa4c2
MD5 041b2f253bfbddd652efbdc276f00476
SHA1 59385d3b130aac31fedbacbc65fa3dbf07d33941
SHA512 930f11cf038031168964963098a36553c2dac290c248fca20cd61ecb15ba5ed1fecbad0ca7e526c6c91ab7a017a369c45b7c3a201d82d160c71f2ec36a8807f4
SSDEEP 6144:R2Kf9/iktO3B9TDXG1w+TEQFyAe1cO3gm:R2KF/iktOx0fTEF1cK
TLSH
T16B445AF05BC80680F9D3D71044FDFF2227B2359AA9CE59BE8BB5A080551E7B33619A4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-110-0x0000000001300000-0x00000000013BF000-memory.dmp

Download

memory/2492-70-0x0000000000BA0000-0x0000000000CC0000-memory.dmp

Download

memory/3176-133-0x0000000001780000-0x000000000183F000-memory.dmp

Download

memory/3316-117-0x0000000000B40000-0x0000000000BFF000-memory.dmp

Download

memory/3452-127-0x00000000018E0000-0x000000000199F000-memory.dmp

Download

memory/3756-72-0x00007FFDAA250000-0x00007FFDAA29B000-memory.dmp

Download

memory/3852-106-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/3852-107-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/3852-144-0x00007FFDB4AA0000-0x00007FFDB4AEB000-memory.dmp

Download

memory/3852-142-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/3852-105-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/3852-98-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/3852-109-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/3852-108-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/3888-136-0x0000000008140000-0x000000000814A000-memory.dmp

Download

memory/3888-228-0x00000000011D0000-0x00000000012F0000-memory.dmp

Download

memory/3888-357-0x00000000011D0000-0x00000000012F0000-memory.dmp

Download

memory/3888-346-0x00000000011D0000-0x00000000012F0000-memory.dmp

Download

memory/3888-135-0x00000000011D0000-0x00000000012F0000-memory.dmp

Download

memory/3888-242-0x000000000D9D0000-0x000000000DC7B000-memory.dmp

Download

memory/3888-240-0x000000000D9D0000-0x000000000E0C2000-memory.dmp

Download

memory/3888-137-0x0000000008150000-0x0000000008158000-memory.dmp

Download

memory/3888-138-0x00000000086B0000-0x00000000086B7000-memory.dmp

Download

memory/3904-287-0x0000000001880000-0x000000000193F000-memory.dmp

Download

memory/3904-153-0x0000000001880000-0x000000000193F000-memory.dmp

Download

memory/3904-154-0x0000000002250000-0x0000000002257000-memory.dmp

Download

memory/3912-130-0x0000000002770000-0x000000000282F000-memory.dmp

Download

memory/4472-69-0x00000000030A0000-0x00000000034DC000-memory.dmp

Download

memory/4912-54-0x0000000005360000-0x000000000579C000-memory.dmp

Download

memory/4912-0-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4912-59-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5284-71-0x0000000000E40000-0x0000000000EFF000-memory.dmp

Download

memory/5480-155-0x0000000001B20000-0x0000000001BDF000-memory.dmp

Download

memory/5640-124-0x0000000001780000-0x000000000183F000-memory.dmp

Download

memory/5772-160-0x0000000000B70000-0x0000000000C2F000-memory.dmp

Download

memory/5912-93-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/5912-92-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/5912-141-0x00007FFDB4AA0000-0x00007FFDB4AEB000-memory.dmp

Download

memory/5912-139-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/5912-94-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/5912-91-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/5912-95-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/5912-84-0x0000000180000000-0x0000000180037000-memory.dmp

Download

memory/5944-73-0x0000000001430000-0x0000000001550000-memory.dmp

Download