Analysis
-
max time kernel
133s -
max time network
132s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
19-01-2022 15:11
Static task
static1
General
-
Target
650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe
-
Size
578KB
-
MD5
dfbf1c3345fa6eecbc7625e48745bb5d
-
SHA1
4052413e09323f822f5e4dcbd8a82ca376d6e26f
-
SHA256
650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b
-
SHA512
269c4ed1dd5b2cfe93eaab0b0173762a1351630af91938f54f6da852a8feca1a51127e0ab57ca06d4fd36e2847595a47ebf6336f21e12b239bbaf65453676364
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 11 IoCs
Processes:
fl.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exepid process 4392 fl.exe 1500 RegHost.exe 2772 RegHost.exe 4756 RegHost.exe 1924 RegHost.exe 4128 RegHost.exe 3552 RegHost.exe 1548 RegHost.exe 3504 RegHost.exe 2388 RegHost.exe 3480 RegHost.exe -
Processes:
resource yara_rule behavioral1/memory/916-145-0x0000000140000000-0x000000014274C000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
RegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exefl.exeRegHost.exeRegHost.exeRegHost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RegHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RegHost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\fl.exe themida C:\Users\Admin\AppData\Local\Temp\fl.exe themida behavioral1/memory/4392-142-0x00007FF7EC340000-0x00007FF7EC77B000-memory.dmp themida behavioral1/memory/4392-143-0x00007FF7EC340000-0x00007FF7EC77B000-memory.dmp themida behavioral1/memory/4392-144-0x00007FF7EC340000-0x00007FF7EC77B000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/1500-150-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/1500-151-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/1500-152-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/2772-157-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/2772-158-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/2772-159-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/4756-164-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/4756-165-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/4756-166-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/1924-171-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/1924-172-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/1924-173-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/4128-178-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/4128-179-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/4128-180-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/3552-185-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/3552-186-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/3552-187-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/1548-192-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/1548-193-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/1548-194-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/3504-199-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/3504-200-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/3504-201-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/2388-206-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/2388-207-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/2388-208-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe themida behavioral1/memory/3480-213-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/3480-214-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida behavioral1/memory/3480-215-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 11 IoCs
Processes:
RegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exefl.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" fl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe" RegHost.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
RegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exefl.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegHost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exepid process 3996 650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe -
Suspicious use of SetThreadContext 20 IoCs
Processes:
fl.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exeRegHost.exedescription pid process target process PID 4392 set thread context of 916 4392 fl.exe bfsvc.exe PID 4392 set thread context of 1088 4392 fl.exe explorer.exe PID 1500 set thread context of 1820 1500 RegHost.exe bfsvc.exe PID 1500 set thread context of 2184 1500 RegHost.exe explorer.exe PID 2772 set thread context of 3600 2772 RegHost.exe bfsvc.exe PID 2772 set thread context of 4508 2772 RegHost.exe explorer.exe PID 4756 set thread context of 1964 4756 RegHost.exe bfsvc.exe PID 4756 set thread context of 5088 4756 RegHost.exe explorer.exe PID 1924 set thread context of 4976 1924 RegHost.exe bfsvc.exe PID 1924 set thread context of 2928 1924 RegHost.exe explorer.exe PID 4128 set thread context of 392 4128 RegHost.exe bfsvc.exe PID 4128 set thread context of 3244 4128 RegHost.exe explorer.exe PID 3552 set thread context of 1452 3552 RegHost.exe bfsvc.exe PID 3552 set thread context of 2396 3552 RegHost.exe explorer.exe PID 1548 set thread context of 1800 1548 RegHost.exe bfsvc.exe PID 1548 set thread context of 1680 1548 RegHost.exe explorer.exe PID 3504 set thread context of 3764 3504 RegHost.exe bfsvc.exe PID 3504 set thread context of 1264 3504 RegHost.exe explorer.exe PID 2388 set thread context of 2220 2388 RegHost.exe bfsvc.exe PID 2388 set thread context of 3964 2388 RegHost.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4600 3480 WerFault.exe RegHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3996 650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe 3996 650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe 3996 650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 1088 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 4508 explorer.exe 5088 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3996 650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe Token: SeDebugPrivilege 4600 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exefl.exeexplorer.exeRegHost.exeexplorer.exeRegHost.exedescription pid process target process PID 3996 wrote to memory of 4392 3996 650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe fl.exe PID 3996 wrote to memory of 4392 3996 650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe fl.exe PID 4392 wrote to memory of 916 4392 fl.exe bfsvc.exe PID 4392 wrote to memory of 916 4392 fl.exe bfsvc.exe PID 4392 wrote to memory of 916 4392 fl.exe bfsvc.exe PID 4392 wrote to memory of 916 4392 fl.exe bfsvc.exe PID 4392 wrote to memory of 916 4392 fl.exe bfsvc.exe PID 4392 wrote to memory of 916 4392 fl.exe bfsvc.exe PID 4392 wrote to memory of 916 4392 fl.exe bfsvc.exe PID 4392 wrote to memory of 916 4392 fl.exe bfsvc.exe PID 4392 wrote to memory of 916 4392 fl.exe bfsvc.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 4392 wrote to memory of 1088 4392 fl.exe explorer.exe PID 1088 wrote to memory of 1500 1088 explorer.exe RegHost.exe PID 1088 wrote to memory of 1500 1088 explorer.exe RegHost.exe PID 1500 wrote to memory of 1820 1500 RegHost.exe bfsvc.exe PID 1500 wrote to memory of 1820 1500 RegHost.exe bfsvc.exe PID 1500 wrote to memory of 1820 1500 RegHost.exe bfsvc.exe PID 1500 wrote to memory of 1820 1500 RegHost.exe bfsvc.exe PID 1500 wrote to memory of 1820 1500 RegHost.exe bfsvc.exe PID 1500 wrote to memory of 1820 1500 RegHost.exe bfsvc.exe PID 1500 wrote to memory of 1820 1500 RegHost.exe bfsvc.exe PID 1500 wrote to memory of 1820 1500 RegHost.exe bfsvc.exe PID 1500 wrote to memory of 1820 1500 RegHost.exe bfsvc.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 1500 wrote to memory of 2184 1500 RegHost.exe explorer.exe PID 2184 wrote to memory of 2772 2184 explorer.exe RegHost.exe PID 2184 wrote to memory of 2772 2184 explorer.exe RegHost.exe PID 2772 wrote to memory of 3600 2772 RegHost.exe bfsvc.exe PID 2772 wrote to memory of 3600 2772 RegHost.exe bfsvc.exe PID 2772 wrote to memory of 3600 2772 RegHost.exe bfsvc.exe PID 2772 wrote to memory of 3600 2772 RegHost.exe bfsvc.exe PID 2772 wrote to memory of 3600 2772 RegHost.exe bfsvc.exe PID 2772 wrote to memory of 3600 2772 RegHost.exe bfsvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe"C:\Users\Admin\AppData\Local\Temp\650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fl.exe"C:\Users\Admin\AppData\Local\Temp\fl.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm3⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm5⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm7⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm9⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"10⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm11⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"11⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"12⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm13⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"13⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"14⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm15⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"15⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"16⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm17⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"17⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"18⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm19⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"19⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"20⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm21⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"21⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"22⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3480 -s 57223⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fl.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Local\Temp\fl.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
600c20e18834769dc0ae528c69108a5d
SHA1743b942a951d381c0e3efc1fac3e2f09740769c2
SHA256b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb
SHA51236079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec
-
memory/916-145-0x0000000140000000-0x000000014274C000-memory.dmpFilesize
39.3MB
-
memory/1088-146-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/1088-147-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/1264-204-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/1500-152-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/1500-150-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/1500-151-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/1548-194-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/1548-192-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/1548-193-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/1680-197-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/1924-171-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/1924-173-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/1924-172-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/2184-155-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/2388-206-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/2388-207-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/2388-208-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/2396-190-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/2772-159-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/2772-158-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/2772-157-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/2928-176-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/3244-183-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/3480-214-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/3480-213-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/3480-215-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/3504-199-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/3504-201-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/3504-200-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/3552-186-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/3552-185-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/3552-187-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/3964-211-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/3996-135-0x0000000006440000-0x00000000064B6000-memory.dmpFilesize
472KB
-
memory/3996-136-0x0000000006560000-0x00000000065F2000-memory.dmpFilesize
584KB
-
memory/3996-117-0x0000000074D70000-0x0000000074F32000-memory.dmpFilesize
1.8MB
-
memory/3996-133-0x00000000068C0000-0x0000000006DBE000-memory.dmpFilesize
5.0MB
-
memory/3996-134-0x0000000005B40000-0x0000000005BA6000-memory.dmpFilesize
408KB
-
memory/3996-132-0x0000000070BE0000-0x0000000070C2B000-memory.dmpFilesize
300KB
-
memory/3996-138-0x0000000007370000-0x00000000073C0000-memory.dmpFilesize
320KB
-
memory/3996-119-0x0000000076130000-0x0000000076221000-memory.dmpFilesize
964KB
-
memory/3996-120-0x0000000001000000-0x0000000001071000-memory.dmpFilesize
452KB
-
memory/3996-121-0x0000000001000000-0x0000000001071000-memory.dmpFilesize
452KB
-
memory/3996-137-0x00000000064C0000-0x00000000064DE000-memory.dmpFilesize
120KB
-
memory/3996-126-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/3996-122-0x0000000072990000-0x0000000072A10000-memory.dmpFilesize
512KB
-
memory/3996-115-0x0000000001000000-0x0000000001071000-memory.dmpFilesize
452KB
-
memory/3996-123-0x0000000005DB0000-0x00000000063B6000-memory.dmpFilesize
6.0MB
-
memory/3996-124-0x00000000057A0000-0x00000000057B2000-memory.dmpFilesize
72KB
-
memory/3996-118-0x0000000002D90000-0x0000000002DD4000-memory.dmpFilesize
272KB
-
memory/3996-125-0x00000000058D0000-0x00000000059DA000-memory.dmpFilesize
1.0MB
-
memory/3996-139-0x00000000082E0000-0x000000000880C000-memory.dmpFilesize
5.2MB
-
memory/3996-131-0x0000000005870000-0x00000000058BB000-memory.dmpFilesize
300KB
-
memory/3996-130-0x00000000768C0000-0x0000000077C08000-memory.dmpFilesize
19.3MB
-
memory/3996-129-0x0000000074F40000-0x00000000754C4000-memory.dmpFilesize
5.5MB
-
memory/3996-128-0x0000000005BB0000-0x0000000005D72000-memory.dmpFilesize
1.8MB
-
memory/3996-127-0x0000000005800000-0x000000000583E000-memory.dmpFilesize
248KB
-
memory/4128-180-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/4128-179-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/4128-178-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/4392-143-0x00007FF7EC340000-0x00007FF7EC77B000-memory.dmpFilesize
4.2MB
-
memory/4392-142-0x00007FF7EC340000-0x00007FF7EC77B000-memory.dmpFilesize
4.2MB
-
memory/4392-144-0x00007FF7EC340000-0x00007FF7EC77B000-memory.dmpFilesize
4.2MB
-
memory/4508-162-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/4756-164-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/4756-166-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/4756-165-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmpFilesize
4.2MB
-
memory/5088-169-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB