xmrig | 1b93a853a85370341ce9d5ef5cc1f48709a9483849ea2366fabb29e0bdd08066

Analysis

max time kernel
1194s
max time network
1205s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cudo Miner/Cudo Miner.exe
Size

633KB
MD5

12a23c5df65b5502b16769bb131aa735
SHA1

a78f9833d3ae55ee5025baa81eb86c06cdd9a98a
SHA256

2b2d4bcb499ea6e3a0add102b19dd08c97a4590f137b843c9b9ab849c84d92c6
SHA512

b23af6f117f106937b9973b5bcbb8e54efd8e141735277023e086304d465fb46eb8f29bf2fa1bb461df345cba75813ee44ac3d14eb59c70053de6aeb85f9b588
SSDEEP

6144:GvZQvBs7tHAKKgl/o/PnfZMJmUNb3sWh7BgRsO5ajgKlT2c66OZFXmt61dReZglW:w/tgKK4Jm2b7ehugFLQZglkf

Score

10^/10

xmrig discovery miner

Malware Config

Signatures

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/files/0x0007000000023630-434.dat	family_xmrig
behavioral1/files/0x0007000000023630-434.dat	xmrig
behavioral1/memory/4052-436-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-438-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-444-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-454-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4600-456-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-455-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-457-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-458-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4600-460-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-459-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-461-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-462-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-463-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-464-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-465-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-466-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4600-468-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-467-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-469-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-470-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-471-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-472-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4600-474-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-473-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-476-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-475-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-478-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-477-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-479-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-480-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4600-482-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-481-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-484-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-483-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-486-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-485-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-487-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-488-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4600-490-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-489-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-491-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-492-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4600-494-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-493-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-495-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-496-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-497-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-498-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-499-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-500-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4600-502-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-501-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-503-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-504-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4600-506-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-505-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-507-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-508-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4600-510-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig
behavioral1/memory/4052-509-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4052-511-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp	xmrig
behavioral1/memory/4600-512-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 2 IoCs

pid	Process
4052	xmrig.exe
4600	xmrig.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
108	raw.githubusercontent.com
109	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
4984	msedge.exe
4984	msedge.exe
2076	identity_helper.exe
2076	identity_helper.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4612	Cudo Miner.exe
Token: SeRestorePrivilege	624	7zG.exe
Token: 35	624	7zG.exe
Token: SeSecurityPrivilege	624	7zG.exe
Token: SeSecurityPrivilege	624	7zG.exe
Token: SeRestorePrivilege	1680	7zG.exe
Token: 35	1680	7zG.exe
Token: SeSecurityPrivilege	1680	7zG.exe
Token: SeSecurityPrivilege	1680	7zG.exe
Token: SeRestorePrivilege	4736	7zG.exe
Token: 35	4736	7zG.exe
Token: SeSecurityPrivilege	4736	7zG.exe
Token: SeSecurityPrivilege	4736	7zG.exe
Token: SeLockMemoryPrivilege	4052	xmrig.exe
Token: SeLockMemoryPrivilege	4052	xmrig.exe
Token: SeLockMemoryPrivilege	4600	xmrig.exe
Token: SeLockMemoryPrivilege	4600	xmrig.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
624	7zG.exe
1680	7zG.exe
4736	7zG.exe
4052	xmrig.exe
4600	xmrig.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 5012	4984	msedge.exe	95
PID 4984 wrote to memory of 5012	4984	msedge.exe	95
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1536	4984	msedge.exe	96
PID 4984 wrote to memory of 1256	4984	msedge.exe	97
PID 4984 wrote to memory of 1256	4984	msedge.exe	97
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98
PID 4984 wrote to memory of 3008	4984	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\Cudo Miner\Cudo Miner.exe
"C:\Users\Admin\AppData\Local\Temp\Cudo Miner\Cudo Miner.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff5de946f8,0x7fff5de94708,0x7fff5de94718
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2004,9790439057292990009,8577568854130712568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2964

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\xmrig origine\" -spe -an -ai#7zMap15574:88:7zEvent12765
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:624

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\xmrig origine\xmrig- plus\" -spe -an -ai#7zMap5451:112:7zEvent15785
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1680

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\xmrig origine\xmrig-6.22.0-gcc-win64 plus\" -spe -an -ai#7zMap1767:144:7zEvent25764
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\xmrig origine\xmrig- plus\0 rx.unmineable.bat" "
1⤵
PID:1500
- C:\Users\Admin\Downloads\xmrig origine\xmrig- plus\xmrig.exe
  xmrig.exe -o stratum+ssl://rx.unmineable.com:443 -a rx -k -u USDT:TFbVps6AMb9D129FuKsMvoDdU5zppckfWp.CPU_x8w8-w05n -p x
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\xmrig origine\xmrig-6.22.0-gcc-win64 plus\1Kryptex-ETC-Rigel.bat" "
1⤵
PID:1560
- C:\Users\Admin\Downloads\xmrig origine\xmrig-6.22.0-gcc-win64 plus\xmrig.exe
  xmrig --coin XMR --url "xmr.kryptex.network:7777" --user "[email protected]/WORKER_NAME"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fc76bdfe5038240ba7690ab2842f1455

SHA1
49e4a8cc071c27fa07445e442ac80c11dd5faf5d

SHA256
370ebaa4962f10595dd1598043ae314e66ae9513af9df54e66aaa78ddfd33faf

SHA512
8df51132bddf7a54f7abbd41c63f9ff74acb37a36bc548f550b5f21bcb599df9816b5ba068cd7500e97c2ac37aefc0492b8baf990fd7c5300ceab88b8acccd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9d749b310f4970e7c91efccc1ba2a905

SHA1
9318cd8632d6f88adeb0366d82b4c8d1c2e27f9c

SHA256
44c8627798edab9368a470c76d53989ce6cd374dd7a853da0a6fcb87fe987fdb

SHA512
f54e34f3a689d5a0356c292b9d7a0b5b97f241c0cc02e79fcfbe65686b229666235fccff32807c14238bbdb8d98537ed218d4d82d2ce88d832f2c907d31f7881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
624d9ea191239e2640a3d43a2b3e4ec6

SHA1
ec64e8e4b01731ba927704e33e15b6c7ddc4a5ce

SHA256
f0039dbe22ebed3d80dc0ca6f872eaf0eba5d41624b5fd3e6a4e20b85f14a488

SHA512
c0b61923ab5dca5442a6ef3a45cba6558004a700bd542e93496ae0e2a3d2b32dd1a89c24968f59d875b20bd9ec8c60d7f12feedc311392ec1f345a295a5c7f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0cebccb04440efafb8b1e9bea231fffb

SHA1
5c3fa786812b4c33676e381d55c827eeb6d2e51c

SHA256
264305b68ca3a361fe04d618c19bca4e450adeafb6b91c987dc1cbaced855718

SHA512
59bf51d90e2d5058a1b901828a168d3284c285b7f76962f39f6e6a15d1da112f424b28ad74b5e452b00aaa378420fe68a08a5931c8144b02bb11bafa00b18662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
23ca67823e9d25f0f42d25375e97f74c

SHA1
ee819c814f69a9501f8625b71edfcf28969b5651

SHA256
1e6c7cae3e201c578888011bff2f53c4c5e2e519715358fdf60aeb853eb250c4

SHA512
b625aafbd2dcad9dedcc78cc2d80e2d0e59ce5dbe98bbe46b6b80277c0421b6378e38c7d3481128956c45983a503b3fb5d31b7f0e002fdba44800216557cdf2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aafe84e159cd704bcbd02bb4e2d67054

SHA1
038274395f75e080931cd018a200216ba12b6a8d

SHA256
94d457d145e95a2fb5c430145cf3913a0311605ec55e82c7e056a14967829db0

SHA512
4e5ef4be8bdb7bfe644c8d6b03d6445fe04b041801311691591c1909f6916b88b9e202b04c5481787c073ec8c0faa2629ffede727221cf370c89129db542133e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3765cdb0c88fa8392854a2b9ed5a9a7d

SHA1
d3ff0d55abcc7d5198edcacb0d5a3c19ac871378

SHA256
2189f35f8763250c708d739932241c5684366da1462632299ab4b74fa2bfdb3d

SHA512
ef592c01c96600e01131b140e48f2c28ad24adb875a44531543e4610c1e5ef6e6c578e9bb7386e542af37c65c87800158f9903e3346a9d8fe692f691253fc702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0c1cab1cbe2b7ba16d6fe8805504b43a

SHA1
b4b680d45dccb6be2312c3c12f2ff80ccd865ffc

SHA256
1cec7b6bfd878f98f0d596675cf7fb01984bcf7682b9fa6c91d8c6bcb0611222

SHA512
81b01e7ee0e23cdeb0da6cd97fccd554f04f4ae545bd7146f638b18706ce7d08a745a66e84a4bb63e2bd38ec91b381bacaf1a10324c177667dbf956f9ae218cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5f9c97.TMP

Filesize
874B

MD5
f4bf361ebc70d3156ead69ca5c8403f1

SHA1
3b88bab9d321fcd9fdb775255eb83a7cd76070e8

SHA256
062b73610a64878e23fadc1f79df3fc77354f6204ad1e64dddf2e611dded9db3

SHA512
62c7cb70bb989d1c4bcdf3180fdbe0608e333e0e0a358cd2cea95ac7fe5bf52e7959e98f709773e02285dd4ce39d130ca890c43b8b7c7052ba23ddb178a1a5f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cff99218ad90ac1206e697ececebb981

SHA1
40bb7a4262dac35e8713e753ed0f7de6079c38ad

SHA256
31621e578ea6f153f8d915d3c84d0254d88ccc4d77b4d5469b506e05666a9f72

SHA512
755f6153c84a20e9757bf233d2945f05052958149125c75bbb9787a37f2b0d1bf161253d32031764077d2ca7e4cac29784a0ae847dfbd226deb6947f8e5d4a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da79b3178ada33818517e1a86c5d4c14

SHA1
f3ad59760fb06cb6bd663ec6671969c3a31e1fdd

SHA256
db46a2e1bb245731a375e0165329b01ead097666ee40207b57020fe5e757c35b

SHA512
0d8410dcd32b00ca97eea32eda79c0113fb84db3d8e27fa13e1de0802754754d398833637f993feab8bd89603bc25d22ab05572f0a0e47113202160ca0a39e99

Download Submit
C:\Users\Admin\Downloads\xmrig origine.zip

Filesize
7.4MB

MD5
00e4eb4ba18989d2a142f184b3065318

SHA1
32ffa277232eb0fa31ebaf6fc24fa4487d0f3df0

SHA256
87862b14b20f16f1a72950c9f9bb3b6ded8751f78088825779f27687e6a0248d

SHA512
555d023705ef8e56cf7b2d0797c808ddff54cc21419b067af5486f52633de16e3229600b0dcf6d8c45273b7d75ec20d1b522283cad7ac67569a7780621598571

Download Submit
C:\Users\Admin\Downloads\xmrig origine\xmrig- plus.zip

Filesize
3.7MB

MD5
d54054710e2bf81c1a974cbadef49b62

SHA1
40257c5dde8851fcf2706bf21971e458e558386c

SHA256
25f676b71c0d456013a46dfc3c8524cdec7533c1dc7be2617a1f12074995d00b

SHA512
7cc1dfa82bb75b0bfdb1f6fd725529272e7dac0db65e9a88d69f3ddbe6506cc6de77a826b2440cddfd0791d2640a5d6153a1dee8ee9df104047d9e991da97af2

Download Submit
C:\Users\Admin\Downloads\xmrig origine\xmrig- plus\11 rx.unmineable.bat

Filesize
127B

MD5
5d211a59dce5b7be814d8718f594feb7

SHA1
b1703b40281c1d5db193331350d7f5edf45847a7

SHA256
05ed30ee3a1348bbc6e67a6ac725eab176c0e44f870a177e3e26c0a6ebc78067

SHA512
7476759ca3471f70153e2c570b0fe0824ab8b85b8cd4d416614cfa2f220dec799d053f303ebf11010c0ca83ac190625d6912a630bda982082f0bed48c651a39c

Download Submit
C:\Users\Admin\Downloads\xmrig origine\xmrig- plus\xmrig.exe

Filesize
9.1MB

MD5
d6c24bdff1cb0f2fcbe5ae63c42c7d92

SHA1
6412934a06c3221a25ed1986098ec57d0c221cd8

SHA256
e5cd22ffe8725fbabf32ae2ba993d5b791e65e2ef159ad32ad260505f2e22480

SHA512
f8f028ebafcc96fd97984494c4773093be5b5e5eae820e3ae0097d101f8962d320863adcc944763104f0ad5efed01c3c6be88797fd9c40e5258642c5b325a2a6

Download Submit
C:\Users\Admin\Downloads\xmrig origine\xmrig-6.22.0-gcc-win64 plus.zip

Filesize
3.7MB

MD5
ea0408666018f39ac93eb963e56ab9c2

SHA1
c9c8f339225219c9fbb8e5b0f01bc1cb49de5205

SHA256
ed4b133ca27cb6ae60400d9b9a012bbe8030f4a7e15f7b44018e16f1dedf415f

SHA512
8a243f76483544b8bef9098d844768989e81f713901d56f11ab1ac7d84ba61fea290a8ab1120061f443ba4fa7dcbfec4d4bb5c87aad91d72bd47de9eff375d94

Download Submit
C:\Users\Admin\Downloads\xmrig origine\xmrig-6.22.0-gcc-win64 plus\3Kryptex-ETC-Rigel.bat

Filesize
92B

MD5
634f74bb86bbee797fb3fd78bb981c69

SHA1
dacc178885db2349ad47b9e8d2fb6140dbb7ca61

SHA256
4c42750d70f4097dd4de26367a7ee25704bca438e82476c4e9481246d067b632

SHA512
07d76ed885fefa28765cfe3b6c42213fb43c6ec709a82aa7245c8896fe4e79b7d672fcf3043a658ed034e27449e9921f5120a911cb0a0ce8667d819e6d2720ef

Download Submit
memory/4052-469-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-479-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-511-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-509-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-507-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-435-0x0000018FCE440000-0x0000018FCE460000-memory.dmp

Filesize
128KB

Download
memory/4052-436-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-438-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-444-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-505-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-503-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-501-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-455-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-457-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-499-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-497-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-459-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-461-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-495-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-463-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-493-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-465-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-491-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-489-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-467-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-487-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-485-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-471-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-483-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-481-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-473-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-477-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4052-475-0x00007FF67DE00000-0x00007FF67EA32000-memory.dmp

Filesize
12.2MB

Download
memory/4600-462-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-476-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-512-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-480-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-482-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-474-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-484-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-472-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-486-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-470-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-510-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-488-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-490-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-468-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-466-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-492-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-464-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-494-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-506-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-496-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-460-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-498-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-458-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-500-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-502-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-456-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-454-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-504-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-478-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4600-508-0x00007FF67A9C0000-0x00007FF67B5F2000-memory.dmp

Filesize
12.2MB

Download
memory/4612-2-0x00007FFF5CC30000-0x00007FFF5D6F1000-memory.dmp

Filesize
10.8MB

Download
memory/4612-1-0x0000000000C70000-0x0000000000D12000-memory.dmp

Filesize
648KB

Download
memory/4612-0-0x00007FFF5CC33000-0x00007FFF5CC35000-memory.dmp

Filesize
8KB

Download
memory/4612-4-0x00007FFF5CC33000-0x00007FFF5CC35000-memory.dmp

Filesize
8KB

Download
memory/4612-5-0x00007FFF5CC30000-0x00007FFF5D6F1000-memory.dmp

Filesize
10.8MB

Download
memory/4612-7-0x00007FFF5CC30000-0x00007FFF5D6F1000-memory.dmp

Filesize
10.8MB

Download