77cb17ef2f4f282f39838e7430bf040c3356e59ae8f13cbd4e670712e9f44a4e

Analysis

max time kernel
133s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73f075adda1fe81dea4022f4e06fb64a.exe
Size

538KB
MD5

73f075adda1fe81dea4022f4e06fb64a
SHA1

ca241492da03a4d86fd43a5a076e22ac6949505c
SHA256

77cb17ef2f4f282f39838e7430bf040c3356e59ae8f13cbd4e670712e9f44a4e
SHA512

c3e5b5efd9c7842320657a09770f5f0d75b5143cffbafd179a7fd70bf8d48a8246cee948462d190f9d032599a2f6d5947d9ed694732b2dcb68d5429c4843d010
SSDEEP

12288:JaX8kSXZJS+FTH9+3HI6iR8WnDRzMy6NVD8TS6SJuiRxkorXl:TpfFTdEri9sjS1a5tzl

Score

8^/10

collection spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

Wzhtwkrl.exePhoenixClientbaluci.exeSystem.exeWzhtwkrl.exe

pid process

316 Wzhtwkrl.exe
668 PhoenixClientbaluci.exe
1172 System.exe
1440 Wzhtwkrl.exe
Loads dropped DLL 4 IoCs

Processes:

73f075adda1fe81dea4022f4e06fb64a.execmd.exetaskeng.exe

pid process

1896 73f075adda1fe81dea4022f4e06fb64a.exe
1896 73f075adda1fe81dea4022f4e06fb64a.exe
1588 cmd.exe
1320 taskeng.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
316	Wzhtwkrl.exe
668	PhoenixClientbaluci.exe
1172	System.exe
1440	Wzhtwkrl.exe

pid	process
1896	73f075adda1fe81dea4022f4e06fb64a.exe
1896	73f075adda1fe81dea4022f4e06fb64a.exe
1588	cmd.exe
1320	taskeng.exe

Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs

collection

Email Collection

T1114

Processes:

Wzhtwkrl.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Wzhtwkrl.exe
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Wzhtwkrl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Wzhtwkrl.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Wzhtwkrl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Wzhtwkrl.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

896 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1608 timeout.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

System.exe

pid process

1172 System.exe

pid	process
896	schtasks.exe

pid	process
1608	timeout.exe

pid	process
1172	System.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exePhoenixClientbaluci.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWzhtwkrl.exe

pid	process
1612	powershell.exe
1320	powershell.exe
2028	powershell.exe
1892	powershell.exe
2000	powershell.exe
668	PhoenixClientbaluci.exe
1924	powershell.exe
1784	powershell.exe
892	powershell.exe
896	powershell.exe
1608	powershell.exe
888	powershell.exe
1440	Wzhtwkrl.exe
1440	Wzhtwkrl.exe
1440	Wzhtwkrl.exe
1440	Wzhtwkrl.exe
1440	Wzhtwkrl.exe
1440	Wzhtwkrl.exe
1440	Wzhtwkrl.exe
1440	Wzhtwkrl.exe
1440	Wzhtwkrl.exe
1440	Wzhtwkrl.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exePhoenixClientbaluci.exeWzhtwkrl.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeSystem.exeWzhtwkrl.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	668	PhoenixClientbaluci.exe
Token: SeDebugPrivilege	316	Wzhtwkrl.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	1172	System.exe
Token: SeDebugPrivilege	1172	System.exe
Token: SeDebugPrivilege	1440	Wzhtwkrl.exe
Token: SeDebugPrivilege	888	powershell.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

73f075adda1fe81dea4022f4e06fb64a.exePhoenixClientbaluci.execmd.execmd.execmd.exeWzhtwkrl.exetaskeng.exeSystem.execmd.exe

description	pid	process	target process
PID 1896 wrote to memory of 1612	1896	73f075adda1fe81dea4022f4e06fb64a.exe	powershell.exe
PID 1896 wrote to memory of 1612	1896	73f075adda1fe81dea4022f4e06fb64a.exe	powershell.exe
PID 1896 wrote to memory of 1612	1896	73f075adda1fe81dea4022f4e06fb64a.exe	powershell.exe
PID 1896 wrote to memory of 316	1896	73f075adda1fe81dea4022f4e06fb64a.exe	Wzhtwkrl.exe
PID 1896 wrote to memory of 316	1896	73f075adda1fe81dea4022f4e06fb64a.exe	Wzhtwkrl.exe
PID 1896 wrote to memory of 316	1896	73f075adda1fe81dea4022f4e06fb64a.exe	Wzhtwkrl.exe
PID 1896 wrote to memory of 668	1896	73f075adda1fe81dea4022f4e06fb64a.exe	PhoenixClientbaluci.exe
PID 1896 wrote to memory of 668	1896	73f075adda1fe81dea4022f4e06fb64a.exe	PhoenixClientbaluci.exe
PID 1896 wrote to memory of 668	1896	73f075adda1fe81dea4022f4e06fb64a.exe	PhoenixClientbaluci.exe
PID 668 wrote to memory of 112	668	PhoenixClientbaluci.exe	cmd.exe
PID 668 wrote to memory of 112	668	PhoenixClientbaluci.exe	cmd.exe
PID 668 wrote to memory of 112	668	PhoenixClientbaluci.exe	cmd.exe
PID 112 wrote to memory of 1320	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 1320	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 1320	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 2028	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 2028	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 2028	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 1892	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 1892	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 1892	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 2000	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 2000	112	cmd.exe	powershell.exe
PID 112 wrote to memory of 2000	112	cmd.exe	powershell.exe
PID 668 wrote to memory of 1700	668	PhoenixClientbaluci.exe	cmd.exe
PID 668 wrote to memory of 1700	668	PhoenixClientbaluci.exe	cmd.exe
PID 668 wrote to memory of 1700	668	PhoenixClientbaluci.exe	cmd.exe
PID 668 wrote to memory of 1588	668	PhoenixClientbaluci.exe	cmd.exe
PID 668 wrote to memory of 1588	668	PhoenixClientbaluci.exe	cmd.exe
PID 668 wrote to memory of 1588	668	PhoenixClientbaluci.exe	cmd.exe
PID 1700 wrote to memory of 896	1700	cmd.exe	schtasks.exe
PID 1700 wrote to memory of 896	1700	cmd.exe	schtasks.exe
PID 1700 wrote to memory of 896	1700	cmd.exe	schtasks.exe
PID 1588 wrote to memory of 1608	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 1608	1588	cmd.exe	timeout.exe
PID 1588 wrote to memory of 1608	1588	cmd.exe	timeout.exe
PID 316 wrote to memory of 1924	316	Wzhtwkrl.exe	powershell.exe
PID 316 wrote to memory of 1924	316	Wzhtwkrl.exe	powershell.exe
PID 316 wrote to memory of 1924	316	Wzhtwkrl.exe	powershell.exe
PID 1588 wrote to memory of 1172	1588	cmd.exe	System.exe
PID 1588 wrote to memory of 1172	1588	cmd.exe	System.exe
PID 1588 wrote to memory of 1172	1588	cmd.exe	System.exe
PID 1320 wrote to memory of 1440	1320	taskeng.exe	Wzhtwkrl.exe
PID 1320 wrote to memory of 1440	1320	taskeng.exe	Wzhtwkrl.exe
PID 1320 wrote to memory of 1440	1320	taskeng.exe	Wzhtwkrl.exe
PID 1172 wrote to memory of 1944	1172	System.exe	cmd.exe
PID 1172 wrote to memory of 1944	1172	System.exe	cmd.exe
PID 1172 wrote to memory of 1944	1172	System.exe	cmd.exe
PID 1944 wrote to memory of 1784	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 1784	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 1784	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 892	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 892	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 892	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 896	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 896	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 896	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 1608	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 1608	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 1608	1944	cmd.exe	powershell.exe
PID 1172 wrote to memory of 888	1172	System.exe	powershell.exe
PID 1172 wrote to memory of 888	1172	System.exe	powershell.exe
PID 1172 wrote to memory of 888	1172	System.exe	powershell.exe

outlook_office_path 1 IoCs

Processes:

Wzhtwkrl.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe

outlook_win_path 1 IoCs

Processes:

Wzhtwkrl.exe

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Wzhtwkrl.exe

C:\Users\Admin\AppData\Local\Temp\73f075adda1fe81dea4022f4e06fb64a.exe
"C:\Users\Admin\AppData\Local\Temp\73f075adda1fe81dea4022f4e06fb64a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAeAB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAcwBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGgAYgBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAdABkACMAPgA="
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Users\Admin\AppData\Local\Temp\Wzhtwkrl.exe
"C:\Users\Admin\AppData\Local\Temp\Wzhtwkrl.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Users\Admin\AppData\Local\Temp\PhoenixClientbaluci.exe
"C:\Users\Admin\AppData\Local\Temp\PhoenixClientbaluci.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%APPDATA%' & powershell -Command Add-MpPreference -ExclusionPath '%TMP%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%'
3⤵
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System\System.exe"' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System\System.exe"'
4⤵
- Creates scheduled task(s)
PID:896

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp50A1.tmp.bat""
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\system32\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:1608

C:\Users\Admin\AppData\Roaming\System\System.exe
"C:\Users\Admin\AppData\Roaming\System\System.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%APPDATA%' & powershell -Command Add-MpPreference -ExclusionPath '%TMP%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%'
5⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" (Get-ItemProperty -Path 'HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0*' -Name HardwareInformation.qwMemorySize -ErrorAction SilentlyContinue).'HardwareInformation.qwMemorySize'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Windows\system32\taskeng.exe
taskeng.exe {FEF9D870-4072-44FF-AE37-3BF1E47EFB07} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1320

C:\Users\Admin\AppData\Roaming\Wzhtwkrl.exe
C:\Users\Admin\AppData\Roaming\Wzhtwkrl.exe
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PhoenixClientbaluci.exe
Filesize
62KB

MD5
d6dda9cb85261b5fdc12eb22c5d3e6da

SHA1
4dc5ed6cd82eb87dbd0dfca4729871ea16aa143b

SHA256
8f50935534bb6cee9b68b515e68dbfb465068ca07def048299b01d42f63550b4

SHA512
7948f58de435c125b3dd7eff9e83e6bb1966603efba081a4b93ef4b3fc93c01e0d20175f35520fe479fb6b411d42dcf124dfcfad60d56bf4132acec6c5d2e440

Download Submit
C:\Users\Admin\AppData\Local\Temp\PhoenixClientbaluci.exe
Filesize
62KB

MD5
d6dda9cb85261b5fdc12eb22c5d3e6da

SHA1
4dc5ed6cd82eb87dbd0dfca4729871ea16aa143b

SHA256
8f50935534bb6cee9b68b515e68dbfb465068ca07def048299b01d42f63550b4

SHA512
7948f58de435c125b3dd7eff9e83e6bb1966603efba081a4b93ef4b3fc93c01e0d20175f35520fe479fb6b411d42dcf124dfcfad60d56bf4132acec6c5d2e440

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wzhtwkrl.exe
Filesize
469KB

MD5
12c686d78a0c45f37fd17b743a0609f0

SHA1
9febe4209af334f03cae6c16a98abd0b1beafb43

SHA256
e96ba96b2e5420983890d82dcb11c75f3ae436559dd9bf8ecda5135a290fc290

SHA512
974d87f205d975bcb06f1b201cdc84c05120b74e08f897256ef35a774a3e9d1170ee7ad0d856ef9cbe9600434190c36dbde34177e6b2cf5e5b80595d155adef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wzhtwkrl.exe
Filesize
469KB

MD5
12c686d78a0c45f37fd17b743a0609f0

SHA1
9febe4209af334f03cae6c16a98abd0b1beafb43

SHA256
e96ba96b2e5420983890d82dcb11c75f3ae436559dd9bf8ecda5135a290fc290

SHA512
974d87f205d975bcb06f1b201cdc84c05120b74e08f897256ef35a774a3e9d1170ee7ad0d856ef9cbe9600434190c36dbde34177e6b2cf5e5b80595d155adef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp50A1.tmp.bat
Filesize
157B

MD5
06943de024f8eaa9feaff169f4e29af9

SHA1
1ff8d9cfea04db8a6fa3464ad8bb125f404f02ac

SHA256
fa58c99d20673803763971b25e99ee970108b04ba17de4a53ddec4c746b0cd5c

SHA512
c910311dce536ca59fb49bae9138e15e78b2ad377888be1ce18e57cc158ce064df4440b4ff0af1c790376e9a3cf7f1f718312ae5213c94b3f6e2ae578937e52e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
488f8cbfe0485c0b36c23d481473391f

SHA1
66e11c2338ec511b05ec1b844402438a334ef0a3

SHA256
61ff1b1ed39c564efdd230e670e186a04a702bf77e8863e3b195473ac49eaa55

SHA512
34ca6afdd4d47ca547e6bc3568768fe4519bb84b3b3a177a053aa90520f3a35ecf5ae871784ae92ba102464122acac988bc11563a1e62182d244e48b82c540c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
488f8cbfe0485c0b36c23d481473391f

SHA1
66e11c2338ec511b05ec1b844402438a334ef0a3

SHA256
61ff1b1ed39c564efdd230e670e186a04a702bf77e8863e3b195473ac49eaa55

SHA512
34ca6afdd4d47ca547e6bc3568768fe4519bb84b3b3a177a053aa90520f3a35ecf5ae871784ae92ba102464122acac988bc11563a1e62182d244e48b82c540c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
488f8cbfe0485c0b36c23d481473391f

SHA1
66e11c2338ec511b05ec1b844402438a334ef0a3

SHA256
61ff1b1ed39c564efdd230e670e186a04a702bf77e8863e3b195473ac49eaa55

SHA512
34ca6afdd4d47ca547e6bc3568768fe4519bb84b3b3a177a053aa90520f3a35ecf5ae871784ae92ba102464122acac988bc11563a1e62182d244e48b82c540c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
488f8cbfe0485c0b36c23d481473391f

SHA1
66e11c2338ec511b05ec1b844402438a334ef0a3

SHA256
61ff1b1ed39c564efdd230e670e186a04a702bf77e8863e3b195473ac49eaa55

SHA512
34ca6afdd4d47ca547e6bc3568768fe4519bb84b3b3a177a053aa90520f3a35ecf5ae871784ae92ba102464122acac988bc11563a1e62182d244e48b82c540c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
488f8cbfe0485c0b36c23d481473391f

SHA1
66e11c2338ec511b05ec1b844402438a334ef0a3

SHA256
61ff1b1ed39c564efdd230e670e186a04a702bf77e8863e3b195473ac49eaa55

SHA512
34ca6afdd4d47ca547e6bc3568768fe4519bb84b3b3a177a053aa90520f3a35ecf5ae871784ae92ba102464122acac988bc11563a1e62182d244e48b82c540c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
488f8cbfe0485c0b36c23d481473391f

SHA1
66e11c2338ec511b05ec1b844402438a334ef0a3

SHA256
61ff1b1ed39c564efdd230e670e186a04a702bf77e8863e3b195473ac49eaa55

SHA512
34ca6afdd4d47ca547e6bc3568768fe4519bb84b3b3a177a053aa90520f3a35ecf5ae871784ae92ba102464122acac988bc11563a1e62182d244e48b82c540c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
488f8cbfe0485c0b36c23d481473391f

SHA1
66e11c2338ec511b05ec1b844402438a334ef0a3

SHA256
61ff1b1ed39c564efdd230e670e186a04a702bf77e8863e3b195473ac49eaa55

SHA512
34ca6afdd4d47ca547e6bc3568768fe4519bb84b3b3a177a053aa90520f3a35ecf5ae871784ae92ba102464122acac988bc11563a1e62182d244e48b82c540c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
488f8cbfe0485c0b36c23d481473391f

SHA1
66e11c2338ec511b05ec1b844402438a334ef0a3

SHA256
61ff1b1ed39c564efdd230e670e186a04a702bf77e8863e3b195473ac49eaa55

SHA512
34ca6afdd4d47ca547e6bc3568768fe4519bb84b3b3a177a053aa90520f3a35ecf5ae871784ae92ba102464122acac988bc11563a1e62182d244e48b82c540c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
488f8cbfe0485c0b36c23d481473391f

SHA1
66e11c2338ec511b05ec1b844402438a334ef0a3

SHA256
61ff1b1ed39c564efdd230e670e186a04a702bf77e8863e3b195473ac49eaa55

SHA512
34ca6afdd4d47ca547e6bc3568768fe4519bb84b3b3a177a053aa90520f3a35ecf5ae871784ae92ba102464122acac988bc11563a1e62182d244e48b82c540c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
488f8cbfe0485c0b36c23d481473391f

SHA1
66e11c2338ec511b05ec1b844402438a334ef0a3

SHA256
61ff1b1ed39c564efdd230e670e186a04a702bf77e8863e3b195473ac49eaa55

SHA512
34ca6afdd4d47ca547e6bc3568768fe4519bb84b3b3a177a053aa90520f3a35ecf5ae871784ae92ba102464122acac988bc11563a1e62182d244e48b82c540c1

Download Submit
C:\Users\Admin\AppData\Roaming\System\System.exe
Filesize
62KB

MD5
d6dda9cb85261b5fdc12eb22c5d3e6da

SHA1
4dc5ed6cd82eb87dbd0dfca4729871ea16aa143b

SHA256
8f50935534bb6cee9b68b515e68dbfb465068ca07def048299b01d42f63550b4

SHA512
7948f58de435c125b3dd7eff9e83e6bb1966603efba081a4b93ef4b3fc93c01e0d20175f35520fe479fb6b411d42dcf124dfcfad60d56bf4132acec6c5d2e440

Download Submit
C:\Users\Admin\AppData\Roaming\System\System.exe
Filesize
62KB

MD5
d6dda9cb85261b5fdc12eb22c5d3e6da

SHA1
4dc5ed6cd82eb87dbd0dfca4729871ea16aa143b

SHA256
8f50935534bb6cee9b68b515e68dbfb465068ca07def048299b01d42f63550b4

SHA512
7948f58de435c125b3dd7eff9e83e6bb1966603efba081a4b93ef4b3fc93c01e0d20175f35520fe479fb6b411d42dcf124dfcfad60d56bf4132acec6c5d2e440

Download Submit
C:\Users\Admin\AppData\Roaming\Wzhtwkrl.exe
Filesize
469KB

MD5
12c686d78a0c45f37fd17b743a0609f0

SHA1
9febe4209af334f03cae6c16a98abd0b1beafb43

SHA256
e96ba96b2e5420983890d82dcb11c75f3ae436559dd9bf8ecda5135a290fc290

SHA512
974d87f205d975bcb06f1b201cdc84c05120b74e08f897256ef35a774a3e9d1170ee7ad0d856ef9cbe9600434190c36dbde34177e6b2cf5e5b80595d155adef9

Download Submit
C:\Users\Admin\AppData\Roaming\Wzhtwkrl.exe
Filesize
469KB

MD5
12c686d78a0c45f37fd17b743a0609f0

SHA1
9febe4209af334f03cae6c16a98abd0b1beafb43

SHA256
e96ba96b2e5420983890d82dcb11c75f3ae436559dd9bf8ecda5135a290fc290

SHA512
974d87f205d975bcb06f1b201cdc84c05120b74e08f897256ef35a774a3e9d1170ee7ad0d856ef9cbe9600434190c36dbde34177e6b2cf5e5b80595d155adef9

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\PhoenixClientbaluci.exe
Filesize
62KB

MD5
d6dda9cb85261b5fdc12eb22c5d3e6da

SHA1
4dc5ed6cd82eb87dbd0dfca4729871ea16aa143b

SHA256
8f50935534bb6cee9b68b515e68dbfb465068ca07def048299b01d42f63550b4

SHA512
7948f58de435c125b3dd7eff9e83e6bb1966603efba081a4b93ef4b3fc93c01e0d20175f35520fe479fb6b411d42dcf124dfcfad60d56bf4132acec6c5d2e440

Download Submit
\Users\Admin\AppData\Local\Temp\Wzhtwkrl.exe
Filesize
469KB

MD5
12c686d78a0c45f37fd17b743a0609f0

SHA1
9febe4209af334f03cae6c16a98abd0b1beafb43

SHA256
e96ba96b2e5420983890d82dcb11c75f3ae436559dd9bf8ecda5135a290fc290

SHA512
974d87f205d975bcb06f1b201cdc84c05120b74e08f897256ef35a774a3e9d1170ee7ad0d856ef9cbe9600434190c36dbde34177e6b2cf5e5b80595d155adef9

Download Submit
\Users\Admin\AppData\Roaming\System\System.exe
Filesize
62KB

MD5
d6dda9cb85261b5fdc12eb22c5d3e6da

SHA1
4dc5ed6cd82eb87dbd0dfca4729871ea16aa143b

SHA256
8f50935534bb6cee9b68b515e68dbfb465068ca07def048299b01d42f63550b4

SHA512
7948f58de435c125b3dd7eff9e83e6bb1966603efba081a4b93ef4b3fc93c01e0d20175f35520fe479fb6b411d42dcf124dfcfad60d56bf4132acec6c5d2e440

Download Submit
\Users\Admin\AppData\Roaming\Wzhtwkrl.exe
Filesize
469KB

MD5
12c686d78a0c45f37fd17b743a0609f0

SHA1
9febe4209af334f03cae6c16a98abd0b1beafb43

SHA256
e96ba96b2e5420983890d82dcb11c75f3ae436559dd9bf8ecda5135a290fc290

SHA512
974d87f205d975bcb06f1b201cdc84c05120b74e08f897256ef35a774a3e9d1170ee7ad0d856ef9cbe9600434190c36dbde34177e6b2cf5e5b80595d155adef9

Download Submit
memory/112-77-0x0000000000000000-mapping.dmp

Download
memory/316-125-0x000000001BAB6000-0x000000001BAD5000-memory.dmp

Filesize
124KB

Download
memory/316-59-0x0000000000000000-mapping.dmp

Download
memory/316-66-0x0000000000790000-0x00000000007DE000-memory.dmp

Filesize
312KB

Download
memory/316-110-0x00000000008D0000-0x000000000091C000-memory.dmp

Filesize
304KB

Download
memory/316-62-0x000000013F4E0000-0x000000013F558000-memory.dmp

Filesize
480KB

Download
memory/316-64-0x000000001B960000-0x000000001BA04000-memory.dmp

Filesize
656KB

Download
memory/316-122-0x000000001AC80000-0x000000001ACD4000-memory.dmp

Filesize
336KB

Download
memory/668-72-0x0000000000FD0000-0x0000000000FE4000-memory.dmp

Filesize
80KB

Download
memory/668-69-0x0000000000000000-mapping.dmp

Download
memory/888-176-0x000007FEED010000-0x000007FEEDA33000-memory.dmp

Filesize
10.1MB

Download
memory/888-180-0x00000000024DB000-0x00000000024FA000-memory.dmp

Filesize
124KB

Download
memory/888-179-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/888-178-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/888-177-0x000007FEEC4B0000-0x000007FEED00D000-memory.dmp

Filesize
11.4MB

Download
memory/888-173-0x0000000000000000-mapping.dmp

Download
memory/892-152-0x000007FEEDE60000-0x000007FEEE883000-memory.dmp

Filesize
10.1MB

Download
memory/892-155-0x00000000025C4000-0x00000000025C7000-memory.dmp

Filesize
12KB

Download
memory/892-156-0x00000000025CB000-0x00000000025EA000-memory.dmp

Filesize
124KB

Download
memory/892-154-0x00000000025C4000-0x00000000025C7000-memory.dmp

Filesize
12KB

Download
memory/892-149-0x0000000000000000-mapping.dmp

Download
memory/892-153-0x000007FEED300000-0x000007FEEDE5D000-memory.dmp

Filesize
11.4MB

Download
memory/896-160-0x000007FEEE890000-0x000007FEEF2B3000-memory.dmp

Filesize
10.1MB

Download
memory/896-113-0x0000000000000000-mapping.dmp

Download
memory/896-163-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/896-162-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/896-164-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/896-161-0x000007FEEDD30000-0x000007FEEE88D000-memory.dmp

Filesize
11.4MB

Download
memory/896-157-0x0000000000000000-mapping.dmp

Download
memory/1172-127-0x0000000000000000-mapping.dmp

Download
memory/1172-130-0x0000000000CE0000-0x0000000000CF4000-memory.dmp

Filesize
80KB

Download
memory/1320-87-0x000000000270B000-0x000000000272A000-memory.dmp

Filesize
124KB

Download
memory/1320-78-0x0000000000000000-mapping.dmp

Download
memory/1320-86-0x0000000002704000-0x0000000002707000-memory.dmp

Filesize
12KB

Download
memory/1320-85-0x000000000270B000-0x000000000272A000-memory.dmp

Filesize
124KB

Download
memory/1320-84-0x0000000002704000-0x0000000002707000-memory.dmp

Filesize
12KB

Download
memory/1320-83-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/1320-82-0x000007FEEE760000-0x000007FEEF2BD000-memory.dmp

Filesize
11.4MB

Download
memory/1440-182-0x000000001B9E6000-0x000000001BA05000-memory.dmp

Filesize
124KB

Download
memory/1440-183-0x000000001C1A0000-0x000000001C214000-memory.dmp

Filesize
464KB

Download
memory/1440-181-0x000000001B9E6000-0x000000001BA05000-memory.dmp

Filesize
124KB

Download
memory/1440-132-0x0000000000000000-mapping.dmp

Download
memory/1440-185-0x000000001C850000-0x000000001C8D8000-memory.dmp

Filesize
544KB

Download
memory/1440-184-0x0000000002170000-0x000000000217C000-memory.dmp

Filesize
48KB

Download
memory/1440-135-0x000000013F5F0000-0x000000013F668000-memory.dmp

Filesize
480KB

Download
memory/1588-112-0x0000000000000000-mapping.dmp

Download
memory/1608-168-0x000007FEEDE60000-0x000007FEEE883000-memory.dmp

Filesize
10.1MB

Download
memory/1608-115-0x0000000000000000-mapping.dmp

Download
memory/1608-172-0x00000000026FB000-0x000000000271A000-memory.dmp

Filesize
124KB

Download
memory/1608-171-0x00000000026F4000-0x00000000026F7000-memory.dmp

Filesize
12KB

Download
memory/1608-165-0x0000000000000000-mapping.dmp

Download
memory/1608-169-0x000007FEED300000-0x000007FEEDE5D000-memory.dmp

Filesize
11.4MB

Download
memory/1608-170-0x00000000026F4000-0x00000000026F7000-memory.dmp

Filesize
12KB

Download
memory/1612-73-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

Filesize
3.0MB

Download
memory/1612-74-0x00000000023F4000-0x00000000023F7000-memory.dmp

Filesize
12KB

Download
memory/1612-56-0x0000000000000000-mapping.dmp

Download
memory/1612-65-0x000007FEED880000-0x000007FEEE3DD000-memory.dmp

Filesize
11.4MB

Download
memory/1612-67-0x00000000023F4000-0x00000000023F7000-memory.dmp

Filesize
12KB

Download
memory/1612-75-0x00000000023FB000-0x000000000241A000-memory.dmp

Filesize
124KB

Download
memory/1700-111-0x0000000000000000-mapping.dmp

Download
memory/1784-145-0x00000000026C4000-0x00000000026C7000-memory.dmp

Filesize
12KB

Download
memory/1784-143-0x000007FEEE890000-0x000007FEEF2B3000-memory.dmp

Filesize
10.1MB

Download
memory/1784-140-0x0000000000000000-mapping.dmp

Download
memory/1784-144-0x000007FEEDD30000-0x000007FEEE88D000-memory.dmp

Filesize
11.4MB

Download
memory/1784-146-0x00000000026CB000-0x00000000026EA000-memory.dmp

Filesize
124KB

Download
memory/1784-147-0x00000000026C4000-0x00000000026C7000-memory.dmp

Filesize
12KB

Download
memory/1784-148-0x00000000026CB000-0x00000000026EA000-memory.dmp

Filesize
124KB

Download
memory/1892-101-0x0000000002AA4000-0x0000000002AA7000-memory.dmp

Filesize
12KB

Download
memory/1892-100-0x000000001B7F0000-0x000000001BAEF000-memory.dmp

Filesize
3.0MB

Download
memory/1892-95-0x0000000000000000-mapping.dmp

Download
memory/1892-102-0x0000000002AAB000-0x0000000002ACA000-memory.dmp

Filesize
124KB

Download
memory/1892-99-0x000007FEEE760000-0x000007FEEF2BD000-memory.dmp

Filesize
11.4MB

Download
memory/1896-54-0x00000000012B0000-0x000000000133C000-memory.dmp

Filesize
560KB

Download
memory/1896-55-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/1924-137-0x00000000024BB000-0x00000000024DA000-memory.dmp

Filesize
124KB

Download
memory/1924-136-0x00000000024B4000-0x00000000024B7000-memory.dmp

Filesize
12KB

Download
memory/1924-123-0x00000000024B4000-0x00000000024B7000-memory.dmp

Filesize
12KB

Download
memory/1924-121-0x000007FEEC670000-0x000007FEED1CD000-memory.dmp

Filesize
11.4MB

Download
memory/1924-116-0x0000000000000000-mapping.dmp

Download
memory/1924-124-0x00000000024BB000-0x00000000024DA000-memory.dmp

Filesize
124KB

Download
memory/1944-139-0x0000000000000000-mapping.dmp

Download
memory/2000-108-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/2000-103-0x0000000000000000-mapping.dmp

Download
memory/2000-107-0x000007FEED880000-0x000007FEEE3DD000-memory.dmp

Filesize
11.4MB

Download
memory/2000-109-0x00000000029AB000-0x00000000029CA000-memory.dmp

Filesize
124KB

Download
memory/2028-88-0x0000000000000000-mapping.dmp

Download
memory/2028-94-0x00000000025DB000-0x00000000025FA000-memory.dmp

Filesize
124KB

Download
memory/2028-93-0x00000000025D4000-0x00000000025D7000-memory.dmp

Filesize
12KB

Download
memory/2028-92-0x000007FEED880000-0x000007FEEE3DD000-memory.dmp

Filesize
11.4MB

Download