lumma | 55626f87358dc713199e31869307ffcc9e38a08d7f204b5feb0181f17ea47519

Analysis

max time kernel
579s
max time network
448s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RainwaySetup.exe
Size 77.5MB
Sample240319-12pgdsha44
SHA256 55626f87358dc713199e31869307ffcc9e38a08d7f204b5feb0181f17ea47519
MD5 119252b2492fe260ae6e86288f47681e
SHA1 86e99df45c60c14debedf2fe8aa5ae3c58fdcba8
SHA512 bad80ea00dc0a198e0399b15ccc7f4d10c3bfe1fdd2d6f63a8281e4af9d7524a2556a5f467b033c659717b8821a8cb03194a362ab9ea7a08484126c63ffd160f
SSDEEP 1572864:j1rENW7sV/fd5W6hUQz6aNM02KbWuwxNtv8uXQK9JU+HZNpkSeqS5VexR:jpEesV/G6hUQzHPgxNtv8EJUavkSRR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma purelogstealer discovery persistence stealer

Malware Config

Extracted

Family

lumma

https://colorfulequalugliess.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023350-5657.dat	family_purelog_stealer

Executes dropped EXE 6 IoCs

pid	Process
5092	FeelingEyestrain-Launcher.exe
3160	javaw.exe
5004	chooseadvancepro.exe
1252	chooseadvance.exe
2496	chooseadvance.exe
4892	choosieadvanceress.exe

Loads dropped DLL 15 IoCs

pid	Process
2808	RainwaySetup.exe
2808	RainwaySetup.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe
3160	javaw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	chooseadvancepro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1252 set thread context of 2496	1252	chooseadvance.exe	146

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3936	2496	WerFault.exe	146

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2256	powershell.exe
2256	powershell.exe
2256	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1700	SearchApp.exe
Token: SeRestorePrivilege	1700	SearchApp.exe
Token: SeTakeOwnershipPrivilege	1700	SearchApp.exe
Token: SeRestorePrivilege	1700	SearchApp.exe
Token: SeTakeOwnershipPrivilege	1700	SearchApp.exe
Token: SeRestorePrivilege	1700	SearchApp.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	1252	chooseadvance.exe
Token: SeDebugPrivilege	4892	choosieadvanceress.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1700	SearchApp.exe
3160	javaw.exe
3160	javaw.exe
4108	SearchApp.exe
1700	SearchApp.exe
1184	SearchApp.exe
1088	SearchApp.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 5092	2808	RainwaySetup.exe	95
PID 2808 wrote to memory of 5092	2808	RainwaySetup.exe	95
PID 2808 wrote to memory of 5092	2808	RainwaySetup.exe	95
PID 5092 wrote to memory of 3160	5092	FeelingEyestrain-Launcher.exe	96
PID 5092 wrote to memory of 3160	5092	FeelingEyestrain-Launcher.exe	96
PID 5092 wrote to memory of 3160	5092	FeelingEyestrain-Launcher.exe	96
PID 1700 wrote to memory of 4436	1700	SearchApp.exe	109
PID 1700 wrote to memory of 4436	1700	SearchApp.exe	109
PID 1700 wrote to memory of 4436	1700	SearchApp.exe	109
PID 3160 wrote to memory of 5080	3160	javaw.exe	113
PID 3160 wrote to memory of 5080	3160	javaw.exe	113
PID 3160 wrote to memory of 5080	3160	javaw.exe	113
PID 5080 wrote to memory of 2256	5080	cmd.exe	116
PID 5080 wrote to memory of 2256	5080	cmd.exe	116
PID 5080 wrote to memory of 2256	5080	cmd.exe	116
PID 3160 wrote to memory of 3296	3160	javaw.exe	134
PID 3160 wrote to memory of 3296	3160	javaw.exe	134
PID 3160 wrote to memory of 3296	3160	javaw.exe	134
PID 1540 wrote to memory of 5004	1540	explorer.exe	136
PID 1540 wrote to memory of 5004	1540	explorer.exe	136
PID 5004 wrote to memory of 1252	5004	chooseadvancepro.exe	138
PID 5004 wrote to memory of 1252	5004	chooseadvancepro.exe	138
PID 5004 wrote to memory of 1252	5004	chooseadvancepro.exe	138
PID 1252 wrote to memory of 2496	1252	chooseadvance.exe	146
PID 1252 wrote to memory of 2496	1252	chooseadvance.exe	146
PID 1252 wrote to memory of 2496	1252	chooseadvance.exe	146
PID 1252 wrote to memory of 2496	1252	chooseadvance.exe	146
PID 1252 wrote to memory of 2496	1252	chooseadvance.exe	146
PID 1252 wrote to memory of 2496	1252	chooseadvance.exe	146
PID 1252 wrote to memory of 2496	1252	chooseadvance.exe	146
PID 1252 wrote to memory of 2496	1252	chooseadvance.exe	146
PID 1252 wrote to memory of 2496	1252	chooseadvance.exe	146
PID 5004 wrote to memory of 4892	5004	chooseadvancepro.exe	147
PID 5004 wrote to memory of 4892	5004	chooseadvancepro.exe	147
PID 5004 wrote to memory of 4892	5004	chooseadvancepro.exe	147

C:\Users\Admin\AppData\Local\Temp\RainwaySetup.exe
"C:\Users\Admin\AppData\Local\Temp\RainwaySetup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\FeelingEyestrain-Launcher.exe
  C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\FeelingEyestrain-Launcher.exe /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\javaw.exe
    "C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\FeelingEyestrain-Launcher.exe" org.develnext.jphp.ext.javafx.FXLauncher /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\f76cd6660bd3a3ca526277598b12f004.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
  - - C:\Windows\SysWOW64\explorer.exe
      explorer C:\Users\Admin\AppData\Local\Temp\chooseadvancepro\chooseadvancepro.exe
      4⤵
      PID:3296

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1700 -s 3596
  2⤵
  PID:4436

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4108

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1184

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1088

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3612

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\chooseadvancepro\chooseadvancepro.exe
  "C:\Users\Admin\AppData\Local\Temp\chooseadvancepro\chooseadvancepro.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chooseadvance.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chooseadvance.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chooseadvance.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chooseadvance.exe
      4⤵
      Executes dropped EXE
      PID:2496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1096
        5⤵
        Program crash
        
        PID:3936
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\choosieadvanceress.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\choosieadvanceress.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2496 -ip 2496
1⤵
PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft_Office_SETLANG_EXE_15

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
Size 36KB
SHA256 0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36
MD5 0e2a09c8b94747fa78ec836b5711c0c0
SHA1 92495421ad887f27f53784c470884802797025ad
SHA512 61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409
SSDEEP 768:XmmmmmmmmmmmmmmmmmmmmmmViU6PZmc4sax+ksfEY4q55ZYVfhykWSsk6pa7fD9j:uCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_Windows_ControlPanel

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
Size 36KB
SHA256 1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170
MD5 fb5f8866e1f4c9c1c7f4d377934ff4b2
SHA1 d0a329e387fb7bcba205364938417a67dbb4118a
SHA512 0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c
SSDEEP 384:szMgXGKheIII8SVFBSQ8xFLlSLQU7lbdozJbQt1A+svJC3X:BIII5zb7larNvJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

microsoft.windows[1].xml

Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\SL9YLD9N\microsoft.windows[1].xml
Size 97B
SHA256 11904522eefd80ce753b37f72e745a251ea2a9bd65cbccbc8993944280db3426
MD5 bb7934efe1e99dde2a4be53178ce8fd7
SHA1 49e6b2f364b597c34832d1878259d5eb671f21a4
SHA512 23ae797546cd1b9884c23e593c371e99ec872b54d5f0856729137ad78507e6e120de7bc75aa7dd7c7556217a628bcf8824175ea0982d6c3236cd22b15455c1d6
MD5 SHA1 SHA512

Submit Download

FeelingEyestrain-Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\FeelingEyestrain-Launcher.exe
Size 2.0MB
SHA256 98d74a9df257127868975c6fb5b4eda3800e1dde83aee882b5914213107c853b
MD5 d051fd01c371f4a28ae3bb2aea6e364c
SHA1 5a24a664b6315d051a77c87b27560f8513267cf3
SHA512 80d91e678a66f527d1cad9a3f2eca430782e70a72c912b862b3e66c9c7da21c75e9d502a7e8b2a66963e4bb882defc690df59b5fad9b4711e3849f4de741b1ae
SSDEEP 49152:Qmw+AC50Ew1EeQMFKRTPokBMyHJWGs8FaRr:Qmwk0EwQMyTBrHJWGs5
MD5 SHA1 SHA512 SSDEEP

Submit Download

FeelingEyestrain-Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\FeelingEyestrain-Launcher.exe
Size 1.2MB
SHA256 43438fb0ea51eb6d5eccaa57092794b262f5faada4961b9d3faea28cc6d2d332
MD5 dad0575949f9a4443bfac58ec81f022c
SHA1 5fdea1a758e373997aa88a2ba3822ba5c93a7b1b
SHA512 f5c5938fd19ac65dc9b2ded127d19dead78676596efad6b2ba71d60b014d57cb96f323dd6b79f7509d4d921aebf7c543fe0dc55ec265aa566a028171205b6748
SSDEEP 24576:1AirgRgwQ2LmACxz70Ew1Ec7FrFQHNx+xvPFH:Qmw+AC50Ew1EeQMFH
MD5 SHA1 SHA512 SSDEEP

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\awt.dll
Size 148KB
SHA256 6f482c2e3e38039dcafe5c0dc0e9b87d0efac0e05d43e7f6bd0764a8c4301bbc
MD5 1a4e82d82e487ccd692987ad3304d26b
SHA1 e0b7093478368a7321315cf34c25bcdb9c484e43
SHA512 3808df0b9ae20ee435eb5188f08c9e648e177df3b89b75c76c3cb6e511f51c8f09d8d6b57072b36f03348d19668832c2f9f454950211676f4b3cd74b7708b1a5
SSDEEP 3072:6VnQx1m8k4ayfSkDyWB/aeGU1CcpJ7oDsZDHaB3A+bgO5QbjUB+zduVa:6V+Fa4yM/aJc/oDsZDHaBMALVa
MD5 SHA1 SHA512 SSDEEP

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\awt.dll
Size 153KB
SHA256 a581f0603b63fe25bcbd421da18e796e007316beaad930b7463b78491222110c
MD5 4d39107617cb6c98a2f3093a9ba13936
SHA1 531e81b50e289ce2dfff31cef10b37c353cf7681
SHA512 b042aa1560723e9c42e63f5f697a18670ea890280fb16da810bf2ac9e79f1ec6c80b7269c83657558fa7075b4f0a4061ff05074d51b8209ca79b55bf97006587
SSDEEP 3072:6VnQx1m8k4ayfSkDyWB/aeGU1CcpJ7oDsZDHaB3A+bgO5QbjUB+zduVA:6V+Fa4yM/aJc/oDsZDHaBMALVA
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\client\jvm.dll
Size 1024KB
SHA256 dbd6af4e17651e00fa04853891a42c4a6031c678ea421abecb222e5ae6bc86b3
MD5 1aefeede3b2a1f2427c38f1aaa0e8169
SHA1 3fd9b03230de92510f33d0fde6f6147ee4579fa7
SHA512 f3e4a0c2cd4de097c5ae23ffc9869c4fce32a8f1fb12c82a894e91778e230ecd01ecceba3d18f88cc2e1bf6987e11aaf49734bfcd9074a48fd7be82772b32b17
SSDEEP 24576:GmHNCIyeTrrUGduN/1WpmQqiSCyT2wXH3n8kKVS6cJtML7R8kR:GufcGdul1AF4KVS6ceWO
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\client\jvm.dll
Size 507KB
SHA256 b6c5732563d0678debaa50db7329d4b84d58e0217381d58620b5e32719453a9f
MD5 526bfe6b37fc1eefc23a12d71012e26e
SHA1 6bff34f6f6a289b5d87a82dd4348e0e250868ccd
SHA512 d39df43b4dad4ac92d9524f9550441e59a59690a19f225726b456474715529df5c695885d765c5d371df2d1afd3f45aaea98900a7600b4de4c0391902cde3610
SSDEEP 12288:kcsEfRs1ontjHNCIymj/Cj6rNPhU/eK+VoNExL3wR:GmHNCIyeTrrUGduN/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

glass.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\glass.dll
Size 196KB
SHA256 1edd9022c10c27bbba2ad843310458edaead37a9767c6fc8fddaaf1adfcbc143
MD5 434cbb561d7f326bbeffa2271ecc1446
SHA1 3d9639f6da2bc8ac5a536c150474b659d0177207
SHA512 9e37b985ecf0b2fef262f183c1cd26d437c8c7be97aa4ec4cd8c75c044336cc69a56a4614ea6d33dc252fe0da8e1bbadc193ff61b87be5dce6610525f321b6dc
SSDEEP 3072:lC0MaRHVsSduCCkNlKpR1FHNnuNcCwJPT54l2B3Fzkmldrz5ZD9hYJOj9T3iRK:s0XR1sYtxgGl2B3uWjhYJOj9TSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\java.dll
Size 123KB
SHA256 e7b870deb08bc864fa7fd4dec67cef15896fe802fafb3009e1b7724625d7da30
MD5 73bd0b62b158c5a8d0ce92064600620d
SHA1 63c74250c17f75fe6356b649c484ad5936c3e871
SHA512 eba1cf977365446b35740471882c5209773a313de653404a8d603245417d32a4e9f23e3b6cd85721143d2f9a0e46ed330c3d8ba8c24aee390d137f9b5cd68d8f
SSDEEP 3072:Kw2b3Kr+uWU9XzFhziJ1TBZAhsIn/B9NZwMgjeNXLD:43KFFheLCBpV/
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafx_font.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\javafx_font.dll
Size 56KB
SHA256 f8f0b1e283fd94bd87abca162e41afb36da219386b87b0f6a7e880e99073bda3
MD5 aeada06201bb8f5416d5f934aaa29c87
SHA1 35bb59febe946fb869e5da6500ab3c32985d3930
SHA512 89bad9d1115d030b98e49469275872fff52d8e394fe3f240282696cf31bccf0b87ff5a0e9a697a05befcfe9b24772d65ed73c5dbd168eed111700caad5808a78
SSDEEP 1536:f6arRmcnq2lxm+Na6C7HIT6T8E2pLSSm3:fzm+q7HITS8E2pLSSA
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\javaw.exe
Size 187KB
SHA256 a96d26428942065411b1b32811afd4c5557c21f1d9430f3696aa2ba4c4ac5f22
MD5 48c96771106dbdd5d42bba3772e4b414
SHA1 e84749b99eb491e40a62ed2e92e4d7a790d09273
SHA512 9f891c787eb8ceed30a4e16d8e54208fa9b19f72eeec55b9f12d30dc8b63e5a798a16b1ccc8cea3e986191822c4d37aedb556e534d2eb24e4a02259555d56a2c
SSDEEP 3072:lScg0xvhTZNIs3Ft+STckCBQo3C0Y22vncTBfsO9jZqMN3cH1Tefqk:lSclI6nTc3BQo3C0YHncTBxvs65
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp120.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\msvcp120.dll
Size 444KB
SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
MD5 fd5cabbe52272bd76007b68186ebaf00
SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\msvcr100.dll
Size 608KB
SHA256 535089077bb6f30f4e8748fcd3862563b400729c878e9ba9888c3f1b43a0580d
MD5 f893f4651db9b77a17d97fbf303fa6b3
SHA1 5199221b55f75b860e225780382c3ec50f10d2a4
SHA512 02df77ce050e3846a1f8cfc1717170c732afeafa3816dac03bff8b5b8ae19e8a8d59944ddc4fccd9647afbc8ef4552bf9f5ec4531ad8bcdfad8e1af6f1cd2ee6
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYu:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\msvcr100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr120.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\msvcr120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\net.dll
Size 78KB
SHA256 2f5f1199d277850a009458edb5202688c26dd993f68fe86ca1b946dc74a36d61
MD5 691b937a898271ee2cffab20518b310b
SHA1 abedfcd32c3022326bc593ab392dea433fcf667c
SHA512 1c09f4e35a75b336170f64b5c7254a51461dc1997b5862b62208063c6cf84a7cb2d66a67e947cbbf27e1cf34ccd68ba4e91c71c236104070ef3beb85570213ec
SSDEEP 1536:ygRdVzzmTj2iu+wk5eQjBE55W+hYRwZZ3GFjJJ5n5WF:yIfmHsM5j6VqJJ55WF
MD5 SHA1 SHA512 SSDEEP

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\nio.dll
Size 50KB
SHA256 96cf590bddfd90086476e012d9f48a9a696efc054852ef626b43d6d62e72af31
MD5 95edb3cb2e2333c146a4dd489ce67cbd
SHA1 79013586a6e65e2e1f80e5caf9e2aa15b7363f9a
SHA512 ab671f1bce915d748ee49518cc2a666a2715b329cab4ab8f6b9a975c99c146bb095f7a4284cd2aaf4a5b4fcf4f939f54853af3b3acc4205f89ed2ba8a33bb553
SSDEEP 768:a+BEJER/xSW/EoB8VBQZbKYawLysHFhIAqQbQMD8YpwQ+Qi4v8qUYVC7R:a+BEJERvQGbKnwusjIAq08YDi4UqUYoR
MD5 SHA1 SHA512 SSDEEP

Submit Download

prism_d3d.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\prism_d3d.dll
Size 113KB
SHA256 89dac9792c884b70055566564aa12a8626c3aa127a89303730e66aba3c045f79
MD5 5aadadf700c7771f208dda7ce60de120
SHA1 e9cf7e7d1790dc63a58106c416944fd6717363a5
SHA512 624431a908c2a835f980391a869623ee1fa1f5a1a41f3ee08040e6395b8c11734f76fe401c4b9415f2055e46f60a7f9f2ac0a674604e5743ab8301dbadf279f2
SSDEEP 3072:UbqmeUF67oaebwU3ta+uHMg9glgFvcfgfgzgG4g9XTXDXp+RuXGXlXdY9vXTXvXQ:8qmeUF67ZeUUVjcIA
MD5 SHA1 SHA512 SSDEEP

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\verify.dll
Size 38KB
SHA256 fd856ea783ad60215ce2f920fcb6bb4e416562d3c037c06d047f1ec103cd10b3
MD5 de2167a880207bbf7464bcd1f8bc8657
SHA1 0ff7a5ea29c0364a1162a090dffc13d29bc3d3c7
SHA512 bb83377c5cff6117cec6fbadf6d40989ce1ee3f37e4ceba17562a59ea903d8962091146e2aa5cc44cfdddf280da7928001eea98abf0c0942d69819b2433f1322
SSDEEP 768:Okt1MVMrA9/Klzwz9UyCgMUt9onPs3h3nVt83OndMY7dmMpAnC70N:Oo1oMQ/CrPa3VWO+gdmMW6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\bin\zip.dll
Size 68KB
SHA256 68148243e3a03a3a1aaf4637f054993cb174c04f6bd77894fe84d74af5833bec
MD5 cb99b83bbc19cd0e1c2ec6031d0a80bc
SHA1 927e1e24fd19f9ca8b5191ef3cc746b74ab68bcd
SHA512 29c4978fa56f15025355ce26a52bdf8197b8d8073a441425df3dfc93c7d80d36755cc05b6485dd2e1f168df2941315f883960b81368e742c4ea8e69dd82fa2ba
SSDEEP 1536:ZCghp1EJqcGdjandlraksIOwIOpVnToIft4tpgO6:/142jUhimp9TBft4tqO6
MD5 SHA1 SHA512 SSDEEP

Submit Download

accessibility.properties

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\accessibility.properties
Size 155B
SHA256 a46372b05ce9f40f5d5a775c90d7aa60687cd91aaa7374c499f0221229bf344e
MD5 9e5e954bc0e625a69a0a430e80dcf724
SHA1 c29c1f37a2148b50a343db1a4aa9eb0512f80749
SHA512 18a8277a872fb9e070a1980eee3ddd096ed0bba755db9b57409983c1d5a860e9cbd3b67e66ff47852fe12324b84d4984e2f13859f65fabe2ff175725898f1b67
MD5 SHA1 SHA512

Submit Download

currency.data

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\currency.data
Size 4KB
SHA256 22458853da2415f7775652a7f57bb6665f83a9ae9fb8bd3cf05e29aac24c8441
MD5 f6258230b51220609a60aa6ba70d68f3
SHA1 b5b95dd1ddcd3a433db14976e3b7f92664043536
SHA512 b2dfcfdebf9596f2bb05f021a24335f1eb2a094dca02b2d7dd1b7c871d5eecda7d50da7943b9f85edb5e92d9be6b6adfd24673ce816df3960e4d68c7f894563f
SSDEEP 48:BlWxFFGFSupi94blATFxjGph5vLC6/w37ZXQTbVm/eVzOBJ:BlWJEi94blAT+ph5vLkApmGqr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jfxrt.jar

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\ext\jfxrt.jar
Size 1024KB
SHA256 b8970b2dbc6e4f51d18a9c7b623e459d07256ffbb80d8130555669bb06216af5
MD5 12f489e248cc24b1a32473dd8745eb0a
SHA1 7bf664b4a4c1c533fd3951677dd2a070f2c79f99
SHA512 ca526b044346b98a2dd79a49c073de85f014912b1db253fb4c1c020b8c70b75bd7f04f7ab7ef10bf1f66818d25919d8bbc06a72340f4b53da95bd7b39322d8a1
SSDEEP 12288:C5gsYc9uZpacmZd0BNZYS/DPzifkOziXWBQwcfAbwiuJ:C5KJ0KjJxNiuJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

meta-index

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\ext\meta-index
Size 1KB
SHA256 c557f0c9053301703798e01dc0f65e290b0ae69075fb49fcc0e68c14b21d87f4
MD5 77abe2551c7a5931b70f78962ac5a3c7
SHA1 a8bb53a505d7002def70c7a8788b9a2ea8a1d7bc
SHA512 9fe671380335804d4416e26c1e00cded200687db484f770ebbdb8631a9c769f0a449c661cb38f49c41463e822beb5248e69fd63562c3d8c508154c5d64421935
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\i386\jvm.cfg
Size 657B
SHA256 a73aea3074360cf62adedc0c82bc9c0c36c6a777c70da6c544d0fba7b2d8529e
MD5 9fd47c1a487b79a12e90e7506469477b
SHA1 7814df0ff2ea1827c75dcd73844ca7f025998cc6
SHA512 97b9d4c68ac4b534f86efa9af947763ee61aee6086581d96cbf7b3dbd6fd5d9db4b4d16772dce6f347b44085cef8a6ea3bfd3b84fbd9d4ef763cef39255fbce3
MD5 SHA1 SHA512

Submit Download

jsse.jar

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\jsse.jar
Size 619KB
SHA256 bc3a736e08e68ace28c68b0621dccfb76c1063bd28d7bd8fce7b20e7b7526cc5
MD5 fd1434c81219c385f30b07e33cef9f30
SHA1 0b5ee897864c8605ef69f66dfe1e15729cfcbc59
SHA512 9a778a3843744f1fabad960aa22880d37c30b1cab29e123170d853c9469dc54a81e81a9070e1de1bf63ba527c332bb2b1f1d872907f3bdce33a6898a02fef22d
SSDEEP 6144:ABoQeW0HKwYGORU+ehqEmke1WEAibVR0GPs4j8GgflXhuuMAjYDTj:Uo40WGdNmpb3DP75
MD5 SHA1 SHA512 SSDEEP

Submit Download

meta-index

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\meta-index
Size 2KB
SHA256 4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4
MD5 91aa6ea7320140f30379f758d626e59d
SHA1 3be2febe28723b1033ccdaa110eaf59bbd6d1f96
SHA512 03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb
MD5 SHA1 SHA512

Submit Download

net.properties

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\net.properties
Size 3KB
SHA256 5baf75bdd504b2c80ff5b98f929a16b04e9cb06aa8aae30c144b5b40febe0906
MD5 1cbb261944925044b1ee119dc0563d05
SHA1 05f2f63047f4d82f37dfa59153309e53caa4675c
SHA512 c964a92be25bacf11d20b61365930cab28517d164d9ae4997651e2b715aa65628e45fa4bd236ccd507c65e5d85a470fd165f207f446186d22ae4bd46a04006e6
MD5 SHA1 SHA512

Submit Download

resources.jar

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\resources.jar
Size 2.3MB
SHA256 edfb5e09f9f01fc82d8b68c054855de0e751081bdb51546234fc7b56147b5ad9
MD5 57d108514d8f0e95f913666310fbc218
SHA1 e0be7be5c610b13269c4843b510f3e132c70571d
SHA512 c62fbdc23741ec663ee3db69712e70198ca097689938b15fc069ca10e38f619331a09c2c00ba0901de3794e9f5f12e1a03ca2cc7c150bfd33b8fcd394fe3b3a4
SSDEEP 49152:WX4zfeUcKDQ1toKXiO3fLxqhH3YRazQwIK7XgnyRMvMtMm55HopLKbtJzUkMkOBA:L
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt.jar

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\rt.jar
Size 192KB
SHA256 bfca9c8b4cc5096001dec24f232630aa3ece120c765e2add16040cf5b108b38b
MD5 d7d9ec2f982dbf839fcb0d3aa93a40b1
SHA1 7c6b7ec09a0e3920dc1c764fa50c4a6de9985f79
SHA512 ee8878c9888c959f204432c2ca909f7d2fbeb1515a5c9f7f2389bc2d4d459078bf7f514e5f9e0b6900774744f3ef03d738dff618230ec2bba08e08e15995287e
SSDEEP 3072:eFLonKmzKCAUdzc7+DoyA8Gc8d0C8bTda/5KNEZqkyB61qiHpe8Tl6FctzMjgLeU:y3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\security\java.security
Size 26KB
SHA256 4d9e5a12b8cac8b36ecd88468b1c4018bc83c97eb467141901f90358d146a583
MD5 409c132fe4ea4abe9e5eb5a48a385b61
SHA1 446d68298be43eb657934552d656fa9ae240f2a2
SHA512 7fed286ac9aed03e2dae24c3864edbbf812b65965c7173cc56ce622179eb5f872f77116275e96e1d52d1c58d3cdebe4e82b540b968e95d5da656aa74ad17400d
SSDEEP 768:rmLHAEcqrlANbwbqL1AdLAHaPw2kqUTWip+fzIz:rWQaYFqUTWip0kz
MD5 SHA1 SHA512 SSDEEP

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\tzdb.dat
Size 101KB
SHA256 a636afa5edba8aa0944836793537d9c5b5ca0091ccc3741fc0823edae8697c9d
MD5 5a7f416bd764e4a0c2deb976b1d04b7b
SHA1 e12754541a58d7687deda517cdda14b897ff4400
SHA512 3ab2ad86832b98f8e5e1ce1c1b3ffefa3c3d00b592eb1858e4a10fff88d1a74da81ad24c7ec82615c398192f976a1c15358fce9451aa0af9e65fb566731d6d8f
SSDEEP 1536:OcQWmFKJzLl2g6kpE7tdTMBB/////t97Taz69rU4y/uqmol7s2gK:Oyh3F27/qGzkrfy/uqllQ2gK
MD5 SHA1 SHA512 SSDEEP

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\Temp\FeelingEyestrain-Launcher\u571\lib\tzmappings
Size 8KB
SHA256 3d49b3f2761c70f15057da48abe35a59b43d91fa4922be137c0022851b1ca272
MD5 b8dd8953b143685b5e91abeb13ff24f0
SHA1 b5ceb39061fce39bb9d7a0176049a6e2600c419c
SHA512 c9cd0eb1ba203c170f8196cbab1aaa067bcc86f2e52d0baf979aad370edf9f773e19f430777a5a1c66efe1ec3046f9bc82165acce3e3d1b8ae5879bd92f09c90
SSDEEP 192:j1kfcymkDvxeMmKg5GQEK2TtllXinSV29OHPQT:hhymk/QGT7YT
MD5 SHA1 SHA512 SSDEEP

Submit Download

chooseadvance.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chooseadvance.exe
Size 224KB
SHA256 b9d44e9fea3d4f6d95265949ba4fc23d368a2b5c2f3c0ad5e8babc10b78fdc90
MD5 ef179308e6fe08a6430733e554248d8e
SHA1 24cdb95373194737b76e4adf0ab1bbb0d127cd79
SHA512 8a77d1309f22da66fe0e395d3093e98b993ca6772a8e486c4e375654effa0ac25292036d923b446a208ed1d588c743060e4e0f83168fe52298cc9f19f1648848
SSDEEP 3072:phul3VUfW6e4Sf22v5ln09olEsLtt7ybBqRpa4vDfgvQjQZCAr6nSaN5NJIJz:el3V76ef12HsLP7MWbgojQZCAeSq54z
MD5 SHA1 SHA512 SSDEEP

Submit Download

chooseadvance.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chooseadvance.exe
Size 5.8MB
SHA256 f81fea7f5550d3dbf5cb6d28c92b982379ca695e8ae41034e482d6666f5f558d
MD5 ab9e21f29c49e2ec9f76d5c9218d5e3c
SHA1 2bf0caa132ae402d4ec126d356b65bf8d0366796
SHA512 112f09acc064508f4c4ba57228235364353627b83d6929bd1346d9d54448154a45bc34c92a650c79ee1ce789f96bf04912d0e65023e0f30c9a3cd6094ba5748b
SSDEEP 98304:wYKFxgEJMQvmdhQMS/EFMI5pIB11OZR8XRMoLNu2tmVda4uSF+EoB9tf3Kr:DQqe2uOZRiMcNltmCrSFkhvKr
MD5 SHA1 SHA512 SSDEEP

Submit Download

choosieadvanceress.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\choosieadvanceress.exe
Size 2.7MB
SHA256 0e42afa4a92d84417171db2ded81c005110400c333e03399e80ac1ccfd1990f3
MD5 7d217a21635e862835187ff4e26b326f
SHA1 d7d17b7d1901c5b7c43aa67aed8515517fd03d14
SHA512 7387036ff3ca4c3d7ece24b57b18526b6e20f42652ca4be61360275c18852f0e67b31a246e97f166020f475e581152cbc480484730e8ff55bc7bc29a3cb38acb
SSDEEP 49152:TECUawuW2LpD8jtdKLH/5oK+dP5x6S/3c5hc7FXnCyFMxD3E6nyMUjxkX1qEiwl:dUr321UtoLf5ojRMS/sLInCyFqg6Ejxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_uytm1vtd.nyv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uytm1vtd.nyv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

chooseadvancepro.exe

Path C:\Users\Admin\AppData\Local\Temp\chooseadvancepro\chooseadvancepro.exe
Size 8.2MB
SHA256 7bf8e6e91f29924927683e6e6de36eeac6046a42a7ea64c083bbfcc227b4772e
MD5 9ef73b2433c0dab227be2a7baee56dfd
SHA1 81927dda879b521de700541a0ef3746faf8b481e
SHA512 ad3a5d8ac8cba77b5f3765af50ac5aa4ba79e42d57cafa366575dff160a784e07a01d83a793c2d09c42786b774d4d25bef63408b0a053bc0599c09ca1d7ac708
SSDEEP 196608:CTN6FpTXmAZY32t09jlfEiO0raLNRtNh9HSQ4QXR6qrWjrYnf:qN6FdhYblfHONxN8qr6Af
MD5 SHA1 SHA512 SSDEEP

Submit Download

f76cd6660bd3a3ca526277598b12f004.bat

Path C:\Users\Admin\AppData\Local\Temp\f76cd6660bd3a3ca526277598b12f004.bat
Size 144B
SHA256 27291f25d8c4c13bcc25f0267ab7c5a369fe6bd752da89f1751ed6b3f614de81
MD5 2cb6fa89d02caea13770b09371923222
SHA1 7c3510c55537601bfc3b12361a170057f4736e99
SHA512 8060273a0fc363cc9e2ec9edd56cebe66d381c9fcb2c62c4f25594e0ab7cb9ab9a50cf13e96a682ba9b8753ee276a04346ed43621a9d23aed92837acc13eba7c
MD5 SHA1 SHA512

Submit Download

NAct.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnB4BA.tmp\NAct.dll
Size 206KB
SHA256 cc8ffcf1fe479ae58b2152327fd26d15bb8967e0715a069aa43c2cca827ad6b2
MD5 4c104df125d519b33f9e1a95d6a8ba8a
SHA1 65602e3c6d8caa92137f4c30b35abe53612e9aa7
SHA512 4c0cec10f540f48318f4022b180af3280d1335e191d5a65a6e21699927b069f2241e7860fc4a37f53207ba4332048773e5276556e207ccd153923c3e861ea57a
SSDEEP 3072:YfZnhZnKQ8GhYLpx6psBoac5/pvla1QQC2mCOSvWOOCaQOPBjJ7YQueuVWCjost:GJhZ/8GhYupsBfc5/LaY4WpxQOUhUs
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnB4BA.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2256-514-0x0000000004EC0000-0x00000000054E8000-memory.dmp

Download

memory/2256-527-0x0000000005970000-0x0000000005CC4000-memory.dmp

Download

memory/2256-513-0x0000000000EC0000-0x0000000000EF6000-memory.dmp

Download

memory/2256-534-0x0000000000E60000-0x0000000000E70000-memory.dmp

Download

memory/2256-515-0x0000000004E30000-0x0000000004E52000-memory.dmp

Download

memory/2256-532-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

Download

memory/2256-533-0x0000000000E60000-0x0000000000E70000-memory.dmp

Download

memory/2256-531-0x0000000004B20000-0x0000000004B3E000-memory.dmp

Download

memory/2256-516-0x0000000005720000-0x0000000005786000-memory.dmp

Download

memory/2256-522-0x0000000005800000-0x0000000005866000-memory.dmp

Download

memory/3160-385-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-482-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-378-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-379-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3160-371-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-387-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-388-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-389-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-390-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-391-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-392-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-393-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-394-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-366-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3160-367-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-397-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-398-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-400-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-401-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-365-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3160-412-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-414-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-420-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-430-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-433-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-434-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-435-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-437-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-459-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-466-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-474-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-380-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3160-488-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-496-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-498-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-499-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-508-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-506-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-512-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-360-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-510-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-509-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-354-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-350-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3160-349-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-338-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-330-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-322-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-314-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-528-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-529-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-530-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-313-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3160-312-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3160-305-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-295-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-286-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-284-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3160-279-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-270-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-265-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3160-257-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/3160-242-0x0000000002620000-0x0000000004620000-memory.dmp

Download

memory/5092-218-0x0000000000400000-0x000000000041B000-memory.dmp

Download