amadey | ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3

Resubmissions

26-03-2024 19:10

240326-xvpl2acg8y 10

26-03-2024 18:55

240326-xkxvnace4s 10

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
26-03-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
Size

1.8MB
MD5

644930f420117e3d11ac8391a9de30d5
SHA1

8ceea30914eb12ded4e9a3e6fb71723ff041ef58
SHA256

ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3
SHA512

92dea7b748d373fc5571e19ea5018ac55fae990e755c9d4c45aa7a2209b62cd8b995564dad2708a4e5725a59e2fc936f9b45a60467e731c3ecf14b794816a1bd
SSDEEP

49152:N1WEzgWZv1PIbxfn7ealgtg8SWp2mjjf8zFmOP0KRS:Nx3p1Qf7eRt1SWl0zwOMKY

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://193.233.132.167

Attributes

install_dir
4d0ab15804
install_file
chrosha.exe
strings_key
1a9519d7b465e1f4880fa09a6162d768
url_paths
/enigma/index.php

rc4.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://sajdfue.com/test1/get.php

Attributes

extension
.vook
offline_id
1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1
payload_url
http://sdfjhuz.com/dl/build2.exe

http://sajdfue.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detected Djvu ransomware 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4200-420-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4200-422-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4200-418-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4200-499-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/8-508-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/8-510-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/8-512-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5104-504-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral2/memory/2896-506-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba
behavioral2/memory/3540-528-0x0000000000400000-0x0000000000ED8000-memory.dmp	family_glupteba

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exeexplorha.exeexplorha.exe892deee70e.exeexplorha.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	892deee70e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

flow pid process

4 1544 rundll32.exe
5 1168 rundll32.exe
12 4904 rundll32.exe
14 3588 rundll32.exe
Downloads MZ/PE file

flow	pid	process
4	1544	rundll32.exe
5	1168	rundll32.exe
12	4904	rundll32.exe
14	3588	rundll32.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exeexplorha.exeexplorha.exe892deee70e.exeexplorha.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	892deee70e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	892deee70e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe

Executes dropped EXE 13 IoCs

Processes:

explorha.exeexplorha.exe892deee70e.exelumma21.exechrosha.exeexplorha.exeNewB.exelummalg.exetoolspub1.exeun300un.exe0OI65Y8EkFfkgb8mGOqidn4Z.exe8Sttm9K1J4NLATB6985prend.exeXlH93wUhcbE3TN2315ZWuM0g.exe

pid	process
2872	explorha.exe
4184	explorha.exe
3656	892deee70e.exe
3588	lumma21.exe
1372	chrosha.exe
540	explorha.exe
1012	NewB.exe
2372	lummalg.exe
3620	toolspub1.exe
2016	un300un.exe
4664	0OI65Y8EkFfkgb8mGOqidn4Z.exe
5104	8Sttm9K1J4NLATB6985prend.exe
2896	XlH93wUhcbE3TN2315ZWuM0g.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exeexplorha.exeexplorha.exe892deee70e.exeexplorha.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Wine	ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Wine	892deee70e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Wine	explorha.exe

Loads dropped DLL 6 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

1964 rundll32.exe
1544 rundll32.exe
1168 rundll32.exe
3388 rundll32.exe
4904 rundll32.exe
3588 rundll32.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1456 icacls.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1964	rundll32.exe
1544	rundll32.exe
1168	rundll32.exe
3388	rundll32.exe
4904	rundll32.exe
3588	rundll32.exe

pid	process
1456	icacls.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\u3lk.1.exe	upx
C:\Users\Admin\AppData\Local\Temp\u3lk.1.exe	upx
C:\Users\Admin\AppData\Local\Temp\u3lk.1.exe	upx
C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe	upx
C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe	upx
C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe	upx
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\vewp5ZalGolAJPos6lDUd40e.exe	upx
C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorha.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Microsoft\Windows\CurrentVersion\Run\892deee70e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000022001\\892deee70e.exe"	explorha.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 pastebin.com
16 pastebin.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 api.2ip.ua
43 api.2ip.ua
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exeexplorha.exeexplorha.exeexplorha.exe

pid process

2564 ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
2872 explorha.exe
4184 explorha.exe
540 explorha.exe

flow	ioc
3	pastebin.com
16	pastebin.com

flow	ioc
21	api.2ip.ua
43	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

Processes:

lummalg.exeun300un.exe

description	pid	process	target process
PID 2372 set thread context of 3352	2372	lummalg.exe	RegAsm.exe
PID 2016 set thread context of 2900	2016	un300un.exe	regasm.exe

Drops file in Windows directory 2 IoCs

Processes:

ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exelumma21.exe

description	ioc	process
File created	C:\Windows\Tasks\explorha.job	ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
File created	C:\Windows\Tasks\chrosha.job	lumma21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4728 8 WerFault.exe D6FE.exe
1540 4664 WerFault.exe 0OI65Y8EkFfkgb8mGOqidn4Z.exe

pid	pid_target	process	target process
4728	8	WerFault.exe	D6FE.exe
1540	4664	WerFault.exe	0OI65Y8EkFfkgb8mGOqidn4Z.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

toolspub1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3044 schtasks.exe

pid	process
3044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exeexplorha.exerundll32.exepowershell.exeexplorha.exeexplorha.exetoolspub1.exe

pid	process
2564	ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
2564	ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
2872	explorha.exe
2872	explorha.exe
1544	rundll32.exe
1544	rundll32.exe
1544	rundll32.exe
1544	rundll32.exe
1544	rundll32.exe
1544	rundll32.exe
1544	rundll32.exe
1544	rundll32.exe
1544	rundll32.exe
1544	rundll32.exe
5116	powershell.exe
4184	explorha.exe
4184	explorha.exe
5116	powershell.exe
540	explorha.exe
540	explorha.exe
3620	toolspub1.exe
3620	toolspub1.exe
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236
3236

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

toolspub1.exe

pid process

3620 toolspub1.exe

pid	process
3620	toolspub1.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exepowershell.exeregasm.exe

description	pid	process
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeShutdownPrivilege	3236
Token: SeCreatePagefilePrivilege	3236
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeShutdownPrivilege	3236
Token: SeCreatePagefilePrivilege	3236
Token: SeShutdownPrivilege	3236
Token: SeCreatePagefilePrivilege	3236
Token: SeShutdownPrivilege	3236
Token: SeCreatePagefilePrivilege	3236
Token: SeDebugPrivilege	2900	regasm.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exelumma21.exe

pid process

2564 ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
3588 lumma21.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3236

pid	process
3236

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exeexplorha.exerundll32.exerundll32.exechrosha.exeNewB.exelummalg.exerundll32.exerundll32.execmd.exeun300un.exe

description	pid	process	target process
PID 2564 wrote to memory of 2872	2564	ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe	explorha.exe
PID 2564 wrote to memory of 2872	2564	ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe	explorha.exe
PID 2564 wrote to memory of 2872	2564	ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe	explorha.exe
PID 2872 wrote to memory of 1964	2872	explorha.exe	rundll32.exe
PID 2872 wrote to memory of 1964	2872	explorha.exe	rundll32.exe
PID 2872 wrote to memory of 1964	2872	explorha.exe	rundll32.exe
PID 1964 wrote to memory of 1544	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1544	1964	rundll32.exe	rundll32.exe
PID 1544 wrote to memory of 4440	1544	rundll32.exe	netsh.exe
PID 1544 wrote to memory of 4440	1544	rundll32.exe	netsh.exe
PID 1544 wrote to memory of 5116	1544	rundll32.exe	powershell.exe
PID 1544 wrote to memory of 5116	1544	rundll32.exe	powershell.exe
PID 2872 wrote to memory of 1168	2872	explorha.exe	rundll32.exe
PID 2872 wrote to memory of 1168	2872	explorha.exe	rundll32.exe
PID 2872 wrote to memory of 1168	2872	explorha.exe	rundll32.exe
PID 2872 wrote to memory of 3656	2872	explorha.exe	892deee70e.exe
PID 2872 wrote to memory of 3656	2872	explorha.exe	892deee70e.exe
PID 2872 wrote to memory of 3656	2872	explorha.exe	892deee70e.exe
PID 2872 wrote to memory of 4804	2872	explorha.exe	explorha.exe
PID 2872 wrote to memory of 4804	2872	explorha.exe	explorha.exe
PID 2872 wrote to memory of 4804	2872	explorha.exe	explorha.exe
PID 2872 wrote to memory of 3588	2872	explorha.exe	lumma21.exe
PID 2872 wrote to memory of 3588	2872	explorha.exe	lumma21.exe
PID 2872 wrote to memory of 3588	2872	explorha.exe	lumma21.exe
PID 1372 wrote to memory of 1012	1372	chrosha.exe	NewB.exe
PID 1372 wrote to memory of 1012	1372	chrosha.exe	NewB.exe
PID 1372 wrote to memory of 1012	1372	chrosha.exe	NewB.exe
PID 1012 wrote to memory of 3044	1012	NewB.exe	schtasks.exe
PID 1012 wrote to memory of 3044	1012	NewB.exe	schtasks.exe
PID 1012 wrote to memory of 3044	1012	NewB.exe	schtasks.exe
PID 1372 wrote to memory of 2372	1372	chrosha.exe	lummalg.exe
PID 1372 wrote to memory of 2372	1372	chrosha.exe	lummalg.exe
PID 1372 wrote to memory of 2372	1372	chrosha.exe	lummalg.exe
PID 1012 wrote to memory of 3620	1012	NewB.exe	toolspub1.exe
PID 1012 wrote to memory of 3620	1012	NewB.exe	toolspub1.exe
PID 1012 wrote to memory of 3620	1012	NewB.exe	toolspub1.exe
PID 2372 wrote to memory of 3352	2372	lummalg.exe	RegAsm.exe
PID 2372 wrote to memory of 3352	2372	lummalg.exe	RegAsm.exe
PID 2372 wrote to memory of 3352	2372	lummalg.exe	RegAsm.exe
PID 2372 wrote to memory of 3352	2372	lummalg.exe	RegAsm.exe
PID 2372 wrote to memory of 3352	2372	lummalg.exe	RegAsm.exe
PID 2372 wrote to memory of 3352	2372	lummalg.exe	RegAsm.exe
PID 2372 wrote to memory of 3352	2372	lummalg.exe	RegAsm.exe
PID 2372 wrote to memory of 3352	2372	lummalg.exe	RegAsm.exe
PID 2372 wrote to memory of 3352	2372	lummalg.exe	RegAsm.exe
PID 1372 wrote to memory of 3388	1372	chrosha.exe	rundll32.exe
PID 1372 wrote to memory of 3388	1372	chrosha.exe	rundll32.exe
PID 1372 wrote to memory of 3388	1372	chrosha.exe	rundll32.exe
PID 3388 wrote to memory of 4904	3388	rundll32.exe	rundll32.exe
PID 3388 wrote to memory of 4904	3388	rundll32.exe	rundll32.exe
PID 4904 wrote to memory of 3636	4904	rundll32.exe	netsh.exe
PID 4904 wrote to memory of 3636	4904	rundll32.exe	netsh.exe
PID 4904 wrote to memory of 4584	4904	rundll32.exe	powershell.exe
PID 4904 wrote to memory of 4584	4904	rundll32.exe	powershell.exe
PID 3236 wrote to memory of 1644	3236		cmd.exe
PID 3236 wrote to memory of 1644	3236		cmd.exe
PID 1644 wrote to memory of 4472	1644	cmd.exe	reg.exe
PID 1644 wrote to memory of 4472	1644	cmd.exe	reg.exe
PID 1372 wrote to memory of 3588	1372	chrosha.exe	rundll32.exe
PID 1372 wrote to memory of 3588	1372	chrosha.exe	rundll32.exe
PID 1372 wrote to memory of 3588	1372	chrosha.exe	rundll32.exe
PID 1372 wrote to memory of 2016	1372	chrosha.exe	un300un.exe
PID 1372 wrote to memory of 2016	1372	chrosha.exe	un300un.exe
PID 2016 wrote to memory of 2900	2016	un300un.exe	regasm.exe

C:\Users\Admin\AppData\Local\Temp\ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe
"C:\Users\Admin\AppData\Local\Temp\ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2564

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\system32\netsh.exe
netsh wlan show profiles
5⤵
PID:4440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\852399462405_Desktop.zip' -CompressionLevel Optimal
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1168

C:\Users\Admin\AppData\Local\Temp\1000022001\892deee70e.exe
"C:\Users\Admin\AppData\Local\Temp\1000022001\892deee70e.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
PID:3656

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
3⤵
PID:4804

C:\Users\Admin\AppData\Local\Temp\1000037001\lumma21.exe
"C:\Users\Admin\AppData\Local\Temp\1000037001\lumma21.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:3588

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4184

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372

C:\Users\Admin\AppData\Local\Temp\1000100001\NewB.exe
"C:\Users\Admin\AppData\Local\Temp\1000100001\NewB.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000100001\NewB.exe" /F
3⤵
- Creates scheduled task(s)
PID:3044

C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe
"C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3620

C:\Users\Admin\AppData\Local\Temp\1000103001\lummalg.exe
"C:\Users\Admin\AppData\Local\Temp\1000103001\lummalg.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3352

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3388

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:3636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\852399462405_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3588

C:\Users\Admin\AppData\Local\Temp\1000105001\un300un.exe
"C:\Users\Admin\AppData\Local\Temp\1000105001\un300un.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Users\Admin\Pictures\0OI65Y8EkFfkgb8mGOqidn4Z.exe
"C:\Users\Admin\Pictures\0OI65Y8EkFfkgb8mGOqidn4Z.exe"
4⤵
- Executes dropped EXE
PID:4664

C:\Users\Admin\AppData\Local\Temp\u3lk.0.exe
"C:\Users\Admin\AppData\Local\Temp\u3lk.0.exe"
5⤵
PID:1524

C:\Users\Admin\AppData\Local\Temp\u3lk.1.exe
"C:\Users\Admin\AppData\Local\Temp\u3lk.1.exe"
5⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
6⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 1168
5⤵
- Program crash
PID:1540

C:\Users\Admin\Pictures\8Sttm9K1J4NLATB6985prend.exe
"C:\Users\Admin\Pictures\8Sttm9K1J4NLATB6985prend.exe"
4⤵
- Executes dropped EXE
PID:5104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:2584

C:\Users\Admin\Pictures\XlH93wUhcbE3TN2315ZWuM0g.exe
"C:\Users\Admin\Pictures\XlH93wUhcbE3TN2315ZWuM0g.exe"
4⤵
- Executes dropped EXE
PID:2896

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:3504

C:\Users\Admin\Pictures\UgaGPziV5O7ckLiCerazOShM.exe
"C:\Users\Admin\Pictures\UgaGPziV5O7ckLiCerazOShM.exe"
4⤵
PID:3540

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:5056

C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe
"C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe" --silent --allusers=0
4⤵
PID:4068

C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe
C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.40 --initial-client-data=0x300,0x304,0x308,0x2dc,0x30c,0x6df621f8,0x6df62204,0x6df62210
5⤵
PID:1932

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\vewp5ZalGolAJPos6lDUd40e.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\vewp5ZalGolAJPos6lDUd40e.exe" --version
5⤵
PID:4376

C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe
"C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4068 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240326185758" --session-guid=d99bb8f4-a428-4c7c-80a8-5040259cd513 --server-tracking-blob=MTliY2JjM2Y5NzIzZjQyYTMyYTNkMzBiNWNhYTM0ODkyYTg0ZjgzZmQ5ZTU2NTJlZGI3ZTVhYzU3ZGUyZmYxZjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcxMTQ3OTQ2MS40NDU2IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiJlMWI1ZDc5ZC1kN2FmLTQ4ZWUtYTdmYi03NWE0ODgzNjljMWYifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=8405000000000000
5⤵
PID:5072

C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe
C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.40 --initial-client-data=0x314,0x318,0x31c,0x2e4,0x320,0x6ee321f8,0x6ee32204,0x6ee32210
6⤵
PID:680

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9CB3.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\system32\reg.exe
reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
2⤵
PID:4472

C:\Users\Admin\AppData\Local\Temp\D6FE.exe
C:\Users\Admin\AppData\Local\Temp\D6FE.exe
1⤵
PID:3312

C:\Users\Admin\AppData\Local\Temp\D6FE.exe
C:\Users\Admin\AppData\Local\Temp\D6FE.exe
2⤵
PID:4200

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\df32be30-8872-42a9-9342-807341e23f91" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:1456

C:\Users\Admin\AppData\Local\Temp\D6FE.exe
"C:\Users\Admin\AppData\Local\Temp\D6FE.exe" --Admin IsNotAutoStart IsNotTask
3⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\D6FE.exe
"C:\Users\Admin\AppData\Local\Temp\D6FE.exe" --Admin IsNotAutoStart IsNotTask
4⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 600
5⤵
- Program crash
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8 -ip 8
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4664 -ip 4664
1⤵
PID:764

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ae626d9a72417b14570daa8fcd5d34a4

SHA1
c103ebaf4d760df722d620df87e6f07c0486439f

SHA256
52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a

SHA512
a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
3cae7ca4a15b0a7eb3b48d38b6997eff

SHA1
4e14322793a3d97f418df222cc091aa404ac8ff5

SHA256
624de64de1d3df9796ea890eb56b12db68e6b14e630a62a7ff287d2f520a7dc6

SHA512
45d449ea48c4efcedd269b5097285ab0a46a5c55dcb468f4fecd4c82b041374b476fdb96e048be8719d3b528065e8f374dd7902af59b881c841c983601e46e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
117f100b470fab5df2196c1e8ea80f92

SHA1
06b6130a54c913085c362b41d217e725dc04a9a6

SHA256
96f2e1cab4f3e1048ebdf968222f60230586c576b1194cdfa0c19a510d9ae11c

SHA512
d53f599597da45f64de6426f9349d9713fcd8cbfdc6c25599ca1d280af81d867c338e88d172f3840ef130f62484f559b219fee46f41e955c417d5268bb383eb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\vewp5ZalGolAJPos6lDUd40e.exe
Filesize
1.4MB

MD5
82bbc3208198bd26ade23dbfacf2943d

SHA1
4cdf342095f276ff7c48cce646bef15989eea91a

SHA256
3af49ff4911e4f6fa972978c60c8c4b9bd706695995afb25456ebbed8424cb8a

SHA512
5a36864b0dbd5e30a362ba7c6e37554c97b368371dcaeafc16d39fa629f1bee84f73b1ef6a2e8d3fb35d5e2a8ff3835121f1078c5829238b7c2b4e8ff9630fa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Filesize
1.8MB

MD5
644930f420117e3d11ac8391a9de30d5

SHA1
8ceea30914eb12ded4e9a3e6fb71723ff041ef58

SHA256
ebde61add0ff4e2a11d479edc5513f694022063bc2db8eebcdfb2fd9f2b6bfe3

SHA512
92dea7b748d373fc5571e19ea5018ac55fae990e755c9d4c45aa7a2209b62cd8b995564dad2708a4e5725a59e2fc936f9b45a60467e731c3ecf14b794816a1bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Filesize
512KB

MD5
949739f04438607ca1dcb060be844b97

SHA1
5d09683fb858949ad1c8ce70e1fd1ff40085f5f0

SHA256
5e6abb505a713e5fe28e48152558e2ef47a48e09633fc3562ea97b6932779784

SHA512
cfc5be3711b9681a0eed19385ba48c348418f4998c60d61ecd91d287822a42434d6a071f54d8c46656db1874c62fb4e1d03e4e0b5c1ae45123182612fdf0eab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000022001\892deee70e.exe
Filesize
3.0MB

MD5
c9de505b9585b0731d4ad6ff04f257ca

SHA1
4b50e8269112c8385959e11cc20d165b617dda7e

SHA256
6d43839a8e57cd6955733420371c093165c4bc1421ec172784101ca1fd564537

SHA512
e721d78bfa67885acd54226434eb7a2acdead1380a802e07020bbd586c0551084d74479df5193b554cbcff34f7ad2962712430acb73e0f9976f75d06595f16a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000037001\lumma21.exe
Filesize
413KB

MD5
d467222c3bd563cb72fa49302f80b079

SHA1
9335e2a36abb8309d8a2075faf78d66b968b2a91

SHA256
fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

SHA512
484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000100001\NewB.exe
Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000103001\lummalg.exe
Filesize
350KB

MD5
04df085b57814d1a1accead4e153909e

SHA1
6d277da314ef185ba9072a9b677b599b1f46c35b

SHA256
91a36d137ebfa812b055728807e11338d15d3a5d869cb4babdf779266688e4dd

SHA512
f37678424e46e4f28e1047161db60ad737515558c8c8905ed598ca96b198304da7356e49e7bb9d1e77fe75372f0b5a7f670a353d093749c37bb85c40ec7fdafa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000105001\un300un.exe
Filesize
4.1MB

MD5
8803d74d52bcda67e9b889bd6cc5823e

SHA1
884a1fa1ae3d53bc435d34f912c0068e789a8b25

SHA256
627e36dea92cbdd49fcee34c18a29884010a72b5b004c89df90c19a50303a2b3

SHA512
c190ca373875789477a755f6246565bc7cb5744f1d5f62037e71d3595c1023f587f34a2437d9691ad96cde789026b7c2896110935e58cc2f1498cfea5d0d9564

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000105001\un300un.exe
Filesize
3.0MB

MD5
27e88b1e5cd3b24d98828dc9471f5ab8

SHA1
99b0e6622fdc86b54c7c6a104cff8f3ff2bc9452

SHA256
4a477c686d5361dc2372d6e88b698572bd7c36b12b9176f7ca81b33b7ea629cb

SHA512
128a13bdb7cf9d2105c989b0613713aa2366d2604b3d5e5db55b009d68f70af68a2919beadff70b56b8f4c1b2ace09f02f2b34e9a827ea487ab01bfac2fb6aba

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe
Filesize
299KB

MD5
ae74721b00f375a92786771bc679ff83

SHA1
99be208e5bfc40d91bccfbad773cd7a203732c3b

SHA256
97cbe424b392124b7059e772604446f7ecc3a259e2aa8e4ea2cc1bb598b8e645

SHA512
a4b2cd1ccf4a193e4130ba30e6f6dd584c47904aeb3d421ca98fb2c07f5f975f1f58c75dbbcb1a7c95b6c95a9537062556673c3f7a4e2db334e7255e9b33d730

Download Submit
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
Filesize
5KB

MD5
cfc8fda972a0285e9ab56ec6ce3a401a

SHA1
6ca34acf30be4fc7fdeb98d74b1c0ad988ac1ea8

SHA256
10f0272586c7b617ee027a3bcf498bd31516a8a022405ea9d7cd773f4427d857

SHA512
35aefda4332e22292dd721f66d91cf8d66396fa6c7265dadf49f2c12deed8f873c94e36647471de2a325b9f0cc40dec00d3d202ded1830184219cc5af02a01a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\852399462405_Desktop.zip
Filesize
196KB

MD5
bf650968e5c4b8bb3467b32f9277d366

SHA1
f83228237ded96d3519dea1e7b4b33d96756665f

SHA256
9ccd5e2831d53b481fed7291af642a66b9e2cb8305caa8215959297c71474ed2

SHA512
72ab6d8ea99a84e329767289ffeb38d93f02aaf4e0f16f33803cdc2efafc61e5da5083c4bce4bbc1f988d9a650a6929c8d1c27b8d23aa2c4b0aba106bf67fe3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9CB3.bat
Filesize
77B

MD5
55cc761bf3429324e5a0095cab002113

SHA1
2cc1ef4542a4e92d4158ab3978425d517fafd16d

SHA256
d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

SHA512
33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

Download Submit
C:\Users\Admin\AppData\Local\Temp\D6FE.exe
Filesize
798KB

MD5
96b8da4c66a00c836439f6a65cd9a9f6

SHA1
b89676216818fc360ddad03dee21fcdc463bd725

SHA256
5bcf652c96d961dda03c272d11ea04e25efefbcbff3c4b83e572c3ac523813f7

SHA512
b5bd18d2b675f433360a60f3d92e36db3186ab8e86a7ad477403bc7e253ff04cf2721d747bca7251efba0d720cbc14254adf92cd0efcd5992551d65c9ade81a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403261857571814068.dll
Filesize
1.3MB

MD5
2d4a819dfc2168a3ed9faf8e40cfb602

SHA1
44c8d0e590713738e84546ed3ae927d6d7b986c3

SHA256
5f88f8683f8ee75d5befbf511019a0666e0569e3887b8e0cd6f5ed4a6f315c83

SHA512
c40b421713c02aae3ef9b136294f4c4a123270fbc31f9dbd748bebe9ecd3d6397d88b15998446b739c2fe817ca0651aca28c2dbe72492703589fcc323584a508

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403261857576651932.dll
Filesize
1.6MB

MD5
0ca84aa6da42230f64444cf1fe5c9829

SHA1
513342b234918228fe3b7420a0cbfcb0d03c3095

SHA256
e19347e740bcca4682a530765b2b72698fdf31a07687dfb97f0934822e0a4e10

SHA512
d1a01203a96af18ce7fbbe6cc1557f10af59c6cd72189f176fececb528114690e9320a532c6089343d35b95c492cb3ad84b09c3e2299b61ba121e507a5683e08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403261857581504376.dll
Filesize
1.1MB

MD5
56d5557063ce2d3b79b89f67a8dc18c9

SHA1
2e3e83a5f7db1dcec4058ae202100a3ae85cf3db

SHA256
bc3302b36bb81c9235aa15e533edc0aaa41f4d7dd448ad36645f60904c68eb5d

SHA512
9646e1b9c3225c448bdeb44c05cab90f7d5f2781fc1e640fc2fa04613ae2fa3b4d66b7ee7009c3d3c0d87f9d643badcbd0ad83cfc78b91d9b62f59f20ef4fbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403261857581504376.dll
Filesize
581KB

MD5
9158ee51419fcd1838f140ac322052b9

SHA1
672d373960aa0421f8f587b4b710d73c4ab36f35

SHA256
02abaae4ddf2f14081c58790f848ec5b8c79a074a074ad20562d57c44706d4fb

SHA512
d81851a57bc2d69faad10f0134e1d9a2698de1e0bc51b317d5b55d61d0685ad8a1dcab341d0f75d3080adf2e3ada19574f33cce4f236ebbec81fa6f590209b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Files_\BackupAdd.xls
Filesize
196KB

MD5
ae5bb209428d9a2dba515bc69f1f9cce

SHA1
7071146fd33514c73247474f87a9d6f28a491a40

SHA256
40303a2c68ac1055144db93076375264b7a50bef8e7cc8b8672d182f3d640ef5

SHA512
8f45437efab6a72ea462eb3d7f94280dd34a424782af74206dcc0d741e8e1d94b5ab5ac74802370baed480e49b85a7ac5c09818ad9126a80cf372e0fb2d3fdf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1yascvm0.0jl.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3lk.0.exe
Filesize
299KB

MD5
bf81c7e629eaa2c4a995c9945b98a933

SHA1
145f783f7ea60f1a759dcd2fcc8cb501dac868df

SHA256
7ec38e1e46dbe3557ac9e7dadf0c1adf7e189f2ab820df7f6e08443b5333b1c5

SHA512
fcf7bd1ac1da2e3ce8199cfc462c589f5e303744dfa29eebf4a24e526db3a23221cc8d2198a33af7ab7115e9b5b00f11a6e33e889710536d9e1e4e15ac66d399

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3lk.1.exe
Filesize
1.5MB

MD5
51df2a6dfb5f0eb070235e724e1d5d2f

SHA1
fd1e92f43c400c1618380aa6b19413f6526eca92

SHA256
b821ae07396bad0a2d18c57bc584f37d859b8471ff528b3bb4f95149f0ea7d3e

SHA512
e6d64b798b8c55936b3ec9bbaeb8ab7ac442c5a9a91c76ae726e6391eccb05403f6b130ea5d9e875152daa33b1e95671d4428afb5dd791e2a1f6f17588f2d340

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3lk.1.exe
Filesize
704KB

MD5
84f3d48ac8f6cd5860c1d42463bddd8c

SHA1
9e307a115c353a982fe81c94d134b82162e711d1

SHA256
48527c21e1d974761436b351721d28234f482982ec2bc871ecad019d130895b7

SHA512
8a44ba89c64566b89bce6900ef3281310361ecea25323eef8892f5afe07df09ed82f4e000a4785b8051a6a6945b170bf25ec94e7cb6711cc2770d148fe575a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\u3lk.1.exe
Filesize
1.1MB

MD5
01a90e9b395761e38299d1bf60706e31

SHA1
1d760ee68f064ef2efb345b929a59b662fe5070f

SHA256
1f0fab66b4e866692bb196aa02e61ff685f6bdc23bb69269549191e6879f36cd

SHA512
3d6c46e9cad52d8544f31cfcdac28c9932f487b9d7330f3c4be1184e99eaa1e666031c5912384665d39b32c9b9223260e5051ed2a7d9eb4e19f3f2320a10c7b0

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
109KB

MD5
726cd06231883a159ec1ce28dd538699

SHA1
404897e6a133d255ad5a9c26ac6414d7134285a2

SHA256
12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

SHA512
9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
1.2MB

MD5
15a42d3e4579da615a384c717ab2109b

SHA1
22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

SHA256
3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

SHA512
1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
Filesize
109KB

MD5
154c3f1334dd435f562672f2664fea6b

SHA1
51dd25e2ba98b8546de163b8f26e2972a90c2c79

SHA256
5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

SHA512
1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Filesize
1.2MB

MD5
f35b671fda2603ec30ace10946f11a90

SHA1
059ad6b06559d4db581b1879e709f32f80850872

SHA256
83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

SHA512
b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

Download Submit
C:\Users\Admin\Pictures\0OI65Y8EkFfkgb8mGOqidn4Z.exe
Filesize
443KB

MD5
a825a478aced95f8226c1aac334badf1

SHA1
76053bb1f3091cff4ee766c09e4ab6a188ef930e

SHA256
d240c502306ef7352c0ec765d71399532bba2276231e663cbcbf88d7171df9fa

SHA512
9947428e15180174abce0f1565ae0a80715e0e3a15126c50de3bdc9cd5b8586a98e75a14f47d1dbf2c1925ca15c98c80b156aea46990e90ce9d30a0859bd0439

Download Submit
C:\Users\Admin\Pictures\8Sttm9K1J4NLATB6985prend.exe
Filesize
2.7MB

MD5
5791cf8d4535f16ae85b3d336a8fabc5

SHA1
b7a2ae4c1cbdad895ac49d3b8da4982d8c8631ad

SHA256
ce26e73942255f84877f10e53b2fabaaa1d5223785d5c34bbfe051c0189c3886

SHA512
bbce827706b27f3dc6dc18f05302ecbae8bad45212d7800b0c37a893edbb4d455f223c44388741e66d76930d256b334f00b3c7952235d6716fcccbb0158ce1ed

Download Submit
C:\Users\Admin\Pictures\8Sttm9K1J4NLATB6985prend.exe
Filesize
2.8MB

MD5
749bdf6a99d7c0ec873c747a02d3c224

SHA1
a7987891ebfd033cd427a39d09a552ed3cdea228

SHA256
1840cf361884f178a410da405f5a28ef8f822c438a0e401644dbf9bd3ae5cc70

SHA512
09a9e659183794ff8a105b3f19eb79d294a18221237cc4ea4f09e02815107fe23d541d68ef13c8fc898ada7fbfb6cc2838f7da9337ad04177ed09ac8075c6898

Download Submit
C:\Users\Admin\Pictures\8Sttm9K1J4NLATB6985prend.exe
Filesize
2.3MB

MD5
e4d8ce0801715a6eb8ff48d0f344bc74

SHA1
c57f60971bdcee7a798c3ad6a0457e6865dd6f30

SHA256
227e7d886378a0ae7e099590434490c627ff24c14f711bd23f3952b8dae9962a

SHA512
71b80a0239288a66ea418bc9b230704c261a730b9122c7fe20e1bfd52164fee4a4761de72a1cc9385615ef48b2386cd3ea102e78b3f95f2a2845ef0cb9ca38f3

Download Submit
C:\Users\Admin\Pictures\UgaGPziV5O7ckLiCerazOShM.exe
Filesize
4.2MB

MD5
14129c0f718fe1025afb38409a87e557

SHA1
dc6e8d64bd67dea1010ce41233d3a58466060707

SHA256
36dc2c54f49d449388e8816cb7933ac5f52228203172b13d6c95c462da1b0d4d

SHA512
077eab45b87302dd32baf43f00bfeddea3b19fbba6900406c266215f1adb4b22e0034e91bbd0ea6363bbe38313913bde47f78b2522c935d8f54e6bde8e693346

Download Submit
C:\Users\Admin\Pictures\UgaGPziV5O7ckLiCerazOShM.exe
Filesize
64KB

MD5
cee3fe95b4b8297709f1c262ce64444c

SHA1
dee19f3cd11d348cf3522fa7163200f9b68ddb33

SHA256
894c886f2da9f9bf37dd7f4123d75eb704a8d99cf8e26e960f9db19b81ef4d33

SHA512
7a7e2aa4cd7ccac83b3a9c350cb538cd27eacf2712f8ce746f7f3be2bda3df1bc0d6f4d77b0e529d9bcf4b98a8f7d9d560b7b0970f757db4d0cc8959e36eb2ec

Download Submit
C:\Users\Admin\Pictures\XlH93wUhcbE3TN2315ZWuM0g.exe
Filesize
2.4MB

MD5
4500c2279e5856d743a41bd9eaed030b

SHA1
7bd0a71985adcd5115e1563f7abe9b948fe0caa2

SHA256
8e9791b15b08eb8f770266ef386311c57193d8fe46388bc2fb200ea1f334fa66

SHA512
5fab59e5753a496956736a4e72576a4e5c362afb9cedcb1c85caf09b5bf4ae72db68dc71a78439b7e37b3602b5e68353e770c3ede396c7c1fdcd28ef434fd8fd

Download Submit
C:\Users\Admin\Pictures\XlH93wUhcbE3TN2315ZWuM0g.exe
Filesize
2.9MB

MD5
c85f43d905c495278a835830f4436e65

SHA1
d6b1030c4a2cd6bb969f2f324d201b4f1e648eba

SHA256
c6dbf0ea27686435c7b55d4bd6feeee389fc45f1f17f76c38fa99bd0aabd6f7f

SHA512
0ed9ac5d2ab1a60d812bb6d576885f7dec0ae9f295ce26b2466264030de8c9c0b3186a8a1b21ee13a43bd25e2e828e042f2e22c4cc74f1735d0e303d58cb8efd

Download Submit
C:\Users\Admin\Pictures\XlH93wUhcbE3TN2315ZWuM0g.exe
Filesize
2.2MB

MD5
998d6dce0682e23e89403bdf4be7da40

SHA1
8fa80bfe007e32094a0556e379966bad98e15db5

SHA256
e88cf9bb3860598c8f34ec79fedb74e626c701f797e8d697e849985c513d564e

SHA512
b65892ddf5db3c744b936c45aa3543e79a1da1b92a9356efadf33ec8dbe0e81020dc0ddf6459be376389dd9c111ad6fecb83fe13686cf7bda1a6d49ad4feea43

Download Submit
C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe
Filesize
64KB

MD5
c8f12525678bc9704dfcea3643b4c115

SHA1
763c99d11faa68454ba5d7e44aba0b78108c8412

SHA256
1fd226eaf596bd192b6fd49c8e7d040fe3549acc840768d16dd3e9b4e3332cf3

SHA512
a505e2766c83c0e0a81605370a067fd1aedce647be042b09317a8ad721e907382faeef41aad9c39f776b62d2385c52f0d4a587a3c3aabe6a65fcdf26ad421a5f

Download Submit
C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe
Filesize
1.1MB

MD5
d4315a4da189c8d222fe55287ea69386

SHA1
bfa61b5f7f38a560f7492798cc7bf83a25fbdeac

SHA256
7e1d38f2b81cefbf76c61a47c1f83e8c2748879f972f0e7e75c82e097f9e45e8

SHA512
fff96589666431197807370f51b66a107185d154bb9e394cdf2b68292a1ab99a510536d6dc7f76c47bf9b9642455ef6000f2b43daf3b3c78fd2765b90640c367

Download Submit
C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe
Filesize
832KB

MD5
a3624fe7dc811920836e882f28953119

SHA1
7c1561fe0a228174d9ba414bdd8d0afa9aab8596

SHA256
780a9b9626a680c9a8e055484ef95236ffa59f556596d2994e4987e7a5d97f3d

SHA512
e5129995a49b5915830e6e78bd2d473aad9c4ae4784b3ac6644cdc7889eb1d8ffea5824332559180c3378bd4bed1f8682b3ff14458e2bd037e9bb8b19974d829

Download Submit
C:\Users\Admin\Pictures\vewp5ZalGolAJPos6lDUd40e.exe
Filesize
320KB

MD5
d4b907faed17638716c0380778bc07f7

SHA1
9ce95ed9328c337763789ba0fad11dee847f4697

SHA256
d3985067cab0e1611647f1a76a2b3b2ef2972b07b7f56092b39cedea76ba0237

SHA512
7d1811786128fb6ec13c1ed89c5517c4c076d9baebb671d35554d3dbbcdfc86089a45c4a859f0af807d9884a320a93af08a8f2df895b728d7706882c3bff7e0a

Download Submit
C:\Users\Admin\Pictures\yAvE5bs63p0dPDhRcFJRZmN8.exe
Filesize
7KB

MD5
5b423612b36cde7f2745455c5dd82577

SHA1
0187c7c80743b44e9e0c193e993294e3b969cc3d

SHA256
e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

SHA512
c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

Download Submit
memory/8-508-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/8-510-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/8-512-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/540-162-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/540-144-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/540-152-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/540-151-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/540-150-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/540-149-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/540-148-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/540-146-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/540-147-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/540-145-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/1524-542-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2372-221-0x00000000034D0000-0x00000000054D0000-memory.dmp

Filesize
32.0MB

Download
memory/2372-261-0x00000000034D0000-0x00000000054D0000-memory.dmp

Filesize
32.0MB

Download
memory/2372-212-0x0000000072670000-0x0000000072E21000-memory.dmp

Filesize
7.7MB

Download
memory/2372-210-0x0000000000E40000-0x0000000000E9E000-memory.dmp

Filesize
376KB

Download
memory/2372-220-0x0000000072670000-0x0000000072E21000-memory.dmp

Filesize
7.7MB

Download
memory/2564-9-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/2564-4-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/2564-6-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/2564-5-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/2564-3-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/2564-23-0x00000000009B0000-0x0000000000E5F000-memory.dmp

Filesize
4.7MB

Download
memory/2564-2-0x00000000009B0000-0x0000000000E5F000-memory.dmp

Filesize
4.7MB

Download
memory/2564-1-0x0000000077416000-0x0000000077418000-memory.dmp

Filesize
8KB

Download
memory/2564-7-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/2564-10-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/2564-0-0x00000000009B0000-0x0000000000E5F000-memory.dmp

Filesize
4.7MB

Download
memory/2564-8-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/2872-26-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/2872-24-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-33-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-32-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-31-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/2872-368-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-170-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-139-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-30-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/2872-280-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-137-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-113-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-27-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/2872-29-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/2872-79-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-227-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-527-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-111-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-242-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-22-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-25-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/2872-34-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2872-28-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/2872-90-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/2896-506-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/2900-301-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2900-303-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/2900-302-0x0000000072720000-0x0000000072ED1000-memory.dmp

Filesize
7.7MB

Download
memory/3236-223-0x0000000000CF0000-0x0000000000D06000-memory.dmp

Filesize
88KB

Download
memory/3352-222-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3352-215-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3352-218-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3540-528-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/3620-211-0x0000000000400000-0x0000000000AF5000-memory.dmp

Filesize
7.0MB

Download
memory/3620-209-0x0000000000D60000-0x0000000000D6B000-memory.dmp

Filesize
44KB

Download
memory/3620-224-0x0000000000400000-0x0000000000AF5000-memory.dmp

Filesize
7.0MB

Download
memory/3620-208-0x0000000000DD0000-0x0000000000ED0000-memory.dmp

Filesize
1024KB

Download
memory/3656-260-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-117-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-207-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-109-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-110-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-112-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-116-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-536-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-228-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-375-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-281-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-140-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/3656-138-0x0000000000650000-0x00000000009F1000-memory.dmp

Filesize
3.6MB

Download
memory/4184-62-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/4184-67-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/4184-50-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/4184-63-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/4184-68-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/4184-65-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/4184-64-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/4184-66-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/4184-70-0x0000000000300000-0x00000000007AF000-memory.dmp

Filesize
4.7MB

Download
memory/4184-69-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/4200-420-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4200-422-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4200-418-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4200-499-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4584-245-0x0000022574AA0000-0x0000022574AB0000-memory.dmp

Filesize
64KB

Download
memory/4584-258-0x00007FFC3AEB0000-0x00007FFC3B972000-memory.dmp

Filesize
10.8MB

Download
memory/4584-244-0x00007FFC3AEB0000-0x00007FFC3B972000-memory.dmp

Filesize
10.8MB

Download
memory/4664-502-0x0000000000400000-0x0000000000B18000-memory.dmp

Filesize
7.1MB

Download
memory/4664-547-0x0000000000400000-0x0000000000B18000-memory.dmp

Filesize
7.1MB

Download
memory/5104-504-0x0000000000400000-0x0000000000ED8000-memory.dmp

Filesize
10.8MB

Download
memory/5116-71-0x000001EE712E0000-0x000001EE712F2000-memory.dmp

Filesize
72KB

Download
memory/5116-72-0x000001EE711D0000-0x000001EE711DA000-memory.dmp

Filesize
40KB

Download
memory/5116-77-0x00007FFC3AEB0000-0x00007FFC3B972000-memory.dmp

Filesize
10.8MB

Download
memory/5116-49-0x000001EE71150000-0x000001EE71172000-memory.dmp

Filesize
136KB

Download
memory/5116-61-0x000001EE58FC0000-0x000001EE58FD0000-memory.dmp

Filesize
64KB

Download
memory/5116-52-0x000001EE58FC0000-0x000001EE58FD0000-memory.dmp

Filesize
64KB

Download
memory/5116-51-0x000001EE58FC0000-0x000001EE58FD0000-memory.dmp

Filesize
64KB

Download
memory/5116-48-0x00007FFC3AEB0000-0x00007FFC3B972000-memory.dmp

Filesize
10.8MB

Download