glupteba | d562b3b44859f761645676e0c0e7daad1226c5b90f53b4fe5e5395bf77454ec7

Analysis

max time kernel
33s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

384KB
MD5

3170aed3eb44bd638cce6f67650d4b50
SHA1

22519afd371ed56fe6b4b4565534e09d0dd20453
SHA256

d562b3b44859f761645676e0c0e7daad1226c5b90f53b4fe5e5395bf77454ec7
SHA512

7e7c6289de619d06a7ca36fdb11d3d1a04e0913dffcfabac7af71213e2e8c54bb367ecf318b07e40b8734d3a7db92cb5de6f73e99caa9c254eec876130c93f36
SSDEEP

6144:F9b8+wW/Wco9GZbOHqYCGwYyX9Y1J3yVA3Upzm88TKmIImK4E7AjEwYM/vYZu6Yj:Tb8+/hbOHsG46Xx6mWIFNOYM/h8cvB

Score

10^/10

glupteba stealc discovery dropper evasion loader spyware stealer

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 20 IoCs

resource	yara_rule
behavioral2/memory/1844-80-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/1844-85-0x0000000005120000-0x0000000005A0B000-memory.dmp	family_glupteba
behavioral2/memory/3336-89-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/3336-114-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/1844-120-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/3336-174-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/1844-175-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/1844-293-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/3336-274-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/3336-345-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/3336-356-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/1844-401-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/416-424-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/1844-425-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/416-449-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/2460-450-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/416-463-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/416-531-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/2460-532-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba
behavioral2/memory/416-543-0x0000000000400000-0x000000000311B000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1600	netsh.exe
3312	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	regasm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	SWTqUkTc5v6IsP52zOyqfkz2.exe

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g36qFaVsMfISblclgMZa3bIC.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H0B5TlINTS0cUIzNwiuYf1ZY.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NK0UaGs1TTsZfMC6WDulVTjp.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZC09azFmneMiwrtC6NTpdH5d.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sa0OSP8rhamy5R999pBWi1Wa.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qK7iVRoenmBTxC2Q0R9qPbIL.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MN4ciCB12fUgCC2hWKXMQiPt.bat	regasm.exe

Executes dropped EXE 5 IoCs

pid	Process
3416	SWTqUkTc5v6IsP52zOyqfkz2.exe
3336	7vfv7yHcN8sDGh81Y9gEwdH2.exe
1844	Qxvl1KTyujYZ8jFvwx3GKZ5Q.exe
2896	u2mw.0.exe
2200	LZw70rmyDzErStp9uaoArFbQ.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	pastebin.com
17	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
74	api.myip.com
77	api.myip.com
82	ipinfo.io
85	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1824 set thread context of 1096	1824	tmp.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4124	2896	WerFault.exe	97
2752	2896	WerFault.exe	97
60	3416	WerFault.exe	94

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u2mw.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u2mw.0.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1824	tmp.exe
2896	u2mw.0.exe
2896	u2mw.0.exe
1424	powershell.exe
1424	powershell.exe
3792	powershell.exe
3792	powershell.exe
1424	powershell.exe
3792	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	tmp.exe
Token: SeDebugPrivilege	1096	regasm.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2644	1824	tmp.exe	84
PID 1824 wrote to memory of 2644	1824	tmp.exe	84
PID 1824 wrote to memory of 2644	1824	tmp.exe	84
PID 1824 wrote to memory of 1096	1824	tmp.exe	87
PID 1824 wrote to memory of 1096	1824	tmp.exe	87
PID 1824 wrote to memory of 1096	1824	tmp.exe	87
PID 1824 wrote to memory of 1096	1824	tmp.exe	87
PID 1824 wrote to memory of 1096	1824	tmp.exe	87
PID 1824 wrote to memory of 1096	1824	tmp.exe	87
PID 1824 wrote to memory of 1096	1824	tmp.exe	87
PID 1824 wrote to memory of 1096	1824	tmp.exe	87
PID 1824 wrote to memory of 3316	1824	tmp.exe	88
PID 1824 wrote to memory of 3316	1824	tmp.exe	88
PID 1824 wrote to memory of 3316	1824	tmp.exe	88
PID 1096 wrote to memory of 3416	1096	regasm.exe	94
PID 1096 wrote to memory of 3416	1096	regasm.exe	94
PID 1096 wrote to memory of 3416	1096	regasm.exe	94
PID 1096 wrote to memory of 3336	1096	regasm.exe	95
PID 1096 wrote to memory of 3336	1096	regasm.exe	95
PID 1096 wrote to memory of 3336	1096	regasm.exe	95
PID 1096 wrote to memory of 1844	1096	regasm.exe	96
PID 1096 wrote to memory of 1844	1096	regasm.exe	96
PID 1096 wrote to memory of 1844	1096	regasm.exe	96
PID 3416 wrote to memory of 2896	3416	SWTqUkTc5v6IsP52zOyqfkz2.exe	97
PID 3416 wrote to memory of 2896	3416	SWTqUkTc5v6IsP52zOyqfkz2.exe	97
PID 3416 wrote to memory of 2896	3416	SWTqUkTc5v6IsP52zOyqfkz2.exe	97
PID 3336 wrote to memory of 1424	3336	7vfv7yHcN8sDGh81Y9gEwdH2.exe	101
PID 3336 wrote to memory of 1424	3336	7vfv7yHcN8sDGh81Y9gEwdH2.exe	101
PID 3336 wrote to memory of 1424	3336	7vfv7yHcN8sDGh81Y9gEwdH2.exe	101
PID 1844 wrote to memory of 3792	1844	Qxvl1KTyujYZ8jFvwx3GKZ5Q.exe	100
PID 1844 wrote to memory of 3792	1844	Qxvl1KTyujYZ8jFvwx3GKZ5Q.exe	100
PID 1844 wrote to memory of 3792	1844	Qxvl1KTyujYZ8jFvwx3GKZ5Q.exe	100
PID 1096 wrote to memory of 2200	1096	regasm.exe	104
PID 1096 wrote to memory of 2200	1096	regasm.exe	104

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  PID:2644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Users\Admin\Pictures\SWTqUkTc5v6IsP52zOyqfkz2.exe
    "C:\Users\Admin\Pictures\SWTqUkTc5v6IsP52zOyqfkz2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\u2mw.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u2mw.0.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2896
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 2316
        5⤵
        Program crash
        
        PID:4124
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 2668
        5⤵
        Program crash
        
        PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\u2mw.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u2mw.1.exe"
      4⤵
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        
        PID:2140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1456
      4⤵
      Program crash
      PID:60
- - C:\Users\Admin\Pictures\7vfv7yHcN8sDGh81Y9gEwdH2.exe
    "C:\Users\Admin\Pictures\7vfv7yHcN8sDGh81Y9gEwdH2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1424
  - - C:\Users\Admin\Pictures\7vfv7yHcN8sDGh81Y9gEwdH2.exe
      "C:\Users\Admin\Pictures\7vfv7yHcN8sDGh81Y9gEwdH2.exe"
      4⤵
      PID:416
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1420
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1600
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:3472
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4340
- - C:\Users\Admin\Pictures\Qxvl1KTyujYZ8jFvwx3GKZ5Q.exe
    "C:\Users\Admin\Pictures\Qxvl1KTyujYZ8jFvwx3GKZ5Q.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3792
  - - C:\Users\Admin\Pictures\Qxvl1KTyujYZ8jFvwx3GKZ5Q.exe
      "C:\Users\Admin\Pictures\Qxvl1KTyujYZ8jFvwx3GKZ5Q.exe"
      4⤵
      PID:2460
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4908
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:3312
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4560
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2440
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:1808
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:4780
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:3536
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:4668
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:1764
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:4072
- - C:\Users\Admin\Pictures\LZw70rmyDzErStp9uaoArFbQ.exe
    "C:\Users\Admin\Pictures\LZw70rmyDzErStp9uaoArFbQ.exe"
    3⤵
    - Executes dropped EXE
    PID:2200
- - C:\Users\Admin\Pictures\ZdGLmOTJwO9rmKvsHMLsbMVv.exe
    "C:\Users\Admin\Pictures\ZdGLmOTJwO9rmKvsHMLsbMVv.exe" --silent --allusers=0
    3⤵
    PID:4644
  - - C:\Users\Admin\Pictures\ZdGLmOTJwO9rmKvsHMLsbMVv.exe
      C:\Users\Admin\Pictures\ZdGLmOTJwO9rmKvsHMLsbMVv.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6eb6e1d0,0x6eb6e1dc,0x6eb6e1e8
      4⤵
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\ZdGLmOTJwO9rmKvsHMLsbMVv.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\ZdGLmOTJwO9rmKvsHMLsbMVv.exe" --version
      4⤵
      PID:4348
  - - C:\Users\Admin\Pictures\ZdGLmOTJwO9rmKvsHMLsbMVv.exe
      "C:\Users\Admin\Pictures\ZdGLmOTJwO9rmKvsHMLsbMVv.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4644 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240415222856" --session-guid=986b29ac-883e-4c41-ac86-66c2f190b88e --server-tracking-blob="ZWU2OTQzYWZjZjgyY2RiOTA1OTE1OWQzY2YwZDk4NmNjYWYzNzFmYzA5ZTRhY2NhMTY5MjI1ZjZjNGM1ZTA2Nzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzMjIwMTAzLjI2MTQiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiY2ExMjc1M2ItMjczZC00ODFjLWI4ZTQtNGJlZjk1NmQzZmU4In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1404000000000000
      4⤵
      PID:3068
    - - C:\Users\Admin\Pictures\ZdGLmOTJwO9rmKvsHMLsbMVv.exe
        
        C:\Users\Admin\Pictures\ZdGLmOTJwO9rmKvsHMLsbMVv.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a4,0x2a8,0x2ac,0x274,0x2b0,0x6e02e1d0,0x6e02e1dc,0x6e02e1e8
        5⤵
        
        PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\assistant\assistant_installer.exe" --version
      4⤵
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1dc,0x22c,0xe26038,0xe26044,0xe26050
        5⤵
        
        PID:1124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:3316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2896 -ip 2896
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2896 -ip 2896
1⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3416 -ip 3416
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a6ea7bfcd3aac150c0caef765cb52281

SHA1
037dc22c46a0eb0b9ad4c74088129e387cffe96b

SHA256
f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9

SHA512
c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
21KB

MD5
5788bdf5a9ab96baaed7f228e42ef0eb

SHA1
6189d22ee6d13d3d959063b1f5f756819dafeccb

SHA256
dc7a29c73ebbdb8158fb362286e66d0b555c727bdfdfc5a2aa241e44654960fe

SHA512
8c9b3f91bf46a0aacf878bf1a8aa344d50f5d68c18ecfad5015c569500ca4725c009751cda869d24cda753cb535ed19f4dac64ab46a122e00e859ccb2dba1782

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\additional_file0.tmp

Filesize
2.5MB

MD5
15d8c8f36cef095a67d156969ecdb896

SHA1
a1435deb5866cd341c09e56b65cdda33620fcc95

SHA256
1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

SHA512
d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\assistant\assistant_installer.exe

Filesize
1.9MB

MD5
976bc8e5fe65f9bb56831e20f1747150

SHA1
f9e7f5628aaaabed9939ef055540e24590a9ccfb

SHA256
f53c916ccf3d24d6793227283de2db0f6cc98a2275413851807cc080643d21a0

SHA512
2858e7e08418b170b21b599afb02236d0480d35a5605de142f10976489e01daf2ad80df0f09c2eb38bc5a971336d1f6aa9909c520bcdb18e9c9a8e903379dcd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\assistant\dbgcore.dll

Filesize
166KB

MD5
9ebb919b96f6f94e1be4cdc6913ef629

SHA1
31e99ac4fba516f82b36bd81784e8d518b32f9df

SHA256
fdae21127deb16eb8ba36f2493d2255f4cb8ab4c18e8bd8ba5e587f5a7ecd119

SHA512
a1b42f7d2896da270bb3c80cf9b88c4b4f1491084e7aa7760eeea5533b26f041dc79b21d5ffd2bba2221fe118e0a8d912e170f24fd895c9315b1ee9c7adfe700

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\assistant\dbghelp.dll

Filesize
1.7MB

MD5
544255258f9d45b4608ccfd27a4ed1dd

SHA1
571e30ceb9c977817b5bbac306366ae59f773497

SHA256
3b02fc85602e83059f611c658e3cad6bc59c3c51214d4fe7e31f3ac31388dd68

SHA512
2093da881fa90eec2b90d1ca6eaaff608fe16ac612571a7fd5ed94dd5f7ff7e5c1e8c862bab0a228850829527886473e3942abd23a81d10cab8f9baad2cc7664

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404152228561\opera_package

Filesize
103.8MB

MD5
5014156e9ffbb75d1a8d5fc09fabdc42

SHA1
6968d1b5cec3039e53bbbedeee22e2d43d94c771

SHA256
7a01e11e1830ba3c154e5a6c383da15938b1e48f89a2fe4045cdd260924b6802

SHA512
bfc5c44881d0fa7bcbccfd530d874fa624adec50e1a16063a72de12876d2db10ca5edd6fa841ea63e9deca3ff2adf54065f50719fe051d41de92bb68edba4016

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404152228526524644.dll

Filesize
4.6MB

MD5
0415cb7be0361a74a039d5f31e72fa65

SHA1
46ae154436c8c059ee75cbc6a18ccda96bb2021d

SHA256
bb38a8806705980ee3e9181c099e8d5c425e6c9505a88e5af538ca6a48951798

SHA512
f71c2b9e1559aa4eb2d72f852ef9807c781d4a7b96b8e0c2c53b895885319146bd43aa6e4223d43159f3d40bc60704206404dc034500e47fca0a94e53b60239e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aqeqgio0.jet.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
2KB

MD5
505b2b1e10f775d9242ec49ed52e5004

SHA1
2c8101cb5df2773d3676bf61bb1da39bba883ea8

SHA256
573e0199dde884d258fcacbdc31fe9c9db45a631c49b718a5717a8a36b0d942e

SHA512
035b09458cfc37c8e3d0f2f38f0b8950b0b1f002bac741ed07caa23f122c5ee968d6a53ae0022e8a4c8b771516fab04a0b1a993f31ec9f86b5d41dbfef71c0ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
3KB

MD5
30e2755c1e8dd056be4ce364d9b094ca

SHA1
197bc16b9366794e9834c06b3041c5031f57f0ce

SHA256
3b1b09a962c8ff66c678fb4c12b284b0f2b1e2aba603953e856e88cb4db6af38

SHA512
fa653cfe484f9df911ebe12341702f65998701f88ba87ebd53a83baf2ff6cc7a921284eb7da08424f5cac6344780fffa3220320b4b29af7b58411136b97821a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\u2mw.0.exe

Filesize
361KB

MD5
734b17e8c2eea84385e6766b2082bf05

SHA1
7c0d0b3e7691e5aedda0bc846368e41d2548ef61

SHA256
e8fb9b60192a6464947d0a921c06e9ce6e1b3c6796bbe2d55fdbca4457b892f7

SHA512
95b8c0fc0058f13eb742004a0ecab79f7c2ca755a74a57accb8dcd733f8fcb08b47ac8a016d027ba3b36a2c4ceb5d8e50f7cf363791ca417c748e4e7bb946857

Download Submit
C:\Users\Admin\AppData\Local\Temp\u2mw.1.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
59a6a5451b5eb035ab4be7a854cd0e57

SHA1
b8350c7ccd2d8f915e54976f1f065835d40567da

SHA256
5636e8ff60b7a3a4875f5808a20e89e516b3f715feb1bb5704eee309275b13c9

SHA512
dcd3840ce643e692b303b375fca0b8a9bd45c88492eca60e9a6998ba4e1e9dd71f9ce499da3447867e8a305f053c952d1524cca60a0cc8d1e9cb107e4c3fe709

Download Submit
C:\Users\Admin\Pictures\7vfv7yHcN8sDGh81Y9gEwdH2.exe

Filesize
4.2MB

MD5
469ace49eafd4a129726477ab11ea293

SHA1
3b39f6be2721a02162a173fb7c9bd4708e9133c0

SHA256
25007f40b1804a744f3f48d581465e2b622ca57889a23379923eb992c6f6f4d0

SHA512
65b087a3f56f3621811818fb39bbaa072fadc1fc3a21636c2dbad79e28c9cd69113af30534ab3234912642f2feb60bf17d5caf0515fbef400a74aaeefada71dd

Download Submit
C:\Users\Admin\Pictures\LZw70rmyDzErStp9uaoArFbQ.exe

Filesize
5.0MB

MD5
5111c44e0409c72968f79ca056e3fcfb

SHA1
7bcc5651b0143ea7df58ea521ab9c6b283666765

SHA256
7d308f38489962f4594dcd26e74f3404431cb79019a07194fbe9d27f39bcff6a

SHA512
0a17998f99bef19cc6936e19dc0e42df893d623ab53cd72ddf572ad13e8a7057de41e03b9e1854e137c1012af4d40d448b47ac1a8d8ea179f9de07f46374b828

Download Submit
C:\Users\Admin\Pictures\SWTqUkTc5v6IsP52zOyqfkz2.exe

Filesize
461KB

MD5
c3fefdfe50fa8faa402a547b38132dad

SHA1
d0ffef80bcfbf2e1e8345252fe3af39661e3fbff

SHA256
d6bcf44f79672c7a1e3ea4b9cf1e64135e0c6ece1f72dcabdee781fe64386d8c

SHA512
c9fa8f303ad284766955268803816adb86c5e1ae917a0f7cef1743ab3a0566105be2a5ba08772b024537c14e06b1ae40a311e551c1e7ef3df88f564430771171

Download Submit
C:\Users\Admin\Pictures\ZdGLmOTJwO9rmKvsHMLsbMVv.exe

Filesize
5.1MB

MD5
157d916f0c1d499d6b9ae61cf2d50ffc

SHA1
edd26e391ed251452bae18aadb7d9735a0d3436b

SHA256
8fb1e2054d96138865ec827bb9fd42a9b5c070c6ed87e5a71154b86c844db359

SHA512
8e22e2d1500b3f637217e347d07ae4729b576c75cea54c6e5f3c4b81365bb19f45d90a6b011ee3b84dc0e98ca93070a6b320c508d49dd09046ae6f4b87f7ea52

Download Submit
C:\Users\Admin\Pictures\gyCcGyD4kKjAkUkGKb93e3Ki.exe

Filesize
55KB

MD5
0dc4bf362c4913c91a91d3818c8716d0

SHA1
44e38b5bf55e503eb2cce5c4579799531522d93c

SHA256
ba7417a1634c0b4d3e6e66541945a192f2b474976e7d18e89f0e0e42e8c9d728

SHA512
c63706510bdce7517e1f112c477046d7fe6f0a12b69135be7eaa62dd2305f49377950810f17ab065b19fc25d0d072927d1305bd022e85ff7381605eac2989081

Download Submit
C:\Users\Admin\Pictures\vZfXRNJQamrJvyxMk9IAaZsk.exe

Filesize
55KB

MD5
1fae283670978a34c0b85ca9043ef78d

SHA1
152935284671c95baad34cf1db314a4ee5eeeb13

SHA256
7096a7a14a36d8d36e172f8585332189927a9eaf1d58474c6a5ea95ec0c66a01

SHA512
d929a73fec55600bfefa848f4b2130ef724929548e35e6f67dd64b7b8bf05e01c42330413e181337d7db45ee8e3acecfdeeae9c4a21d48467ced6ae341bc728a

Download Submit
C:\Users\Admin\Pictures\vxhiw15JNxqYM1TebDKl4YQC.exe

Filesize
7KB

MD5
5b423612b36cde7f2745455c5dd82577

SHA1
0187c7c80743b44e9e0c193e993294e3b969cc3d

SHA256
e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

SHA512
c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
3f7a7e6955b8c9113b1995c7e966ba5d

SHA1
7e051a97ec1c14113cc39ddec366250cd22546a1

SHA256
6037f4781fa7cbe669cd3f153232bbd94569ad07563c71be8747564111e81762

SHA512
fd213135b7ff2e3e5929fd852cd63a266e71722fae643bd45d6c2f9c2d58590dfc7b353f0835c54e6ce5d7355cf360030954fbe022abccd9b182f763bc765145

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
f22064adeb38a682c7ce0c5e718322fc

SHA1
0f533f79ad76531366da7e369cae83c3cc3b3cab

SHA256
7d8dd28ffdaedaf8af6edc93922ed1d01fcc7f65dbef1171e5defbf08991455b

SHA512
aa974fa1821118b38bd46d0b0a67da7cd8214397d4f28cbd0a176c598cefe4b508cc976b427f22e68efba2e28cc432b0ed265892e7b8658cd0bb3ce9102078e5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
4a786709df7c4004154649802746ab4f

SHA1
bf80ca1ae4cb3f55a10e1bfc9fd39ce01f9862db

SHA256
5acb5c4b76ff198a99b11cfafa5cffc8581f4e5974e28b5a9c2be70a7c235b90

SHA512
84f161e278e29e5ff53b42f0aef39c34173f4365a125e826a4c1b5fb05fa6c7ec10bb242c31b313d820bd2d4cb90d0d55116975129316ca6f3f53e3e0ae1b7c6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
ee0177a2bb0bd3197e347c5af55c5403

SHA1
0da0da72bf9eeb0753bb60a9fcfc510311754b61

SHA256
5c945014249236ee7de8e20a9a0c65efa9fd7d6633e989d66576c65ce7ce0e30

SHA512
9b16dfe2cd18f2f7c54c7e5b09d19a55b3ae8af2dd7128061809c08a67cb743c0df8603e30870a2cf7c21922d82b348603754e88180c59b122f03136c09d242e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
2ba96467c8a3bcf2d10a4294f7d0e3f5

SHA1
ff3030be6fa2e1ab2c9f64e71bfd5cbb14160da0

SHA256
60336e5111532ed766412fa340079cfff7ed713717384348aaa807882122d764

SHA512
c7f4240ade027630a130902d3139052848f49b93ced2f379bb41d09f939a0244320dfaebfd320fad2b52732cdc88654f7d0dbeea90478782c11e215d33b5d1d0

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/416-463-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/416-531-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/416-414-0x0000000004D90000-0x0000000005189000-memory.dmp

Filesize
4.0MB

Download
memory/416-424-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/416-543-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/416-449-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/1096-6-0x0000000005760000-0x0000000005770000-memory.dmp

Filesize
64KB

Download
memory/1096-5-0x0000000074980000-0x0000000075130000-memory.dmp

Filesize
7.7MB

Download
memory/1096-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1096-169-0x0000000074980000-0x0000000075130000-memory.dmp

Filesize
7.7MB

Download
memory/1096-171-0x0000000005760000-0x0000000005770000-memory.dmp

Filesize
64KB

Download
memory/1424-140-0x0000000005E40000-0x0000000006194000-memory.dmp

Filesize
3.3MB

Download
memory/1424-184-0x000000007F650000-0x000000007F660000-memory.dmp

Filesize
64KB

Download
memory/1424-167-0x0000000002E70000-0x0000000002E80000-memory.dmp

Filesize
64KB

Download
memory/1424-170-0x00000000068B0000-0x00000000068F4000-memory.dmp

Filesize
272KB

Download
memory/1424-163-0x0000000006320000-0x000000000633E000-memory.dmp

Filesize
120KB

Download
memory/1424-173-0x0000000007670000-0x00000000076E6000-memory.dmp

Filesize
472KB

Download
memory/1424-296-0x0000000007A60000-0x0000000007A6E000-memory.dmp

Filesize
56KB

Download
memory/1424-161-0x0000000074980000-0x0000000075130000-memory.dmp

Filesize
7.7MB

Download
memory/1424-176-0x0000000007D70000-0x00000000083EA000-memory.dmp

Filesize
6.5MB

Download
memory/1424-178-0x00000000076F0000-0x000000000770A000-memory.dmp

Filesize
104KB

Download
memory/1424-302-0x0000000007A70000-0x0000000007A84000-memory.dmp

Filesize
80KB

Download
memory/1424-177-0x0000000002E70000-0x0000000002E80000-memory.dmp

Filesize
64KB

Download
memory/1424-113-0x0000000005530000-0x0000000005B58000-memory.dmp

Filesize
6.2MB

Download
memory/1424-311-0x0000000007B60000-0x0000000007B7A000-memory.dmp

Filesize
104KB

Download
memory/1424-182-0x00000000078B0000-0x00000000078E2000-memory.dmp

Filesize
200KB

Download
memory/1424-162-0x0000000002E70000-0x0000000002E80000-memory.dmp

Filesize
64KB

Download
memory/1424-195-0x0000000007890000-0x00000000078AE000-memory.dmp

Filesize
120KB

Download
memory/1424-196-0x00000000078F0000-0x0000000007993000-memory.dmp

Filesize
652KB

Download
memory/1424-185-0x000000006F0C0000-0x000000006F414000-memory.dmp

Filesize
3.3MB

Download
memory/1424-197-0x00000000079E0000-0x00000000079EA000-memory.dmp

Filesize
40KB

Download
memory/1424-183-0x000000006F050000-0x000000006F09C000-memory.dmp

Filesize
304KB

Download
memory/1424-198-0x0000000007AA0000-0x0000000007B36000-memory.dmp

Filesize
600KB

Download
memory/1424-129-0x00000000053E0000-0x0000000005446000-memory.dmp

Filesize
408KB

Download
memory/1424-215-0x0000000007A00000-0x0000000007A11000-memory.dmp

Filesize
68KB

Download
memory/1424-321-0x0000000074980000-0x0000000075130000-memory.dmp

Filesize
7.7MB

Download
memory/1424-314-0x0000000007B40000-0x0000000007B48000-memory.dmp

Filesize
32KB

Download
memory/1824-0-0x0000015D94280000-0x0000015D9428A000-memory.dmp

Filesize
40KB

Download
memory/1824-7-0x00007FFCE4F40000-0x00007FFCE5A01000-memory.dmp

Filesize
10.8MB

Download
memory/1824-3-0x0000015D946C0000-0x0000015D946D0000-memory.dmp

Filesize
64KB

Download
memory/1824-2-0x00007FFCE4F40000-0x00007FFCE5A01000-memory.dmp

Filesize
10.8MB

Download
memory/1824-1-0x0000015D94630000-0x0000015D9468E000-memory.dmp

Filesize
376KB

Download
memory/1844-120-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/1844-425-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/1844-293-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/1844-80-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/1844-401-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/1844-77-0x0000000004D20000-0x000000000511E000-memory.dmp

Filesize
4.0MB

Download
memory/1844-175-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/1844-181-0x0000000004D20000-0x000000000511E000-memory.dmp

Filesize
4.0MB

Download
memory/1844-85-0x0000000005120000-0x0000000005A0B000-memory.dmp

Filesize
8.9MB

Download
memory/2200-276-0x00007FF76F950000-0x00007FF7704D6000-memory.dmp

Filesize
11.5MB

Download
memory/2200-239-0x00007FF76F950000-0x00007FF7704D6000-memory.dmp

Filesize
11.5MB

Download
memory/2460-532-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/2460-450-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/2896-94-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2896-92-0x0000000002E80000-0x0000000002EA7000-memory.dmp

Filesize
156KB

Download
memory/2896-91-0x0000000002D40000-0x0000000002E40000-memory.dmp

Filesize
1024KB

Download
memory/2896-341-0x0000000000400000-0x0000000002D38000-memory.dmp

Filesize
41.2MB

Download
memory/2896-428-0x0000000000400000-0x0000000002D38000-memory.dmp

Filesize
41.2MB

Download
memory/2896-154-0x0000000000400000-0x0000000002D38000-memory.dmp

Filesize
41.2MB

Download
memory/2896-93-0x0000000000400000-0x0000000002D38000-memory.dmp

Filesize
41.2MB

Download
memory/2896-221-0x0000000000400000-0x0000000002D38000-memory.dmp

Filesize
41.2MB

Download
memory/2944-434-0x0000000005BD0000-0x0000000005F24000-memory.dmp

Filesize
3.3MB

Download
memory/3336-174-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/3336-78-0x0000000004DE0000-0x00000000051DA000-memory.dmp

Filesize
4.0MB

Download
memory/3336-89-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/3336-238-0x0000000004DE0000-0x00000000051DA000-memory.dmp

Filesize
4.0MB

Download
memory/3336-114-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/3336-356-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/3336-274-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/3336-345-0x0000000000400000-0x000000000311B000-memory.dmp

Filesize
45.1MB

Download
memory/3416-179-0x0000000002FA0000-0x00000000030A0000-memory.dmp

Filesize
1024KB

Download
memory/3416-73-0x0000000002F00000-0x0000000002F6C000-memory.dmp

Filesize
432KB

Download
memory/3416-74-0x0000000000400000-0x0000000002D51000-memory.dmp

Filesize
41.3MB

Download
memory/3416-72-0x0000000002FA0000-0x00000000030A0000-memory.dmp

Filesize
1024KB

Download
memory/3416-106-0x0000000000400000-0x0000000002D51000-memory.dmp

Filesize
41.3MB

Download
memory/3416-487-0x0000000000400000-0x0000000002D51000-memory.dmp

Filesize
41.3MB

Download
memory/3792-343-0x0000000007700000-0x0000000007714000-memory.dmp

Filesize
80KB

Download
memory/3792-165-0x0000000074980000-0x0000000075130000-memory.dmp

Filesize
7.7MB

Download
memory/3792-180-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3792-402-0x0000000074980000-0x0000000075130000-memory.dmp

Filesize
7.7MB

Download
memory/3792-121-0x0000000004FD0000-0x0000000004FF2000-memory.dmp

Filesize
136KB

Download
memory/3792-130-0x0000000005860000-0x00000000058C6000-memory.dmp

Filesize
408KB

Download
memory/3792-166-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3792-109-0x0000000004A00000-0x0000000004A36000-memory.dmp

Filesize
216KB

Download
memory/3792-164-0x0000000006060000-0x00000000060AC000-memory.dmp

Filesize
304KB

Download
memory/3792-222-0x000000006F050000-0x000000006F09C000-memory.dmp

Filesize
304KB

Download
memory/3792-168-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3792-223-0x000000006F0C0000-0x000000006F414000-memory.dmp

Filesize
3.3MB

Download
memory/4444-556-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/4444-539-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download