Overview

overview

10

Static

static

3

14165c7b3d...6e.exe

windows7-x64

10

14165c7b3d...6e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28-09-2024 01:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14165c7b3da199b6b30c325c1906d87578ceebe57cda17a1bd87aae2c1aaf06e.exe

  • Size

    1.9MB

  • MD5

    e3aa1042729bc6d0ddbed39ddb48b872

  • SHA1

    d9642336d578f012359bbd1f49c90798a76d92ac

  • SHA256

    14165c7b3da199b6b30c325c1906d87578ceebe57cda17a1bd87aae2c1aaf06e

  • SHA512

    9213373356cd9a9e6bb30f1f434619c1dc16a3eb0bc653860e4e41249c9963145f44ea3d2327c7ee6ee5b7dccf8126957699845357e7bb689f8f532ec263f33e

  • SSDEEP

    49152:ArxiFKgvQhg6nnn9b8Tpwoj03t9E9ru/+1j:VIOig6nn58TZ03z8Sm

Score
10/10
amadeyasyncratlummaredlinestealc@oleh_pspdefaultdefault2fed3aalivetrafficnewbundle2savetg cloud @rlreborn admin @fatherofcarderscredential_accessdiscoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

136.244.88.135:17615

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29862

Extracted

Family

redline

Botnet

newbundle2

C2

185.215.113.67:15206

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

stealc

Botnet

save

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

C2

47.238.55.14:4449

Mutex

rqwcncaesrdtlckoweu

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

lumma

C2

https://defenddsouneuw.shop/api

https://reinforcenh.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 14 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 48 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 6 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 62 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1252
      • C:\Users\Admin\AppData\Local\Temp\14165c7b3da199b6b30c325c1906d87578ceebe57cda17a1bd87aae2c1aaf06e.exe
        "C:\Users\Admin\AppData\Local\Temp\14165c7b3da199b6b30c325c1906d87578ceebe57cda17a1bd87aae2c1aaf06e.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2968
          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2476
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1156
          • C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3028
            • C:\Users\Admin\AppData\Roaming\Sw2eEN23LE.exe
              "C:\Users\Admin\AppData\Roaming\Sw2eEN23LE.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:436
            • C:\Users\Admin\AppData\Roaming\J6S2QRS40J.exe
              "C:\Users\Admin\AppData\Roaming\J6S2QRS40J.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1016
          • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2452
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1180
              • C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe
                "C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2876
                • C:\Users\Admin\AppData\Local\Temp\is-DI1UU.tmp\javumar2.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-DI1UU.tmp\javumar2.tmp" /SL5="$801CE,12434628,845824,C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: GetForegroundWindowSpam
                  PID:5748
              • C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe
                "C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:5524
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 5524 -s 136
                  7⤵
                  • Loads dropped DLL
                  PID:5648
          • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
            "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:2216
          • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
            "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2416
            • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
              C:\Users\Admin\AppData\Local\Temp\svchost015.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2464
          • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
            "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:388
          • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
            "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2732
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1636
          • C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
            "C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2168
          • C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
            "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2764
          • C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
            "C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2100
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 784
              5⤵
              • Loads dropped DLL
              • Program crash
              PID:5720
          • C:\Users\Admin\AppData\Local\Temp\1000354001\3ba726aa04.exe
            "C:\Users\Admin\AppData\Local\Temp\1000354001\3ba726aa04.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5672
          • C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
            "C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6948
          • C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
            "C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:7016
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c start context.exe
              5⤵
                PID:3392
                • C:\Users\Admin\AppData\Local\Temp\context.exe
                  context.exe
                  6⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  PID:3428
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                    7⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:3520
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist
                      8⤵
                      • Enumerates processes with tasklist
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3548
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /I "wrsa opssvc"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:3556
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist
                      8⤵
                      • Enumerates processes with tasklist
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3596
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:3604
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c md 607698
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:3636
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:3648
                    • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                      Waters.pif Q
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:3660
                    • C:\Windows\SysWOW64\choice.exe
                      choice /d y /t 5
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:3668
            • C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
              "C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:5740
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                5⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4316
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2728
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "wrsa opssvc"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:236
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2992
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2816
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c md 607698
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1352
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /V "MaskBathroomCompositionInjection" Participants
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1704
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1192
                • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                  Waters.pif Q
                  6⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2864
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "Waters.pif" && timeout 1 && del Waters.pif && Exit"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:4608
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im "Waters.pif"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4748
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:2204
                • C:\Windows\SysWOW64\choice.exe
                  choice /d y /t 5
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3040
            • C:\Users\Admin\AppData\Local\Temp\1000369001\PkContent.exe
              "C:\Users\Admin\AppData\Local\Temp\1000369001\PkContent.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4620
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat
                5⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2908
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2348
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "wrsa opssvc"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2232
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1560
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2844
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c md 724598
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3156
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /V "WowLiberalCalOfficer" Weight
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3168
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3188
                • C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif
                  Thermal.pif y
                  6⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:3200
                  • C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
                    C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    PID:3760
                • C:\Windows\SysWOW64\choice.exe
                  choice /d y /t 5
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3220
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2172
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:3128
        • C:\Windows\SysWOW64\cmd.exe
          cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
          2⤵
          • Drops startup file
          • System Location Discovery: System Language Discovery
          PID:3100
        • C:\Windows\SysWOW64\cmd.exe
          cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\Admin\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit
          2⤵
          • Drops startup file
          • System Location Discovery: System Language Discovery
          PID:3240

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Modify Registry

      2
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      4
      T1552

      Credentials In Files

      4
      T1552.001

      Discovery

      Process Discovery

      1
      T1057

      Query Registry

      5
      T1012

      System Information Discovery

      3
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Virtualization/Sandbox Evasion

      2
      T1497

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        acb06fde56156532141365357e9ec38e

        SHA1

        750b0356d66e2093de19276964490bc644c351a2

        SHA256

        c1643215be53d4811c7e8bf9887b483e2db97c8f0ba029f8e58942fdff5f5b89

        SHA512

        0b1c2a4f376dd6fac45b18a3ea8b5f5ac5559a2aa66b44ec15e936e4f2b1edb692d17eba21aa19aaab2046d3ddfbcfb0c0f37cf2be5558fdaa73f01a12622426

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
        Filesize

        314KB

        MD5

        f2d385ddbb2edafacd070f103f7f1576

        SHA1

        5ee6cb80bc943476067c148e5c16738b7b062029

        SHA256

        d56a1a5602b5e72b8b9b2d6f2e0c5bc689682d0983f30b8c66dad9af093679b3

        SHA512

        e6ee00d15483ef29fb7e48ed28833ce5059f7bfada96b92c350246f6032f85d318571950bf6d2ee557e417e87d24d90965aa1523782416792fa7eb7354266df5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
        Filesize

        1006KB

        MD5

        c005d4ffa3e28c22b41a9d222598260a

        SHA1

        57cc3a6540bc38c649ddfdd54fa4f3c8a2423677

        SHA256

        799d10acbb0e2886c4d32c771964f4c2cb47f93c817cdc26a9acaefa3ba042cb

        SHA512

        ce39903c46160deeee1c7b362000361a3f5a9243b2e180bbaafa5b8ab09cc09ca413ce32f4deb2074fa928110d25b3dae7465c849fc388a58ddf649a9caa3a68

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
        Filesize

        416KB

        MD5

        f5d7b79ee6b6da6b50e536030bcc3b59

        SHA1

        751b555a8eede96d55395290f60adc43b28ba5e2

        SHA256

        2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

        SHA512

        532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        Filesize

        187KB

        MD5

        7a02aa17200aeac25a375f290a4b4c95

        SHA1

        7cc94ca64268a9a9451fb6b682be42374afc22fd

        SHA256

        836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

        SHA512

        f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe
        Filesize

        12.8MB

        MD5

        534704bd30b2d7af9e4537980a8474b1

        SHA1

        e4c78f68d7cb4e7c7ded41bf952044a9b5a8d8f0

        SHA256

        ea8f9e43b89dd8c9ecd7d5413fe82ca75e5acd0d99ea00b9841117361676df0a

        SHA512

        44e51dacdeffc57f968724cc10111499b6cad4a824393241daa4337e6d614ff097bd0b905e04edda7de9a066cc6b7b4994dd077e3c84db522270e0431f6ce989

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe
        Filesize

        989KB

        MD5

        f0cb6a0555896e017b2f778a847b0196

        SHA1

        918e72af4ce78588f2d6fad65a91256ad69e1d8c

        SHA256

        8c3c459481bb940ad69a704a041516f42012775c60f288c731a394954e3eda3c

        SHA512

        af5ab34ba0faad80926c39bd97ae9e7521e1ae7a94ef7e71c20a837797cceaa01d728e186c8f75f754e535ff92a7c46e721aad43076fd6b855520971e4251e80

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
        Filesize

        4.1MB

        MD5

        7fa5c660d124162c405984d14042506f

        SHA1

        69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f

        SHA256

        fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2

        SHA512

        d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
        Filesize

        409KB

        MD5

        a21700718c70ec5e787ad373cb72a757

        SHA1

        027554ab5ff3245e7617f3b83d6548bf7919f92e

        SHA256

        87e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6

        SHA512

        ea292a5442d9fe536e650a2bc5142dd3aef79c66930243897e0e87c57915f0a54e45e03e58daffb473f85fe10b963d4670050bff5ab3f91121d21d463e25659b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
        Filesize

        314KB

        MD5

        ff5afed0a8b802d74af1c1422c720446

        SHA1

        7135acfa641a873cb0c4c37afc49266bfeec91d8

        SHA256

        17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

        SHA512

        11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
        Filesize

        352KB

        MD5

        2f1d09f64218fffe7243a8b44345b27e

        SHA1

        72553e1b3a759c17f54e7b568f39b3f8f1b1cdbe

        SHA256

        4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2

        SHA512

        5871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
        Filesize

        304KB

        MD5

        58e8b2eb19704c5a59350d4ff92e5ab6

        SHA1

        171fc96dda05e7d275ec42840746258217d9caf0

        SHA256

        07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834

        SHA512

        e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000354001\3ba726aa04.exe
        Filesize

        1.7MB

        MD5

        470ac80f769e69057c61d2da35b2c9ff

        SHA1

        82b4d1855a844e8427989e16cba53f478bde123f

        SHA256

        73af3e47903a40fa3af542f93cfc15f1c1063ee623ddc7a42453ef5212630fcf

        SHA512

        084277a54dce5d93659bc9fe19cac3bad3d10e33b9201dc7af700d881a633d520214079e258482d261d887679728ae80cdbff13b2ab3f1978a6a0775c4779fb9

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000355001\9fc57e8848.exe
        Filesize

        832KB

        MD5

        f2b87ea0159ebdae05ed4ed45a67d9e8

        SHA1

        453b8d87f3f6c258cc54f1af9eee74edf7eb9dbe

        SHA256

        c6501257de863d26beb6247727269073317e1b4c6b70fd7c4c7f7095698d382f

        SHA512

        bad5773d991dc188f82dd67ae4a3698ec9ed6f55cadb815484cbeff53b63a3ce5b9cdbbe8f595ae79d85e6fc1ca5150c388d25159e387682d722826cf1bf84b5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
        Filesize

        352KB

        MD5

        2fe92adf3fe6c95c045d07f3d2ecd2ed

        SHA1

        42d1d4b670b60ff3f27c3cc5b8134b67e9c4a138

        SHA256

        13167320a0e8266a56694be70a9560c83e2c645d6eeaa147b9ae585c2960ebb2

        SHA512

        0af7b4a3ce3981707ca450b90829a4a8e933ea3cd3affbce738265a1a0647e96323117db325d0e5e3884f67f36b21b8c955b6c3c6dda21d9b01212e28ef88d65

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
        Filesize

        6KB

        MD5

        c042782226565f89ce3954489075e516

        SHA1

        256dd5ba42837a33c7aa6cb71cef33d5617117ee

        SHA256

        a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

        SHA512

        9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
        Filesize

        1.3MB

        MD5

        2b01c9b0c69f13da5ee7889a4b17c45e

        SHA1

        27f0c1ae0ddeddc9efac38bc473476b103fef043

        SHA256

        d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

        SHA512

        23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000369001\PkContent.exe
        Filesize

        810KB

        MD5

        87c051a77edc0cc77a4d791ef72367d1

        SHA1

        5d5bab642235f0af7d9afe3cacec5ae2a4cfc8e5

        SHA256

        b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c

        SHA512

        259a3f823d5051fcc9e87ceacf25557ab17f5d26ff4f0c17801d9ef83a23d2a51261a73e5ba9c3caf1ca2feb18a569458f17a2a5d56b542b86d6a124a42d4c2c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        Filesize

        1.9MB

        MD5

        e3aa1042729bc6d0ddbed39ddb48b872

        SHA1

        d9642336d578f012359bbd1f49c90798a76d92ac

        SHA256

        14165c7b3da199b6b30c325c1906d87578ceebe57cda17a1bd87aae2c1aaf06e

        SHA512

        9213373356cd9a9e6bb30f1f434619c1dc16a3eb0bc653860e4e41249c9963145f44ea3d2327c7ee6ee5b7dccf8126957699845357e7bb689f8f532ec263f33e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\607698\Q
        Filesize

        794KB

        MD5

        7b5632dcd418bcbae2a9009dbaf85f37

        SHA1

        32aaf06166854718f0bcbb2f7173c2732cfb4d33

        SHA256

        361e9c3b62719b79bc280420b5f710e160fd55f2250bf605911ded7162483db4

        SHA512

        c834e90ccf2d35529c294319b8e9a49db7a7d67d0567e0739131d5af51170db32076d68147dc101f8047a75cb5b2275b25a9c8346a99a146a6798b9764316838

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif
        Filesize

        7KB

        MD5

        39da73cd66f2892b2ef48ef53a4b8bfb

        SHA1

        e99865e87939919d0201171852eed17ef3f2306b

        SHA256

        50d12b8e5a353b9565c6d059dac223c2b4ac5f8a57462db44a7dd814eaa3a254

        SHA512

        ad1a7ae593d90ef75c07a134a77520ff024276d7360b4dc8e042e956b9240bc8707abd6728f27f2f0e5b554b553631eb2fde6a71e86347a871ed7641b2c25882

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Cab22DE.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar30F5.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tmp146B.tmp
        Filesize

        2KB

        MD5

        1420d30f964eac2c85b2ccfe968eebce

        SHA1

        bdf9a6876578a3e38079c4f8cf5d6c79687ad750

        SHA256

        f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

        SHA512

        6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        Filesize

        2.9MB

        MD5

        b826dd92d78ea2526e465a34324ebeea

        SHA1

        bf8a0093acfd2eb93c102e1a5745fb080575372e

        SHA256

        7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

        SHA512

        1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-457978338-2990298471-2379561640-1000\76b53b3ec448f7ccdda2063b15d2bfc3_7ab03691-fc7c-4787-903d-423aed4b9dc2
        Filesize

        2KB

        MD5

        476cf7ff56aa4d060a159d012c2cfeaf

        SHA1

        6b18605188451e8d2d6f995079712e167d50fc12

        SHA256

        66bf9187c3d826f0cc76996a96678ee2a825247d13afd02418b62690a944a2d5

        SHA512

        260544c4eea390fa07e8c8d77bf3c0e8079a1b8b2e9004e378ee14efe7eb3303368f34c5edbfe6f27ae362450da62fc8c4bda12537512571c201c915e1591ae0

        Download Submit

      • C:\Users\Public\Desktop\Google Chrome.lnk
        Filesize

        2KB

        MD5

        64dac8316063005732778edd56bb99ca

        SHA1

        5dfb87b3d5091dda07ddd2db73775e964e4c32bc

        SHA256

        b6d0423b14c29e89ccee3beb38809675495faa35ff9a9cc7873ece4f2ff2ff3a

        SHA512

        06aadd7ac3d2fae26673ddc098554a3553e98b5520e94987774df9442b9effa9281a3b6a4b5d7a89f31a7d65a5e21dbe5351beeff45b4e7b9d2066e8bd6e29f5

        Download Submit

      • \ProgramData\mozglue.dll
        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        Download Submit

      • \ProgramData\nss3.dll
        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

        Download Submit

      • \Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
        Filesize

        963KB

        MD5

        1ef39c8bc5799aa381fe093a1f2d532a

        SHA1

        57eabb02a7c43c9682988227dd470734cc75edb2

        SHA256

        0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4

        SHA512

        13a9c267c4ceb2bd176f1339faa035ffeb08936deeeb4e38252ea43cfe487ea1c1876e4cc2a965548e767af02805a1da62885e6538da056be0c6fae33b637682

        Download Submit

      • \Users\Admin\AppData\Roaming\J6S2QRS40J.exe
        Filesize

        304KB

        MD5

        65c058e4a90d2ec70b03211d768b6ecc

        SHA1

        bf5af6f650759e5e612d42d72145660056737164

        SHA256

        5a00e3718afb5bfb18a6b1c824b680015733f0403af0d5663289a17ba8206cc3

        SHA512

        3d9114409f8096ce8a1d134a48235fbbad0c6c53f820707a951bac42c4f7ba6a38e98a50c9d929f049042263a7c0e24da8368d3aa4e934f5da79e9bda4a930aa

        Download Submit

      • \Users\Admin\AppData\Roaming\Sw2eEN23LE.exe
        Filesize

        490KB

        MD5

        b473c40205c61dc4750bc49f779908dd

        SHA1

        88a0fc0962099f0ac2d827d2c4d691ed9cade251

        SHA256

        8707c03158ba6395a11bdfd8c1b11eeedc2e052d3b55d73d0a5c64417e5fbd3b

        SHA512

        8fbaaa5bde30fe7c6e31a349c14e3bd710e92c4dbcca8cbdbaf34583887bc31e07e10a0223fc6c6c0d091787c296eba139ec91af44ec4ee6abbfb611493951d1

        Download Submit

      • memory/388-228-0x0000000000B30000-0x0000000000B9C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/436-82-0x0000000000020000-0x00000000000A0000-memory.dmp

        Filesize

        512KB

        Download

      • memory/1016-83-0x0000000001060000-0x00000000010B2000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1156-58-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1156-56-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1156-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1156-66-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1156-62-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1156-60-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1156-67-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1156-65-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1636-258-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1636-263-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1636-256-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1636-260-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1636-265-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1636-264-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/2100-409-0x00000000051B0000-0x000000000529E000-memory.dmp

        Filesize

        952KB

        Download

      • memory/2100-1506-0x0000000000C00000-0x0000000000C4C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/2100-415-0x00000000051B0000-0x0000000005298000-memory.dmp

        Filesize

        928KB

        Download

      • memory/2100-391-0x0000000000EA0000-0x0000000000F98000-memory.dmp

        Filesize

        992KB

        Download

      • memory/2100-417-0x00000000051B0000-0x0000000005298000-memory.dmp

        Filesize

        928KB

        Download

      • memory/2100-1109-0x00000000051B0000-0x0000000005298000-memory.dmp

        Filesize

        928KB

        Download

      • memory/2100-1112-0x00000000051B0000-0x0000000005298000-memory.dmp

        Filesize

        928KB

        Download

      • memory/2100-414-0x00000000051B0000-0x0000000005298000-memory.dmp

        Filesize

        928KB

        Download

      • memory/2100-1114-0x00000000051B0000-0x0000000005298000-memory.dmp

        Filesize

        928KB

        Download

      • memory/2100-1116-0x00000000051B0000-0x0000000005298000-memory.dmp

        Filesize

        928KB

        Download

      • memory/2100-1508-0x0000000000D00000-0x0000000000D54000-memory.dmp

        Filesize

        336KB

        Download

      • memory/2100-1505-0x0000000000B20000-0x0000000000B88000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2216-154-0x0000000000A90000-0x0000000000CD3000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2216-1551-0x0000000000A90000-0x0000000000CD3000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2216-181-0x0000000061E00000-0x0000000061EF3000-memory.dmp

        Filesize

        972KB

        Download

      • memory/2416-374-0x0000000000400000-0x000000000081B000-memory.dmp

        Filesize

        4.1MB

        Download

      • memory/2464-372-0x0000000000400000-0x0000000000643000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2464-1554-0x0000000000400000-0x0000000000643000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2464-364-0x0000000000400000-0x0000000000643000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2464-366-0x0000000000400000-0x0000000000643000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2464-370-0x0000000000400000-0x0000000000643000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2464-368-0x0000000000400000-0x0000000000643000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2464-375-0x0000000000400000-0x0000000000643000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2464-362-0x0000000000400000-0x0000000000643000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2464-376-0x0000000000400000-0x0000000000643000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2476-38-0x0000000000FA0000-0x0000000000FF4000-memory.dmp

        Filesize

        336KB

        Download

      • memory/2720-17-0x0000000000CC0000-0x0000000001194000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2720-3-0x0000000000CC0000-0x0000000001194000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2720-11-0x0000000000CC0000-0x0000000001194000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2720-6-0x0000000000CC0000-0x0000000001194000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2720-4-0x0000000000CC0000-0x0000000001194000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2720-2-0x0000000000CC1000-0x0000000000CEF000-memory.dmp

        Filesize

        184KB

        Download

      • memory/2720-0-0x0000000000CC0000-0x0000000001194000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2720-1-0x0000000077850000-0x0000000077852000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2732-252-0x0000000001020000-0x0000000001074000-memory.dmp

        Filesize

        336KB

        Download

      • memory/2764-335-0x0000000000A90000-0x0000000000AE2000-memory.dmp

        Filesize

        328KB

        Download

      • memory/2968-19-0x00000000012E1000-0x000000000130F000-memory.dmp

        Filesize

        184KB

        Download

      • memory/2968-393-0x00000000012E0000-0x00000000017B4000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2968-1539-0x0000000006370000-0x0000000006A09000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/2968-1545-0x0000000006370000-0x0000000006A09000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/2968-210-0x00000000012E0000-0x00000000017B4000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2968-18-0x00000000012E0000-0x00000000017B4000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2968-22-0x00000000012E0000-0x00000000017B4000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2968-1558-0x0000000006370000-0x0000000006A09000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/2968-1678-0x0000000006290000-0x00000000064D3000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2968-1677-0x0000000006290000-0x00000000064D3000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2968-21-0x00000000012E0000-0x00000000017B4000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2968-152-0x0000000006290000-0x00000000064D3000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2968-23-0x00000000012E0000-0x00000000017B4000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2968-163-0x00000000012E0000-0x00000000017B4000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2968-153-0x0000000006290000-0x00000000064D3000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2968-155-0x00000000012E0000-0x00000000017B4000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/3760-1710-0x00000000000D0000-0x00000000000E8000-memory.dmp

        Filesize

        96KB

        Download

      • memory/5672-1562-0x0000000001070000-0x0000000001709000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/5672-1559-0x0000000001070000-0x0000000001709000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/5672-1546-0x0000000001070000-0x0000000001709000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/7016-1608-0x0000000001260000-0x0000000001268000-memory.dmp

        Filesize

        32KB

        Download