lumma | 5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db

Analysis

max time kernel
29s
max time network
152s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe
Size

403KB
MD5

6fd36225fe8b30bef2ba91748be1be69
SHA1

1dd29bec09dcb70474865f9aa06158d4ba60df77
SHA256

5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db
SHA512

5eb88f76f22aa8edc48545047040e00333e789922ffeee01d79504f5197e0130e2f207e34c3961de6bde888506b0279c04ceadd9147812d938266fdfad172fc2
SSDEEP

12288:I07ad1g0uGMpnLs5AdFTVuHxBZ9Cwd4hwJqXrBEO:1dHQHNEdr7Bt

Score

10^/10

lumma vidar 4b74261d834413e886f920a1e9dc5b33 a669a86f8433a1e88901711c0f772c97 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

4b74261d834413e886f920a1e9dc5b33

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

lumma

Extracted

Family

vidar

Version

Botnet

a669a86f8433a1e88901711c0f772c97

https://t.me/jamsemlg

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

lumma

https://possiwreeste.site/api

https://underlinemdsj.site/api

Signatures

Detect Vidar Stealer 23 IoCs

stealer

resource	yara_rule
behavioral1/memory/2108-23-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-17-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-14-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-11-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-10-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-9-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-19-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-162-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-181-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-215-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-234-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-296-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-366-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-385-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-428-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-447-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1628-577-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1628-579-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1628-575-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1628-572-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1628-570-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1628-568-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2108-685-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
664	DGHIDHCAAK.exe
2388	HDHJEBFBFH.exe
2232	GCFBAKKJDB.exe
1420	AdminEGDBAFHJJD.exe
1588	AdminIEGCBFHJDH.exe

Loads dropped DLL 18 IoCs

pid	Process
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2752	RegAsm.exe
2752	RegAsm.exe
3064	cmd.exe
2288	cmd.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 664 set thread context of 1984	664	DGHIDHCAAK.exe	37
PID 2388 set thread context of 1628	2388	HDHJEBFBFH.exe	41
PID 2232 set thread context of 2752	2232	GCFBAKKJDB.exe	44
PID 1420 set thread context of 1976	1420	AdminEGDBAFHJJD.exe	53
PID 1588 set thread context of 2384	1588	AdminIEGCBFHJDH.exe	59

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
704	1984	WerFault.exe	37

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminEGDBAFHJJD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminIEGCBFHJDH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DGHIDHCAAK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HDHJEBFBFH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GCFBAKKJDB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1520	timeout.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2108	RegAsm.exe
2752	RegAsm.exe
2108	RegAsm.exe
1628	RegAsm.exe
2752	RegAsm.exe
1628	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2000 wrote to memory of 2108	2000	5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe	31
PID 2108 wrote to memory of 664	2108	RegAsm.exe	35
PID 2108 wrote to memory of 664	2108	RegAsm.exe	35
PID 2108 wrote to memory of 664	2108	RegAsm.exe	35
PID 2108 wrote to memory of 664	2108	RegAsm.exe	35
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 664 wrote to memory of 1984	664	DGHIDHCAAK.exe	37
PID 1984 wrote to memory of 704	1984	RegAsm.exe	38
PID 1984 wrote to memory of 704	1984	RegAsm.exe	38
PID 1984 wrote to memory of 704	1984	RegAsm.exe	38
PID 1984 wrote to memory of 704	1984	RegAsm.exe	38
PID 2108 wrote to memory of 2388	2108	RegAsm.exe	39
PID 2108 wrote to memory of 2388	2108	RegAsm.exe	39
PID 2108 wrote to memory of 2388	2108	RegAsm.exe	39
PID 2108 wrote to memory of 2388	2108	RegAsm.exe	39
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2388 wrote to memory of 1628	2388	HDHJEBFBFH.exe	41
PID 2108 wrote to memory of 2232	2108	RegAsm.exe	42
PID 2108 wrote to memory of 2232	2108	RegAsm.exe	42
PID 2108 wrote to memory of 2232	2108	RegAsm.exe	42
PID 2108 wrote to memory of 2232	2108	RegAsm.exe	42
PID 2232 wrote to memory of 2752	2232	GCFBAKKJDB.exe	44
PID 2232 wrote to memory of 2752	2232	GCFBAKKJDB.exe	44
PID 2232 wrote to memory of 2752	2232	GCFBAKKJDB.exe	44
PID 2232 wrote to memory of 2752	2232	GCFBAKKJDB.exe	44
PID 2232 wrote to memory of 2752	2232	GCFBAKKJDB.exe	44
PID 2232 wrote to memory of 2752	2232	GCFBAKKJDB.exe	44
PID 2232 wrote to memory of 2752	2232	GCFBAKKJDB.exe	44

C:\Users\Admin\AppData\Local\Temp\5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe
"C:\Users\Admin\AppData\Local\Temp\5c0e7c82e65dfbf8b4416abe9734d66b52acfd695a0686107454f12698f329db.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\ProgramData\DGHIDHCAAK.exe
    "C:\ProgramData\DGHIDHCAAK.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 252
        5⤵
        Program crash
        
        PID:704
- - C:\ProgramData\HDHJEBFBFH.exe
    "C:\ProgramData\HDHJEBFBFH.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:1628
- - C:\ProgramData\GCFBAKKJDB.exe
    "C:\ProgramData\GCFBAKKJDB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2752
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminEGDBAFHJJD.exe"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3064
      - C:\Users\AdminEGDBAFHJJD.exe
        
        "C:\Users\AdminEGDBAFHJJD.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1420
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminIEGCBFHJDH.exe"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2288
      - C:\Users\AdminIEGCBFHJDH.exe
        
        "C:\Users\AdminIEGCBFHJDH.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:720
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EHJDGCBGDBKJ" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1944
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\CGDGHCBG

Filesize
92KB

MD5
a58d87b023e155c10b4e15fdfc6fcb06

SHA1
0ee449b782aeac54c0406adde543f19ecd9dfd38

SHA256
331b040f0bd7731b64e72a837ad86943379ff02e239c305d200108fe7e3c8c61

SHA512
1965574101a71a640efb135a49c4a968fd5feb328779c33936047afb2209424b44fba3a1ccdacee959ce5a016f22b49c8b42dc543476b11f83df0feb1b080eae

Download Submit
C:\ProgramData\GHDBAFIIECBFHIEBKJJK

Filesize
6KB

MD5
6d359c219ceb6840ad04f29a5cccf4b9

SHA1
0f0bc3c9e6c8f903652816d2d3cd5b7f394d85b2

SHA256
60fc14a82f864ff815cf398beebced9191c4e72335f92a531d2aeb7964812b9c

SHA512
ab8ab78af93817e3cf50e60bc7056f945b42b891e5259df6f31fea3770addde1dc8df63596ccce656942cf02ada494a2755bf30badfdd8454127bfa6eb1e2df6

Download Submit
C:\ProgramData\HCBFIJJECFIE\FCFIEH

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\ProgramData\HCBFIJJECFIE\HIEHDA

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\ProgramData\freebl3.dll

Filesize
116KB

MD5
62f04660859fbbf4c2f8487e6ff54986

SHA1
844ad956896df358c454bf9546418af85141ed29

SHA256
a5c93a106310d34b21503787e0ab219cb661413b2ccb1030090c8a62a43c3eb5

SHA512
6d0d3f7309843735d4bcc3589a2011aef0903919e5a5a566da59d025d424720be583f58d1ec836b78eda31248fc95e1f0453eb7b29a8a38cc7f732dea571b59c

Download Submit
C:\ProgramData\msvcp140.dll

Filesize
1024B

MD5
458532781441ed7f121a3cc4e6f63b14

SHA1
f3e84e6a4179fb84f0b0a008f858fd878a1d35b5

SHA256
be23585ccb1f4d5389af6747a03cb83f4508e333ea885027d04045fb7c6b5a5c

SHA512
3b823102f72d45527c51ad39de238cb4dc38a1b6bfa25c0087aa35d65f3628c4f0f2b718bdd8dc7abf4c69f67944d63ca2b7f402047946ce5d7950a961aefb56

Download Submit
C:\ProgramData\nss3.dll

Filesize
58KB

MD5
0d7e7e50702114556e921589889af95f

SHA1
16fc133119fdb8432274f9fd59c910b692919083

SHA256
69eb6d73921e3e61addf344223700d5e789682869f78239bdf4f6543ac869be7

SHA512
e57360d5f1530a7d6b9546173067bf8f727091026facd2574f5252880dfd89b4cc345066528611d63d5faa2aaf7750cf34a307b9f280dc558c59b42ade538387

Download Submit
C:\ProgramData\vcruntime140.dll

Filesize
5KB

MD5
67f218c11ef13d92d970443b146d8bb2

SHA1
2a4fbf8723cc106feb52f75f86398596e93b5248

SHA256
33d2763b1e47e5f71db902fdc46b4fa393e41c9c4ffa614ce3fa19cd6e574043

SHA512
e88f452d7df5fb38ec4ee52ec287eb1651e18f5b4c0b462bcd63471f3311fb60c22f612f75f3bc2e44c4e53fdd47c6d21a9e315151207afcb1e2fbc0b5b34cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bd550b7bacc31033bf07cdb97a4fc92

SHA1
151478218b7c14bc697e51b0382ab36ce24907c2

SHA256
9cb2207c0d0a5552dcd17775f3d775b9f669b93546a8ffc4dd03a984c0453a96

SHA512
f05ae37943d92e3f5fc3d624a4537d79a3d24a338cb7f5c82f25787ddb90b3e62531c481028f43f69d8a3b525cf519b807e709f87dd45fd5519fd992027f13d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f629e3f2b9b029dce551861c50a24fc

SHA1
8e813d81f04ee3bb594b02719bc748840796372c

SHA256
6a761fd01c936bf65531a3eca6d12b9357e6cfb68c75d73afa38e8e5b24f6921

SHA512
219ccb4776fdbf4d8e7f4f864f316dfa93b6786b86ab593bcd744c4f4ea347b8de3048242ec2f87673c3dd8fb49a989a17af50145735f9713aa486c07151d564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b50de8232a0605f09d5221b745b6af23

SHA1
226056ff77f2c4d2693155980a22e68e06c1d45c

SHA256
c29cac011bbaf6431c7012adcef723f193f951b7e93def7d8556c6619de909ee

SHA512
9b0f70d4e419eb182aa4052951a457954a883e4a7069a19d02290b28814952197309bd87d64d128be913ae8efc57ff89c30cfe54f219e04a3371466d89b301e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ab95a59e3053d471513d8bec9ab9a3dd

SHA1
805a66bfd8fa256c5d3bcff233065b5dcff14f0b

SHA256
27c0e279273641c6fbcbdd6144157a804f8730089239400264e96913a3a542c5

SHA512
401fb018a65146851929ea007b82061d58d1da75950cd9654ed9ce7d4aa20a0a906c3690a0093f21baf07d771ac7fabec416225efc52163e51b48f26d060f36a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\76561199780418869[1].htm

Filesize
33KB

MD5
f0c61de597fdd82c42e7308a4c8f2ee5

SHA1
c3d1175eac2b5c954eb9c6b4c4c642de21e2ea11

SHA256
7cc52d7e1a89de438e5eb5ed77285108326a32a682c07ee4027dca6ba1f864a8

SHA512
35620e9345eff01948062f0ff8f944d9ff313bcda16b8258980fedee66e8fb79996fdf15da66139b67e60c1474a529e25eef607bacfb1f1ebb9f4a8890e310ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\76561199780418869[1].htm

Filesize
33KB

MD5
66282bb2cf2201964ee8125728887b36

SHA1
15866ac76a73247b87c57b5891a7f20113343bcc

SHA256
8142698013e64f9da4ecf1cc1ab6dcce747df4fa50730bfdb41ccc072bcf9afb

SHA512
e1a9e40825c22d0f4eefacba43805e7c58fb3ba1015ad8768eee7b673b7d4bb4d1d9c089c178683dc8aa688504bc718b35aa3e4a54e617ce0e87e4347ebfa72d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB8A7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8C9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\ProgramData\DGHIDHCAAK.exe

Filesize
371KB

MD5
32c2e31313c3df4a7a36c72503a5beba

SHA1
1c88051112dab0e306cadd9ee5d65f8dc229f079

SHA256
f1fa2872fcd33c6dbce8d974c0c0381c0762d46a53ceaca14a29727ad02baef3

SHA512
ee04d786e53f7fa203dbc4f8c018c72a907dabbd2d1c57e219b2ccc2dbd9d79a4ee8580b98f9b5c5024e628c0207cdd2bf93b9468e457f4ee00326c7c689f1ae

Download Submit
\ProgramData\GCFBAKKJDB.exe

Filesize
326KB

MD5
2832fbde1cf7ea83bd6fd6a4a5e8fe15

SHA1
1ced7a749d257091e0c3b75605fd3bc005e531de

SHA256
2b8bcd9d7d072feb114e0436dc10aa80fda52cdd46a4948ea1ae984f74898375

SHA512
c69f1197a0c74d057ab569d35c9af675fc465ce6abcc6c8fc32b316d3586871a426d7ab904c43827be7413748f0f45f7f3689076ca031fd858a4a8abf78b9299

Download Submit
\ProgramData\HDHJEBFBFH.exe

Filesize
404KB

MD5
38dabc7063c0a175a12c30bd44cf3dbc

SHA1
6d7aabebd8a417168e220c7497f4bc38c314da3b

SHA256
de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89

SHA512
674760ad37cf7886ca4cd786e4d1966d3827fdad008a85a125e18bd474d073dae8d4296427253bb86e78d3173a300611ee5eb2e01c1f968700679350fc17a24d

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/664-534-0x0000000073280000-0x000000007396E000-memory.dmp

Filesize
6.9MB

Download
memory/664-502-0x0000000000210000-0x0000000000270000-memory.dmp

Filesize
384KB

Download
memory/664-501-0x000000007328E000-0x000000007328F000-memory.dmp

Filesize
4KB

Download
memory/1420-781-0x0000000000080000-0x00000000000EA000-memory.dmp

Filesize
424KB

Download
memory/1588-826-0x0000000000F20000-0x0000000000F80000-memory.dmp

Filesize
384KB

Download
memory/1628-566-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1628-575-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1628-572-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1628-570-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1628-579-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1628-577-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1628-564-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1628-568-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1984-515-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1984-514-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1984-513-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1984-516-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1984-517-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1984-521-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1984-523-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2000-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

Filesize
4KB

Download
memory/2000-1-0x0000000000BC0000-0x0000000000C28000-memory.dmp

Filesize
416KB

Download
memory/2000-22-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/2000-16-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/2108-200-0x00000000202F0000-0x000000002054F000-memory.dmp

Filesize
2.4MB

Download
memory/2108-5-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-296-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-234-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-3-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-23-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-447-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-215-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-385-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-181-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-685-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-162-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-19-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-366-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-7-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-9-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-10-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-11-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2108-14-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-428-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2108-17-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2232-608-0x0000000000BF0000-0x0000000000C46000-memory.dmp

Filesize
344KB

Download
memory/2388-552-0x0000000001020000-0x000000000108A000-memory.dmp

Filesize
424KB

Download
memory/2752-618-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/2752-620-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download