Analysis
-
max time kernel
154s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 19:41
Static task
static1
Behavioral task
behavioral1
Sample
CFDI__Manager__12365.exe
Resource
win7v20201028
General
-
Target
CFDI__Manager__12365.exe
-
Size
809KB
-
MD5
5b7c3ff3556606c67a61527f81579eee
-
SHA1
75299ed8a21eebe1b1969e065e80f02ad21d4267
-
SHA256
82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f
-
SHA512
6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe -
Executes dropped EXE 3 IoCs
Processes:
57ss733k_1.exe3s1c7iag.exem1g777su1kug5e.exepid process 1632 57ss733k_1.exe 3540 3s1c7iag.exe 212 m1g777su1kug5e.exe -
Sets file execution options in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\57ss733k.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\57ss733k.exe\"" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\57ss733k.exe\"" explorer.exe -
Processes:
CFDI__Manager__12365.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CFDI__Manager__12365.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\ProgramData\Google Updater 2.09\desktop.ini explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
CFDI__Manager__12365.exeexplorer.exepid process 4000 CFDI__Manager__12365.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
CFDI__Manager__12365.exe57ss733k_1.exedescription pid process target process PID 832 set thread context of 4000 832 CFDI__Manager__12365.exe CFDI__Manager__12365.exe PID 1632 set thread context of 0 1632 57ss733k_1.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
explorer.exeCFDI__Manager__12365.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CFDI__Manager__12365.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CFDI__Manager__12365.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0" explorer.exe -
NTFS ADS 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe:14EDFC78 explorer.exe File created C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe:14EDFC78 explorer.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
explorer.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 3592 powershell.exe 3916 powershell.exe 2160 powershell.exe 2828 powershell.exe 2160 powershell.exe 2160 powershell.exe 3592 powershell.exe 2828 powershell.exe 3916 powershell.exe 3592 powershell.exe 2828 powershell.exe 3916 powershell.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe 668 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
m1g777su1kug5e.exepid process 212 m1g777su1kug5e.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
CFDI__Manager__12365.exepid process 4000 CFDI__Manager__12365.exe 4000 CFDI__Manager__12365.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
CFDI__Manager__12365.exepid process 4000 CFDI__Manager__12365.exe -
Suspicious use of AdjustPrivilegeToken 116 IoCs
Processes:
CFDI__Manager__12365.exeexplorer.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4000 CFDI__Manager__12365.exe Token: SeRestorePrivilege 4000 CFDI__Manager__12365.exe Token: SeBackupPrivilege 4000 CFDI__Manager__12365.exe Token: SeLoadDriverPrivilege 4000 CFDI__Manager__12365.exe Token: SeCreatePagefilePrivilege 4000 CFDI__Manager__12365.exe Token: SeShutdownPrivilege 4000 CFDI__Manager__12365.exe Token: SeTakeOwnershipPrivilege 4000 CFDI__Manager__12365.exe Token: SeChangeNotifyPrivilege 4000 CFDI__Manager__12365.exe Token: SeCreateTokenPrivilege 4000 CFDI__Manager__12365.exe Token: SeMachineAccountPrivilege 4000 CFDI__Manager__12365.exe Token: SeSecurityPrivilege 4000 CFDI__Manager__12365.exe Token: SeAssignPrimaryTokenPrivilege 4000 CFDI__Manager__12365.exe Token: SeCreateGlobalPrivilege 4000 CFDI__Manager__12365.exe Token: 33 4000 CFDI__Manager__12365.exe Token: SeDebugPrivilege 668 explorer.exe Token: SeRestorePrivilege 668 explorer.exe Token: SeBackupPrivilege 668 explorer.exe Token: SeLoadDriverPrivilege 668 explorer.exe Token: SeCreatePagefilePrivilege 668 explorer.exe Token: SeShutdownPrivilege 668 explorer.exe Token: SeTakeOwnershipPrivilege 668 explorer.exe Token: SeChangeNotifyPrivilege 668 explorer.exe Token: SeCreateTokenPrivilege 668 explorer.exe Token: SeMachineAccountPrivilege 668 explorer.exe Token: SeSecurityPrivilege 668 explorer.exe Token: SeAssignPrimaryTokenPrivilege 668 explorer.exe Token: SeCreateGlobalPrivilege 668 explorer.exe Token: 33 668 explorer.exe Token: SeDebugPrivilege 3592 powershell.exe Token: SeDebugPrivilege 3916 powershell.exe Token: SeDebugPrivilege 2160 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe Token: SeIncreaseQuotaPrivilege 2828 powershell.exe Token: SeSecurityPrivilege 2828 powershell.exe Token: SeTakeOwnershipPrivilege 2828 powershell.exe Token: SeLoadDriverPrivilege 2828 powershell.exe Token: SeSystemProfilePrivilege 2828 powershell.exe Token: SeSystemtimePrivilege 2828 powershell.exe Token: SeProfSingleProcessPrivilege 2828 powershell.exe Token: SeIncBasePriorityPrivilege 2828 powershell.exe Token: SeCreatePagefilePrivilege 2828 powershell.exe Token: SeBackupPrivilege 2828 powershell.exe Token: SeRestorePrivilege 2828 powershell.exe Token: SeShutdownPrivilege 2828 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe Token: SeSystemEnvironmentPrivilege 2828 powershell.exe Token: SeRemoteShutdownPrivilege 2828 powershell.exe Token: SeUndockPrivilege 2828 powershell.exe Token: SeManageVolumePrivilege 2828 powershell.exe Token: 33 2828 powershell.exe Token: 34 2828 powershell.exe Token: 35 2828 powershell.exe Token: 36 2828 powershell.exe Token: SeIncreaseQuotaPrivilege 2160 powershell.exe Token: SeSecurityPrivilege 2160 powershell.exe Token: SeTakeOwnershipPrivilege 2160 powershell.exe Token: SeLoadDriverPrivilege 2160 powershell.exe Token: SeSystemProfilePrivilege 2160 powershell.exe Token: SeSystemtimePrivilege 2160 powershell.exe Token: SeProfSingleProcessPrivilege 2160 powershell.exe Token: SeIncBasePriorityPrivilege 2160 powershell.exe Token: SeCreatePagefilePrivilege 2160 powershell.exe Token: SeBackupPrivilege 2160 powershell.exe Token: SeRestorePrivilege 2160 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
m1g777su1kug5e.exepid process 212 m1g777su1kug5e.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
3s1c7iag.exem1g777su1kug5e.exepid process 3540 3s1c7iag.exe 212 m1g777su1kug5e.exe 212 m1g777su1kug5e.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
CFDI__Manager__12365.exeCFDI__Manager__12365.exeexplorer.exe3s1c7iag.exedescription pid process target process PID 832 wrote to memory of 4000 832 CFDI__Manager__12365.exe CFDI__Manager__12365.exe PID 832 wrote to memory of 4000 832 CFDI__Manager__12365.exe CFDI__Manager__12365.exe PID 832 wrote to memory of 4000 832 CFDI__Manager__12365.exe CFDI__Manager__12365.exe PID 832 wrote to memory of 4000 832 CFDI__Manager__12365.exe CFDI__Manager__12365.exe PID 832 wrote to memory of 4000 832 CFDI__Manager__12365.exe CFDI__Manager__12365.exe PID 4000 wrote to memory of 668 4000 CFDI__Manager__12365.exe explorer.exe PID 4000 wrote to memory of 668 4000 CFDI__Manager__12365.exe explorer.exe PID 4000 wrote to memory of 668 4000 CFDI__Manager__12365.exe explorer.exe PID 668 wrote to memory of 1632 668 explorer.exe 57ss733k_1.exe PID 668 wrote to memory of 1632 668 explorer.exe 57ss733k_1.exe PID 668 wrote to memory of 1632 668 explorer.exe 57ss733k_1.exe PID 668 wrote to memory of 3540 668 explorer.exe 3s1c7iag.exe PID 668 wrote to memory of 3540 668 explorer.exe 3s1c7iag.exe PID 668 wrote to memory of 3540 668 explorer.exe 3s1c7iag.exe PID 3540 wrote to memory of 3592 3540 3s1c7iag.exe powershell.exe PID 3540 wrote to memory of 3592 3540 3s1c7iag.exe powershell.exe PID 3540 wrote to memory of 2828 3540 3s1c7iag.exe powershell.exe PID 3540 wrote to memory of 2828 3540 3s1c7iag.exe powershell.exe PID 3540 wrote to memory of 2160 3540 3s1c7iag.exe powershell.exe PID 3540 wrote to memory of 2160 3540 3s1c7iag.exe powershell.exe PID 3540 wrote to memory of 3916 3540 3s1c7iag.exe powershell.exe PID 3540 wrote to memory of 3916 3540 3s1c7iag.exe powershell.exe PID 668 wrote to memory of 212 668 explorer.exe m1g777su1kug5e.exe PID 668 wrote to memory of 212 668 explorer.exe m1g777su1kug5e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exe/suac4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe"C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\Google Updater 2.09\'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe"C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logMD5
ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
b39ad784a945662c6d042198e050e825
SHA1899b3ca0e072377f0dff9f1e7c56c76582d56998
SHA256f0d9c875fa0e7932acb477d8d0062fa8325f53259dcaaa79d8f77417fc31c44c
SHA512a5f83ecf9184fb749e0e19dc67d09d72a8b042e0a1811387a30a7405cece6063df8544c0c66330fc0b1856b75f8c783868a956a057f152abc8501d1595f77a9c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
76711b32ad551401ac91da1a087c6e09
SHA1ad0695820978056de9d67e23e9cab0880b57a667
SHA25681a20f8c5ec86e516f174808420bc0f6f843702e6106a3ac8ea8917f1c35f11c
SHA51254b0d5367cc54ffc22f7e9d013afeefe5e68ab82c4fb7b19d8941987d5d401ebcc94998c5232c4362a35f86ff42af8635fcc5423e9f6f7afa9e257cd448052ed
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
eb45d2fa89e11bd91a99444e420048ca
SHA11a7f8cae5055a36a0f6d5a7bcc4c046e21d60f32
SHA25602d674d4d3cb757bcda6e0decb1d06ef726bd4457e5fafc7f52391c39a87bffc
SHA5120381967cbab06ae7b395d31ec5ab03d5aec9999d1fbb36c9610c0d2c5b4cafdb831270563bdbd48a1e5c7effee1b9e6657163121ded058fd98ef557e5a7827bf
-
C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exeMD5
6176d4702486a540afc4752ff32748e7
SHA11c59b8f1271a97a09967dacd8b8111d9c0e1b48a
SHA256dc3f9a25a8df96d5a7f6e5fdb83159512c679462569f80ba8c639e08f7ded0eb
SHA512bb88baed4e080b239c409d6bf5e187de68cbf6c298001b98be284f1772fcffc3c9b02ddf32a54cb70c2fcb08feadf20ca24ceacf2a0d84535c653e9eaab41d76
-
C:\Users\Admin\AppData\Local\Temp\3s1c7iag.exeMD5
6176d4702486a540afc4752ff32748e7
SHA11c59b8f1271a97a09967dacd8b8111d9c0e1b48a
SHA256dc3f9a25a8df96d5a7f6e5fdb83159512c679462569f80ba8c639e08f7ded0eb
SHA512bb88baed4e080b239c409d6bf5e187de68cbf6c298001b98be284f1772fcffc3c9b02ddf32a54cb70c2fcb08feadf20ca24ceacf2a0d84535c653e9eaab41d76
-
C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exeMD5
5b7c3ff3556606c67a61527f81579eee
SHA175299ed8a21eebe1b1969e065e80f02ad21d4267
SHA25682e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f
SHA5126484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c
-
C:\Users\Admin\AppData\Local\Temp\57ss733k_1.exeMD5
5b7c3ff3556606c67a61527f81579eee
SHA175299ed8a21eebe1b1969e065e80f02ad21d4267
SHA25682e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f
SHA5126484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c
-
C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exeMD5
8ae38d41a537a39a726499d9195bb360
SHA1d391b0d22763cc804451364bbe9fb102d6f32fac
SHA2568a6ed4f0513731fc02d9f2153e5573310745b53a2db3f41968bddc974e3cae84
SHA5127c0975bded07d27aff598d18d34f249782754edfd347433c8234070c380b3ba92ad3f70c9aa6a793974013092536c866bed7b8675bf4979fe0ea1cffe98aded3
-
C:\Users\Admin\AppData\Local\Temp\m1g777su1kug5e.exeMD5
8ae38d41a537a39a726499d9195bb360
SHA1d391b0d22763cc804451364bbe9fb102d6f32fac
SHA2568a6ed4f0513731fc02d9f2153e5573310745b53a2db3f41968bddc974e3cae84
SHA5127c0975bded07d27aff598d18d34f249782754edfd347433c8234070c380b3ba92ad3f70c9aa6a793974013092536c866bed7b8675bf4979fe0ea1cffe98aded3
-
memory/212-71-0x000000001B1C7000-0x000000001B1C9000-memory.dmpFilesize
8KB
-
memory/212-72-0x000000001B1C9000-0x000000001B1CF000-memory.dmpFilesize
24KB
-
memory/212-54-0x0000000000000000-mapping.dmp
-
memory/212-57-0x00007FFAEE1E0000-0x00007FFAEEBCC000-memory.dmpFilesize
9.9MB
-
memory/212-58-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/212-60-0x000000001B1C0000-0x000000001B1C2000-memory.dmpFilesize
8KB
-
memory/212-69-0x000000001B1C3000-0x000000001B1C5000-memory.dmpFilesize
8KB
-
memory/212-70-0x000000001B1C5000-0x000000001B1C7000-memory.dmpFilesize
8KB
-
memory/668-11-0x0000000000DA0000-0x00000000011E0000-memory.dmpFilesize
4.2MB
-
memory/668-9-0x0000000000000000-mapping.dmp
-
memory/668-12-0x0000000000BE0000-0x0000000000D14000-memory.dmpFilesize
1.2MB
-
memory/668-17-0x0000000005530000-0x0000000005532000-memory.dmpFilesize
8KB
-
memory/668-13-0x0000000003710000-0x000000000371D000-memory.dmpFilesize
52KB
-
memory/1632-18-0x0000000000000000-mapping.dmp
-
memory/2160-61-0x00000276280C8000-0x00000276280C9000-memory.dmpFilesize
4KB
-
memory/2160-28-0x0000000000000000-mapping.dmp
-
memory/2160-42-0x00000276426B0000-0x00000276426B1000-memory.dmpFilesize
4KB
-
memory/2160-32-0x00007FFAEE1E0000-0x00007FFAEEBCC000-memory.dmpFilesize
9.9MB
-
memory/2160-50-0x00000276280C6000-0x00000276280C8000-memory.dmpFilesize
8KB
-
memory/2160-38-0x00000276280C0000-0x00000276280C2000-memory.dmpFilesize
8KB
-
memory/2160-41-0x00000276280C3000-0x00000276280C5000-memory.dmpFilesize
8KB
-
memory/2828-44-0x00000157C8FB3000-0x00000157C8FB5000-memory.dmpFilesize
8KB
-
memory/2828-53-0x00000157C8FB6000-0x00000157C8FB8000-memory.dmpFilesize
8KB
-
memory/2828-43-0x00000157C8FB0000-0x00000157C8FB2000-memory.dmpFilesize
8KB
-
memory/2828-62-0x00000157C8FB8000-0x00000157C8FB9000-memory.dmpFilesize
4KB
-
memory/2828-27-0x0000000000000000-mapping.dmp
-
memory/2828-33-0x00007FFAEE1E0000-0x00007FFAEEBCC000-memory.dmpFilesize
9.9MB
-
memory/3540-21-0x0000000000000000-mapping.dmp
-
memory/3592-30-0x00007FFAEE1E0000-0x00007FFAEEBCC000-memory.dmpFilesize
9.9MB
-
memory/3592-64-0x00000259B1268000-0x00000259B1269000-memory.dmpFilesize
4KB
-
memory/3592-51-0x00000259B1266000-0x00000259B1268000-memory.dmpFilesize
8KB
-
memory/3592-34-0x0000025998DD0000-0x0000025998DD1000-memory.dmpFilesize
4KB
-
memory/3592-39-0x00000259B1260000-0x00000259B1262000-memory.dmpFilesize
8KB
-
memory/3592-26-0x0000000000000000-mapping.dmp
-
memory/3592-40-0x00000259B1263000-0x00000259B1265000-memory.dmpFilesize
8KB
-
memory/3916-63-0x00000267F6318000-0x00000267F6319000-memory.dmpFilesize
4KB
-
memory/3916-29-0x0000000000000000-mapping.dmp
-
memory/3916-46-0x00000267F6313000-0x00000267F6315000-memory.dmpFilesize
8KB
-
memory/3916-45-0x00000267F6310000-0x00000267F6312000-memory.dmpFilesize
8KB
-
memory/3916-52-0x00000267F6316000-0x00000267F6318000-memory.dmpFilesize
8KB
-
memory/3916-31-0x00007FFAEE1E0000-0x00007FFAEEBCC000-memory.dmpFilesize
9.9MB
-
memory/4000-5-0x00000000020F0000-0x0000000002156000-memory.dmpFilesize
408KB
-
memory/4000-7-0x0000000002630000-0x0000000002631000-memory.dmpFilesize
4KB
-
memory/4000-4-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4000-2-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4000-6-0x00000000024B0000-0x00000000024BD000-memory.dmpFilesize
52KB
-
memory/4000-3-0x00000000004015C6-mapping.dmp
-
memory/4000-8-0x0000000002660000-0x000000000266C000-memory.dmpFilesize
48KB
-
memory/4000-10-0x0000000002650000-0x0000000002651000-memory.dmpFilesize
4KB