Analysis
-
max time kernel
73s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-06-2021 01:42
Static task
static1
Behavioral task
behavioral1
Sample
36b9570a14ac21869cad456713714940.exe
Resource
win7v20210410
General
-
Target
36b9570a14ac21869cad456713714940.exe
-
Size
144KB
-
MD5
36b9570a14ac21869cad456713714940
-
SHA1
17ce33e58167a089b7e4e6c49a362a23364d30de
-
SHA256
6843226fd84ae2ce783119d4ba634e00d10dc6e5374a23d26b42cd0e7e6b18cd
-
SHA512
4af43e89ca22fd81365f6e68a1350400cc653d3d12e642ed04bceb1597be9ce89f857c851b14390b3aad3c8b89d69235cad20b8c30a8d93b74b93f6339393bd9
Malware Config
Extracted
systembc
65.21.93.53:4173
95.216.118.223:4173
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Nirsoft 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\AdvancedRun.exe Nirsoft -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 22 4624 rundll32.exe -
Executes dropped EXE 3 IoCs
Processes:
AdvancedRun.exeAdvancedRun.execlient.exepid process 3836 AdvancedRun.exe 2912 AdvancedRun.exe 4548 client.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4624 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
36b9570a14ac21869cad456713714940.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 36b9570a14ac21869cad456713714940.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 36b9570a14ac21869cad456713714940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\36b9570a14ac21869cad456713714940.exe = "0" 36b9570a14ac21869cad456713714940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 36b9570a14ac21869cad456713714940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 36b9570a14ac21869cad456713714940.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection 36b9570a14ac21869cad456713714940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 36b9570a14ac21869cad456713714940.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet 36b9570a14ac21869cad456713714940.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" 36b9570a14ac21869cad456713714940.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 36b9570a14ac21869cad456713714940.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
client.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ProtectIT = "C:\\Windows\\System32\\rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\valid.sa, rundll" client.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
36b9570a14ac21869cad456713714940.exepid process 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
36b9570a14ac21869cad456713714940.exedescription pid process target process PID 776 set thread context of 2188 776 36b9570a14ac21869cad456713714940.exe 36b9570a14ac21869cad456713714940.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3676 776 WerFault.exe 36b9570a14ac21869cad456713714940.exe 4580 2188 WerFault.exe 36b9570a14ac21869cad456713714940.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3748 timeout.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exe36b9570a14ac21869cad456713714940.exepowershell.exepowershell.exepowershell.exeWerFault.exeWerFault.exepid process 3836 AdvancedRun.exe 3836 AdvancedRun.exe 3836 AdvancedRun.exe 3836 AdvancedRun.exe 2912 AdvancedRun.exe 2912 AdvancedRun.exe 2912 AdvancedRun.exe 2912 AdvancedRun.exe 4048 powershell.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 776 36b9570a14ac21869cad456713714940.exe 4048 powershell.exe 3680 powershell.exe 3828 powershell.exe 2924 powershell.exe 4048 powershell.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3680 powershell.exe 3828 powershell.exe 2924 powershell.exe 3680 powershell.exe 3828 powershell.exe 2924 powershell.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
36b9570a14ac21869cad456713714940.exeAdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exepowershell.exeWerFault.exe36b9570a14ac21869cad456713714940.exeWerFault.exedescription pid process Token: SeDebugPrivilege 776 36b9570a14ac21869cad456713714940.exe Token: SeDebugPrivilege 3836 AdvancedRun.exe Token: SeImpersonatePrivilege 3836 AdvancedRun.exe Token: SeDebugPrivilege 2912 AdvancedRun.exe Token: SeImpersonatePrivilege 2912 AdvancedRun.exe Token: SeDebugPrivilege 4048 powershell.exe Token: SeDebugPrivilege 3680 powershell.exe Token: SeDebugPrivilege 3828 powershell.exe Token: SeDebugPrivilege 2924 powershell.exe Token: SeRestorePrivilege 3676 WerFault.exe Token: SeBackupPrivilege 3676 WerFault.exe Token: SeBackupPrivilege 3676 WerFault.exe Token: SeDebugPrivilege 3676 WerFault.exe Token: SeDebugPrivilege 2188 36b9570a14ac21869cad456713714940.exe Token: SeDebugPrivilege 2188 36b9570a14ac21869cad456713714940.exe Token: SeDebugPrivilege 4580 WerFault.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
36b9570a14ac21869cad456713714940.exeAdvancedRun.execmd.exe36b9570a14ac21869cad456713714940.execlient.exedescription pid process target process PID 776 wrote to memory of 3836 776 36b9570a14ac21869cad456713714940.exe AdvancedRun.exe PID 776 wrote to memory of 3836 776 36b9570a14ac21869cad456713714940.exe AdvancedRun.exe PID 776 wrote to memory of 3836 776 36b9570a14ac21869cad456713714940.exe AdvancedRun.exe PID 3836 wrote to memory of 2912 3836 AdvancedRun.exe AdvancedRun.exe PID 3836 wrote to memory of 2912 3836 AdvancedRun.exe AdvancedRun.exe PID 3836 wrote to memory of 2912 3836 AdvancedRun.exe AdvancedRun.exe PID 776 wrote to memory of 4048 776 36b9570a14ac21869cad456713714940.exe powershell.exe PID 776 wrote to memory of 4048 776 36b9570a14ac21869cad456713714940.exe powershell.exe PID 776 wrote to memory of 4048 776 36b9570a14ac21869cad456713714940.exe powershell.exe PID 776 wrote to memory of 352 776 36b9570a14ac21869cad456713714940.exe cmd.exe PID 776 wrote to memory of 352 776 36b9570a14ac21869cad456713714940.exe cmd.exe PID 776 wrote to memory of 352 776 36b9570a14ac21869cad456713714940.exe cmd.exe PID 352 wrote to memory of 3748 352 cmd.exe timeout.exe PID 352 wrote to memory of 3748 352 cmd.exe timeout.exe PID 352 wrote to memory of 3748 352 cmd.exe timeout.exe PID 776 wrote to memory of 2188 776 36b9570a14ac21869cad456713714940.exe 36b9570a14ac21869cad456713714940.exe PID 776 wrote to memory of 2188 776 36b9570a14ac21869cad456713714940.exe 36b9570a14ac21869cad456713714940.exe PID 776 wrote to memory of 2188 776 36b9570a14ac21869cad456713714940.exe 36b9570a14ac21869cad456713714940.exe PID 776 wrote to memory of 2188 776 36b9570a14ac21869cad456713714940.exe 36b9570a14ac21869cad456713714940.exe PID 776 wrote to memory of 2188 776 36b9570a14ac21869cad456713714940.exe 36b9570a14ac21869cad456713714940.exe PID 776 wrote to memory of 2188 776 36b9570a14ac21869cad456713714940.exe 36b9570a14ac21869cad456713714940.exe PID 776 wrote to memory of 2188 776 36b9570a14ac21869cad456713714940.exe 36b9570a14ac21869cad456713714940.exe PID 776 wrote to memory of 2188 776 36b9570a14ac21869cad456713714940.exe 36b9570a14ac21869cad456713714940.exe PID 2188 wrote to memory of 3680 2188 36b9570a14ac21869cad456713714940.exe powershell.exe PID 2188 wrote to memory of 3680 2188 36b9570a14ac21869cad456713714940.exe powershell.exe PID 2188 wrote to memory of 3680 2188 36b9570a14ac21869cad456713714940.exe powershell.exe PID 2188 wrote to memory of 2924 2188 36b9570a14ac21869cad456713714940.exe powershell.exe PID 2188 wrote to memory of 2924 2188 36b9570a14ac21869cad456713714940.exe powershell.exe PID 2188 wrote to memory of 2924 2188 36b9570a14ac21869cad456713714940.exe powershell.exe PID 2188 wrote to memory of 3828 2188 36b9570a14ac21869cad456713714940.exe powershell.exe PID 2188 wrote to memory of 3828 2188 36b9570a14ac21869cad456713714940.exe powershell.exe PID 2188 wrote to memory of 3828 2188 36b9570a14ac21869cad456713714940.exe powershell.exe PID 2188 wrote to memory of 4548 2188 36b9570a14ac21869cad456713714940.exe client.exe PID 2188 wrote to memory of 4548 2188 36b9570a14ac21869cad456713714940.exe client.exe PID 2188 wrote to memory of 4548 2188 36b9570a14ac21869cad456713714940.exe client.exe PID 4548 wrote to memory of 4624 4548 client.exe rundll32.exe PID 4548 wrote to memory of 4624 4548 client.exe rundll32.exe PID 4548 wrote to memory of 4624 4548 client.exe rundll32.exe PID 4548 wrote to memory of 4636 4548 client.exe cmd.exe PID 4548 wrote to memory of 4636 4548 client.exe cmd.exe PID 4548 wrote to memory of 4636 4548 client.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36b9570a14ac21869cad456713714940.exe"C:\Users\Admin\AppData\Local\Temp\36b9570a14ac21869cad456713714940.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\AdvancedRun.exe" /SpecialRun 4101d8 38363⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\36b9570a14ac21869cad456713714940.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\36b9570a14ac21869cad456713714940.exe"C:\Users\Admin\AppData\Local\Temp\36b9570a14ac21869cad456713714940.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Set-MpPreference -PUAProtection 13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications' -Name DisableNotifications -Value 13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\client.exe"C:\Users\Admin\AppData\Roaming\client.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Roaming\valid.sa, rundll4⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c del "C:\Users\Admin\AppData\Roaming\client.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 21483⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 21202⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
c558fdaa3884f969f1ec904ae7bbd991
SHA1b4f85d04f6bf061a17f52c264c065b786cfd33ff
SHA2563e2559b6ca355d011b05b1fcf35ed8b2375586fe6bb01bc367f24eb8ac82975e
SHA5126523c778fd9fab0085fafe7b4049e591403865212cc25109cb11f11584c7258bc15e0a5524d089d0f662151b22f3f8e6f871091cec57064c69a9a95903f9e7d4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
a3c3ef81e21086e78dd9bc9f5301c8f4
SHA14f11e6b5cd988eceba865d78e6f79e30efb85d0a
SHA256a760caf89e9d636c5aac09c75dbe4000640e983d8979e14e240d63ceac2994e6
SHA512b4474cf30e836df375ea7bacdce9438bca3deed3e0b4c93a5b8da44b8ac13d25604dde74273850ab1f8b0ea72185865a85655208a927e7e46f34674a455d85e6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
3ee755b17599ae71fa4e78dfc05c382e
SHA11833f39e9015929692d94ed5ac10c4139e59023a
SHA256c729602a20219507599e2d418ab6c1afce5dcc11dd897d8ce2a2fbb7dd54052f
SHA5128e67ed27af5277860aff9df1b5271df052216e76269a72057711becc95f753aecd07b53a644c826c5939d267ee1ed4351db16fb25aa9a7bb3b555e9d5b15074e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
b894092f40407d3e6150188bab119770
SHA10ddaa049e3e2e2bc1066c5abc6a51b76c8548486
SHA2563ef36f7c97546ba115089e66041337f324ff83c256b2f2979e4b1067d9558144
SHA51237809e9c0f046a9f140504b8d6a6d94155d54e5231a926f550c5b98d5c1e749bf547f8f9026c389d9e7b69a82039a35c538f0876cf9b113aa8eb70539cd43dc0
-
C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\049f8cc0-8ef1-4916-9e3a-494793513e27\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Roaming\client.exeMD5
ab80e92fbdd11c699d650a455de769d0
SHA156fa38589ebc1653d285aaaf9f79426ac5f1d826
SHA2564fb561dbdfd2eac3757e56df1cda954fc4cdbab3da7225ea97ed3a9111ae74e5
SHA512141d58c3a36982398cc991b83f4e4d70304c7fe9f3ef1920eec6ffba4b75164f326614e34f87b03ce576b5a08d2c84e369b775570ff57d727cab6313a792b0f5
-
C:\Users\Admin\AppData\Roaming\client.exeMD5
ab80e92fbdd11c699d650a455de769d0
SHA156fa38589ebc1653d285aaaf9f79426ac5f1d826
SHA2564fb561dbdfd2eac3757e56df1cda954fc4cdbab3da7225ea97ed3a9111ae74e5
SHA512141d58c3a36982398cc991b83f4e4d70304c7fe9f3ef1920eec6ffba4b75164f326614e34f87b03ce576b5a08d2c84e369b775570ff57d727cab6313a792b0f5
-
C:\Users\Admin\AppData\Roaming\valid.saMD5
4ed86d03e1b1992737a82147f37b0f26
SHA165c8d604169f09b9d746ee1d5137f35e0de73a8e
SHA2561f5ab2dd8c68798890cc3f34c342aae74fb15846d2beb3cc4fc78dc6a94f7d1c
SHA512238b338aa6b5d31f17e64ccf9e635c19867bf8eb267578a65158a61bb6bea5ec616b5798dafabd3ca0797268869e7b414db1d3668542ef95698d0cf9f17839c5
-
\Users\Admin\AppData\Roaming\valid.saMD5
4ed86d03e1b1992737a82147f37b0f26
SHA165c8d604169f09b9d746ee1d5137f35e0de73a8e
SHA2561f5ab2dd8c68798890cc3f34c342aae74fb15846d2beb3cc4fc78dc6a94f7d1c
SHA512238b338aa6b5d31f17e64ccf9e635c19867bf8eb267578a65158a61bb6bea5ec616b5798dafabd3ca0797268869e7b414db1d3668542ef95698d0cf9f17839c5
-
memory/352-128-0x0000000000000000-mapping.dmp
-
memory/776-119-0x000000000C6A0000-0x000000000C6A1000-memory.dmpFilesize
4KB
-
memory/776-114-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/776-116-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/776-117-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/776-118-0x000000000AE10000-0x000000000B141000-memory.dmpFilesize
3.2MB
-
memory/2188-190-0x0000000002D70000-0x0000000002D71000-memory.dmpFilesize
4KB
-
memory/2188-138-0x0000000000400000-0x00000000006D4000-memory.dmpFilesize
2.8MB
-
memory/2188-139-0x00000000006CF42E-mapping.dmp
-
memory/2912-123-0x0000000000000000-mapping.dmp
-
memory/2924-206-0x0000000006E63000-0x0000000006E64000-memory.dmpFilesize
4KB
-
memory/2924-178-0x0000000006E62000-0x0000000006E63000-memory.dmpFilesize
4KB
-
memory/2924-169-0x0000000006E60000-0x0000000006E61000-memory.dmpFilesize
4KB
-
memory/2924-144-0x0000000000000000-mapping.dmp
-
memory/3680-204-0x0000000007303000-0x0000000007304000-memory.dmpFilesize
4KB
-
memory/3680-143-0x0000000000000000-mapping.dmp
-
memory/3680-173-0x0000000007300000-0x0000000007301000-memory.dmpFilesize
4KB
-
memory/3680-174-0x0000000007302000-0x0000000007303000-memory.dmpFilesize
4KB
-
memory/3680-201-0x000000007E970000-0x000000007E971000-memory.dmpFilesize
4KB
-
memory/3748-131-0x0000000000000000-mapping.dmp
-
memory/3828-145-0x0000000000000000-mapping.dmp
-
memory/3828-205-0x0000000006CF3000-0x0000000006CF4000-memory.dmpFilesize
4KB
-
memory/3828-171-0x0000000006CF0000-0x0000000006CF1000-memory.dmpFilesize
4KB
-
memory/3828-176-0x0000000006CF2000-0x0000000006CF3000-memory.dmpFilesize
4KB
-
memory/3828-203-0x000000007F170000-0x000000007F171000-memory.dmpFilesize
4KB
-
memory/3836-120-0x0000000000000000-mapping.dmp
-
memory/4048-130-0x0000000006B30000-0x0000000006B31000-memory.dmpFilesize
4KB
-
memory/4048-133-0x0000000004102000-0x0000000004103000-memory.dmpFilesize
4KB
-
memory/4048-200-0x000000007F380000-0x000000007F381000-memory.dmpFilesize
4KB
-
memory/4048-161-0x0000000007CD0000-0x0000000007CD1000-memory.dmpFilesize
4KB
-
memory/4048-153-0x0000000007C80000-0x0000000007C81000-memory.dmpFilesize
4KB
-
memory/4048-148-0x0000000007800000-0x0000000007801000-memory.dmpFilesize
4KB
-
memory/4048-137-0x0000000007490000-0x0000000007491000-memory.dmpFilesize
4KB
-
memory/4048-136-0x0000000007240000-0x0000000007241000-memory.dmpFilesize
4KB
-
memory/4048-135-0x0000000007420000-0x0000000007421000-memory.dmpFilesize
4KB
-
memory/4048-134-0x00000000071A0000-0x00000000071A1000-memory.dmpFilesize
4KB
-
memory/4048-125-0x0000000000000000-mapping.dmp
-
memory/4048-202-0x0000000004103000-0x0000000004104000-memory.dmpFilesize
4KB
-
memory/4048-132-0x0000000004100000-0x0000000004101000-memory.dmpFilesize
4KB
-
memory/4048-129-0x0000000004110000-0x0000000004111000-memory.dmpFilesize
4KB
-
memory/4548-211-0x0000000000000000-mapping.dmp
-
memory/4548-218-0x0000000002410000-0x0000000002445000-memory.dmpFilesize
212KB
-
memory/4548-219-0x0000000000400000-0x0000000000901000-memory.dmpFilesize
5.0MB
-
memory/4624-214-0x0000000000000000-mapping.dmp
-
memory/4624-221-0x00000000032D0000-0x00000000032D7000-memory.dmpFilesize
28KB
-
memory/4624-220-0x00000000032B0000-0x00000000032B5000-memory.dmpFilesize
20KB
-
memory/4636-215-0x0000000000000000-mapping.dmp