Analysis
-
max time kernel
4294209s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
21-03-2022 23:56
Static task
static1
Behavioral task
behavioral1
Sample
PaymentConfirmation.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
PaymentConfirmation.exe
Resource
win10-20220310-en
General
-
Target
PaymentConfirmation.exe
-
Size
29KB
-
MD5
1c819edc4def5670ad7e2f7facceda93
-
SHA1
4882d04f0b0cc6b1cc3aed86d49c724b9209c777
-
SHA256
8143ce440d081fbd4fdb3c1dca4baa8aeaff53a350a41dd8ebe3eb51e8bd2483
-
SHA512
12333acc054929aad86132c617e90a26166ad00dc955ecf37c37d04d530fdd866daec288ca0dce51da93a918681b2799c8d95f1873a9ef10024f24bc396d0e84
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
shoresedge.co.za - Port:
587 - Username:
bookings@shoresedge.co.za - Password:
woz]p3pgIg&W - Email To:
easiacess5@gmail.com
Extracted
nanocore
1.2.2.0
sannation.duckdns.org:2180
04c62d04-0ba2-4935-b680-1eb56df154c3
-
activate_away_mode
true
-
backup_connection_host
sannation.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-12-31T05:30:02.915038836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2180
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
04c62d04-0ba2-4935-b680-1eb56df154c3
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
sannation.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
AgentTesla Payload 9 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exe family_agenttesla C:\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exe family_agenttesla C:\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exe family_agenttesla behavioral1/memory/1112-66-0x0000000000980000-0x00000000009BC000-memory.dmp family_agenttesla \Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exe family_agenttesla \Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exe family_agenttesla \Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exe family_agenttesla \Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exe family_agenttesla \Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exe family_agenttesla -
Executes dropped EXE 1 IoCs
Processes:
Witdmaqzywrpbrahnytnew origin bin.exepid process 1112 Witdmaqzywrpbrahnytnew origin bin.exe -
Loads dropped DLL 6 IoCs
Processes:
PaymentConfirmation.exeWerFault.exepid process 1832 PaymentConfirmation.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe 640 WerFault.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
PaymentConfirmation.exePaymentConfirmation.exeWitdmaqzywrpbrahnytnew origin bin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox = "\"C:\\Users\\Admin\\AppData\\Local\\firefox.exe\"" PaymentConfirmation.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Monitor = "C:\\Program Files (x86)\\DDP Monitor\\ddpmon.exe" PaymentConfirmation.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\hcnIuh = "C:\\Users\\Admin\\AppData\\Roaming\\hcnIuh\\hcnIuh.exe" Witdmaqzywrpbrahnytnew origin bin.exe -
Processes:
PaymentConfirmation.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PaymentConfirmation.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PaymentConfirmation.exedescription pid process target process PID 1832 set thread context of 1580 1832 PaymentConfirmation.exe PaymentConfirmation.exe -
Drops file in Program Files directory 2 IoCs
Processes:
PaymentConfirmation.exedescription ioc process File created C:\Program Files (x86)\DDP Monitor\ddpmon.exe PaymentConfirmation.exe File opened for modification C:\Program Files (x86)\DDP Monitor\ddpmon.exe PaymentConfirmation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 640 1112 WerFault.exe Witdmaqzywrpbrahnytnew origin bin.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1788 timeout.exe -
Processes:
PaymentConfirmation.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D8BA37530F686AF4284277F42DF075CAD4CCD827 PaymentConfirmation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D8BA37530F686AF4284277F42DF075CAD4CCD827\Blob = 0f000000010000002000000061662c1d31000b44120fbfc6411d85bf8027cdb6379b14ab8ba62b8f62c1819f030000000100000014000000d8ba37530f686af4284277f42df075cad4ccd8272000000001000000f9020000308202f5308201dda00302010202100cb7630bf507d616790bc64f11e8443c300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3232303232333133303030305a170d3237303232323133303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100b03c83b0ab4b47c3238a63870f97c23c847c00a376d833432cdb27a02e89a378cb9f41ce2755f9749beb9a943b0f96f7c30d3ab7836a7d4cbe49638073237180530db058135ef853f0a012c923f27b664c86448eb62ac81e8e3d16978d378a99352ffc7ad0819f8ffbd161eddb025e5b9d9c2aee6565b06220b8b152613d0af2f8b712f26da7e697fae1ec7f556bcc4917e39bd89cbb6a6e5f41264cef7fba466b4225407321e9bde80df32a7cbf2fe9fb669b06912880186b99c6f3da607ebfcef29ce4ea24da351ce1cf056427858b51d4daa76329c09bdf8a1eeae5088eb4c8312f16d229cc82538b66fc5d772f46d9ab43aeef86dac4a1e8d773cfb95c030203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414fbd005c48989cbaf0ef414b09eb6f904e4e41970300d06092a864886f70d01010b05000382010100608a58eee73fdd282d54b3547458c6093107b15302a28fd1c89f3ee8694f9089db2663f7556a4942783795ad2452bc5c3091ea18a782ad2d715ec25442ed2c96f9dfd3ef2b2883b4020fa221e876a09f4f01cc83f3df32468c7dff00bc78c923d6da850a15ab56b804eaa21cee8d4bcdf7c56999b03043db3fdc75fdd775f203855e02f789e48cf71cc69c14ba0b6b60159a4caa797f81722804cb35098d7e86749a03b955b9db480455bc72d1304235e16c7001d3c9a00edbe08e77d7b36acea0711ccfff3c73c807f051bdfb6a4cfac0be6d66bf5aaca4473696190118f3db45e920c96bc1d3c3df012ada755e33cbf3ee52527500cbae787d440a27fb03f2 PaymentConfirmation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D8BA37530F686AF4284277F42DF075CAD4CCD827\Blob = 140000000100000014000000fbd005c48989cbaf0ef414b09eb6f904e4e41970030000000100000014000000d8ba37530f686af4284277f42df075cad4ccd8270f000000010000002000000061662c1d31000b44120fbfc6411d85bf8027cdb6379b14ab8ba62b8f62c1819f2000000001000000f9020000308202f5308201dda00302010202100cb7630bf507d616790bc64f11e8443c300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3232303232333133303030305a170d3237303232323133303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100b03c83b0ab4b47c3238a63870f97c23c847c00a376d833432cdb27a02e89a378cb9f41ce2755f9749beb9a943b0f96f7c30d3ab7836a7d4cbe49638073237180530db058135ef853f0a012c923f27b664c86448eb62ac81e8e3d16978d378a99352ffc7ad0819f8ffbd161eddb025e5b9d9c2aee6565b06220b8b152613d0af2f8b712f26da7e697fae1ec7f556bcc4917e39bd89cbb6a6e5f41264cef7fba466b4225407321e9bde80df32a7cbf2fe9fb669b06912880186b99c6f3da607ebfcef29ce4ea24da351ce1cf056427858b51d4daa76329c09bdf8a1eeae5088eb4c8312f16d229cc82538b66fc5d772f46d9ab43aeef86dac4a1e8d773cfb95c030203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414fbd005c48989cbaf0ef414b09eb6f904e4e41970300d06092a864886f70d01010b05000382010100608a58eee73fdd282d54b3547458c6093107b15302a28fd1c89f3ee8694f9089db2663f7556a4942783795ad2452bc5c3091ea18a782ad2d715ec25442ed2c96f9dfd3ef2b2883b4020fa221e876a09f4f01cc83f3df32468c7dff00bc78c923d6da850a15ab56b804eaa21cee8d4bcdf7c56999b03043db3fdc75fdd775f203855e02f789e48cf71cc69c14ba0b6b60159a4caa797f81722804cb35098d7e86749a03b955b9db480455bc72d1304235e16c7001d3c9a00edbe08e77d7b36acea0711ccfff3c73c807f051bdfb6a4cfac0be6d66bf5aaca4473696190118f3db45e920c96bc1d3c3df012ada755e33cbf3ee52527500cbae787d440a27fb03f2 PaymentConfirmation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D8BA37530F686AF4284277F42DF075CAD4CCD827\Blob = 1900000001000000100000005fcc6eeadccb356944599793a3861ba70f000000010000002000000061662c1d31000b44120fbfc6411d85bf8027cdb6379b14ab8ba62b8f62c1819f030000000100000014000000d8ba37530f686af4284277f42df075cad4ccd827140000000100000014000000fbd005c48989cbaf0ef414b09eb6f904e4e419702000000001000000f9020000308202f5308201dda00302010202100cb7630bf507d616790bc64f11e8443c300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3232303232333133303030305a170d3237303232323133303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100b03c83b0ab4b47c3238a63870f97c23c847c00a376d833432cdb27a02e89a378cb9f41ce2755f9749beb9a943b0f96f7c30d3ab7836a7d4cbe49638073237180530db058135ef853f0a012c923f27b664c86448eb62ac81e8e3d16978d378a99352ffc7ad0819f8ffbd161eddb025e5b9d9c2aee6565b06220b8b152613d0af2f8b712f26da7e697fae1ec7f556bcc4917e39bd89cbb6a6e5f41264cef7fba466b4225407321e9bde80df32a7cbf2fe9fb669b06912880186b99c6f3da607ebfcef29ce4ea24da351ce1cf056427858b51d4daa76329c09bdf8a1eeae5088eb4c8312f16d229cc82538b66fc5d772f46d9ab43aeef86dac4a1e8d773cfb95c030203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414fbd005c48989cbaf0ef414b09eb6f904e4e41970300d06092a864886f70d01010b05000382010100608a58eee73fdd282d54b3547458c6093107b15302a28fd1c89f3ee8694f9089db2663f7556a4942783795ad2452bc5c3091ea18a782ad2d715ec25442ed2c96f9dfd3ef2b2883b4020fa221e876a09f4f01cc83f3df32468c7dff00bc78c923d6da850a15ab56b804eaa21cee8d4bcdf7c56999b03043db3fdc75fdd775f203855e02f789e48cf71cc69c14ba0b6b60159a4caa797f81722804cb35098d7e86749a03b955b9db480455bc72d1304235e16c7001d3c9a00edbe08e77d7b36acea0711ccfff3c73c807f051bdfb6a4cfac0be6d66bf5aaca4473696190118f3db45e920c96bc1d3c3df012ada755e33cbf3ee52527500cbae787d440a27fb03f2 PaymentConfirmation.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Witdmaqzywrpbrahnytnew origin bin.exePaymentConfirmation.exePaymentConfirmation.exepid process 1112 Witdmaqzywrpbrahnytnew origin bin.exe 1112 Witdmaqzywrpbrahnytnew origin bin.exe 1832 PaymentConfirmation.exe 1832 PaymentConfirmation.exe 1580 PaymentConfirmation.exe 1580 PaymentConfirmation.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
PaymentConfirmation.exepid process 1580 PaymentConfirmation.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PaymentConfirmation.exeWitdmaqzywrpbrahnytnew origin bin.exePaymentConfirmation.exedescription pid process Token: SeDebugPrivilege 1832 PaymentConfirmation.exe Token: SeDebugPrivilege 1112 Witdmaqzywrpbrahnytnew origin bin.exe Token: SeDebugPrivilege 1580 PaymentConfirmation.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
PaymentConfirmation.execmd.exeWitdmaqzywrpbrahnytnew origin bin.exedescription pid process target process PID 1832 wrote to memory of 1320 1832 PaymentConfirmation.exe cmd.exe PID 1832 wrote to memory of 1320 1832 PaymentConfirmation.exe cmd.exe PID 1832 wrote to memory of 1320 1832 PaymentConfirmation.exe cmd.exe PID 1832 wrote to memory of 1320 1832 PaymentConfirmation.exe cmd.exe PID 1320 wrote to memory of 1788 1320 cmd.exe timeout.exe PID 1320 wrote to memory of 1788 1320 cmd.exe timeout.exe PID 1320 wrote to memory of 1788 1320 cmd.exe timeout.exe PID 1320 wrote to memory of 1788 1320 cmd.exe timeout.exe PID 1832 wrote to memory of 1112 1832 PaymentConfirmation.exe Witdmaqzywrpbrahnytnew origin bin.exe PID 1832 wrote to memory of 1112 1832 PaymentConfirmation.exe Witdmaqzywrpbrahnytnew origin bin.exe PID 1832 wrote to memory of 1112 1832 PaymentConfirmation.exe Witdmaqzywrpbrahnytnew origin bin.exe PID 1832 wrote to memory of 1112 1832 PaymentConfirmation.exe Witdmaqzywrpbrahnytnew origin bin.exe PID 1832 wrote to memory of 1580 1832 PaymentConfirmation.exe PaymentConfirmation.exe PID 1832 wrote to memory of 1580 1832 PaymentConfirmation.exe PaymentConfirmation.exe PID 1832 wrote to memory of 1580 1832 PaymentConfirmation.exe PaymentConfirmation.exe PID 1832 wrote to memory of 1580 1832 PaymentConfirmation.exe PaymentConfirmation.exe PID 1832 wrote to memory of 1580 1832 PaymentConfirmation.exe PaymentConfirmation.exe PID 1832 wrote to memory of 1580 1832 PaymentConfirmation.exe PaymentConfirmation.exe PID 1832 wrote to memory of 1580 1832 PaymentConfirmation.exe PaymentConfirmation.exe PID 1832 wrote to memory of 1580 1832 PaymentConfirmation.exe PaymentConfirmation.exe PID 1832 wrote to memory of 1580 1832 PaymentConfirmation.exe PaymentConfirmation.exe PID 1112 wrote to memory of 640 1112 Witdmaqzywrpbrahnytnew origin bin.exe WerFault.exe PID 1112 wrote to memory of 640 1112 Witdmaqzywrpbrahnytnew origin bin.exe WerFault.exe PID 1112 wrote to memory of 640 1112 Witdmaqzywrpbrahnytnew origin bin.exe WerFault.exe PID 1112 wrote to memory of 640 1112 Witdmaqzywrpbrahnytnew origin bin.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PaymentConfirmation.exe"C:\Users\Admin\AppData\Local\Temp\PaymentConfirmation.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 102⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 103⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exe"C:\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 10083⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\PaymentConfirmation.exeC:\Users\Admin\AppData\Local\Temp\PaymentConfirmation.exe purecrypter.exe2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exeMD5
4a27672e4061a5998824886505f4e020
SHA10126388ce02700f859fbade41302226c01d6da41
SHA25643daf586434a7a967a3ab7d8516c76666a6eeba6c1761cea70187e2a2e4513af
SHA512e21d6645e8654d5b85ebb04a2ed174915313e3d7e33b63c5d3fa9164483b9cf3b505e603d6d4788287c15181fd60d6cbfd1fecaa8bd2bd9b9c45c2367ce6d8b0
-
C:\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exeMD5
4a27672e4061a5998824886505f4e020
SHA10126388ce02700f859fbade41302226c01d6da41
SHA25643daf586434a7a967a3ab7d8516c76666a6eeba6c1761cea70187e2a2e4513af
SHA512e21d6645e8654d5b85ebb04a2ed174915313e3d7e33b63c5d3fa9164483b9cf3b505e603d6d4788287c15181fd60d6cbfd1fecaa8bd2bd9b9c45c2367ce6d8b0
-
\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exeMD5
4a27672e4061a5998824886505f4e020
SHA10126388ce02700f859fbade41302226c01d6da41
SHA25643daf586434a7a967a3ab7d8516c76666a6eeba6c1761cea70187e2a2e4513af
SHA512e21d6645e8654d5b85ebb04a2ed174915313e3d7e33b63c5d3fa9164483b9cf3b505e603d6d4788287c15181fd60d6cbfd1fecaa8bd2bd9b9c45c2367ce6d8b0
-
\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exeMD5
4a27672e4061a5998824886505f4e020
SHA10126388ce02700f859fbade41302226c01d6da41
SHA25643daf586434a7a967a3ab7d8516c76666a6eeba6c1761cea70187e2a2e4513af
SHA512e21d6645e8654d5b85ebb04a2ed174915313e3d7e33b63c5d3fa9164483b9cf3b505e603d6d4788287c15181fd60d6cbfd1fecaa8bd2bd9b9c45c2367ce6d8b0
-
\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exeMD5
4a27672e4061a5998824886505f4e020
SHA10126388ce02700f859fbade41302226c01d6da41
SHA25643daf586434a7a967a3ab7d8516c76666a6eeba6c1761cea70187e2a2e4513af
SHA512e21d6645e8654d5b85ebb04a2ed174915313e3d7e33b63c5d3fa9164483b9cf3b505e603d6d4788287c15181fd60d6cbfd1fecaa8bd2bd9b9c45c2367ce6d8b0
-
\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exeMD5
4a27672e4061a5998824886505f4e020
SHA10126388ce02700f859fbade41302226c01d6da41
SHA25643daf586434a7a967a3ab7d8516c76666a6eeba6c1761cea70187e2a2e4513af
SHA512e21d6645e8654d5b85ebb04a2ed174915313e3d7e33b63c5d3fa9164483b9cf3b505e603d6d4788287c15181fd60d6cbfd1fecaa8bd2bd9b9c45c2367ce6d8b0
-
\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exeMD5
4a27672e4061a5998824886505f4e020
SHA10126388ce02700f859fbade41302226c01d6da41
SHA25643daf586434a7a967a3ab7d8516c76666a6eeba6c1761cea70187e2a2e4513af
SHA512e21d6645e8654d5b85ebb04a2ed174915313e3d7e33b63c5d3fa9164483b9cf3b505e603d6d4788287c15181fd60d6cbfd1fecaa8bd2bd9b9c45c2367ce6d8b0
-
\Users\Admin\AppData\Local\Temp\Witdmaqzywrpbrahnytnew origin bin.exeMD5
4a27672e4061a5998824886505f4e020
SHA10126388ce02700f859fbade41302226c01d6da41
SHA25643daf586434a7a967a3ab7d8516c76666a6eeba6c1761cea70187e2a2e4513af
SHA512e21d6645e8654d5b85ebb04a2ed174915313e3d7e33b63c5d3fa9164483b9cf3b505e603d6d4788287c15181fd60d6cbfd1fecaa8bd2bd9b9c45c2367ce6d8b0
-
memory/1112-68-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB
-
memory/1112-67-0x0000000073F50000-0x000000007463E000-memory.dmpFilesize
6.9MB
-
memory/1112-66-0x0000000000980000-0x00000000009BC000-memory.dmpFilesize
240KB
-
memory/1580-84-0x00000000003F0000-0x00000000003FA000-memory.dmpFilesize
40KB
-
memory/1580-82-0x00000000003E0000-0x00000000003EA000-memory.dmpFilesize
40KB
-
memory/1580-85-0x0000000073F50000-0x000000007463E000-memory.dmpFilesize
6.9MB
-
memory/1580-86-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/1580-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1580-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1580-73-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1580-75-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1580-77-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1580-79-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1580-81-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1580-83-0x0000000000570000-0x000000000058E000-memory.dmpFilesize
120KB
-
memory/1832-62-0x0000000005390000-0x00000000053DC000-memory.dmpFilesize
304KB
-
memory/1832-54-0x0000000000140000-0x000000000014C000-memory.dmpFilesize
48KB
-
memory/1832-60-0x0000000000640000-0x0000000000692000-memory.dmpFilesize
328KB
-
memory/1832-61-0x0000000005300000-0x0000000005352000-memory.dmpFilesize
328KB
-
memory/1832-59-0x0000000000810000-0x0000000000866000-memory.dmpFilesize
344KB
-
memory/1832-58-0x0000000005900000-0x00000000059B2000-memory.dmpFilesize
712KB
-
memory/1832-57-0x0000000004410000-0x0000000004411000-memory.dmpFilesize
4KB
-
memory/1832-56-0x0000000073F50000-0x000000007463E000-memory.dmpFilesize
6.9MB
-
memory/1832-55-0x0000000075E61000-0x0000000075E63000-memory.dmpFilesize
8KB