Malware Analysis Report

2024-10-23 21:32

Sample ID 220521-cpmv2ahcfm
Target b96cfbc6878aabb8d480b165c2576c68af6807c8b80bc80810effd84be7f08e7
SHA256 b96cfbc6878aabb8d480b165c2576c68af6807c8b80bc80810effd84be7f08e7
Tags
masslogger collection evasion ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b96cfbc6878aabb8d480b165c2576c68af6807c8b80bc80810effd84be7f08e7

Threat Level: Known bad

The file b96cfbc6878aabb8d480b165c2576c68af6807c8b80bc80810effd84be7f08e7 was found to be: Known bad.

Malicious Activity Summary

masslogger collection evasion ransomware spyware stealer

MassLogger log file

MassLogger

Modifies visibility of file extensions in Explorer

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

Checks BIOS information in registry

Reads user/profile data of web browsers

Maps connected drives based on registry

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: AddClipboardFormatListener

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-21 02:15

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-21 02:15

Reported

2022-05-21 03:23

Platform

win7-20220414-en

Max time kernel

93s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe"

Signatures

MassLogger

stealer spyware masslogger

MassLogger log file

Description Indicator Process Target
N/A N/A N/A N/A

Modifies visibility of file extensions in Explorer

evasion

Looks for VirtualBox Guest Additions in registry

evasion

Looks for VMWare Tools registry key

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1472 set thread context of 1700 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1472 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\schtasks.exe
PID 1472 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\schtasks.exe
PID 1472 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\schtasks.exe
PID 1472 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\schtasks.exe
PID 1472 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 1472 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 1472 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 1472 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 1472 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 1472 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 1472 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 1472 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 1472 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 1700 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\cmd.exe
PID 1700 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\cmd.exe
PID 1700 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\cmd.exe
PID 1700 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 1952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1368 wrote to memory of 1952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1368 wrote to memory of 1952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1368 wrote to memory of 1952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

outlook_office_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

outlook_win_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe

"C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZAbUGjxkoulYQa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp906.tmp"

C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe

"{path}"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c start /b powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe' & exit

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 3.232.242.170:80 api.ipify.org tcp

Files

memory/1472-54-0x00000000010B0000-0x0000000001178000-memory.dmp

memory/1472-55-0x0000000000350000-0x000000000036C000-memory.dmp

memory/1472-56-0x0000000004A70000-0x0000000004B06000-memory.dmp

memory/1664-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp906.tmp

MD5 d5057d04fd8b21dbdfbb33d7220f0a7e
SHA1 9a870390381c0ca55f50e3af2c7d5356ab2e5f75
SHA256 02d03f82853ad3f9222c5c0b7243abe4e052f79163aa0dfdc4a3b155d1948d35
SHA512 9888823e97341bfcba00abdda2196732c41a3b29bb18cd279b86c0dfee70c66075c70e962b88f5e223438dc4571b18542e7d31d98f1e732cd8d9f501bf093194

memory/1700-60-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1700-59-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1700-62-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1700-63-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1700-64-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1700-65-0x000000000048956E-mapping.dmp

memory/1700-67-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1700-69-0x0000000000400000-0x000000000048E000-memory.dmp

memory/1700-70-0x00000000007E0000-0x0000000000824000-memory.dmp

memory/1700-71-0x0000000074F21000-0x0000000074F23000-memory.dmp

memory/1700-72-0x0000000000820000-0x0000000000834000-memory.dmp

memory/1700-73-0x0000000004C25000-0x0000000004C36000-memory.dmp

memory/1368-74-0x0000000000000000-mapping.dmp

memory/1952-75-0x0000000000000000-mapping.dmp

memory/1952-77-0x000000006EB60000-0x000000006F10B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-21 02:15

Reported

2022-05-21 03:23

Platform

win10v2004-20220414-en

Max time kernel

113s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe"

Signatures

Looks for VirtualBox Guest Additions in registry

evasion

Looks for VMWare Tools registry key

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3996 set thread context of 1216 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3996 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\schtasks.exe
PID 3996 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\schtasks.exe
PID 3996 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\schtasks.exe
PID 3996 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 3996 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 3996 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 3996 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 3996 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 3996 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 3996 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 3996 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe
PID 1216 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\cmd.exe
PID 1216 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4368 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4368 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe

"C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZAbUGjxkoulYQa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC1BA.tmp"

C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe

"{path}"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe' & exit

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\DEBIT SLIP.exe'

Network

Country Destination Domain Proto
US 13.89.178.26:443 tcp
NL 40.126.32.73:443 tcp
US 8.253.208.112:80 tcp
US 8.253.208.112:80 tcp
US 8.253.208.112:80 tcp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp

Files

memory/3996-130-0x0000000000D80000-0x0000000000E48000-memory.dmp

memory/3996-131-0x00000000057B0000-0x000000000584C000-memory.dmp

memory/3996-132-0x0000000005990000-0x0000000005A22000-memory.dmp

memory/3996-133-0x00000000066D0000-0x0000000006C74000-memory.dmp

memory/3996-134-0x00000000061F0000-0x0000000006256000-memory.dmp

memory/340-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC1BA.tmp

MD5 92c98524769065f58ae880ee5845ce94
SHA1 857c857001f238b8df6531f96f6ef791e193d22d
SHA256 c3c51df7a0f0826712bb93b042328ce6411527b1f72972ffff42bb7a9a6dca96
SHA512 6fbbf35cab59902e960ca96294544803c37889cbcf9715683067f2a22273912fe46ec1a7cad08b64b5e09d5efa29aad06a9777c45d3a2339bb6b4e39aee90190

memory/1216-137-0x0000000000000000-mapping.dmp

memory/1216-138-0x0000000000400000-0x000000000048E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DEBIT SLIP.exe.log

MD5 b98b34a0939a52075c19959d5564e798
SHA1 cbaaa2e88b48648b9875afac8f33b4c30703378e
SHA256 937899941aa7d74e757dae8ccf5b05a0e2d9452b735cfb91d285e5415dd5e852
SHA512 7fb6692f780abbbc099bde1b42721d71acce0c0b8cea0cd0b5c1f07c4152fb1a1a1d99ed452ef2c01523d0653f177e66a7232712e5a70cc1468ddc9ad556a3d3

memory/4368-140-0x0000000000000000-mapping.dmp

memory/1992-141-0x0000000000000000-mapping.dmp

memory/1992-142-0x0000000002F70000-0x0000000002FA6000-memory.dmp

memory/1992-143-0x0000000005B20000-0x0000000006148000-memory.dmp

memory/1992-144-0x00000000059B0000-0x00000000059D2000-memory.dmp

memory/1992-145-0x0000000005A50000-0x0000000005AB6000-memory.dmp

memory/1992-146-0x0000000006900000-0x000000000691E000-memory.dmp

memory/1992-147-0x0000000007F70000-0x00000000085EA000-memory.dmp

memory/1992-148-0x0000000006D80000-0x0000000006D9A000-memory.dmp

memory/1992-149-0x0000000007B90000-0x0000000007C26000-memory.dmp

memory/1992-150-0x0000000006EC0000-0x0000000006EE2000-memory.dmp