Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2022 17:44
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
2.2MB
-
MD5
106adc0183d444263d6675db1a2e9540
-
SHA1
d4479ce12196290bea418795e36628a136021949
-
SHA256
5cf09ada20a1467a9f031f8253ca916e3a61d1a399ad64153e63d6ed140f7ee3
-
SHA512
921aa6487e6bb524fab9dad94b59c65f2a567965d845490fd5ada5c27be3e23889d22700591ca581cf639c6662b33d61d3e42b2fe87a52482050edd5a91110fb
-
SSDEEP
49152:F70aLyun15F4UfHlSQWeBGnWSglFJp+uRp4LgCBAvQlAXHzziRy2oqIR7R4j:FAaLyun15FHnJsWJ0oH4lAgSJR2
Malware Config
Extracted
redline
5
116.203.187.3:14916
-
auth_value
febe6965b41d2583ad2bb6b5aa23cfd5
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2928-147-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Updater.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Updater.exe -
Downloads MZ/PE file
-
Executes dropped EXE 16 IoCs
Processes:
Updater.exemnr.exe1.exe2.exeCsatu.exemnr.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exepid process 3196 Updater.exe 4116 mnr.exe 4596 1.exe 4496 2.exe 2704 Csatu.exe 4688 mnr.exe 4084 Csatu.exe 4708 Csatu.exe 3348 Csatu.exe 1876 Csatu.exe 4980 Csatu.exe 4104 Csatu.exe 1440 Csatu.exe 2396 Csatu.exe 4068 Csatu.exe 1164 Csatu.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Updater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Updater.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Csatu.exemnr.exefile.exefile.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Csatu.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation mnr.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation file.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
file.exeCsatu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tehtosfc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gsvigc\\Tehtosfc.exe\"" file.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pmfumz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Fhejna\\Pmfumz.exe\"" Csatu.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Updater.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Updater.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Updater.exepid process 3196 Updater.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 4264 set thread context of 2928 4264 file.exe file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
powershell.exefile.exepowershell.exefile.exeCsatu.exepowershell.exeUpdater.exepowershell.exepid process 540 powershell.exe 540 powershell.exe 4264 file.exe 2976 powershell.exe 2976 powershell.exe 4264 file.exe 4264 file.exe 2928 file.exe 2704 Csatu.exe 4780 powershell.exe 4780 powershell.exe 3196 Updater.exe 3196 Updater.exe 1640 powershell.exe 1640 powershell.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe 2704 Csatu.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exefile.exepowershell.exefile.exeCsatu.exepowershell.exemnr.exepowershell.exemnr.exedescription pid process Token: SeDebugPrivilege 540 powershell.exe Token: SeDebugPrivilege 4264 file.exe Token: SeDebugPrivilege 2976 powershell.exe Token: SeDebugPrivilege 2928 file.exe Token: SeDebugPrivilege 2704 Csatu.exe Token: SeDebugPrivilege 4780 powershell.exe Token: SeDebugPrivilege 4116 mnr.exe Token: SeDebugPrivilege 1640 powershell.exe Token: SeDebugPrivilege 4688 mnr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exefile.exeCsatu.exeUpdater.exemnr.exedescription pid process target process PID 4264 wrote to memory of 540 4264 file.exe powershell.exe PID 4264 wrote to memory of 540 4264 file.exe powershell.exe PID 4264 wrote to memory of 540 4264 file.exe powershell.exe PID 4264 wrote to memory of 2976 4264 file.exe powershell.exe PID 4264 wrote to memory of 2976 4264 file.exe powershell.exe PID 4264 wrote to memory of 2976 4264 file.exe powershell.exe PID 4264 wrote to memory of 3088 4264 file.exe file.exe PID 4264 wrote to memory of 3088 4264 file.exe file.exe PID 4264 wrote to memory of 3088 4264 file.exe file.exe PID 4264 wrote to memory of 2928 4264 file.exe file.exe PID 4264 wrote to memory of 2928 4264 file.exe file.exe PID 4264 wrote to memory of 2928 4264 file.exe file.exe PID 4264 wrote to memory of 2928 4264 file.exe file.exe PID 4264 wrote to memory of 2928 4264 file.exe file.exe PID 4264 wrote to memory of 2928 4264 file.exe file.exe PID 4264 wrote to memory of 2928 4264 file.exe file.exe PID 4264 wrote to memory of 2928 4264 file.exe file.exe PID 2928 wrote to memory of 3196 2928 file.exe Updater.exe PID 2928 wrote to memory of 3196 2928 file.exe Updater.exe PID 2928 wrote to memory of 3196 2928 file.exe Updater.exe PID 2928 wrote to memory of 4116 2928 file.exe mnr.exe PID 2928 wrote to memory of 4116 2928 file.exe mnr.exe PID 2928 wrote to memory of 4596 2928 file.exe 1.exe PID 2928 wrote to memory of 4596 2928 file.exe 1.exe PID 2928 wrote to memory of 4496 2928 file.exe 2.exe PID 2928 wrote to memory of 4496 2928 file.exe 2.exe PID 2928 wrote to memory of 2704 2928 file.exe Csatu.exe PID 2928 wrote to memory of 2704 2928 file.exe Csatu.exe PID 2928 wrote to memory of 2704 2928 file.exe Csatu.exe PID 2704 wrote to memory of 4780 2704 Csatu.exe powershell.exe PID 2704 wrote to memory of 4780 2704 Csatu.exe powershell.exe PID 2704 wrote to memory of 4780 2704 Csatu.exe powershell.exe PID 3196 wrote to memory of 3368 3196 Updater.exe schtasks.exe PID 3196 wrote to memory of 3368 3196 Updater.exe schtasks.exe PID 3196 wrote to memory of 3368 3196 Updater.exe schtasks.exe PID 4116 wrote to memory of 1640 4116 mnr.exe powershell.exe PID 4116 wrote to memory of 1640 4116 mnr.exe powershell.exe PID 2704 wrote to memory of 4084 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4084 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4084 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4708 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4708 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4708 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 3348 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 3348 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 3348 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 1876 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 1876 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 1876 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4980 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4980 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4980 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4104 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4104 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4104 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 1440 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 1440 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 1440 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 2396 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 2396 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 2396 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4068 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4068 2704 Csatu.exe Csatu.exe PID 2704 wrote to memory of 4068 2704 Csatu.exe Csatu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 302⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Updater.exe"C:\Users\Admin\AppData\Local\Temp\Updater.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\mnr.exe"C:\Users\Admin\AppData\Local\Temp\mnr.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exe"C:\Users\Admin\AppData\Local\Temp\Csatu.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\mnr.exeC:\Users\Admin\AppData\Roaming\mnr.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD57d720727b5867ddfed44fbfc8fcf861b
SHA1d349feb70fbfb46ca52f0fa75830faae1965da06
SHA2566e96d9cad8531891d2efa926e0ddc80d5b2c3423ed0423ea1cf11ea92a560885
SHA51270b298c320eb1ac0d027e2e10ae460fabb073fd1bdcad14d181cd1d3af673cb8e7283809e83382c503ecd9001c6ccf14e1e69332eac883caf292f94a94d84b9d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD536969e5327af13da7b6095b45d351ebe
SHA1a7aaed0eaf19951de2e451e80373e153badeb8e2
SHA2566b96171b9bed1a6c740d394275f66d404d99ac6921a94fbb669d8e1aed90d71c
SHA51299e52c52478d9de9ae4b3ba25111239bd3e9108cb4b263d4eba0e5231651c64754b209010a76d2c82dd63c6fed6d4baa216e4d2733593f3c1af08ddb0edc89ad
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Local\Temp\2.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Local\Temp\2.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeFilesize
2.8MB
MD5ecfae3cc8a7ba2e4681a378864658af6
SHA1a84beb327be022f600aed467c2029b4301756dca
SHA25620239b724322bdef1aa4adbdfaa03a90d1f18a5b3b8bcfb16dec10a5823ac0fd
SHA51233ce30cdcfb7b86cdd86e3f9ba7ff97ea168001eca76e0c05f14555a25ce200f2e661b03e8ab762b4a9330bfd794b6366912768a4cce7f88c60c9a2a5717abda
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeFilesize
2.8MB
MD5ecfae3cc8a7ba2e4681a378864658af6
SHA1a84beb327be022f600aed467c2029b4301756dca
SHA25620239b724322bdef1aa4adbdfaa03a90d1f18a5b3b8bcfb16dec10a5823ac0fd
SHA51233ce30cdcfb7b86cdd86e3f9ba7ff97ea168001eca76e0c05f14555a25ce200f2e661b03e8ab762b4a9330bfd794b6366912768a4cce7f88c60c9a2a5717abda
-
C:\Users\Admin\AppData\Local\Temp\mnr.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Local\Temp\mnr.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Roaming\mnr.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Roaming\mnr.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
memory/540-137-0x00000000057C0000-0x0000000005826000-memory.dmpFilesize
408KB
-
memory/540-138-0x0000000005830000-0x0000000005896000-memory.dmpFilesize
408KB
-
memory/540-139-0x0000000005F70000-0x0000000005F8E000-memory.dmpFilesize
120KB
-
memory/540-140-0x0000000007720000-0x0000000007D9A000-memory.dmpFilesize
6.5MB
-
memory/540-136-0x0000000004FA0000-0x0000000004FC2000-memory.dmpFilesize
136KB
-
memory/540-135-0x0000000005190000-0x00000000057B8000-memory.dmpFilesize
6.2MB
-
memory/540-141-0x00000000070A0000-0x00000000070BA000-memory.dmpFilesize
104KB
-
memory/540-134-0x0000000002650000-0x0000000002686000-memory.dmpFilesize
216KB
-
memory/540-133-0x0000000000000000-mapping.dmp
-
memory/1164-284-0x0000000000000000-mapping.dmp
-
memory/1440-278-0x0000000000000000-mapping.dmp
-
memory/1640-245-0x0000021C67440000-0x0000021C67462000-memory.dmpFilesize
136KB
-
memory/1640-291-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/1640-246-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/1640-289-0x0000021C673B0000-0x0000021C673BA000-memory.dmpFilesize
40KB
-
memory/1640-288-0x0000021C00B20000-0x0000021C00B28000-memory.dmpFilesize
32KB
-
memory/1640-287-0x0000021C673A0000-0x0000021C673AA000-memory.dmpFilesize
40KB
-
memory/1640-286-0x0000021C67470000-0x0000021C6748C000-memory.dmpFilesize
112KB
-
memory/1640-244-0x0000000000000000-mapping.dmp
-
memory/1876-271-0x0000000000000000-mapping.dmp
-
memory/2396-280-0x0000000000000000-mapping.dmp
-
memory/2704-205-0x00000000002E0000-0x000000000055E000-memory.dmpFilesize
2.5MB
-
memory/2704-199-0x0000000000000000-mapping.dmp
-
memory/2928-155-0x0000000007670000-0x0000000007832000-memory.dmpFilesize
1.8MB
-
memory/2928-148-0x0000000005F80000-0x0000000006598000-memory.dmpFilesize
6.1MB
-
memory/2928-146-0x0000000000000000-mapping.dmp
-
memory/2928-147-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2928-156-0x0000000007D70000-0x000000000829C000-memory.dmpFilesize
5.2MB
-
memory/2928-149-0x00000000033F0000-0x0000000003402000-memory.dmpFilesize
72KB
-
memory/2928-154-0x0000000007350000-0x00000000073A0000-memory.dmpFilesize
320KB
-
memory/2928-153-0x0000000006C70000-0x0000000006C8E000-memory.dmpFilesize
120KB
-
memory/2928-150-0x0000000005A70000-0x0000000005B7A000-memory.dmpFilesize
1.0MB
-
memory/2928-151-0x00000000059A0000-0x00000000059DC000-memory.dmpFilesize
240KB
-
memory/2928-152-0x0000000006950000-0x00000000069C6000-memory.dmpFilesize
472KB
-
memory/2976-142-0x0000000000000000-mapping.dmp
-
memory/3088-145-0x0000000000000000-mapping.dmp
-
memory/3196-157-0x0000000000000000-mapping.dmp
-
memory/3196-166-0x0000000000F90000-0x000000000144C000-memory.dmpFilesize
4.7MB
-
memory/3196-224-0x0000000000F90000-0x000000000144C000-memory.dmpFilesize
4.7MB
-
memory/3196-223-0x0000000077B80000-0x0000000077D23000-memory.dmpFilesize
1.6MB
-
memory/3196-242-0x0000000077B80000-0x0000000077D23000-memory.dmpFilesize
1.6MB
-
memory/3196-240-0x0000000000F90000-0x000000000144C000-memory.dmpFilesize
4.7MB
-
memory/3348-267-0x0000000000000000-mapping.dmp
-
memory/3368-237-0x0000000000000000-mapping.dmp
-
memory/4068-282-0x0000000000000000-mapping.dmp
-
memory/4084-259-0x0000000000000000-mapping.dmp
-
memory/4104-276-0x0000000000000000-mapping.dmp
-
memory/4116-200-0x00007FFA324B0000-0x00007FFA325FE000-memory.dmpFilesize
1.3MB
-
memory/4116-213-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4116-233-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4116-270-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4116-178-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4116-160-0x0000000000000000-mapping.dmp
-
memory/4116-268-0x00007FF6F2110000-0x00007FF6F2228000-memory.dmpFilesize
1.1MB
-
memory/4116-167-0x00007FF6F2110000-0x00007FF6F2228000-memory.dmpFilesize
1.1MB
-
memory/4116-169-0x00007FFA4F720000-0x00007FFA4F7BE000-memory.dmpFilesize
632KB
-
memory/4116-207-0x00007FFA3B690000-0x00007FFA3B6A9000-memory.dmpFilesize
100KB
-
memory/4116-168-0x0000000002DB0000-0x0000000002DF2000-memory.dmpFilesize
264KB
-
memory/4116-193-0x00007FFA4FBD0000-0x00007FFA4FBFB000-memory.dmpFilesize
172KB
-
memory/4116-165-0x00007FFA32F30000-0x00007FFA32FDA000-memory.dmpFilesize
680KB
-
memory/4116-171-0x00007FFA4BBF0000-0x00007FFA4BC02000-memory.dmpFilesize
72KB
-
memory/4116-225-0x00007FF6F2110000-0x00007FF6F2228000-memory.dmpFilesize
1.1MB
-
memory/4116-226-0x0000000002DB0000-0x0000000002DF2000-memory.dmpFilesize
264KB
-
memory/4116-172-0x00007FFA32E70000-0x00007FFA32F2D000-memory.dmpFilesize
756KB
-
memory/4116-228-0x00007FFA4E2A0000-0x00007FFA4E2C7000-memory.dmpFilesize
156KB
-
memory/4116-173-0x00007FFA4ED00000-0x00007FFA4EEA1000-memory.dmpFilesize
1.6MB
-
memory/4116-197-0x00007FF6F2110000-0x00007FF6F2228000-memory.dmpFilesize
1.1MB
-
memory/4264-144-0x0000000006BA0000-0x0000000007144000-memory.dmpFilesize
5.6MB
-
memory/4264-143-0x0000000000EF0000-0x0000000000F82000-memory.dmpFilesize
584KB
-
memory/4264-132-0x0000000000350000-0x0000000000586000-memory.dmpFilesize
2.2MB
-
memory/4496-202-0x00007FFA32E70000-0x00007FFA32F2D000-memory.dmpFilesize
756KB
-
memory/4496-191-0x00007FF609940000-0x00007FF609A58000-memory.dmpFilesize
1.1MB
-
memory/4496-236-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4496-194-0x0000000002C60000-0x0000000002CA2000-memory.dmpFilesize
264KB
-
memory/4496-234-0x00007FFA4E2A0000-0x00007FFA4E2C7000-memory.dmpFilesize
156KB
-
memory/4496-232-0x0000000002C60000-0x0000000002CA2000-memory.dmpFilesize
264KB
-
memory/4496-180-0x0000000000000000-mapping.dmp
-
memory/4496-241-0x00007FF609940000-0x00007FF609A58000-memory.dmpFilesize
1.1MB
-
memory/4496-198-0x00007FFA4BBF0000-0x00007FFA4BC02000-memory.dmpFilesize
72KB
-
memory/4496-243-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4496-227-0x00007FF609940000-0x00007FF609A58000-memory.dmpFilesize
1.1MB
-
memory/4496-196-0x00007FFA4F720000-0x00007FFA4F7BE000-memory.dmpFilesize
632KB
-
memory/4496-195-0x00007FFA32F30000-0x00007FFA32FDA000-memory.dmpFilesize
680KB
-
memory/4496-206-0x00007FFA4ED00000-0x00007FFA4EEA1000-memory.dmpFilesize
1.6MB
-
memory/4496-208-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4496-218-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4496-216-0x00007FFA324B0000-0x00007FFA325FE000-memory.dmpFilesize
1.3MB
-
memory/4496-217-0x00007FFA3B690000-0x00007FFA3B6A9000-memory.dmpFilesize
100KB
-
memory/4496-211-0x00007FFA4FBD0000-0x00007FFA4FBFB000-memory.dmpFilesize
172KB
-
memory/4496-214-0x00007FF609940000-0x00007FF609A58000-memory.dmpFilesize
1.1MB
-
memory/4596-201-0x00007FFA4FBD0000-0x00007FFA4FBFB000-memory.dmpFilesize
172KB
-
memory/4596-188-0x0000000000E00000-0x0000000000E42000-memory.dmpFilesize
264KB
-
memory/4596-170-0x0000000000000000-mapping.dmp
-
memory/4596-179-0x00007FFA32F30000-0x00007FFA32FDA000-memory.dmpFilesize
680KB
-
memory/4596-181-0x00007FFA4F720000-0x00007FFA4F7BE000-memory.dmpFilesize
632KB
-
memory/4596-182-0x00007FFA4BBF0000-0x00007FFA4BC02000-memory.dmpFilesize
72KB
-
memory/4596-187-0x00007FFA32E70000-0x00007FFA32F2D000-memory.dmpFilesize
756KB
-
memory/4596-185-0x00007FF670A00000-0x00007FF670B18000-memory.dmpFilesize
1.1MB
-
memory/4596-190-0x00007FFA4ED00000-0x00007FFA4EEA1000-memory.dmpFilesize
1.6MB
-
memory/4596-192-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4596-212-0x00007FFA3B690000-0x00007FFA3B6A9000-memory.dmpFilesize
100KB
-
memory/4596-210-0x00007FFA324B0000-0x00007FFA325FE000-memory.dmpFilesize
1.3MB
-
memory/4596-209-0x00007FF670A00000-0x00007FF670B18000-memory.dmpFilesize
1.1MB
-
memory/4596-215-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4596-239-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4596-229-0x00007FFA4E2A0000-0x00007FFA4E2C7000-memory.dmpFilesize
156KB
-
memory/4596-230-0x00007FF670A00000-0x00007FF670B18000-memory.dmpFilesize
1.1MB
-
memory/4596-238-0x00007FF670A00000-0x00007FF670B18000-memory.dmpFilesize
1.1MB
-
memory/4596-235-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4596-231-0x0000000000E00000-0x0000000000E42000-memory.dmpFilesize
264KB
-
memory/4688-257-0x00007FF77D5F0000-0x00007FF77D708000-memory.dmpFilesize
1.1MB
-
memory/4688-255-0x00007FFA4ED00000-0x00007FFA4EEA1000-memory.dmpFilesize
1.6MB
-
memory/4688-292-0x00007FFA4E2A0000-0x00007FFA4E2C7000-memory.dmpFilesize
156KB
-
memory/4688-251-0x00007FFA32F30000-0x00007FFA32FDA000-memory.dmpFilesize
680KB
-
memory/4688-253-0x00007FFA4BBF0000-0x00007FFA4BC02000-memory.dmpFilesize
72KB
-
memory/4688-254-0x00007FFA32E70000-0x00007FFA32F2D000-memory.dmpFilesize
756KB
-
memory/4688-263-0x00007FF77D5F0000-0x00007FF77D708000-memory.dmpFilesize
1.1MB
-
memory/4688-264-0x00007FFA324B0000-0x00007FFA325FE000-memory.dmpFilesize
1.3MB
-
memory/4688-258-0x0000000002CA0000-0x0000000002CE2000-memory.dmpFilesize
264KB
-
memory/4688-272-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4688-266-0x00007FFA3B690000-0x00007FFA3B6A9000-memory.dmpFilesize
100KB
-
memory/4688-256-0x00007FFA30CA0000-0x00007FFA31761000-memory.dmpFilesize
10.8MB
-
memory/4688-252-0x00007FFA4F720000-0x00007FFA4F7BE000-memory.dmpFilesize
632KB
-
memory/4688-260-0x00007FFA4FBD0000-0x00007FFA4FBFB000-memory.dmpFilesize
172KB
-
memory/4708-262-0x0000000000000000-mapping.dmp
-
memory/4780-219-0x0000000000000000-mapping.dmp
-
memory/4980-274-0x0000000000000000-mapping.dmp