Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2022 17:44
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
2.2MB
-
MD5
106adc0183d444263d6675db1a2e9540
-
SHA1
d4479ce12196290bea418795e36628a136021949
-
SHA256
5cf09ada20a1467a9f031f8253ca916e3a61d1a399ad64153e63d6ed140f7ee3
-
SHA512
921aa6487e6bb524fab9dad94b59c65f2a567965d845490fd5ada5c27be3e23889d22700591ca581cf639c6662b33d61d3e42b2fe87a52482050edd5a91110fb
-
SSDEEP
49152:F70aLyun15F4UfHlSQWeBGnWSglFJp+uRp4LgCBAvQlAXHzziRy2oqIR7R4j:FAaLyun15FHnJsWJ0oH4lAgSJR2
Malware Config
Extracted
redline
5
116.203.187.3:14916
-
auth_value
febe6965b41d2583ad2bb6b5aa23cfd5
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4612-146-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Updater.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Updater.exe -
Downloads MZ/PE file
-
Executes dropped EXE 16 IoCs
Processes:
Updater.exemnr.exe1.exe2.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exeCsatu.exemnr.exepid process 3808 Updater.exe 996 mnr.exe 4936 1.exe 936 2.exe 644 Csatu.exe 4720 Csatu.exe 4268 Csatu.exe 3848 Csatu.exe 1768 Csatu.exe 3104 Csatu.exe 1200 Csatu.exe 2912 Csatu.exe 2680 Csatu.exe 1264 Csatu.exe 3800 Csatu.exe 1824 mnr.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Updater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Updater.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Csatu.exemnr.exefile.exefile.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Csatu.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation mnr.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation file.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
file.exeCsatu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tehtosfc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gsvigc\\Tehtosfc.exe\"" file.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pmfumz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Fhejna\\Pmfumz.exe\"" Csatu.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Updater.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Updater.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Updater.exepid process 3808 Updater.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 2280 set thread context of 4612 2280 file.exe file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
powershell.exefile.exepowershell.exefile.exeCsatu.exepowershell.exeUpdater.exepowershell.exepid process 212 powershell.exe 212 powershell.exe 2280 file.exe 3844 powershell.exe 3844 powershell.exe 4612 file.exe 644 Csatu.exe 4680 powershell.exe 4680 powershell.exe 3808 Updater.exe 3808 Updater.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 644 Csatu.exe 1208 powershell.exe 1208 powershell.exe 644 Csatu.exe 644 Csatu.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exefile.exepowershell.exefile.exeCsatu.exepowershell.exemnr.exepowershell.exemnr.exedescription pid process Token: SeDebugPrivilege 212 powershell.exe Token: SeDebugPrivilege 2280 file.exe Token: SeDebugPrivilege 3844 powershell.exe Token: SeDebugPrivilege 4612 file.exe Token: SeDebugPrivilege 644 Csatu.exe Token: SeDebugPrivilege 4680 powershell.exe Token: SeDebugPrivilege 996 mnr.exe Token: SeDebugPrivilege 1208 powershell.exe Token: SeDebugPrivilege 1824 mnr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exefile.exeCsatu.exeUpdater.exemnr.exedescription pid process target process PID 2280 wrote to memory of 212 2280 file.exe powershell.exe PID 2280 wrote to memory of 212 2280 file.exe powershell.exe PID 2280 wrote to memory of 212 2280 file.exe powershell.exe PID 2280 wrote to memory of 3844 2280 file.exe powershell.exe PID 2280 wrote to memory of 3844 2280 file.exe powershell.exe PID 2280 wrote to memory of 3844 2280 file.exe powershell.exe PID 2280 wrote to memory of 4612 2280 file.exe file.exe PID 2280 wrote to memory of 4612 2280 file.exe file.exe PID 2280 wrote to memory of 4612 2280 file.exe file.exe PID 2280 wrote to memory of 4612 2280 file.exe file.exe PID 2280 wrote to memory of 4612 2280 file.exe file.exe PID 2280 wrote to memory of 4612 2280 file.exe file.exe PID 2280 wrote to memory of 4612 2280 file.exe file.exe PID 2280 wrote to memory of 4612 2280 file.exe file.exe PID 4612 wrote to memory of 3808 4612 file.exe Updater.exe PID 4612 wrote to memory of 3808 4612 file.exe Updater.exe PID 4612 wrote to memory of 3808 4612 file.exe Updater.exe PID 4612 wrote to memory of 996 4612 file.exe mnr.exe PID 4612 wrote to memory of 996 4612 file.exe mnr.exe PID 4612 wrote to memory of 4936 4612 file.exe 1.exe PID 4612 wrote to memory of 4936 4612 file.exe 1.exe PID 4612 wrote to memory of 936 4612 file.exe 2.exe PID 4612 wrote to memory of 936 4612 file.exe 2.exe PID 4612 wrote to memory of 644 4612 file.exe Csatu.exe PID 4612 wrote to memory of 644 4612 file.exe Csatu.exe PID 4612 wrote to memory of 644 4612 file.exe Csatu.exe PID 644 wrote to memory of 4680 644 Csatu.exe powershell.exe PID 644 wrote to memory of 4680 644 Csatu.exe powershell.exe PID 644 wrote to memory of 4680 644 Csatu.exe powershell.exe PID 3808 wrote to memory of 2016 3808 Updater.exe schtasks.exe PID 3808 wrote to memory of 2016 3808 Updater.exe schtasks.exe PID 3808 wrote to memory of 2016 3808 Updater.exe schtasks.exe PID 644 wrote to memory of 4720 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 4720 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 4720 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 4268 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 4268 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 4268 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 3848 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 3848 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 3848 644 Csatu.exe Csatu.exe PID 996 wrote to memory of 1208 996 mnr.exe powershell.exe PID 996 wrote to memory of 1208 996 mnr.exe powershell.exe PID 644 wrote to memory of 1768 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 1768 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 1768 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 3104 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 3104 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 3104 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 1200 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 1200 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 1200 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 2912 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 2912 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 2912 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 2680 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 2680 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 2680 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 1264 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 1264 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 1264 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 3800 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 3800 644 Csatu.exe Csatu.exe PID 644 wrote to memory of 3800 644 Csatu.exe Csatu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 302⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:212 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\Updater.exe"C:\Users\Admin\AppData\Local\Temp\Updater.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"4⤵
- Creates scheduled task(s)
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\mnr.exe"C:\Users\Admin\AppData\Local\Temp\mnr.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"3⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exe"C:\Users\Admin\AppData\Local\Temp\Csatu.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\Csatu.exeC:\Users\Admin\AppData\Local\Temp\Csatu.exe4⤵
- Executes dropped EXE
PID:3800
-
C:\Users\Admin\AppData\Roaming\mnr.exeC:\Users\Admin\AppData\Roaming\mnr.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1824
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD56f129fd346e1d90873398bb5904035e5
SHA14eadb9e75ad56c4c5e554babaf60521bed760999
SHA256165c23ffad37936a4abcb164e68e081649cc894aee5750848b23a38a47f3119c
SHA512b426e0e41892cbf0610ee52b598925564f25719fc27ff4e7284b6c60ee05a79bd06a1509424cb2b561092d6f522ca12161f1dd8a6a6589572ab5dc8a0584a0a1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
15KB
MD5f0510dc600c62eb87a650527907e467b
SHA1e0979e13f2e6678e9a36e90351137fbcda7f5c36
SHA2566d4f989a139d407120a0f741beda46b1514a43b7229b53d2e6b79bd48dae337a
SHA512d165279d4755e29ea57030258f88667c43f2ed9dbe4b448e81d1824f7a26af3338ef3c79e996ded7fa4855727e482f1317fe3c74f4f4630ee55ab6c6ec12d4e6
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Local\Temp\2.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Local\Temp\2.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Csatu.exeFilesize
2.5MB
MD5abe7dd67159fc04f49f0fead1465e16c
SHA1683b8f96cee5ae7f00ebe7104e92137478c63583
SHA256228a12d1c29aafcf7cfe1781159eb135cb7124271f64d0bc4ad259f907db134f
SHA512ebcbcbdba71096034ec59b7e0030cafe844ff8968e359634e9810f8d044172089f7827038d59499a55200b060b01d0d2db8eb25e2221743ffc5161f1b52a135d
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeFilesize
2.8MB
MD5ecfae3cc8a7ba2e4681a378864658af6
SHA1a84beb327be022f600aed467c2029b4301756dca
SHA25620239b724322bdef1aa4adbdfaa03a90d1f18a5b3b8bcfb16dec10a5823ac0fd
SHA51233ce30cdcfb7b86cdd86e3f9ba7ff97ea168001eca76e0c05f14555a25ce200f2e661b03e8ab762b4a9330bfd794b6366912768a4cce7f88c60c9a2a5717abda
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeFilesize
2.8MB
MD5ecfae3cc8a7ba2e4681a378864658af6
SHA1a84beb327be022f600aed467c2029b4301756dca
SHA25620239b724322bdef1aa4adbdfaa03a90d1f18a5b3b8bcfb16dec10a5823ac0fd
SHA51233ce30cdcfb7b86cdd86e3f9ba7ff97ea168001eca76e0c05f14555a25ce200f2e661b03e8ab762b4a9330bfd794b6366912768a4cce7f88c60c9a2a5717abda
-
C:\Users\Admin\AppData\Local\Temp\mnr.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Local\Temp\mnr.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Roaming\mnr.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
C:\Users\Admin\AppData\Roaming\mnr.exeFilesize
1.1MB
MD583f5b59561ffd68339e06f5e007537bf
SHA1235df5c30aeba5f1f2fa93ea93a18f31f863460d
SHA256dec3e568197c83617b06aa3b099d4cc7fc05b0881af4b0585e626b8eb5be572a
SHA512cb2d670e1c6f9e4563b6be93ca053cfcb5a56c1fff3d9a8f0f2358822f10d4291afde09f8e0c9aba99fe09e45c5617bbed72ae0f88066a9468cb9828c26f0ba7
-
memory/212-134-0x0000000002E90000-0x0000000002EC6000-memory.dmpFilesize
216KB
-
memory/212-133-0x0000000000000000-mapping.dmp
-
memory/212-138-0x0000000006020000-0x0000000006086000-memory.dmpFilesize
408KB
-
memory/212-135-0x0000000005880000-0x0000000005EA8000-memory.dmpFilesize
6.2MB
-
memory/212-136-0x00000000057C0000-0x00000000057E2000-memory.dmpFilesize
136KB
-
memory/212-141-0x00000000078C0000-0x00000000078DA000-memory.dmpFilesize
104KB
-
memory/212-140-0x0000000007F40000-0x00000000085BA000-memory.dmpFilesize
6.5MB
-
memory/212-139-0x00000000067A0000-0x00000000067BE000-memory.dmpFilesize
120KB
-
memory/212-137-0x0000000005EB0000-0x0000000005F16000-memory.dmpFilesize
408KB
-
memory/644-190-0x0000000000000000-mapping.dmp
-
memory/644-199-0x0000000000A40000-0x0000000000CBE000-memory.dmpFilesize
2.5MB
-
memory/936-177-0x0000000000000000-mapping.dmp
-
memory/936-198-0x00007FFAC8A90000-0x00007FFAC8AA2000-memory.dmpFilesize
72KB
-
memory/936-188-0x00000000027B0000-0x00000000027F2000-memory.dmpFilesize
264KB
-
memory/936-240-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/936-191-0x00007FFAAF010000-0x00007FFAAF0BA000-memory.dmpFilesize
680KB
-
memory/936-194-0x00007FFACBFB0000-0x00007FFACC04E000-memory.dmpFilesize
632KB
-
memory/936-229-0x00000000027B0000-0x00000000027F2000-memory.dmpFilesize
264KB
-
memory/936-233-0x00007FFACB2A0000-0x00007FFACB2C7000-memory.dmpFilesize
156KB
-
memory/936-234-0x00007FF68E0D0000-0x00007FF68E1E8000-memory.dmpFilesize
1.1MB
-
memory/936-218-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/936-200-0x00007FFAAE480000-0x00007FFAAE53D000-memory.dmpFilesize
756KB
-
memory/936-202-0x00007FFACBC80000-0x00007FFACBE21000-memory.dmpFilesize
1.6MB
-
memory/936-215-0x00007FFAACD30000-0x00007FFAACE7E000-memory.dmpFilesize
1.3MB
-
memory/936-204-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/936-236-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/936-237-0x00007FF68E0D0000-0x00007FF68E1E8000-memory.dmpFilesize
1.1MB
-
memory/936-209-0x00007FFACB630000-0x00007FFACB65B000-memory.dmpFilesize
172KB
-
memory/936-214-0x00007FF68E0D0000-0x00007FF68E1E8000-memory.dmpFilesize
1.1MB
-
memory/936-217-0x00007FFAB8080000-0x00007FFAB8099000-memory.dmpFilesize
100KB
-
memory/996-192-0x00007FFACB630000-0x00007FFACB65B000-memory.dmpFilesize
172KB
-
memory/996-231-0x00007FFACB2A0000-0x00007FFACB2C7000-memory.dmpFilesize
156KB
-
memory/996-226-0x0000000001000000-0x0000000001042000-memory.dmpFilesize
264KB
-
memory/996-212-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/996-167-0x00007FFACBFB0000-0x00007FFACC04E000-memory.dmpFilesize
632KB
-
memory/996-169-0x00007FFAC8A90000-0x00007FFAC8AA2000-memory.dmpFilesize
72KB
-
memory/996-170-0x00007FFAAE480000-0x00007FFAAE53D000-memory.dmpFilesize
756KB
-
memory/996-205-0x00007FF7D1790000-0x00007FF7D18A8000-memory.dmpFilesize
1.1MB
-
memory/996-203-0x00007FF7D1790000-0x00007FF7D18A8000-memory.dmpFilesize
1.1MB
-
memory/996-211-0x00007FFAB8080000-0x00007FFAB8099000-memory.dmpFilesize
100KB
-
memory/996-287-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/996-207-0x00007FFAACD30000-0x00007FFAACE7E000-memory.dmpFilesize
1.3MB
-
memory/996-285-0x00007FF7D1790000-0x00007FF7D18A8000-memory.dmpFilesize
1.1MB
-
memory/996-166-0x00007FFAAF010000-0x00007FFAAF0BA000-memory.dmpFilesize
680KB
-
memory/996-230-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/996-174-0x00007FFACBC80000-0x00007FFACBE21000-memory.dmpFilesize
1.6MB
-
memory/996-179-0x0000000001000000-0x0000000001042000-memory.dmpFilesize
264KB
-
memory/996-225-0x00007FF7D1790000-0x00007FF7D18A8000-memory.dmpFilesize
1.1MB
-
memory/996-176-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/996-159-0x0000000000000000-mapping.dmp
-
memory/996-165-0x00007FF7D1790000-0x00007FF7D18A8000-memory.dmpFilesize
1.1MB
-
memory/1200-256-0x0000000000000000-mapping.dmp
-
memory/1208-268-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/1208-264-0x000001ABF9320000-0x000001ABF9342000-memory.dmpFilesize
136KB
-
memory/1208-288-0x000001ABF9420000-0x000001ABF943C000-memory.dmpFilesize
112KB
-
memory/1208-289-0x000001ABF9440000-0x000001ABF944A000-memory.dmpFilesize
40KB
-
memory/1208-290-0x000001ABF9450000-0x000001ABF9458000-memory.dmpFilesize
32KB
-
memory/1208-250-0x0000000000000000-mapping.dmp
-
memory/1264-262-0x0000000000000000-mapping.dmp
-
memory/1768-252-0x0000000000000000-mapping.dmp
-
memory/1824-283-0x00007FFAACD30000-0x00007FFAACE7E000-memory.dmpFilesize
1.3MB
-
memory/1824-273-0x00007FFAAF010000-0x00007FFAAF0BA000-memory.dmpFilesize
680KB
-
memory/1824-282-0x00007FF68DD60000-0x00007FF68DE78000-memory.dmpFilesize
1.1MB
-
memory/1824-276-0x00007FFAAE480000-0x00007FFAAE53D000-memory.dmpFilesize
756KB
-
memory/1824-277-0x00007FFACBC80000-0x00007FFACBE21000-memory.dmpFilesize
1.6MB
-
memory/1824-275-0x00007FFAC8A90000-0x00007FFAC8AA2000-memory.dmpFilesize
72KB
-
memory/1824-278-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/1824-279-0x00007FFACB630000-0x00007FFACB65B000-memory.dmpFilesize
172KB
-
memory/1824-274-0x00007FFACBFB0000-0x00007FFACC04E000-memory.dmpFilesize
632KB
-
memory/1824-281-0x0000000001000000-0x0000000001042000-memory.dmpFilesize
264KB
-
memory/1824-293-0x00007FFACB2A0000-0x00007FFACB2C7000-memory.dmpFilesize
156KB
-
memory/1824-284-0x00007FFAB8080000-0x00007FFAB8099000-memory.dmpFilesize
100KB
-
memory/1824-280-0x00007FF68DD60000-0x00007FF68DE78000-memory.dmpFilesize
1.1MB
-
memory/1824-286-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/2016-238-0x0000000000000000-mapping.dmp
-
memory/2280-143-0x0000000005710000-0x00000000057A2000-memory.dmpFilesize
584KB
-
memory/2280-132-0x0000000000A90000-0x0000000000CC6000-memory.dmpFilesize
2.2MB
-
memory/2280-144-0x00000000072E0000-0x0000000007884000-memory.dmpFilesize
5.6MB
-
memory/2680-260-0x0000000000000000-mapping.dmp
-
memory/2912-258-0x0000000000000000-mapping.dmp
-
memory/3104-254-0x0000000000000000-mapping.dmp
-
memory/3800-265-0x0000000000000000-mapping.dmp
-
memory/3808-224-0x0000000077C50000-0x0000000077DF3000-memory.dmpFilesize
1.6MB
-
memory/3808-244-0x0000000077C50000-0x0000000077DF3000-memory.dmpFilesize
1.6MB
-
memory/3808-243-0x0000000000D40000-0x00000000011FC000-memory.dmpFilesize
4.7MB
-
memory/3808-242-0x0000000000D40000-0x00000000011FC000-memory.dmpFilesize
4.7MB
-
memory/3808-156-0x0000000000000000-mapping.dmp
-
memory/3808-164-0x0000000000D40000-0x00000000011FC000-memory.dmpFilesize
4.7MB
-
memory/3808-223-0x0000000000D40000-0x00000000011FC000-memory.dmpFilesize
4.7MB
-
memory/3844-142-0x0000000000000000-mapping.dmp
-
memory/3848-249-0x0000000000000000-mapping.dmp
-
memory/4268-247-0x0000000000000000-mapping.dmp
-
memory/4612-155-0x00000000072E0000-0x0000000007330000-memory.dmpFilesize
320KB
-
memory/4612-149-0x0000000005840000-0x000000000594A000-memory.dmpFilesize
1.0MB
-
memory/4612-148-0x0000000005710000-0x0000000005722000-memory.dmpFilesize
72KB
-
memory/4612-150-0x0000000005770000-0x00000000057AC000-memory.dmpFilesize
240KB
-
memory/4612-151-0x0000000005AF0000-0x0000000005B66000-memory.dmpFilesize
472KB
-
memory/4612-147-0x0000000005D00000-0x0000000006318000-memory.dmpFilesize
6.1MB
-
memory/4612-152-0x0000000005C80000-0x0000000005C9E000-memory.dmpFilesize
120KB
-
memory/4612-146-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4612-153-0x0000000007350000-0x0000000007512000-memory.dmpFilesize
1.8MB
-
memory/4612-154-0x0000000007A50000-0x0000000007F7C000-memory.dmpFilesize
5.2MB
-
memory/4612-145-0x0000000000000000-mapping.dmp
-
memory/4680-219-0x0000000000000000-mapping.dmp
-
memory/4720-245-0x0000000000000000-mapping.dmp
-
memory/4936-228-0x00000000003A0000-0x00000000003E2000-memory.dmpFilesize
264KB
-
memory/4936-195-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/4936-235-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/4936-232-0x00007FFACB2A0000-0x00007FFACB2C7000-memory.dmpFilesize
156KB
-
memory/4936-241-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/4936-227-0x00007FF7FEC60000-0x00007FF7FED78000-memory.dmpFilesize
1.1MB
-
memory/4936-208-0x00007FF7FEC60000-0x00007FF7FED78000-memory.dmpFilesize
1.1MB
-
memory/4936-168-0x0000000000000000-mapping.dmp
-
memory/4936-187-0x00007FFAC8A90000-0x00007FFAC8AA2000-memory.dmpFilesize
72KB
-
memory/4936-178-0x00007FFAAF010000-0x00007FFAAF0BA000-memory.dmpFilesize
680KB
-
memory/4936-183-0x00007FF7FEC60000-0x00007FF7FED78000-memory.dmpFilesize
1.1MB
-
memory/4936-239-0x00007FF7FEC60000-0x00007FF7FED78000-memory.dmpFilesize
1.1MB
-
memory/4936-185-0x00007FFACBFB0000-0x00007FFACC04E000-memory.dmpFilesize
632KB
-
memory/4936-186-0x00000000003A0000-0x00000000003E2000-memory.dmpFilesize
264KB
-
memory/4936-189-0x00007FFAAE480000-0x00007FFAAE53D000-memory.dmpFilesize
756KB
-
memory/4936-193-0x00007FFACBC80000-0x00007FFACBE21000-memory.dmpFilesize
1.6MB
-
memory/4936-201-0x00007FFACB630000-0x00007FFACB65B000-memory.dmpFilesize
172KB
-
memory/4936-206-0x00007FF7FEC60000-0x00007FF7FED78000-memory.dmpFilesize
1.1MB
-
memory/4936-216-0x00007FFAAE540000-0x00007FFAAF001000-memory.dmpFilesize
10.8MB
-
memory/4936-213-0x00007FFAB8080000-0x00007FFAB8099000-memory.dmpFilesize
100KB
-
memory/4936-210-0x00007FFAACD30000-0x00007FFAACE7E000-memory.dmpFilesize
1.3MB