Analysis
-
max time kernel
119s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2022 10:19
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe
-
Size
589KB
-
MD5
1cce66219ac8c0def60f5a3c23d02f42
-
SHA1
c9c99c1e25835e3688f30adb6fe0f85e564f4d74
-
SHA256
47fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
-
SHA512
098484fba05b902c0747580693ea8c33bd15af605d67c3f50d1c114e060c8eff31a7e0fe43bff7d310e2692764bd6a30137fd0006bad6e8f1dc55daffbf190dc
-
SSDEEP
12288:dH5hE7rJpAEHrcQE05VZaCs8tAu+WCwUQzCHnQPz44aqMZeoW0rgm9MtBImQrwFo:ROzGavOLzHKmaX4
Malware Config
Extracted
netwire
iphanyi.edns.biz:3360
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
RDP_SEPT_2022
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
caster123
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 13 IoCs
Processes:
resource yara_rule behavioral2/memory/224-136-0x00000000005C0000-0x0000000000610000-memory.dmp netwire behavioral2/memory/224-143-0x00000000005C0000-0x0000000000610000-memory.dmp netwire behavioral2/memory/224-147-0x00000000005C0000-0x0000000000610000-memory.dmp netwire behavioral2/memory/3508-155-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/3508-156-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/3508-158-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/3508-165-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/2796-171-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/2796-172-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/2796-175-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/2796-177-0x0000000000400000-0x0000000000450000-memory.dmp netwire behavioral2/memory/4000-189-0x0000000000700000-0x0000000000750000-memory.dmp netwire behavioral2/memory/4000-194-0x0000000000700000-0x0000000000750000-memory.dmp netwire -
Executes dropped EXE 6 IoCs
Processes:
intelGraphic.exeintelGraphic.exeHost.exeHost.exeintelGraphic.exeintelGraphic.exepid process 4652 intelGraphic.exe 3508 intelGraphic.exe 4128 Host.exe 2796 Host.exe 3464 intelGraphic.exe 4000 intelGraphic.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
intelGraphic.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation intelGraphic.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exeintelGraphic.exeHost.exeintelGraphic.exedescription pid process target process PID 4836 set thread context of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4652 set thread context of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4128 set thread context of 2796 4128 Host.exe Host.exe PID 3464 set thread context of 4000 3464 intelGraphic.exe intelGraphic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 828 224 WerFault.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe 4324 4000 WerFault.exe intelGraphic.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3544 schtasks.exe 2624 schtasks.exe 760 schtasks.exe 688 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exeintelGraphic.exeHost.exeintelGraphic.exedescription pid process Token: SeDebugPrivilege 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe Token: SeDebugPrivilege 4652 intelGraphic.exe Token: SeDebugPrivilege 4128 Host.exe Token: SeDebugPrivilege 3464 intelGraphic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.execmd.exeintelGraphic.execmd.exeintelGraphic.exeHost.exedescription pid process target process PID 4836 wrote to memory of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4836 wrote to memory of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4836 wrote to memory of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4836 wrote to memory of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4836 wrote to memory of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4836 wrote to memory of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4836 wrote to memory of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4836 wrote to memory of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4836 wrote to memory of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4836 wrote to memory of 224 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe PID 4836 wrote to memory of 116 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe cmd.exe PID 4836 wrote to memory of 116 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe cmd.exe PID 4836 wrote to memory of 116 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe cmd.exe PID 4836 wrote to memory of 1928 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe cmd.exe PID 4836 wrote to memory of 1928 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe cmd.exe PID 4836 wrote to memory of 1928 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe cmd.exe PID 4836 wrote to memory of 4284 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe cmd.exe PID 4836 wrote to memory of 4284 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe cmd.exe PID 4836 wrote to memory of 4284 4836 SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe cmd.exe PID 1928 wrote to memory of 3544 1928 cmd.exe schtasks.exe PID 1928 wrote to memory of 3544 1928 cmd.exe schtasks.exe PID 1928 wrote to memory of 3544 1928 cmd.exe schtasks.exe PID 4652 wrote to memory of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4652 wrote to memory of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4652 wrote to memory of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4652 wrote to memory of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4652 wrote to memory of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4652 wrote to memory of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4652 wrote to memory of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4652 wrote to memory of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4652 wrote to memory of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4652 wrote to memory of 3508 4652 intelGraphic.exe intelGraphic.exe PID 4652 wrote to memory of 2024 4652 intelGraphic.exe cmd.exe PID 4652 wrote to memory of 2024 4652 intelGraphic.exe cmd.exe PID 4652 wrote to memory of 2024 4652 intelGraphic.exe cmd.exe PID 4652 wrote to memory of 940 4652 intelGraphic.exe cmd.exe PID 4652 wrote to memory of 940 4652 intelGraphic.exe cmd.exe PID 4652 wrote to memory of 940 4652 intelGraphic.exe cmd.exe PID 4652 wrote to memory of 3784 4652 intelGraphic.exe cmd.exe PID 4652 wrote to memory of 3784 4652 intelGraphic.exe cmd.exe PID 4652 wrote to memory of 3784 4652 intelGraphic.exe cmd.exe PID 940 wrote to memory of 2624 940 cmd.exe schtasks.exe PID 940 wrote to memory of 2624 940 cmd.exe schtasks.exe PID 940 wrote to memory of 2624 940 cmd.exe schtasks.exe PID 3508 wrote to memory of 4128 3508 intelGraphic.exe Host.exe PID 3508 wrote to memory of 4128 3508 intelGraphic.exe Host.exe PID 3508 wrote to memory of 4128 3508 intelGraphic.exe Host.exe PID 4128 wrote to memory of 2796 4128 Host.exe Host.exe PID 4128 wrote to memory of 2796 4128 Host.exe Host.exe PID 4128 wrote to memory of 2796 4128 Host.exe Host.exe PID 4128 wrote to memory of 2796 4128 Host.exe Host.exe PID 4128 wrote to memory of 2796 4128 Host.exe Host.exe PID 4128 wrote to memory of 2796 4128 Host.exe Host.exe PID 4128 wrote to memory of 2796 4128 Host.exe Host.exe PID 4128 wrote to memory of 2796 4128 Host.exe Host.exe PID 4128 wrote to memory of 2796 4128 Host.exe Host.exe PID 4128 wrote to memory of 2796 4128 Host.exe Host.exe PID 4128 wrote to memory of 3356 4128 Host.exe cmd.exe PID 4128 wrote to memory of 3356 4128 Host.exe cmd.exe PID 4128 wrote to memory of 3356 4128 Host.exe cmd.exe PID 4128 wrote to memory of 644 4128 Host.exe cmd.exe PID 4128 wrote to memory of 644 4128 Host.exe cmd.exe PID 4128 wrote to memory of 644 4128 Host.exe cmd.exe PID 4128 wrote to memory of 368 4128 Host.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 4563⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\intelGraphic"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.24.28876.20696.exe" "C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 224 -ip 2241⤵
-
C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exeC:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe"C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\intelGraphic"4⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe'" /f4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe'" /f5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Install\Host.exe" "C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\intelGraphic"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe" "C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exeC:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe"C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 4563⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\intelGraphic"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe" "C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4000 -ip 40001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\intelGraphic.exe.logFilesize
520B
MD503febbff58da1d3318c31657d89c8542
SHA1c9e017bd9d0a4fe533795b227c855935d86c2092
SHA2565164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4
SHA5123750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
589KB
MD51cce66219ac8c0def60f5a3c23d02f42
SHA1c9c99c1e25835e3688f30adb6fe0f85e564f4d74
SHA25647fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
SHA512098484fba05b902c0747580693ea8c33bd15af605d67c3f50d1c114e060c8eff31a7e0fe43bff7d310e2692764bd6a30137fd0006bad6e8f1dc55daffbf190dc
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
589KB
MD51cce66219ac8c0def60f5a3c23d02f42
SHA1c9c99c1e25835e3688f30adb6fe0f85e564f4d74
SHA25647fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
SHA512098484fba05b902c0747580693ea8c33bd15af605d67c3f50d1c114e060c8eff31a7e0fe43bff7d310e2692764bd6a30137fd0006bad6e8f1dc55daffbf190dc
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
589KB
MD51cce66219ac8c0def60f5a3c23d02f42
SHA1c9c99c1e25835e3688f30adb6fe0f85e564f4d74
SHA25647fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
SHA512098484fba05b902c0747580693ea8c33bd15af605d67c3f50d1c114e060c8eff31a7e0fe43bff7d310e2692764bd6a30137fd0006bad6e8f1dc55daffbf190dc
-
C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exeFilesize
589KB
MD51cce66219ac8c0def60f5a3c23d02f42
SHA1c9c99c1e25835e3688f30adb6fe0f85e564f4d74
SHA25647fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
SHA512098484fba05b902c0747580693ea8c33bd15af605d67c3f50d1c114e060c8eff31a7e0fe43bff7d310e2692764bd6a30137fd0006bad6e8f1dc55daffbf190dc
-
C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exeFilesize
589KB
MD51cce66219ac8c0def60f5a3c23d02f42
SHA1c9c99c1e25835e3688f30adb6fe0f85e564f4d74
SHA25647fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
SHA512098484fba05b902c0747580693ea8c33bd15af605d67c3f50d1c114e060c8eff31a7e0fe43bff7d310e2692764bd6a30137fd0006bad6e8f1dc55daffbf190dc
-
C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exeFilesize
589KB
MD51cce66219ac8c0def60f5a3c23d02f42
SHA1c9c99c1e25835e3688f30adb6fe0f85e564f4d74
SHA25647fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
SHA512098484fba05b902c0747580693ea8c33bd15af605d67c3f50d1c114e060c8eff31a7e0fe43bff7d310e2692764bd6a30137fd0006bad6e8f1dc55daffbf190dc
-
C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exeFilesize
589KB
MD51cce66219ac8c0def60f5a3c23d02f42
SHA1c9c99c1e25835e3688f30adb6fe0f85e564f4d74
SHA25647fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
SHA512098484fba05b902c0747580693ea8c33bd15af605d67c3f50d1c114e060c8eff31a7e0fe43bff7d310e2692764bd6a30137fd0006bad6e8f1dc55daffbf190dc
-
C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exeFilesize
589KB
MD51cce66219ac8c0def60f5a3c23d02f42
SHA1c9c99c1e25835e3688f30adb6fe0f85e564f4d74
SHA25647fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
SHA512098484fba05b902c0747580693ea8c33bd15af605d67c3f50d1c114e060c8eff31a7e0fe43bff7d310e2692764bd6a30137fd0006bad6e8f1dc55daffbf190dc
-
C:\Users\Admin\AppData\Roaming\intelGraphic\intelGraphic.exeFilesize
589KB
MD51cce66219ac8c0def60f5a3c23d02f42
SHA1c9c99c1e25835e3688f30adb6fe0f85e564f4d74
SHA25647fe8af42f4b7360f7d6dcd89b161c1bec308d6598c17262d8bf234e1871b39a
SHA512098484fba05b902c0747580693ea8c33bd15af605d67c3f50d1c114e060c8eff31a7e0fe43bff7d310e2692764bd6a30137fd0006bad6e8f1dc55daffbf190dc
-
memory/116-138-0x0000000000000000-mapping.dmp
-
memory/224-147-0x00000000005C0000-0x0000000000610000-memory.dmpFilesize
320KB
-
memory/224-143-0x00000000005C0000-0x0000000000610000-memory.dmpFilesize
320KB
-
memory/224-136-0x00000000005C0000-0x0000000000610000-memory.dmpFilesize
320KB
-
memory/224-134-0x0000000000000000-mapping.dmp
-
memory/368-174-0x0000000000000000-mapping.dmp
-
memory/644-173-0x0000000000000000-mapping.dmp
-
memory/688-197-0x0000000000000000-mapping.dmp
-
memory/760-176-0x0000000000000000-mapping.dmp
-
memory/940-159-0x0000000000000000-mapping.dmp
-
memory/1928-140-0x0000000000000000-mapping.dmp
-
memory/2024-157-0x0000000000000000-mapping.dmp
-
memory/2624-161-0x0000000000000000-mapping.dmp
-
memory/2796-177-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2796-171-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2796-175-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2796-167-0x0000000000000000-mapping.dmp
-
memory/2796-172-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3036-195-0x0000000000000000-mapping.dmp
-
memory/3356-170-0x0000000000000000-mapping.dmp
-
memory/3464-181-0x0000000000DA0000-0x0000000000E3A000-memory.dmpFilesize
616KB
-
memory/3508-165-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3508-158-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3508-156-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3508-155-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3508-152-0x0000000000000000-mapping.dmp
-
memory/3544-148-0x0000000000000000-mapping.dmp
-
memory/3784-160-0x0000000000000000-mapping.dmp
-
memory/4000-194-0x0000000000700000-0x0000000000750000-memory.dmpFilesize
320KB
-
memory/4000-182-0x0000000000000000-mapping.dmp
-
memory/4000-189-0x0000000000700000-0x0000000000750000-memory.dmpFilesize
320KB
-
memory/4128-166-0x0000000000220000-0x00000000002BA000-memory.dmpFilesize
616KB
-
memory/4128-162-0x0000000000000000-mapping.dmp
-
memory/4184-193-0x0000000000000000-mapping.dmp
-
memory/4284-142-0x0000000000000000-mapping.dmp
-
memory/4652-151-0x0000000000660000-0x00000000006FA000-memory.dmpFilesize
616KB
-
memory/4836-132-0x0000000000020000-0x00000000000BA000-memory.dmpFilesize
616KB
-
memory/4836-133-0x0000000005280000-0x0000000005824000-memory.dmpFilesize
5.6MB
-
memory/4904-196-0x0000000000000000-mapping.dmp