Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 18:28
Static task
static1
Behavioral task
behavioral1
Sample
73f780f7e9f9d66d33e5a54c9a438bb4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
73f780f7e9f9d66d33e5a54c9a438bb4.exe
Resource
win10v2004-20220901-en
General
-
Target
73f780f7e9f9d66d33e5a54c9a438bb4.exe
-
Size
129KB
-
MD5
73f780f7e9f9d66d33e5a54c9a438bb4
-
SHA1
0e975b2412e62f1e5e52e432f25c1b7450d7497f
-
SHA256
1c53f738a9b801e8bee50006506812fabf93b585b30715e417d66c8fa003688a
-
SHA512
2d6f8793b7c5814579a59d2aa6c6319a38b4f0f98c5c64719185b633b12e5538a76b50eade45e7dc64e5afd191e546a54de10abe8287546cde303ce33b9f56ec
-
SSDEEP
3072:4PCcTc5fkr/3q0Hme9JMPOAdKa0VjnnkNT5B:5kry3MJMldKVdng
Malware Config
Extracted
djvu
http://winnlinne.com/lancer/get.php
-
extension
.ofww
-
offline_id
xkNzhkB1wvgoDI7Uo0HPNLY3qCuwoFpP7nlhlut1
-
payload_url
http://rgyui.top/dl/build2.exe
http://winnlinne.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-EWKSsSJiVn Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0569Jhyjd
Extracted
vidar
54.6
517
https://t.me/huobiinside
https://mas.to/@kyriazhs1975
-
profile_id
517
Extracted
redline
LogsDiller Cloud (TG: @mr_golds)
77.73.134.27:7161
-
auth_value
4b2de03af6b6ac513ac597c2e6c1ad51
Extracted
redline
install1part
185.224.133.182:16382
-
auth_value
01759eb8d6120155c19b779c527fb1e2
Signatures
-
Detected Djvu ransomware 10 IoCs
Processes:
resource yara_rule behavioral2/memory/3176-158-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3176-160-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3064-162-0x0000000002340000-0x000000000245B000-memory.dmp family_djvu behavioral2/memory/3176-163-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3176-166-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3176-170-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4208-175-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4208-177-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4208-182-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4208-228-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects Smokeloader packer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2056-133-0x00000000006D0000-0x00000000006D9000-memory.dmp family_smokeloader behavioral2/memory/4468-144-0x0000000000600000-0x0000000000609000-memory.dmp family_smokeloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/102892-245-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral2/memory/103452-289-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 16 IoCs
Processes:
2422.exe3134.exe3309.exe3309.exe3309.exe3309.exebuild2.exebuild2.exebuild3.exemstsca.exe9C53.exeA52E.exeB53C.exeBBB6.exeidefiuwwdefiuwpid process 4468 2422.exe 3760 3134.exe 3064 3309.exe 3176 3309.exe 4144 3309.exe 4208 3309.exe 4868 build2.exe 1476 build2.exe 1316 build3.exe 4564 mstsca.exe 2988 9C53.exe 60248 A52E.exe 102956 B53C.exe 103104 BBB6.exe 103708 idefiuw 103732 wdefiuw -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3309.exe3309.exebuild2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3309.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3309.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation build2.exe -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exebuild2.exepid process 5068 regsvr32.exe 1476 build2.exe 1476 build2.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3309.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\8f149bc9-c395-462b-8c93-09e11f204422\\3309.exe\" --AutoStart" 3309.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 api.2ip.ua 35 api.2ip.ua 47 api.2ip.ua -
Suspicious use of SetThreadContext 5 IoCs
Processes:
3309.exe3309.exebuild2.exe9C53.exeBBB6.exedescription pid process target process PID 3064 set thread context of 3176 3064 3309.exe 3309.exe PID 4144 set thread context of 4208 4144 3309.exe 3309.exe PID 4868 set thread context of 1476 4868 build2.exe build2.exe PID 2988 set thread context of 102892 2988 9C53.exe AppLaunch.exe PID 103104 set thread context of 103452 103104 BBB6.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 72204 60248 WerFault.exe A52E.exe 103784 103732 WerFault.exe wdefiuw -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2422.exeidefiuw73f780f7e9f9d66d33e5a54c9a438bb4.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2422.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI idefiuw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 73f780f7e9f9d66d33e5a54c9a438bb4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 73f780f7e9f9d66d33e5a54c9a438bb4.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 73f780f7e9f9d66d33e5a54c9a438bb4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2422.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2422.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI idefiuw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI idefiuw -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4616 schtasks.exe 4760 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4432 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4468 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
73f780f7e9f9d66d33e5a54c9a438bb4.exepid process 2056 73f780f7e9f9d66d33e5a54c9a438bb4.exe 2056 73f780f7e9f9d66d33e5a54c9a438bb4.exe 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 776 -
Suspicious behavior: MapViewOfSection 25 IoCs
Processes:
73f780f7e9f9d66d33e5a54c9a438bb4.exe2422.exeidefiuwpid process 2056 73f780f7e9f9d66d33e5a54c9a438bb4.exe 776 776 776 776 4468 2422.exe 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 776 103708 idefiuw -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
taskkill.exeA52E.exeAppLaunch.exedescription pid process Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeDebugPrivilege 4468 taskkill.exe Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeDebugPrivilege 60248 A52E.exe Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeDebugPrivilege 102892 AppLaunch.exe Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 Token: SeShutdownPrivilege 776 Token: SeCreatePagefilePrivilege 776 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exe3309.exe3309.exe3309.exe3309.exebuild2.exebuild3.exedescription pid process target process PID 776 wrote to memory of 4468 776 2422.exe PID 776 wrote to memory of 4468 776 2422.exe PID 776 wrote to memory of 4468 776 2422.exe PID 776 wrote to memory of 4356 776 regsvr32.exe PID 776 wrote to memory of 4356 776 regsvr32.exe PID 4356 wrote to memory of 5068 4356 regsvr32.exe regsvr32.exe PID 4356 wrote to memory of 5068 4356 regsvr32.exe regsvr32.exe PID 4356 wrote to memory of 5068 4356 regsvr32.exe regsvr32.exe PID 776 wrote to memory of 3760 776 3134.exe PID 776 wrote to memory of 3760 776 3134.exe PID 776 wrote to memory of 3760 776 3134.exe PID 776 wrote to memory of 3064 776 3309.exe PID 776 wrote to memory of 3064 776 3309.exe PID 776 wrote to memory of 3064 776 3309.exe PID 776 wrote to memory of 3048 776 explorer.exe PID 776 wrote to memory of 3048 776 explorer.exe PID 776 wrote to memory of 3048 776 explorer.exe PID 776 wrote to memory of 3048 776 explorer.exe PID 776 wrote to memory of 568 776 explorer.exe PID 776 wrote to memory of 568 776 explorer.exe PID 776 wrote to memory of 568 776 explorer.exe PID 3064 wrote to memory of 3176 3064 3309.exe 3309.exe PID 3064 wrote to memory of 3176 3064 3309.exe 3309.exe PID 3064 wrote to memory of 3176 3064 3309.exe 3309.exe PID 3064 wrote to memory of 3176 3064 3309.exe 3309.exe PID 3064 wrote to memory of 3176 3064 3309.exe 3309.exe PID 3064 wrote to memory of 3176 3064 3309.exe 3309.exe PID 3064 wrote to memory of 3176 3064 3309.exe 3309.exe PID 3064 wrote to memory of 3176 3064 3309.exe 3309.exe PID 3064 wrote to memory of 3176 3064 3309.exe 3309.exe PID 3064 wrote to memory of 3176 3064 3309.exe 3309.exe PID 3176 wrote to memory of 4432 3176 3309.exe icacls.exe PID 3176 wrote to memory of 4432 3176 3309.exe icacls.exe PID 3176 wrote to memory of 4432 3176 3309.exe icacls.exe PID 3176 wrote to memory of 4144 3176 3309.exe 3309.exe PID 3176 wrote to memory of 4144 3176 3309.exe 3309.exe PID 3176 wrote to memory of 4144 3176 3309.exe 3309.exe PID 4144 wrote to memory of 4208 4144 3309.exe 3309.exe PID 4144 wrote to memory of 4208 4144 3309.exe 3309.exe PID 4144 wrote to memory of 4208 4144 3309.exe 3309.exe PID 4144 wrote to memory of 4208 4144 3309.exe 3309.exe PID 4144 wrote to memory of 4208 4144 3309.exe 3309.exe PID 4144 wrote to memory of 4208 4144 3309.exe 3309.exe PID 4144 wrote to memory of 4208 4144 3309.exe 3309.exe PID 4144 wrote to memory of 4208 4144 3309.exe 3309.exe PID 4144 wrote to memory of 4208 4144 3309.exe 3309.exe PID 4144 wrote to memory of 4208 4144 3309.exe 3309.exe PID 4208 wrote to memory of 4868 4208 3309.exe build2.exe PID 4208 wrote to memory of 4868 4208 3309.exe build2.exe PID 4208 wrote to memory of 4868 4208 3309.exe build2.exe PID 4868 wrote to memory of 1476 4868 build2.exe build2.exe PID 4868 wrote to memory of 1476 4868 build2.exe build2.exe PID 4868 wrote to memory of 1476 4868 build2.exe build2.exe PID 4868 wrote to memory of 1476 4868 build2.exe build2.exe PID 4868 wrote to memory of 1476 4868 build2.exe build2.exe PID 4868 wrote to memory of 1476 4868 build2.exe build2.exe PID 4868 wrote to memory of 1476 4868 build2.exe build2.exe PID 4868 wrote to memory of 1476 4868 build2.exe build2.exe PID 4868 wrote to memory of 1476 4868 build2.exe build2.exe PID 4208 wrote to memory of 1316 4208 3309.exe build3.exe PID 4208 wrote to memory of 1316 4208 3309.exe build3.exe PID 4208 wrote to memory of 1316 4208 3309.exe build3.exe PID 1316 wrote to memory of 4616 1316 build3.exe schtasks.exe PID 1316 wrote to memory of 4616 1316 build3.exe schtasks.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73f780f7e9f9d66d33e5a54c9a438bb4.exe"C:\Users\Admin\AppData\Local\Temp\73f780f7e9f9d66d33e5a54c9a438bb4.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2422.exeC:\Users\Admin\AppData\Local\Temp\2422.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\257B.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\257B.dll2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3134.exeC:\Users\Admin\AppData\Local\Temp\3134.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3309.exeC:\Users\Admin\AppData\Local\Temp\3309.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3309.exeC:\Users\Admin\AppData\Local\Temp\3309.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\8f149bc9-c395-462b-8c93-09e11f204422" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\3309.exe"C:\Users\Admin\AppData\Local\Temp\3309.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3309.exe"C:\Users\Admin\AppData\Local\Temp\3309.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build2.exe"C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build2.exe"C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build2.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" \/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build2.exe" & del C:\PrograData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build3.exe"C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\9C53.exeC:\Users\Admin\AppData\Local\Temp\9C53.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\A52E.exeC:\Users\Admin\AppData\Local\Temp\A52E.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60248 -s 12602⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\B53C.exeC:\Users\Admin\AppData\Local\Temp\B53C.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BBB6.exeC:\Users\Admin\AppData\Local\Temp\BBB6.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 60248 -ip 602481⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\idefiuwC:\Users\Admin\AppData\Roaming\idefiuw1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\wdefiuwC:\Users\Admin\AppData\Roaming\wdefiuw1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 103732 -s 2722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 103732 -ip 1037321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD53229b6929fc9caec79e3e5ad740250c6
SHA1d677cb89c767b4c4a444fedfa53dd6c8aa1d7d6e
SHA256ece826b5b4484d173ea804773ca9a13c7248d2f6f3c8a7efeea2a9e3691d7628
SHA51279b5ab3c41f03f913c0c947c6b6c66f396af97f7f69b3df72622beb9fddf8c6cc1a4f830d3edbd91ec570ce59531f09db54e51a2694a8b330ded69fd932036d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD5edcd4c783b2b2c906602519bd8f697f4
SHA1fc56fded4065d6960c6507cac4264dfd2b038004
SHA256367e0ac4e24f1d1530de05a6abf81d6b572c0546b5aa134c246fa1514582fd90
SHA512cb23a82c06211121e39ed0dbec5928b1a85aca7c25f2c060d609350e3a94bf82e9159a2a4d5e67295fc29bac22c95d525ea2461a0000d24c6c4cb630520f68d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD577109ec187fabaeef47e62d1903cb0d4
SHA152393977295454c441b5e132226eea974c0b8927
SHA256ea2ab47cc1161bf2da567b1018da76273639ee48ad8f220ca3f3749da6e9206a
SHA51269ee4c069ba044e26935680bfcc18a4926b921e14219713bf2bf469ade1a03bcb7d6956d7c0fc422c59a99672039ba3f6d74bb7267a0eb027b4ffd59850a2619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD5b42031e501914b01ea168fb6a11cd802
SHA12ffe21ac02c613762caf1b12175cd197d3deff3f
SHA2568e807d66ef564c25a997e46740d5e7cfa65e33b8e5bf71c4a9936828eec6fa9c
SHA512db37a92dbe156524de111105308096f1374f477e1e8fa5f26d5ed323f830a2652039c24ad4803e9041f2c28636c2b2a07f8f3f87bdfd6a5e351ffd56d23e9f8d
-
C:\Users\Admin\AppData\Local\8f149bc9-c395-462b-8c93-09e11f204422\3309.exeFilesize
671KB
MD576e2f72591365a229a3db764f8f1aa19
SHA13821ce3edf4c3b8802f16421b1cf8bc0b86ffbe7
SHA2560818f3213320624e1467bd9e159ac15cce81740c824b39684eb806c18ed1e44e
SHA512da8f42b1a54a9c3d8c2be83a74d0d04bd046d278770bbd214c157a2398f5319ff62e5483becb1cadbfe3cfb0de741de6c286151014409cf1f70001e0d53f9c0d
-
C:\Users\Admin\AppData\Local\Temp\2422.exeFilesize
130KB
MD52ae08b2b339f8593d743991cce0c747c
SHA1d99acc1fc5702475f27c729be631fb0c4d2f1625
SHA2560f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a
SHA512bc6c43377168db0d06a682e4f99187bd06f16b1da058e37090ae902ed8dd87fa68578fa17cf3cf9b223b91c5c648e8b3e492030f026a6253aa28efaaf16633f2
-
C:\Users\Admin\AppData\Local\Temp\2422.exeFilesize
130KB
MD52ae08b2b339f8593d743991cce0c747c
SHA1d99acc1fc5702475f27c729be631fb0c4d2f1625
SHA2560f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a
SHA512bc6c43377168db0d06a682e4f99187bd06f16b1da058e37090ae902ed8dd87fa68578fa17cf3cf9b223b91c5c648e8b3e492030f026a6253aa28efaaf16633f2
-
C:\Users\Admin\AppData\Local\Temp\257B.dllFilesize
1.5MB
MD5dd357086742716fbd26e3877b75c3459
SHA13251f9c26b25321b1b254eaf481a58a1865d86ad
SHA256035e85144e35b6218de1a96c6df72d9697c40ae56e47757f330c35ea8260bb12
SHA51216c436c7c6a246e0bfaed5fb387308cf62b66abdd72cbce7b80dc5c19bca4e905f8f66f85bc7f0a1c04387832a070fd1fd2b9d2049eefede04dd948263c26a5c
-
C:\Users\Admin\AppData\Local\Temp\257B.dllFilesize
1.5MB
MD5dd357086742716fbd26e3877b75c3459
SHA13251f9c26b25321b1b254eaf481a58a1865d86ad
SHA256035e85144e35b6218de1a96c6df72d9697c40ae56e47757f330c35ea8260bb12
SHA51216c436c7c6a246e0bfaed5fb387308cf62b66abdd72cbce7b80dc5c19bca4e905f8f66f85bc7f0a1c04387832a070fd1fd2b9d2049eefede04dd948263c26a5c
-
C:\Users\Admin\AppData\Local\Temp\3134.exeFilesize
7.8MB
MD520883f9be310e657471161adcb9482e3
SHA17c5b768a1d5f4bc1560d7f4a232b2ab33bdf8ec4
SHA256a4251b5ce425ab74b835a36c850623cda073258045e9c5de17e213000317f1b0
SHA512ae5a1801ee2d445ca68b1d72296d42078df42d1e8913e2b85e0a9ece1510b888f9ee3734aac7cc82a5cab572e8bd6e7fc4e01b8bcd21b255c727b4a3a054691d
-
C:\Users\Admin\AppData\Local\Temp\3134.exeFilesize
7.8MB
MD520883f9be310e657471161adcb9482e3
SHA17c5b768a1d5f4bc1560d7f4a232b2ab33bdf8ec4
SHA256a4251b5ce425ab74b835a36c850623cda073258045e9c5de17e213000317f1b0
SHA512ae5a1801ee2d445ca68b1d72296d42078df42d1e8913e2b85e0a9ece1510b888f9ee3734aac7cc82a5cab572e8bd6e7fc4e01b8bcd21b255c727b4a3a054691d
-
C:\Users\Admin\AppData\Local\Temp\3309.exeFilesize
671KB
MD576e2f72591365a229a3db764f8f1aa19
SHA13821ce3edf4c3b8802f16421b1cf8bc0b86ffbe7
SHA2560818f3213320624e1467bd9e159ac15cce81740c824b39684eb806c18ed1e44e
SHA512da8f42b1a54a9c3d8c2be83a74d0d04bd046d278770bbd214c157a2398f5319ff62e5483becb1cadbfe3cfb0de741de6c286151014409cf1f70001e0d53f9c0d
-
C:\Users\Admin\AppData\Local\Temp\3309.exeFilesize
671KB
MD576e2f72591365a229a3db764f8f1aa19
SHA13821ce3edf4c3b8802f16421b1cf8bc0b86ffbe7
SHA2560818f3213320624e1467bd9e159ac15cce81740c824b39684eb806c18ed1e44e
SHA512da8f42b1a54a9c3d8c2be83a74d0d04bd046d278770bbd214c157a2398f5319ff62e5483becb1cadbfe3cfb0de741de6c286151014409cf1f70001e0d53f9c0d
-
C:\Users\Admin\AppData\Local\Temp\3309.exeFilesize
671KB
MD576e2f72591365a229a3db764f8f1aa19
SHA13821ce3edf4c3b8802f16421b1cf8bc0b86ffbe7
SHA2560818f3213320624e1467bd9e159ac15cce81740c824b39684eb806c18ed1e44e
SHA512da8f42b1a54a9c3d8c2be83a74d0d04bd046d278770bbd214c157a2398f5319ff62e5483becb1cadbfe3cfb0de741de6c286151014409cf1f70001e0d53f9c0d
-
C:\Users\Admin\AppData\Local\Temp\3309.exeFilesize
671KB
MD576e2f72591365a229a3db764f8f1aa19
SHA13821ce3edf4c3b8802f16421b1cf8bc0b86ffbe7
SHA2560818f3213320624e1467bd9e159ac15cce81740c824b39684eb806c18ed1e44e
SHA512da8f42b1a54a9c3d8c2be83a74d0d04bd046d278770bbd214c157a2398f5319ff62e5483becb1cadbfe3cfb0de741de6c286151014409cf1f70001e0d53f9c0d
-
C:\Users\Admin\AppData\Local\Temp\3309.exeFilesize
671KB
MD576e2f72591365a229a3db764f8f1aa19
SHA13821ce3edf4c3b8802f16421b1cf8bc0b86ffbe7
SHA2560818f3213320624e1467bd9e159ac15cce81740c824b39684eb806c18ed1e44e
SHA512da8f42b1a54a9c3d8c2be83a74d0d04bd046d278770bbd214c157a2398f5319ff62e5483becb1cadbfe3cfb0de741de6c286151014409cf1f70001e0d53f9c0d
-
C:\Users\Admin\AppData\Local\Temp\9C53.exeFilesize
2.6MB
MD5caa086e140d4ffbc78a1a4c91869a973
SHA18d5b4f00412169130ffba2167e502601b007b526
SHA256bd245b6180cf30b67108be0b3afad151434f065c5590a3dae5d8568146090dc8
SHA512f94286f599ae3d87e06f1df6f8794e0c7e968237dfa734e69ee68432ef45eb5b7eb3b70287815b0b9225eb5b86f2a010a8c9708e54799c7c12a0d346ec4b1ff2
-
C:\Users\Admin\AppData\Local\Temp\9C53.exeFilesize
2.6MB
MD5caa086e140d4ffbc78a1a4c91869a973
SHA18d5b4f00412169130ffba2167e502601b007b526
SHA256bd245b6180cf30b67108be0b3afad151434f065c5590a3dae5d8568146090dc8
SHA512f94286f599ae3d87e06f1df6f8794e0c7e968237dfa734e69ee68432ef45eb5b7eb3b70287815b0b9225eb5b86f2a010a8c9708e54799c7c12a0d346ec4b1ff2
-
C:\Users\Admin\AppData\Local\Temp\A52E.exeFilesize
255KB
MD507ea3bc2b9eaacd002de4f59803ef234
SHA18a796069e5eac844f40b4487c80ed1c93316a331
SHA2562302396062d7523a230f0a81ada322bb8907e11d006c0ec29a37821dd084bfe1
SHA512d89e46145536d9b5fc310b72b24a4b1790100bbfd18b39a48dd10938255233132f0d87190c4c84c2b78076d9b0a39c4c9f6f27ece40a9b3f93b3e65aaca2c092
-
C:\Users\Admin\AppData\Local\Temp\A52E.exeFilesize
255KB
MD507ea3bc2b9eaacd002de4f59803ef234
SHA18a796069e5eac844f40b4487c80ed1c93316a331
SHA2562302396062d7523a230f0a81ada322bb8907e11d006c0ec29a37821dd084bfe1
SHA512d89e46145536d9b5fc310b72b24a4b1790100bbfd18b39a48dd10938255233132f0d87190c4c84c2b78076d9b0a39c4c9f6f27ece40a9b3f93b3e65aaca2c092
-
C:\Users\Admin\AppData\Local\Temp\B53C.exeFilesize
337KB
MD525e6c3058f4e1331ad1d886f48170866
SHA1dac4d0c2a39a76530426bef95ad5a5d10b4b625d
SHA256c6e2deb30016057cf4fbe8aecdbbb7142332e3e561c98fb125797e3da6391506
SHA5120df3e761e000f1c7bf2e698be541fdd46c9f4bf21cf7c150a4ad6ddb447e834f53447ab8bf70a3965d8c77d2795b988f93c7f5bafb83b67d8a60b674a7ceda64
-
C:\Users\Admin\AppData\Local\Temp\B53C.exeFilesize
337KB
MD525e6c3058f4e1331ad1d886f48170866
SHA1dac4d0c2a39a76530426bef95ad5a5d10b4b625d
SHA256c6e2deb30016057cf4fbe8aecdbbb7142332e3e561c98fb125797e3da6391506
SHA5120df3e761e000f1c7bf2e698be541fdd46c9f4bf21cf7c150a4ad6ddb447e834f53447ab8bf70a3965d8c77d2795b988f93c7f5bafb83b67d8a60b674a7ceda64
-
C:\Users\Admin\AppData\Local\Temp\BBB6.exeFilesize
2.6MB
MD5529174498fbbf1c72fb39af656d5f98f
SHA1439edbff12742da9e15da5ab4a2710f97f947a50
SHA2569e4bb9e9b4a0bd622deb940906c082b65d299d3c768b4957c1a89a8f60572f28
SHA512ad760ef8d26f645736a05d076baf98731ce99f3d8dd13f7828a09ade228c3da0ddefe50c7a8e9bc5b53488986c86aa708cbc1717e8ad1636e59b3f0f91141abe
-
C:\Users\Admin\AppData\Local\Temp\BBB6.exeFilesize
2.6MB
MD5529174498fbbf1c72fb39af656d5f98f
SHA1439edbff12742da9e15da5ab4a2710f97f947a50
SHA2569e4bb9e9b4a0bd622deb940906c082b65d299d3c768b4957c1a89a8f60572f28
SHA512ad760ef8d26f645736a05d076baf98731ce99f3d8dd13f7828a09ade228c3da0ddefe50c7a8e9bc5b53488986c86aa708cbc1717e8ad1636e59b3f0f91141abe
-
C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build2.exeFilesize
246KB
MD54e08ecaa075b90f30327bf200d23130b
SHA1f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2
SHA2566c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47
SHA512e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7
-
C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build2.exeFilesize
246KB
MD54e08ecaa075b90f30327bf200d23130b
SHA1f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2
SHA2566c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47
SHA512e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7
-
C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build2.exeFilesize
246KB
MD54e08ecaa075b90f30327bf200d23130b
SHA1f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2
SHA2566c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47
SHA512e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7
-
C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\b8556a23-b827-49db-949c-62dd0a4268c5\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\idefiuwFilesize
130KB
MD52ae08b2b339f8593d743991cce0c747c
SHA1d99acc1fc5702475f27c729be631fb0c4d2f1625
SHA2560f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a
SHA512bc6c43377168db0d06a682e4f99187bd06f16b1da058e37090ae902ed8dd87fa68578fa17cf3cf9b223b91c5c648e8b3e492030f026a6253aa28efaaf16633f2
-
C:\Users\Admin\AppData\Roaming\idefiuwFilesize
130KB
MD52ae08b2b339f8593d743991cce0c747c
SHA1d99acc1fc5702475f27c729be631fb0c4d2f1625
SHA2560f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a
SHA512bc6c43377168db0d06a682e4f99187bd06f16b1da058e37090ae902ed8dd87fa68578fa17cf3cf9b223b91c5c648e8b3e492030f026a6253aa28efaaf16633f2
-
C:\Users\Admin\AppData\Roaming\wdefiuwFilesize
129KB
MD573f780f7e9f9d66d33e5a54c9a438bb4
SHA10e975b2412e62f1e5e52e432f25c1b7450d7497f
SHA2561c53f738a9b801e8bee50006506812fabf93b585b30715e417d66c8fa003688a
SHA5122d6f8793b7c5814579a59d2aa6c6319a38b4f0f98c5c64719185b633b12e5538a76b50eade45e7dc64e5afd191e546a54de10abe8287546cde303ce33b9f56ec
-
C:\Users\Admin\AppData\Roaming\wdefiuwFilesize
129KB
MD573f780f7e9f9d66d33e5a54c9a438bb4
SHA10e975b2412e62f1e5e52e432f25c1b7450d7497f
SHA2561c53f738a9b801e8bee50006506812fabf93b585b30715e417d66c8fa003688a
SHA5122d6f8793b7c5814579a59d2aa6c6319a38b4f0f98c5c64719185b633b12e5538a76b50eade45e7dc64e5afd191e546a54de10abe8287546cde303ce33b9f56ec
-
memory/568-155-0x0000000000000000-mapping.dmp
-
memory/568-156-0x00000000007D0000-0x00000000007DC000-memory.dmpFilesize
48KB
-
memory/1316-195-0x0000000000000000-mapping.dmp
-
memory/1476-188-0x0000000000000000-mapping.dmp
-
memory/1476-201-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/1476-191-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/1476-189-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/1476-193-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/1476-199-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/1476-227-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2056-132-0x0000000000708000-0x0000000000719000-memory.dmpFilesize
68KB
-
memory/2056-135-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/2056-134-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/2056-133-0x00000000006D0000-0x00000000006D9000-memory.dmpFilesize
36KB
-
memory/2988-234-0x0000000000000000-mapping.dmp
-
memory/3048-154-0x00000000004D0000-0x000000000053B000-memory.dmpFilesize
428KB
-
memory/3048-164-0x00000000004D0000-0x000000000053B000-memory.dmpFilesize
428KB
-
memory/3048-152-0x0000000000000000-mapping.dmp
-
memory/3048-153-0x0000000000540000-0x00000000005B5000-memory.dmpFilesize
468KB
-
memory/3064-161-0x00000000022A9000-0x000000000233A000-memory.dmpFilesize
580KB
-
memory/3064-162-0x0000000002340000-0x000000000245B000-memory.dmpFilesize
1.1MB
-
memory/3064-149-0x0000000000000000-mapping.dmp
-
memory/3176-158-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3176-160-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3176-163-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3176-166-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3176-157-0x0000000000000000-mapping.dmp
-
memory/3176-170-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3756-226-0x0000000000000000-mapping.dmp
-
memory/3760-146-0x0000000000000000-mapping.dmp
-
memory/4144-169-0x0000000000000000-mapping.dmp
-
memory/4144-225-0x00000000022D1000-0x0000000002362000-memory.dmpFilesize
580KB
-
memory/4144-176-0x00000000022D1000-0x0000000002362000-memory.dmpFilesize
580KB
-
memory/4208-172-0x0000000000000000-mapping.dmp
-
memory/4208-175-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4208-177-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4208-228-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4208-182-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4356-139-0x0000000000000000-mapping.dmp
-
memory/4432-230-0x0000000000000000-mapping.dmp
-
memory/4432-165-0x0000000000000000-mapping.dmp
-
memory/4468-229-0x0000000000000000-mapping.dmp
-
memory/4468-143-0x0000000000689000-0x000000000069A000-memory.dmpFilesize
68KB
-
memory/4468-144-0x0000000000600000-0x0000000000609000-memory.dmpFilesize
36KB
-
memory/4468-168-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/4468-136-0x0000000000000000-mapping.dmp
-
memory/4468-145-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/4616-198-0x0000000000000000-mapping.dmp
-
memory/4760-233-0x0000000000000000-mapping.dmp
-
memory/4868-183-0x0000000000000000-mapping.dmp
-
memory/4868-192-0x0000000000788000-0x00000000007B1000-memory.dmpFilesize
164KB
-
memory/4868-194-0x00000000006F0000-0x0000000000737000-memory.dmpFilesize
284KB
-
memory/5068-187-0x0000000003500000-0x00000000035F1000-memory.dmpFilesize
964KB
-
memory/5068-141-0x0000000000000000-mapping.dmp
-
memory/5068-186-0x00000000032E0000-0x0000000003405000-memory.dmpFilesize
1.1MB
-
memory/5068-200-0x00000000030D0000-0x000000000318E000-memory.dmpFilesize
760KB
-
memory/5068-222-0x0000000003500000-0x00000000035F1000-memory.dmpFilesize
964KB
-
memory/5068-209-0x0000000003600000-0x00000000036A8000-memory.dmpFilesize
672KB
-
memory/9936-303-0x0000000000540000-0x0000000000549000-memory.dmpFilesize
36KB
-
memory/9936-272-0x0000000000530000-0x000000000053F000-memory.dmpFilesize
60KB
-
memory/9936-271-0x0000000000540000-0x0000000000549000-memory.dmpFilesize
36KB
-
memory/9936-268-0x0000000000000000-mapping.dmp
-
memory/24992-275-0x0000000000130000-0x0000000000139000-memory.dmpFilesize
36KB
-
memory/24992-274-0x0000000000140000-0x0000000000145000-memory.dmpFilesize
20KB
-
memory/24992-273-0x0000000000000000-mapping.dmp
-
memory/54460-276-0x0000000000000000-mapping.dmp
-
memory/54460-277-0x00000000005D0000-0x00000000005D6000-memory.dmpFilesize
24KB
-
memory/54460-278-0x00000000005C0000-0x00000000005CC000-memory.dmpFilesize
48KB
-
memory/60248-284-0x0000000000400000-0x000000000059A000-memory.dmpFilesize
1.6MB
-
memory/60248-270-0x00000000071B0000-0x00000000071CE000-memory.dmpFilesize
120KB
-
memory/60248-237-0x0000000000000000-mapping.dmp
-
memory/60248-259-0x00000000072F0000-0x00000000074B2000-memory.dmpFilesize
1.8MB
-
memory/60248-240-0x0000000000899000-0x00000000008C3000-memory.dmpFilesize
168KB
-
memory/60248-241-0x00000000007F0000-0x0000000000828000-memory.dmpFilesize
224KB
-
memory/60248-267-0x0000000007080000-0x00000000070D0000-memory.dmpFilesize
320KB
-
memory/60248-242-0x0000000000400000-0x000000000059A000-memory.dmpFilesize
1.6MB
-
memory/60248-269-0x00000000070E0000-0x0000000007156000-memory.dmpFilesize
472KB
-
memory/60248-263-0x00000000074C0000-0x00000000079EC000-memory.dmpFilesize
5.2MB
-
memory/60248-258-0x0000000005D50000-0x0000000005DB6000-memory.dmpFilesize
408KB
-
memory/60248-257-0x0000000005CB0000-0x0000000005D42000-memory.dmpFilesize
584KB
-
memory/60248-243-0x0000000004CF0000-0x0000000005294000-memory.dmpFilesize
5.6MB
-
memory/60248-253-0x00000000059D0000-0x0000000005A0C000-memory.dmpFilesize
240KB
-
memory/60248-283-0x0000000000899000-0x00000000008C3000-memory.dmpFilesize
168KB
-
memory/60248-251-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/68448-280-0x0000000000370000-0x0000000000392000-memory.dmpFilesize
136KB
-
memory/68448-281-0x0000000000340000-0x0000000000367000-memory.dmpFilesize
156KB
-
memory/68448-279-0x0000000000000000-mapping.dmp
-
memory/74880-282-0x0000000000000000-mapping.dmp
-
memory/74880-285-0x0000000001020000-0x0000000001025000-memory.dmpFilesize
20KB
-
memory/74880-286-0x0000000001010000-0x0000000001019000-memory.dmpFilesize
36KB
-
memory/92492-295-0x00000000001D0000-0x00000000001DB000-memory.dmpFilesize
44KB
-
memory/92492-287-0x0000000000000000-mapping.dmp
-
memory/92492-294-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB
-
memory/102892-252-0x00000000053E0000-0x00000000054EA000-memory.dmpFilesize
1.0MB
-
memory/102892-250-0x00000000058C0000-0x0000000005ED8000-memory.dmpFilesize
6.1MB
-
memory/102892-244-0x0000000000000000-mapping.dmp
-
memory/102892-245-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/102956-254-0x0000000000000000-mapping.dmp
-
memory/103104-260-0x0000000000000000-mapping.dmp
-
memory/103148-302-0x0000000001020000-0x0000000001027000-memory.dmpFilesize
28KB
-
memory/103148-262-0x0000000000000000-mapping.dmp
-
memory/103148-265-0x0000000001020000-0x0000000001027000-memory.dmpFilesize
28KB
-
memory/103148-266-0x0000000001010000-0x000000000101B000-memory.dmpFilesize
44KB
-
memory/103452-289-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/103452-288-0x0000000000000000-mapping.dmp
-
memory/103508-298-0x0000000001030000-0x000000000103D000-memory.dmpFilesize
52KB
-
memory/103508-297-0x0000000001040000-0x0000000001047000-memory.dmpFilesize
28KB
-
memory/103508-296-0x0000000000000000-mapping.dmp
-
memory/103536-301-0x0000000000370000-0x000000000037B000-memory.dmpFilesize
44KB
-
memory/103536-300-0x0000000000380000-0x0000000000388000-memory.dmpFilesize
32KB
-
memory/103536-299-0x0000000000000000-mapping.dmp