Analysis
-
max time kernel
81s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-10-2022 12:57
Static task
static1
Behavioral task
behavioral1
Sample
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe
Resource
win10v2004-20220901-en
General
-
Target
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe
-
Size
690KB
-
MD5
84bb2b8233dc0fe26e26a501b9d671d0
-
SHA1
97cac0aaa77a44fb2aec9bd3952b2b03d5585396
-
SHA256
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1
-
SHA512
fa83dd36a120a5b05013944fc136cb6ca4e73e6e8bb56243b302099c700daf845d556fc921a0fb26f9030c6cf5ae959b1aa03d634a4eefefb9f9ea123aa05045
-
SSDEEP
12288:0klCKO873JTr30l/a3ipCF3152Bhfmlky2SA3OMmq+ovM3vYDf8wiaSwIM:HCK/7ZfDp6Bhfc2SOOgvM3vYDz7S3M
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\egwryrbT.dll acprotect -
Drops file in Drivers directory 1 IoCs
Processes:
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exedescription ioc process File created C:\Windows\SysWOW64\drivers\6a8bd6f4.sys 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 2008 icacls.exe 732 takeown.exe 1180 icacls.exe 1740 takeown.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\6a8bd6f4\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\6a8bd6f4.sys" 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\egwryrbT.dll upx behavioral1/memory/532-70-0x0000000010000000-0x00000000105DF000-memory.dmp upx behavioral1/memory/532-72-0x0000000010000000-0x00000000105DF000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1480 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exepid process 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 2008 icacls.exe 732 takeown.exe 1180 icacls.exe 1740 takeown.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe -
Drops file in System32 directory 5 IoCs
Processes:
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wshtcpip.dll 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe File created C:\Windows\SysWOW64\midimap.dll 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe File created C:\Windows\SysWOW64\egwryrbT.dll 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe File created C:\Windows\SysWOW64\uueuDear.dll 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe File created C:\Windows\SysWOW64\wshtcpip.dll 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe -
Modifies registry class 4 IoCs
Processes:
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe" 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "JJBUriwiHt.dll" 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exepid process 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exepid process 460 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
takeown.exetakeown.exe5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exedescription pid process Token: SeTakeOwnershipPrivilege 732 takeown.exe Token: SeTakeOwnershipPrivilege 1740 takeown.exe Token: SeDebugPrivilege 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.execmd.execmd.exedescription pid process target process PID 532 wrote to memory of 1640 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 532 wrote to memory of 1640 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 532 wrote to memory of 1640 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 532 wrote to memory of 1640 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 1640 wrote to memory of 732 1640 cmd.exe takeown.exe PID 1640 wrote to memory of 732 1640 cmd.exe takeown.exe PID 1640 wrote to memory of 732 1640 cmd.exe takeown.exe PID 1640 wrote to memory of 732 1640 cmd.exe takeown.exe PID 1640 wrote to memory of 1180 1640 cmd.exe icacls.exe PID 1640 wrote to memory of 1180 1640 cmd.exe icacls.exe PID 1640 wrote to memory of 1180 1640 cmd.exe icacls.exe PID 1640 wrote to memory of 1180 1640 cmd.exe icacls.exe PID 532 wrote to memory of 932 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 532 wrote to memory of 932 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 532 wrote to memory of 932 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 532 wrote to memory of 932 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 932 wrote to memory of 1740 932 cmd.exe takeown.exe PID 932 wrote to memory of 1740 932 cmd.exe takeown.exe PID 932 wrote to memory of 1740 932 cmd.exe takeown.exe PID 932 wrote to memory of 1740 932 cmd.exe takeown.exe PID 932 wrote to memory of 2008 932 cmd.exe icacls.exe PID 932 wrote to memory of 2008 932 cmd.exe icacls.exe PID 932 wrote to memory of 2008 932 cmd.exe icacls.exe PID 932 wrote to memory of 2008 932 cmd.exe icacls.exe PID 532 wrote to memory of 1480 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 532 wrote to memory of 1480 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 532 wrote to memory of 1480 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe PID 532 wrote to memory of 1480 532 5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe"C:\Users\Admin\AppData\Local\Temp\5bfc2bb5d3244f2ef4d1535204c51aae9c401eaebfb541de0ede9405e9589af1.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:732 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1180 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1740 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2008 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
PID:1480
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD547b2f8f0934f851a5d2f07b455562804
SHA1b758f495ebd8552d3231a79df7a919f8a1efa370
SHA25673cae61f226d83e46015d947e7343cd9f53157fff6ecaeeb3bd2882a8f54dbb7
SHA5125f4a87a8a2aaf105523342172cd999c0bb411f568a516be16fab099cca05880f2a5b68139ac98449a067f1e84248a6c9852fa453fc87181a27e510218a966859
-
\Users\Admin\AppData\Local\Temp\egwryrbT.dllFilesize
4.8MB
MD58be1958899ddc1e8648b5ae977879565
SHA10dcf178f147a4e32a83e5bebb5bba3264b635a41
SHA256e226f9f2e97df00b938685673717483603d61a600c23396d83f106df93730a8d
SHA51201d09d9b648a2bd22a206167a9f2124113bf7daca1323a77fd39a23e457d6dc9d8d248dbe9b9b6bbd3a989eadf97615489266dcca68cde45d3bb705201c61558
-
\Windows\SysWOW64\wshtcpip.dllFilesize
19KB
MD5ea7aec4ae1aa0d8e2da601b4f7d45d29
SHA1d01b2fd75a468b607168c58d425c49aafed65649
SHA256bd032a408bea4e7caea6339dc7d96bc19806d13459c530c9d131e0b6b21d8bdc
SHA512c53dae2c75f8c2fd082a25b04f2a917eeb98ad309e1a7d8c6f400a5547171dd91a0260aae172e5ed8cac48e30a2892f48ac220f5e437953168cedc9ba9532942
-
memory/532-66-0x0000000000230000-0x0000000000250000-memory.dmpFilesize
128KB
-
memory/532-71-0x0000000001000000-0x0000000001698000-memory.dmpFilesize
6.6MB
-
memory/532-59-0x0000000000230000-0x0000000000250000-memory.dmpFilesize
128KB
-
memory/532-72-0x0000000010000000-0x00000000105DF000-memory.dmpFilesize
5.9MB
-
memory/532-70-0x0000000010000000-0x00000000105DF000-memory.dmpFilesize
5.9MB
-
memory/532-64-0x00000000719C1000-0x00000000719C5000-memory.dmpFilesize
16KB
-
memory/532-65-0x0000000001000000-0x0000000001698000-memory.dmpFilesize
6.6MB
-
memory/532-54-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB
-
memory/532-58-0x0000000001000000-0x0000000001698000-memory.dmpFilesize
6.6MB
-
memory/732-56-0x0000000000000000-mapping.dmp
-
memory/932-60-0x0000000000000000-mapping.dmp
-
memory/1180-57-0x0000000000000000-mapping.dmp
-
memory/1480-67-0x0000000000000000-mapping.dmp
-
memory/1640-55-0x0000000000000000-mapping.dmp
-
memory/1740-61-0x0000000000000000-mapping.dmp
-
memory/2008-62-0x0000000000000000-mapping.dmp