Analysis
-
max time kernel
88s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-11-2022 07:28
Static task
static1
Behavioral task
behavioral1
Sample
i.exe
Resource
win7-20220812-en
General
-
Target
i.exe
-
Size
3.0MB
-
MD5
365d7fdc34a8c57a60a4d1cd548e507b
-
SHA1
eb635b6e7fa6fe1e3a83026fd47c87bc78753006
-
SHA256
cf2667a5f76796a5ccc9995582737765e20eaf53b70b3688885974877f1d2d75
-
SHA512
ca7e0f0c3aa1034b90bb613908eac6f1aeb443b5dccb4c0c5d315747baa2843b67cfee3ae020c68c9a7cd7e9f197a5a870936f382c1e252aa12333396e403bf2
-
SSDEEP
12288:ny4zXZXBJ+LgSRQTy3pFjIwUOIojNoEFjwqIHGRGvFvaPw+3Y12wW:vrJ+LgTTy3pFjIwUOPVFjv8dvaPNI4D
Malware Config
Signatures
-
Processes:
resource yara_rule \Users\Public\pitap\oruy.exe upx behavioral1/memory/948-61-0x00000000001D0000-0x00000000001DB000-memory.dmp upx \Users\Public\pitap\oruy.exe upx \Users\Public\pitap\oruy.exe upx \Users\Public\pitap\oruy.exe upx \Users\Public\pitap\oruy.exe upx \Users\Public\pitap\oruy.exe upx behavioral1/memory/948-70-0x00000000001D0000-0x00000000001DB000-memory.dmp upx C:\Users\Public\pitap\oruy.exe upx -
Loads dropped DLL 7 IoCs
Processes:
i.exepid process 948 i.exe 948 i.exe 948 i.exe 948 i.exe 948 i.exe 948 i.exe 948 i.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe -
Modifies registry class 49 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Mode = "4" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\FFlags = "1092616193" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\LogicalViewMode = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a00000002e37a3569cced2119f0e006097c686f60700000028000000e0859ff2f94f6810ab9108002b27b3d902000000a00000002e37a3569cced2119f0e006097c686f602000000780000002e37a3569cced2119f0e006097c686f60400000088000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByDirection = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupView = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByKey:PID = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000000c55cb701100557365727300600008000400efbeee3a851a0c55cb702a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Music" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\FFlags = "1092616209" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\IconSize = "16" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 78003100000000006155964311005075626c69630000620008000400efbeee3a851a615596432a0000007c0200000000010000000000000000003800000000005000750062006c0069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003600000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 74003100000000006155984311004d7573696300600008000400efbeee3a851a615598432a000000820200000000010000000000000000003600000000004d007500730069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380030003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000006155984310006461666e647000003a0008000400efbe61559843615598432a000000672701000000070000000000000000000000000000006400610066006e0064007000000016000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Rev = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{94D6DDCC-4A68-4175-A374-BD584A510B78}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
i.exepid process 948 i.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
i.exepid process 948 i.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
i.exedescription pid process target process PID 948 wrote to memory of 936 948 i.exe explorer.exe PID 948 wrote to memory of 936 948 i.exe explorer.exe PID 948 wrote to memory of 936 948 i.exe explorer.exe PID 948 wrote to memory of 936 948 i.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\i.exe"C:\Users\Admin\AppData\Local\Temp\i.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Public\Music\dafndp2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Music\dafndp\aluwtl.lnkFilesize
1KB
MD584187a3ab929473894a7a4923687c390
SHA1f0a823ca36e086d23d18d66fe5cd37acaedf6372
SHA256bb61fa0c602eee498b158dda4a65580d4ea2bcd555ff104fe09769a54eaa6341
SHA5122b0d4477d9620994af5e20547669c076ba726e1ff49a99d8c07ef465e73a5138730a986217d88d17c2be5305479b3b397287d8044e25f8f2406cd07b6d13dd43
-
C:\Users\Public\Music\dafndp\atfcttc.urlFilesize
136B
MD57326f2e70420d4d0b1a57170b9c3b9a4
SHA1a6ae9435dcca17ae36901bd49fee52d4301183fe
SHA2569d444739e3e59247181fc7a84fea16b589b9a1d36ff0a8d0c94288642b7e9616
SHA51263fe3cadb6c6f619e00bfd7dc4cd510b4e98969efd7ab754b387097fe27c9c662461caa38b061d3af2bdb85b8d68c8179570c857d4297cd287d78b21ad08d91f
-
C:\Users\Public\Music\dafndp\bcvqdgl.urlFilesize
136B
MD57326f2e70420d4d0b1a57170b9c3b9a4
SHA1a6ae9435dcca17ae36901bd49fee52d4301183fe
SHA2569d444739e3e59247181fc7a84fea16b589b9a1d36ff0a8d0c94288642b7e9616
SHA51263fe3cadb6c6f619e00bfd7dc4cd510b4e98969efd7ab754b387097fe27c9c662461caa38b061d3af2bdb85b8d68c8179570c857d4297cd287d78b21ad08d91f
-
C:\Users\Public\Music\dafndp\dgsrcca.urlFilesize
136B
MD57326f2e70420d4d0b1a57170b9c3b9a4
SHA1a6ae9435dcca17ae36901bd49fee52d4301183fe
SHA2569d444739e3e59247181fc7a84fea16b589b9a1d36ff0a8d0c94288642b7e9616
SHA51263fe3cadb6c6f619e00bfd7dc4cd510b4e98969efd7ab754b387097fe27c9c662461caa38b061d3af2bdb85b8d68c8179570c857d4297cd287d78b21ad08d91f
-
C:\Users\Public\Music\dafndp\eoreol.lnkFilesize
1KB
MD584187a3ab929473894a7a4923687c390
SHA1f0a823ca36e086d23d18d66fe5cd37acaedf6372
SHA256bb61fa0c602eee498b158dda4a65580d4ea2bcd555ff104fe09769a54eaa6341
SHA5122b0d4477d9620994af5e20547669c076ba726e1ff49a99d8c07ef465e73a5138730a986217d88d17c2be5305479b3b397287d8044e25f8f2406cd07b6d13dd43
-
C:\Users\Public\Music\dafndp\hauupg.lnkFilesize
1KB
MD584187a3ab929473894a7a4923687c390
SHA1f0a823ca36e086d23d18d66fe5cd37acaedf6372
SHA256bb61fa0c602eee498b158dda4a65580d4ea2bcd555ff104fe09769a54eaa6341
SHA5122b0d4477d9620994af5e20547669c076ba726e1ff49a99d8c07ef465e73a5138730a986217d88d17c2be5305479b3b397287d8044e25f8f2406cd07b6d13dd43
-
C:\Users\Public\Music\dafndp\nawvbr.lnkFilesize
1KB
MD584187a3ab929473894a7a4923687c390
SHA1f0a823ca36e086d23d18d66fe5cd37acaedf6372
SHA256bb61fa0c602eee498b158dda4a65580d4ea2bcd555ff104fe09769a54eaa6341
SHA5122b0d4477d9620994af5e20547669c076ba726e1ff49a99d8c07ef465e73a5138730a986217d88d17c2be5305479b3b397287d8044e25f8f2406cd07b6d13dd43
-
C:\Users\Public\Music\dafndp\qtqvofp.urlFilesize
136B
MD57326f2e70420d4d0b1a57170b9c3b9a4
SHA1a6ae9435dcca17ae36901bd49fee52d4301183fe
SHA2569d444739e3e59247181fc7a84fea16b589b9a1d36ff0a8d0c94288642b7e9616
SHA51263fe3cadb6c6f619e00bfd7dc4cd510b4e98969efd7ab754b387097fe27c9c662461caa38b061d3af2bdb85b8d68c8179570c857d4297cd287d78b21ad08d91f
-
C:\Users\Public\Music\dafndp\sayiox.lnkFilesize
1KB
MD584187a3ab929473894a7a4923687c390
SHA1f0a823ca36e086d23d18d66fe5cd37acaedf6372
SHA256bb61fa0c602eee498b158dda4a65580d4ea2bcd555ff104fe09769a54eaa6341
SHA5122b0d4477d9620994af5e20547669c076ba726e1ff49a99d8c07ef465e73a5138730a986217d88d17c2be5305479b3b397287d8044e25f8f2406cd07b6d13dd43
-
C:\Users\Public\Music\dafndp\ugccpp.lnkFilesize
1KB
MD584187a3ab929473894a7a4923687c390
SHA1f0a823ca36e086d23d18d66fe5cd37acaedf6372
SHA256bb61fa0c602eee498b158dda4a65580d4ea2bcd555ff104fe09769a54eaa6341
SHA5122b0d4477d9620994af5e20547669c076ba726e1ff49a99d8c07ef465e73a5138730a986217d88d17c2be5305479b3b397287d8044e25f8f2406cd07b6d13dd43
-
C:\Users\Public\Music\dafndp\upcaudm.urlFilesize
136B
MD57326f2e70420d4d0b1a57170b9c3b9a4
SHA1a6ae9435dcca17ae36901bd49fee52d4301183fe
SHA2569d444739e3e59247181fc7a84fea16b589b9a1d36ff0a8d0c94288642b7e9616
SHA51263fe3cadb6c6f619e00bfd7dc4cd510b4e98969efd7ab754b387097fe27c9c662461caa38b061d3af2bdb85b8d68c8179570c857d4297cd287d78b21ad08d91f
-
C:\Users\Public\Music\dafndp\vbugnxr.urlFilesize
136B
MD57326f2e70420d4d0b1a57170b9c3b9a4
SHA1a6ae9435dcca17ae36901bd49fee52d4301183fe
SHA2569d444739e3e59247181fc7a84fea16b589b9a1d36ff0a8d0c94288642b7e9616
SHA51263fe3cadb6c6f619e00bfd7dc4cd510b4e98969efd7ab754b387097fe27c9c662461caa38b061d3af2bdb85b8d68c8179570c857d4297cd287d78b21ad08d91f
-
C:\Users\Public\pitap\oruy.exeFilesize
40KB
MD5d3ed82f676591a9c47037a7b66908832
SHA149533ea0b019b76131c14936814f99b9794d506b
SHA2560ef64a90dad0929f282fa1425422b2ffd70bf2ac803371fe3c780afefad66455
SHA512c79e09b8f47200acec33042cf183ead8cb3f7f87380e2ee4b3a2d6a05d96305277dea13974714d3e8ff8dd7c4733a2e4e93e137408de66ef60b6ec6f3e862986
-
\Users\Public\Pictures\Vrice\exowcb\xnelfi.exeFilesize
340KB
MD583020e8c25dd7d078733fe74c80d9b46
SHA157aa17d77a4912ed48b086cc86e78ffde7646aaa
SHA25633b1ff750a50970f7646806c41e444ce956566691efe735b2ff541c429c2b2d6
SHA5128b958749c6504874109adda9eb7bcc077e68474abd5fb2914aa1dd1212cf3e4c79c678aee7f23ef99a608fdd24fb39e12e57881db8708935a78999c999a70faa
-
\Users\Public\pitap\oruy.exeFilesize
40KB
MD5d3ed82f676591a9c47037a7b66908832
SHA149533ea0b019b76131c14936814f99b9794d506b
SHA2560ef64a90dad0929f282fa1425422b2ffd70bf2ac803371fe3c780afefad66455
SHA512c79e09b8f47200acec33042cf183ead8cb3f7f87380e2ee4b3a2d6a05d96305277dea13974714d3e8ff8dd7c4733a2e4e93e137408de66ef60b6ec6f3e862986
-
\Users\Public\pitap\oruy.exeFilesize
40KB
MD5d3ed82f676591a9c47037a7b66908832
SHA149533ea0b019b76131c14936814f99b9794d506b
SHA2560ef64a90dad0929f282fa1425422b2ffd70bf2ac803371fe3c780afefad66455
SHA512c79e09b8f47200acec33042cf183ead8cb3f7f87380e2ee4b3a2d6a05d96305277dea13974714d3e8ff8dd7c4733a2e4e93e137408de66ef60b6ec6f3e862986
-
\Users\Public\pitap\oruy.exeFilesize
40KB
MD5d3ed82f676591a9c47037a7b66908832
SHA149533ea0b019b76131c14936814f99b9794d506b
SHA2560ef64a90dad0929f282fa1425422b2ffd70bf2ac803371fe3c780afefad66455
SHA512c79e09b8f47200acec33042cf183ead8cb3f7f87380e2ee4b3a2d6a05d96305277dea13974714d3e8ff8dd7c4733a2e4e93e137408de66ef60b6ec6f3e862986
-
\Users\Public\pitap\oruy.exeFilesize
40KB
MD5d3ed82f676591a9c47037a7b66908832
SHA149533ea0b019b76131c14936814f99b9794d506b
SHA2560ef64a90dad0929f282fa1425422b2ffd70bf2ac803371fe3c780afefad66455
SHA512c79e09b8f47200acec33042cf183ead8cb3f7f87380e2ee4b3a2d6a05d96305277dea13974714d3e8ff8dd7c4733a2e4e93e137408de66ef60b6ec6f3e862986
-
\Users\Public\pitap\oruy.exeFilesize
40KB
MD5d3ed82f676591a9c47037a7b66908832
SHA149533ea0b019b76131c14936814f99b9794d506b
SHA2560ef64a90dad0929f282fa1425422b2ffd70bf2ac803371fe3c780afefad66455
SHA512c79e09b8f47200acec33042cf183ead8cb3f7f87380e2ee4b3a2d6a05d96305277dea13974714d3e8ff8dd7c4733a2e4e93e137408de66ef60b6ec6f3e862986
-
\Users\Public\pitap\oruy.exeFilesize
40KB
MD5d3ed82f676591a9c47037a7b66908832
SHA149533ea0b019b76131c14936814f99b9794d506b
SHA2560ef64a90dad0929f282fa1425422b2ffd70bf2ac803371fe3c780afefad66455
SHA512c79e09b8f47200acec33042cf183ead8cb3f7f87380e2ee4b3a2d6a05d96305277dea13974714d3e8ff8dd7c4733a2e4e93e137408de66ef60b6ec6f3e862986
-
memory/608-58-0x00000000039C0000-0x00000000039D0000-memory.dmpFilesize
64KB
-
memory/936-55-0x0000000000000000-mapping.dmp
-
memory/936-56-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmpFilesize
8KB
-
memory/948-78-0x00000000002E0000-0x00000000002EA000-memory.dmpFilesize
40KB
-
memory/948-71-0x00000000001D0000-0x00000000001DB000-memory.dmpFilesize
44KB
-
memory/948-80-0x00000000001D0000-0x00000000001DB000-memory.dmpFilesize
44KB
-
memory/948-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmpFilesize
8KB
-
memory/948-61-0x00000000001D0000-0x00000000001DB000-memory.dmpFilesize
44KB
-
memory/948-59-0x0000000074071000-0x0000000074073000-memory.dmpFilesize
8KB
-
memory/948-65-0x00000000001D0000-0x00000000001DB000-memory.dmpFilesize
44KB
-
memory/948-66-0x00000000001D0000-0x00000000001DB000-memory.dmpFilesize
44KB
-
memory/948-70-0x00000000001D0000-0x00000000001DB000-memory.dmpFilesize
44KB