Analysis
-
max time kernel
98s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
13-11-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
2c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d.exe
Resource
win10-20220901-en
General
-
Target
2c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d.exe
-
Size
232KB
-
MD5
a2dabba22902cfd175114a878b63847a
-
SHA1
6b5398184633460da5e80f816b873bd2fce29e42
-
SHA256
2c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d
-
SHA512
08c0ca27640a5652786006b20849fdc0e76f545da7b5ed7ba52e8af07bee36cea10415cac3ce60f7397ec77dc12b048687fa6b2ac82d2221a79440df86ff0a30
-
SSDEEP
6144:1cMLHMtZq1cCd3WFeXOG5TUWD+xeGBdNfJ:1cMTkM1cuWFeXV5YG+oG
Malware Config
Extracted
redline
@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)
151.80.89.233:13553
-
auth_value
fbee175162920530e6bf470c8003fa1a
Extracted
redline
boy
77.73.134.241:4691
-
auth_value
a91fa8cc2cfaefc42a23c03faef44bd3
Signatures
-
Detect Amadey credential stealer module 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll amadey_cred_module C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000043001\20K.exe family_redline C:\Users\Admin\AppData\Local\Temp\1000043001\20K.exe family_redline C:\Users\Admin\AppData\Local\Temp\1000007001\mana.exe family_redline behavioral1/memory/2232-490-0x0000000000110000-0x0000000000138000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000007001\mana.exe family_redline behavioral1/memory/4936-533-0x00000000003E0000-0x0000000000408000-memory.dmp family_redline -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 17 4624 rundll32.exe 20 208 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
Processes:
rovwer.exelego.exerovwer.exe20K.exemana.exebiba.exerovwer.exerovwer.exepid process 2008 rovwer.exe 4492 lego.exe 4060 rovwer.exe 2232 20K.exe 4936 mana.exe 3244 biba.exe 4772 rovwer.exe 684 rovwer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000057001\biba.exe upx C:\Users\Admin\AppData\Local\Temp\1000057001\biba.exe upx behavioral1/memory/3244-594-0x0000000000ED0000-0x0000000001CE8000-memory.dmp upx behavioral1/memory/3244-596-0x0000000000ED0000-0x0000000001CE8000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4624 rundll32.exe 208 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
rovwer.exerovwer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\lego.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000006000\\lego.exe" rovwer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\20K.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000043001\\20K.exe" rovwer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\mana.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000007001\\mana.exe" rovwer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\biba.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000057001\\biba.exe" rovwer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4724 schtasks.exe 4304 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
20K.exemana.exerundll32.exerundll32.exepid process 2232 20K.exe 2232 20K.exe 4936 mana.exe 4936 mana.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 4624 rundll32.exe 208 rundll32.exe 208 rundll32.exe 208 rundll32.exe 208 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
20K.exemana.exedescription pid process Token: SeDebugPrivilege 2232 20K.exe Token: SeDebugPrivilege 4936 mana.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
2c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d.exerovwer.exelego.exerovwer.execmd.exebiba.execmd.exedescription pid process target process PID 3512 wrote to memory of 2008 3512 2c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d.exe rovwer.exe PID 3512 wrote to memory of 2008 3512 2c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d.exe rovwer.exe PID 3512 wrote to memory of 2008 3512 2c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d.exe rovwer.exe PID 2008 wrote to memory of 4304 2008 rovwer.exe schtasks.exe PID 2008 wrote to memory of 4304 2008 rovwer.exe schtasks.exe PID 2008 wrote to memory of 4304 2008 rovwer.exe schtasks.exe PID 2008 wrote to memory of 4492 2008 rovwer.exe lego.exe PID 2008 wrote to memory of 4492 2008 rovwer.exe lego.exe PID 2008 wrote to memory of 4492 2008 rovwer.exe lego.exe PID 4492 wrote to memory of 4060 4492 lego.exe rovwer.exe PID 4492 wrote to memory of 4060 4492 lego.exe rovwer.exe PID 4492 wrote to memory of 4060 4492 lego.exe rovwer.exe PID 4060 wrote to memory of 4724 4060 rovwer.exe schtasks.exe PID 4060 wrote to memory of 4724 4060 rovwer.exe schtasks.exe PID 4060 wrote to memory of 4724 4060 rovwer.exe schtasks.exe PID 4060 wrote to memory of 4432 4060 rovwer.exe cmd.exe PID 4060 wrote to memory of 4432 4060 rovwer.exe cmd.exe PID 4060 wrote to memory of 4432 4060 rovwer.exe cmd.exe PID 4432 wrote to memory of 4612 4432 cmd.exe cmd.exe PID 4432 wrote to memory of 4612 4432 cmd.exe cmd.exe PID 4432 wrote to memory of 4612 4432 cmd.exe cmd.exe PID 4432 wrote to memory of 392 4432 cmd.exe cacls.exe PID 4432 wrote to memory of 392 4432 cmd.exe cacls.exe PID 4432 wrote to memory of 392 4432 cmd.exe cacls.exe PID 4432 wrote to memory of 1688 4432 cmd.exe cacls.exe PID 4432 wrote to memory of 1688 4432 cmd.exe cacls.exe PID 4432 wrote to memory of 1688 4432 cmd.exe cacls.exe PID 4432 wrote to memory of 200 4432 cmd.exe cmd.exe PID 4432 wrote to memory of 200 4432 cmd.exe cmd.exe PID 4432 wrote to memory of 200 4432 cmd.exe cmd.exe PID 4432 wrote to memory of 188 4432 cmd.exe cacls.exe PID 4432 wrote to memory of 188 4432 cmd.exe cacls.exe PID 4432 wrote to memory of 188 4432 cmd.exe cacls.exe PID 4060 wrote to memory of 2232 4060 rovwer.exe 20K.exe PID 4060 wrote to memory of 2232 4060 rovwer.exe 20K.exe PID 4060 wrote to memory of 2232 4060 rovwer.exe 20K.exe PID 4432 wrote to memory of 1876 4432 cmd.exe cacls.exe PID 4432 wrote to memory of 1876 4432 cmd.exe cacls.exe PID 4432 wrote to memory of 1876 4432 cmd.exe cacls.exe PID 2008 wrote to memory of 4936 2008 rovwer.exe mana.exe PID 2008 wrote to memory of 4936 2008 rovwer.exe mana.exe PID 2008 wrote to memory of 4936 2008 rovwer.exe mana.exe PID 4060 wrote to memory of 3244 4060 rovwer.exe biba.exe PID 4060 wrote to memory of 3244 4060 rovwer.exe biba.exe PID 3244 wrote to memory of 3560 3244 biba.exe cmd.exe PID 3244 wrote to memory of 3560 3244 biba.exe cmd.exe PID 3560 wrote to memory of 3188 3560 cmd.exe choice.exe PID 3560 wrote to memory of 3188 3560 cmd.exe choice.exe PID 2008 wrote to memory of 4624 2008 rovwer.exe rundll32.exe PID 2008 wrote to memory of 4624 2008 rovwer.exe rundll32.exe PID 2008 wrote to memory of 4624 2008 rovwer.exe rundll32.exe PID 4060 wrote to memory of 208 4060 rovwer.exe rundll32.exe PID 4060 wrote to memory of 208 4060 rovwer.exe rundll32.exe PID 4060 wrote to memory of 208 4060 rovwer.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d.exe"C:\Users\Admin\AppData\Local\Temp\2c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\1000006000\lego.exe"C:\Users\Admin\AppData\Roaming\1000006000\lego.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000043001\20K.exe"C:\Users\Admin\AppData\Local\Temp\1000043001\20K.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000057001\biba.exe"C:\Users\Admin\AppData\Local\Temp\1000057001\biba.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\1000057001\biba.exe6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 07⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\1000007001\mana.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\mana.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000007001\mana.exeFilesize
137KB
MD5e63d74cec6926b2d04e474b889d08af4
SHA1a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb
SHA256a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33
SHA512fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148
-
C:\Users\Admin\AppData\Local\Temp\1000007001\mana.exeFilesize
137KB
MD5e63d74cec6926b2d04e474b889d08af4
SHA1a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb
SHA256a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33
SHA512fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148
-
C:\Users\Admin\AppData\Local\Temp\1000043001\20K.exeFilesize
137KB
MD506cee591f384a048b3403819d9328e82
SHA14b8dd48bb52cf306a21a0ef3a3449c0963dbae4e
SHA256f4d228b52dbea8f6c059c2debe6fea366833f27ae9dcd5b793248e830a0cb8c4
SHA51238928ee89657576814597fb5a4bfe8380b04557921b2b5e5ad09afaa208d3080d897c47154ebc8fdf4a844b55b34f8c7d572ccc2a70e9abdf3861d0621764ae5
-
C:\Users\Admin\AppData\Local\Temp\1000043001\20K.exeFilesize
137KB
MD506cee591f384a048b3403819d9328e82
SHA14b8dd48bb52cf306a21a0ef3a3449c0963dbae4e
SHA256f4d228b52dbea8f6c059c2debe6fea366833f27ae9dcd5b793248e830a0cb8c4
SHA51238928ee89657576814597fb5a4bfe8380b04557921b2b5e5ad09afaa208d3080d897c47154ebc8fdf4a844b55b34f8c7d572ccc2a70e9abdf3861d0621764ae5
-
C:\Users\Admin\AppData\Local\Temp\1000057001\biba.exeFilesize
4.3MB
MD57b4417e46039b501b0677a326ef01d48
SHA18b82f14a4b69c3f1ba7c20cd1a508adc5c5631b5
SHA25684a04190d479e2cf0fd459258a4fd4fc4a5059f96c355172e2c230f0bd1e863b
SHA512b0fd8f5137834e0fd18f4c2390b3531e4b14b3a45052d001b27284728ee9842e127d66c299af3f2aabdf5776bd3c99e078fc01bb35cc3f932998ca6e40697228
-
C:\Users\Admin\AppData\Local\Temp\1000057001\biba.exeFilesize
4.3MB
MD57b4417e46039b501b0677a326ef01d48
SHA18b82f14a4b69c3f1ba7c20cd1a508adc5c5631b5
SHA25684a04190d479e2cf0fd459258a4fd4fc4a5059f96c355172e2c230f0bd1e863b
SHA512b0fd8f5137834e0fd18f4c2390b3531e4b14b3a45052d001b27284728ee9842e127d66c299af3f2aabdf5776bd3c99e078fc01bb35cc3f932998ca6e40697228
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
232KB
MD5a2dabba22902cfd175114a878b63847a
SHA16b5398184633460da5e80f816b873bd2fce29e42
SHA2562c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d
SHA51208c0ca27640a5652786006b20849fdc0e76f545da7b5ed7ba52e8af07bee36cea10415cac3ce60f7397ec77dc12b048687fa6b2ac82d2221a79440df86ff0a30
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
232KB
MD5a2dabba22902cfd175114a878b63847a
SHA16b5398184633460da5e80f816b873bd2fce29e42
SHA2562c8b48592f8c31d2cd0294d399f5c3fcc2b9540c9aa310dbc8aaddd6a5456c9d
SHA51208c0ca27640a5652786006b20849fdc0e76f545da7b5ed7ba52e8af07bee36cea10415cac3ce60f7397ec77dc12b048687fa6b2ac82d2221a79440df86ff0a30
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Roaming\1000006000\lego.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Roaming\1000006000\lego.exeFilesize
241KB
MD5b466f58861bb4069db99312de146a2e8
SHA1295f06794b26ba5ac7c73fbf636c581624f897cd
SHA2566cfe5fe62ed600c72c474e6dfee6be689c74a820f789fbc9310fab1f68a87420
SHA5128693e5a87844600c5e3ac04a74f01c801cefba09216c87e707c07fa34565693a98d74547470eef64ce9b277db4a466ee1176ca0015dddb665c9a84b7e6886c5d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dllFilesize
126KB
MD5b8d80046e28849a320a3dcd868b73d7c
SHA1f15bc4a4c5189e7aa845213469c6def5afd68186
SHA256d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a
SHA512b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dllFilesize
126KB
MD5b8d80046e28849a320a3dcd868b73d7c
SHA1f15bc4a4c5189e7aa845213469c6def5afd68186
SHA256d23147a448d24f81d81d4bb226f3fc968386792c0987dda75917104b5ecd9d5a
SHA512b7f6d59ee55d2b579c2185560d2e660c1952f9214f3db3096b1358af3559fd985859aa3389be333c826f35b85cd63c6f65a03e65a7ad57c7834bb09abd1d853e
-
memory/188-416-0x0000000000000000-mapping.dmp
-
memory/200-414-0x0000000000000000-mapping.dmp
-
memory/208-751-0x0000000000000000-mapping.dmp
-
memory/392-374-0x0000000000000000-mapping.dmp
-
memory/1688-391-0x0000000000000000-mapping.dmp
-
memory/1876-452-0x0000000000000000-mapping.dmp
-
memory/2008-182-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-228-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/2008-590-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/2008-585-0x00000000006E0000-0x000000000082A000-memory.dmpFilesize
1.3MB
-
memory/2008-193-0x00000000006E0000-0x000000000082A000-memory.dmpFilesize
1.3MB
-
memory/2008-191-0x00000000006E0000-0x000000000082A000-memory.dmpFilesize
1.3MB
-
memory/2008-190-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-189-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-187-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-186-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-185-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-184-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-180-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-183-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-181-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-178-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-177-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-167-0x0000000000000000-mapping.dmp
-
memory/2008-170-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-172-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-176-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-174-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2008-169-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/2232-427-0x0000000000000000-mapping.dmp
-
memory/2232-622-0x0000000009700000-0x0000000009C2C000-memory.dmpFilesize
5.2MB
-
memory/2232-615-0x0000000008210000-0x000000000870E000-memory.dmpFilesize
5.0MB
-
memory/2232-614-0x0000000007C70000-0x0000000007D02000-memory.dmpFilesize
584KB
-
memory/2232-566-0x0000000006D30000-0x0000000006E3A000-memory.dmpFilesize
1.0MB
-
memory/2232-564-0x00000000054D0000-0x0000000005AD6000-memory.dmpFilesize
6.0MB
-
memory/2232-490-0x0000000000110000-0x0000000000138000-memory.dmpFilesize
160KB
-
memory/3188-597-0x0000000000000000-mapping.dmp
-
memory/3244-596-0x0000000000ED0000-0x0000000001CE8000-memory.dmpFilesize
14.1MB
-
memory/3244-594-0x0000000000ED0000-0x0000000001CE8000-memory.dmpFilesize
14.1MB
-
memory/3244-591-0x0000000000000000-mapping.dmp
-
memory/3512-135-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-162-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-157-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-156-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-140-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-155-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/3512-117-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-154-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-153-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-152-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-151-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-146-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-147-0x00000000022C0000-0x00000000022FE000-memory.dmpFilesize
248KB
-
memory/3512-150-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-149-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-148-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-145-0x00000000008F6000-0x0000000000915000-memory.dmpFilesize
124KB
-
memory/3512-118-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-142-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-119-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-134-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-136-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-121-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-138-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-139-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-123-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-125-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-126-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-137-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-164-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-133-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-132-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-159-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-120-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-122-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-124-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-128-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-127-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-158-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-130-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-165-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-171-0x00000000008F6000-0x0000000000915000-memory.dmpFilesize
124KB
-
memory/3512-160-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-166-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-161-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-163-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-144-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-143-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-173-0x00000000022C0000-0x00000000022FE000-memory.dmpFilesize
248KB
-
memory/3512-131-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-129-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-175-0x0000000000400000-0x0000000000596000-memory.dmpFilesize
1.6MB
-
memory/3512-141-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3560-595-0x0000000000000000-mapping.dmp
-
memory/4060-299-0x0000000000000000-mapping.dmp
-
memory/4304-223-0x0000000000000000-mapping.dmp
-
memory/4432-348-0x0000000000000000-mapping.dmp
-
memory/4492-252-0x0000000000000000-mapping.dmp
-
memory/4612-362-0x0000000000000000-mapping.dmp
-
memory/4624-668-0x0000000000000000-mapping.dmp
-
memory/4724-346-0x0000000000000000-mapping.dmp
-
memory/4936-570-0x0000000004C20000-0x0000000004C32000-memory.dmpFilesize
72KB
-
memory/4936-482-0x0000000000000000-mapping.dmp
-
memory/4936-533-0x00000000003E0000-0x0000000000408000-memory.dmpFilesize
160KB
-
memory/4936-621-0x0000000006490000-0x0000000006652000-memory.dmpFilesize
1.8MB
-
memory/4936-618-0x0000000005C90000-0x0000000005CE0000-memory.dmpFilesize
320KB
-
memory/4936-617-0x0000000005C10000-0x0000000005C86000-memory.dmpFilesize
472KB
-
memory/4936-578-0x0000000004C90000-0x0000000004CCE000-memory.dmpFilesize
248KB
-
memory/4936-600-0x0000000004FA0000-0x0000000005006000-memory.dmpFilesize
408KB
-
memory/4936-582-0x0000000004E00000-0x0000000004E4B000-memory.dmpFilesize
300KB