Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-11-2022 09:28
Static task
static1
Behavioral task
behavioral1
Sample
86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe
Resource
win10v2004-20220812-en
General
-
Target
86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe
-
Size
174KB
-
MD5
b53973447e614cfcde8d03463955162a
-
SHA1
daf2284e1ab9cfae6c9fde2ef9452fdd7fbd700c
-
SHA256
86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0
-
SHA512
184e2e794726053952c2b91d2051c4ec506d2271d5262e52ee2e54b403a23f969159a067738d30248c2732d90570011602da2ecc77a9a2fa9041ea3f9698a8d6
-
SSDEEP
3072:70lOFhfoZ7L7bZtX/AR+gVB0j2avIVHHqtqt8c:A4yL7bZtPN2irIVHGC
Malware Config
Extracted
redline
rozena1114
jalocliche.xyz:81
chardhesha.xyz:81
-
auth_value
9fefd743a3b62bcd7c3e17a70fbdb3a8
Signatures
-
Detect Amadey credential stealer module 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module behavioral2/memory/4668-238-0x0000000000710000-0x0000000000734000-memory.dmp amadey_cred_module C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module -
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1268-134-0x00000000022E0000-0x00000000022E9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/996-192-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral2/memory/3752-194-0x0000000000750000-0x0000000000772000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 181 4668 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
D428.exeD9A8.exeDDBF.exerovwer.exerovwer.exesacwiwcpid process 4852 D428.exe 2168 D9A8.exe 3996 DDBF.exe 2276 rovwer.exe 660 rovwer.exe 2108 sacwiwc -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rovwer.exeDDBF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation rovwer.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation DDBF.exe -
Loads dropped DLL 3 IoCs
Processes:
D9A8.exerundll32.exepid process 2168 D9A8.exe 4668 rundll32.exe 4668 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
D9A8.exedescription pid process target process PID 2168 set thread context of 996 2168 D9A8.exe ngentask.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2912 3996 WerFault.exe DDBF.exe 1276 4852 WerFault.exe D428.exe 3496 660 WerFault.exe rovwer.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exesacwiwcdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sacwiwc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sacwiwc Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sacwiwc -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exepid process 1268 86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe 1268 86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 684 -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exesacwiwcpid process 1268 86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 2108 sacwiwc -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
D428.exedescription pid process Token: SeDebugPrivilege 4852 D428.exe Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
DDBF.exerovwer.execmd.exeD9A8.exedescription pid process target process PID 684 wrote to memory of 4852 684 D428.exe PID 684 wrote to memory of 4852 684 D428.exe PID 684 wrote to memory of 4852 684 D428.exe PID 684 wrote to memory of 2168 684 D9A8.exe PID 684 wrote to memory of 2168 684 D9A8.exe PID 684 wrote to memory of 2168 684 D9A8.exe PID 684 wrote to memory of 3996 684 DDBF.exe PID 684 wrote to memory of 3996 684 DDBF.exe PID 684 wrote to memory of 3996 684 DDBF.exe PID 3996 wrote to memory of 2276 3996 DDBF.exe rovwer.exe PID 3996 wrote to memory of 2276 3996 DDBF.exe rovwer.exe PID 3996 wrote to memory of 2276 3996 DDBF.exe rovwer.exe PID 684 wrote to memory of 4448 684 explorer.exe PID 684 wrote to memory of 4448 684 explorer.exe PID 684 wrote to memory of 4448 684 explorer.exe PID 684 wrote to memory of 4448 684 explorer.exe PID 2276 wrote to memory of 4236 2276 rovwer.exe schtasks.exe PID 2276 wrote to memory of 4236 2276 rovwer.exe schtasks.exe PID 2276 wrote to memory of 4236 2276 rovwer.exe schtasks.exe PID 2276 wrote to memory of 3868 2276 rovwer.exe cmd.exe PID 2276 wrote to memory of 3868 2276 rovwer.exe cmd.exe PID 2276 wrote to memory of 3868 2276 rovwer.exe cmd.exe PID 684 wrote to memory of 4712 684 explorer.exe PID 684 wrote to memory of 4712 684 explorer.exe PID 684 wrote to memory of 4712 684 explorer.exe PID 3868 wrote to memory of 1336 3868 cmd.exe cmd.exe PID 3868 wrote to memory of 1336 3868 cmd.exe cmd.exe PID 3868 wrote to memory of 1336 3868 cmd.exe cmd.exe PID 3868 wrote to memory of 3972 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 3972 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 3972 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 5116 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 5116 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 5116 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 5100 3868 cmd.exe cmd.exe PID 3868 wrote to memory of 5100 3868 cmd.exe cmd.exe PID 3868 wrote to memory of 5100 3868 cmd.exe cmd.exe PID 3868 wrote to memory of 3760 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 3760 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 3760 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 4640 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 4640 3868 cmd.exe cacls.exe PID 3868 wrote to memory of 4640 3868 cmd.exe cacls.exe PID 684 wrote to memory of 2012 684 explorer.exe PID 684 wrote to memory of 2012 684 explorer.exe PID 684 wrote to memory of 2012 684 explorer.exe PID 684 wrote to memory of 2012 684 explorer.exe PID 2168 wrote to memory of 3180 2168 D9A8.exe ngentask.exe PID 2168 wrote to memory of 3180 2168 D9A8.exe ngentask.exe PID 2168 wrote to memory of 3180 2168 D9A8.exe ngentask.exe PID 684 wrote to memory of 2800 684 explorer.exe PID 684 wrote to memory of 2800 684 explorer.exe PID 684 wrote to memory of 2800 684 explorer.exe PID 2168 wrote to memory of 996 2168 D9A8.exe ngentask.exe PID 2168 wrote to memory of 996 2168 D9A8.exe ngentask.exe PID 2168 wrote to memory of 996 2168 D9A8.exe ngentask.exe PID 684 wrote to memory of 3752 684 explorer.exe PID 684 wrote to memory of 3752 684 explorer.exe PID 684 wrote to memory of 3752 684 explorer.exe PID 684 wrote to memory of 3752 684 explorer.exe PID 2168 wrote to memory of 996 2168 D9A8.exe ngentask.exe PID 2168 wrote to memory of 996 2168 D9A8.exe ngentask.exe PID 684 wrote to memory of 4824 684 explorer.exe PID 684 wrote to memory of 4824 684 explorer.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe"C:\Users\Admin\AppData\Local\Temp\86def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D428.exeC:\Users\Admin\AppData\Local\Temp\D428.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 14802⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\D9A8.exeC:\Users\Admin\AppData\Local\Temp\D9A8.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DDBF.exeC:\Users\Admin\AppData\Local\Temp\DDBF.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 11442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3996 -ip 39961⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4852 -ip 48521⤵
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 4162⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\sacwiwcC:\Users\Admin\AppData\Roaming\sacwiwc1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 660 -ip 6601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
242KB
MD519617bdb19b1aeb574c718a27abc3c31
SHA1369cd7c11f56a89d0f97e4cefdbe02d7120e0b25
SHA256ec1c329fd6890269a1b97f2684d00923a2c251c564f92795c446ca02c9cebf07
SHA512b5664d14bfedab6d536a37d9cc3f83059e2aaa566505514674c8c21cac86dd21b5125e136d75580ff8a11e10bf37eada8a4c0e29040545e13066cb66c0c8a753
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
242KB
MD519617bdb19b1aeb574c718a27abc3c31
SHA1369cd7c11f56a89d0f97e4cefdbe02d7120e0b25
SHA256ec1c329fd6890269a1b97f2684d00923a2c251c564f92795c446ca02c9cebf07
SHA512b5664d14bfedab6d536a37d9cc3f83059e2aaa566505514674c8c21cac86dd21b5125e136d75580ff8a11e10bf37eada8a4c0e29040545e13066cb66c0c8a753
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
242KB
MD519617bdb19b1aeb574c718a27abc3c31
SHA1369cd7c11f56a89d0f97e4cefdbe02d7120e0b25
SHA256ec1c329fd6890269a1b97f2684d00923a2c251c564f92795c446ca02c9cebf07
SHA512b5664d14bfedab6d536a37d9cc3f83059e2aaa566505514674c8c21cac86dd21b5125e136d75580ff8a11e10bf37eada8a4c0e29040545e13066cb66c0c8a753
-
C:\Users\Admin\AppData\Local\Temp\D428.exeFilesize
322KB
MD55d49247d0618ac5c5660c52f005ffa6e
SHA14867a9d0c9c6f9a71947c94640f9101f8664d18a
SHA2561937e19e35d61bc05e47910633806d5336928e315ba2dfec557e3504e786d968
SHA5120359047aa3c20bf43aff2dbe5c5bade2600f99bb435db0cb9c513afcfe779eb0d29a7d9dea5d77f24ccc0e7e69b892593ef463d68c0957710bb8d20efd75e1ef
-
C:\Users\Admin\AppData\Local\Temp\D428.exeFilesize
322KB
MD55d49247d0618ac5c5660c52f005ffa6e
SHA14867a9d0c9c6f9a71947c94640f9101f8664d18a
SHA2561937e19e35d61bc05e47910633806d5336928e315ba2dfec557e3504e786d968
SHA5120359047aa3c20bf43aff2dbe5c5bade2600f99bb435db0cb9c513afcfe779eb0d29a7d9dea5d77f24ccc0e7e69b892593ef463d68c0957710bb8d20efd75e1ef
-
C:\Users\Admin\AppData\Local\Temp\D9A8.exeFilesize
1.1MB
MD55e7c07b9aa0668fa2971747bb4fade1e
SHA17fae544f73f2a8fb7a340a20ec47f76370fbd487
SHA256431a1c4ceae3411f5476eed27fc30ebd55138afb4c4e9dac3db9d4b8addbb361
SHA5125c9c65c99f0c8a5aaa2beac1a0c4304a1cb2ea808eeb6bbe11c2852d6e9fbad8bb68faa5f778848dade617e1c5ee1fb9dae566d7a064b05fdaa30a03019b868f
-
C:\Users\Admin\AppData\Local\Temp\D9A8.exeFilesize
1.1MB
MD55e7c07b9aa0668fa2971747bb4fade1e
SHA17fae544f73f2a8fb7a340a20ec47f76370fbd487
SHA256431a1c4ceae3411f5476eed27fc30ebd55138afb4c4e9dac3db9d4b8addbb361
SHA5125c9c65c99f0c8a5aaa2beac1a0c4304a1cb2ea808eeb6bbe11c2852d6e9fbad8bb68faa5f778848dade617e1c5ee1fb9dae566d7a064b05fdaa30a03019b868f
-
C:\Users\Admin\AppData\Local\Temp\DDBF.exeFilesize
242KB
MD519617bdb19b1aeb574c718a27abc3c31
SHA1369cd7c11f56a89d0f97e4cefdbe02d7120e0b25
SHA256ec1c329fd6890269a1b97f2684d00923a2c251c564f92795c446ca02c9cebf07
SHA512b5664d14bfedab6d536a37d9cc3f83059e2aaa566505514674c8c21cac86dd21b5125e136d75580ff8a11e10bf37eada8a4c0e29040545e13066cb66c0c8a753
-
C:\Users\Admin\AppData\Local\Temp\DDBF.exeFilesize
242KB
MD519617bdb19b1aeb574c718a27abc3c31
SHA1369cd7c11f56a89d0f97e4cefdbe02d7120e0b25
SHA256ec1c329fd6890269a1b97f2684d00923a2c251c564f92795c446ca02c9cebf07
SHA512b5664d14bfedab6d536a37d9cc3f83059e2aaa566505514674c8c21cac86dd21b5125e136d75580ff8a11e10bf37eada8a4c0e29040545e13066cb66c0c8a753
-
C:\Users\Admin\AppData\Local\Temp\advapi32.dllFilesize
1.1MB
MD5486536825ff5e3219a8702319e064907
SHA134f7f9211e2fd9c166fb36ed1d4121ebd427bebd
SHA2566ab2023a2bd76692a694a812bf86c341696810c61666586c09a343832f05dc01
SHA512f77404db724b9f8e93d84f2f9f0cee10b05638bda4445facbfd262eca52f073e285c10f153133fc35f9a426eb84e87e8e0b320f2815b2405ca3ada7ac2fded4c
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
C:\Users\Admin\AppData\Roaming\sacwiwcFilesize
174KB
MD5b53973447e614cfcde8d03463955162a
SHA1daf2284e1ab9cfae6c9fde2ef9452fdd7fbd700c
SHA25686def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0
SHA512184e2e794726053952c2b91d2051c4ec506d2271d5262e52ee2e54b403a23f969159a067738d30248c2732d90570011602da2ecc77a9a2fa9041ea3f9698a8d6
-
C:\Users\Admin\AppData\Roaming\sacwiwcFilesize
174KB
MD5b53973447e614cfcde8d03463955162a
SHA1daf2284e1ab9cfae6c9fde2ef9452fdd7fbd700c
SHA25686def4439d70e908478819d3bed01ff8f47b1e1ccb2a82181aa2b7bfa51911d0
SHA512184e2e794726053952c2b91d2051c4ec506d2271d5262e52ee2e54b403a23f969159a067738d30248c2732d90570011602da2ecc77a9a2fa9041ea3f9698a8d6
-
memory/660-232-0x0000000000400000-0x00000000005A1000-memory.dmpFilesize
1.6MB
-
memory/660-231-0x000000000091C000-0x000000000093A000-memory.dmpFilesize
120KB
-
memory/808-228-0x0000000001050000-0x0000000001058000-memory.dmpFilesize
32KB
-
memory/808-212-0x0000000001040000-0x000000000104B000-memory.dmpFilesize
44KB
-
memory/808-211-0x0000000001050000-0x0000000001058000-memory.dmpFilesize
32KB
-
memory/808-210-0x0000000000000000-mapping.dmp
-
memory/996-188-0x0000000000000000-mapping.dmp
-
memory/996-189-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/996-192-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1268-136-0x0000000000400000-0x0000000000591000-memory.dmpFilesize
1.6MB
-
memory/1268-134-0x00000000022E0000-0x00000000022E9000-memory.dmpFilesize
36KB
-
memory/1268-135-0x0000000000400000-0x0000000000591000-memory.dmpFilesize
1.6MB
-
memory/1268-133-0x0000000000650000-0x0000000000750000-memory.dmpFilesize
1024KB
-
memory/1336-173-0x0000000000000000-mapping.dmp
-
memory/1632-209-0x00000000010A0000-0x00000000010AD000-memory.dmpFilesize
52KB
-
memory/1632-208-0x00000000010B0000-0x00000000010B7000-memory.dmpFilesize
28KB
-
memory/1632-204-0x0000000000000000-mapping.dmp
-
memory/1632-227-0x00000000010B0000-0x00000000010B7000-memory.dmpFilesize
28KB
-
memory/2012-185-0x0000000000800000-0x0000000000809000-memory.dmpFilesize
36KB
-
memory/2012-179-0x0000000000000000-mapping.dmp
-
memory/2012-184-0x0000000000810000-0x0000000000815000-memory.dmpFilesize
20KB
-
memory/2012-219-0x0000000000810000-0x0000000000815000-memory.dmpFilesize
20KB
-
memory/2108-233-0x0000000000400000-0x0000000000591000-memory.dmpFilesize
1.6MB
-
memory/2108-229-0x0000000000869000-0x000000000087A000-memory.dmpFilesize
68KB
-
memory/2108-230-0x0000000000400000-0x0000000000591000-memory.dmpFilesize
1.6MB
-
memory/2168-154-0x0000000002EF1000-0x00000000033FF000-memory.dmpFilesize
5.1MB
-
memory/2168-172-0x000000000F650000-0x000000000F7CF000-memory.dmpFilesize
1.5MB
-
memory/2168-141-0x0000000000000000-mapping.dmp
-
memory/2168-168-0x000000000350E000-0x000000000360C000-memory.dmpFilesize
1016KB
-
memory/2168-206-0x000000000350E000-0x000000000360C000-memory.dmpFilesize
1016KB
-
memory/2168-165-0x000000000F650000-0x000000000F7CF000-memory.dmpFilesize
1.5MB
-
memory/2276-171-0x0000000000400000-0x00000000005A1000-memory.dmpFilesize
1.6MB
-
memory/2276-217-0x00000000007A8000-0x00000000007C7000-memory.dmpFilesize
124KB
-
memory/2276-214-0x0000000000400000-0x00000000005A1000-memory.dmpFilesize
1.6MB
-
memory/2276-169-0x00000000007A8000-0x00000000007C7000-memory.dmpFilesize
124KB
-
memory/2276-156-0x0000000000000000-mapping.dmp
-
memory/2800-220-0x0000000000640000-0x0000000000646000-memory.dmpFilesize
24KB
-
memory/2800-186-0x0000000000630000-0x000000000063C000-memory.dmpFilesize
48KB
-
memory/2800-183-0x0000000000000000-mapping.dmp
-
memory/2800-193-0x0000000000640000-0x0000000000646000-memory.dmpFilesize
24KB
-
memory/3180-182-0x0000000000000000-mapping.dmp
-
memory/3752-221-0x0000000000750000-0x0000000000772000-memory.dmpFilesize
136KB
-
memory/3752-191-0x0000000000000000-mapping.dmp
-
memory/3752-194-0x0000000000750000-0x0000000000772000-memory.dmpFilesize
136KB
-
memory/3752-195-0x0000000000720000-0x0000000000747000-memory.dmpFilesize
156KB
-
memory/3760-177-0x0000000000000000-mapping.dmp
-
memory/3868-164-0x0000000000000000-mapping.dmp
-
memory/3972-174-0x0000000000000000-mapping.dmp
-
memory/3996-148-0x0000000000000000-mapping.dmp
-
memory/3996-159-0x00000000005E9000-0x0000000000608000-memory.dmpFilesize
124KB
-
memory/3996-161-0x0000000000400000-0x00000000005A1000-memory.dmpFilesize
1.6MB
-
memory/3996-160-0x0000000000730000-0x000000000076E000-memory.dmpFilesize
248KB
-
memory/4236-163-0x0000000000000000-mapping.dmp
-
memory/4448-166-0x00000000001F0000-0x00000000001F7000-memory.dmpFilesize
28KB
-
memory/4448-167-0x00000000001E0000-0x00000000001EB000-memory.dmpFilesize
44KB
-
memory/4448-216-0x00000000001F0000-0x00000000001F7000-memory.dmpFilesize
28KB
-
memory/4448-162-0x0000000000000000-mapping.dmp
-
memory/4548-223-0x0000000000D90000-0x0000000000D96000-memory.dmpFilesize
24KB
-
memory/4548-202-0x0000000000D90000-0x0000000000D96000-memory.dmpFilesize
24KB
-
memory/4548-203-0x0000000000D80000-0x0000000000D8B000-memory.dmpFilesize
44KB
-
memory/4548-201-0x0000000000000000-mapping.dmp
-
memory/4640-178-0x0000000000000000-mapping.dmp
-
memory/4668-234-0x0000000000000000-mapping.dmp
-
memory/4668-238-0x0000000000710000-0x0000000000734000-memory.dmpFilesize
144KB
-
memory/4712-181-0x0000000000DA0000-0x0000000000DAF000-memory.dmpFilesize
60KB
-
memory/4712-180-0x0000000000DB0000-0x0000000000DB9000-memory.dmpFilesize
36KB
-
memory/4712-170-0x0000000000000000-mapping.dmp
-
memory/4712-218-0x0000000000DB0000-0x0000000000DB9000-memory.dmpFilesize
36KB
-
memory/4824-200-0x00000000012B0000-0x00000000012B9000-memory.dmpFilesize
36KB
-
memory/4824-199-0x00000000012C0000-0x00000000012C5000-memory.dmpFilesize
20KB
-
memory/4824-222-0x00000000012C0000-0x00000000012C5000-memory.dmpFilesize
20KB
-
memory/4824-198-0x0000000000000000-mapping.dmp
-
memory/4852-153-0x0000000004E70000-0x0000000004E82000-memory.dmpFilesize
72KB
-
memory/4852-155-0x0000000005580000-0x00000000055BC000-memory.dmpFilesize
240KB
-
memory/4852-215-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/4852-152-0x0000000005470000-0x000000000557A000-memory.dmpFilesize
1.0MB
-
memory/4852-151-0x00000000055E0000-0x0000000005BF8000-memory.dmpFilesize
6.1MB
-
memory/4852-213-0x00000000006A9000-0x00000000006DA000-memory.dmpFilesize
196KB
-
memory/4852-142-0x00000000006A9000-0x00000000006DA000-memory.dmpFilesize
196KB
-
memory/4852-145-0x0000000000630000-0x000000000066E000-memory.dmpFilesize
248KB
-
memory/4852-137-0x0000000000000000-mapping.dmp
-
memory/4852-187-0x0000000005E80000-0x0000000005EE6000-memory.dmpFilesize
408KB
-
memory/4852-146-0x0000000004CC0000-0x0000000004D52000-memory.dmpFilesize
584KB
-
memory/4852-147-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/4852-207-0x00000000006A9000-0x00000000006DA000-memory.dmpFilesize
196KB
-
memory/4852-197-0x00000000075A0000-0x0000000007ACC000-memory.dmpFilesize
5.2MB
-
memory/4852-196-0x00000000073A0000-0x0000000007562000-memory.dmpFilesize
1.8MB
-
memory/4852-140-0x0000000004EC0000-0x0000000005464000-memory.dmpFilesize
5.6MB
-
memory/5100-176-0x0000000000000000-mapping.dmp
-
memory/5116-175-0x0000000000000000-mapping.dmp