Analysis
-
max time kernel
60s -
max time network
64s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-11-2022 08:36
Static task
static1
Behavioral task
behavioral1
Sample
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe
Resource
win10v2004-20220812-en
General
-
Target
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe
-
Size
686KB
-
MD5
3a727e40ad724fb8dd9cfbc82b0f4d90
-
SHA1
802544ecc7add1e5248dbbce59e21b5f248a9fcc
-
SHA256
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac
-
SHA512
402c421727810717d94ffa2acdb8e57171284c1e8413f0363d49bd988b4575d3b8ee5472b0673c747defcfc51323c6d8492d18ed216d3212eee71fae996167e4
-
SSDEEP
12288:KwWXgoYk/6Ih6EPvj18RNwpkVo4LfQSYBus9cbxOvBY7ms7vKpnMj5pxHqZGxX:tWw1OkEPb18wYo4LfQBn9iUvm7ms4Kxr
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\u7UwruIi.dll acprotect -
Drops file in Drivers directory 1 IoCs
Processes:
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exedescription ioc process File created C:\Windows\SysWOW64\drivers\6bf0ef52.sys 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 744 icacls.exe 844 takeown.exe 616 icacls.exe 2000 takeown.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\6bf0ef52\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\6bf0ef52.sys" 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\u7UwruIi.dll upx behavioral1/memory/2004-71-0x0000000010000000-0x00000000105DF000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1808 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exepid process 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 2000 takeown.exe 744 icacls.exe 844 takeown.exe 616 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe -
Drops file in System32 directory 5 IoCs
Processes:
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exedescription ioc process File created C:\Windows\SysWOW64\wshtcpip.dll 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe File opened for modification C:\Windows\SysWOW64\wshtcpip.dll 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe File created C:\Windows\SysWOW64\midimap.dll 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe File created C:\Windows\SysWOW64\u7UwruIi.dll 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe File created C:\Windows\SysWOW64\gYIuhj8y.dll 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe -
Modifies registry class 4 IoCs
Processes:
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "VeIBueeW1.dll" 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe" 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exepid process 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exepid process 460 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
takeown.exetakeown.exe637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exedescription pid process Token: SeTakeOwnershipPrivilege 2000 takeown.exe Token: SeTakeOwnershipPrivilege 844 takeown.exe Token: SeDebugPrivilege 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.execmd.execmd.exedescription pid process target process PID 2004 wrote to memory of 1756 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 2004 wrote to memory of 1756 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 2004 wrote to memory of 1756 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 2004 wrote to memory of 1756 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 1756 wrote to memory of 2000 1756 cmd.exe takeown.exe PID 1756 wrote to memory of 2000 1756 cmd.exe takeown.exe PID 1756 wrote to memory of 2000 1756 cmd.exe takeown.exe PID 1756 wrote to memory of 2000 1756 cmd.exe takeown.exe PID 1756 wrote to memory of 744 1756 cmd.exe icacls.exe PID 1756 wrote to memory of 744 1756 cmd.exe icacls.exe PID 1756 wrote to memory of 744 1756 cmd.exe icacls.exe PID 1756 wrote to memory of 744 1756 cmd.exe icacls.exe PID 2004 wrote to memory of 1200 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 2004 wrote to memory of 1200 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 2004 wrote to memory of 1200 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 2004 wrote to memory of 1200 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 1200 wrote to memory of 844 1200 cmd.exe takeown.exe PID 1200 wrote to memory of 844 1200 cmd.exe takeown.exe PID 1200 wrote to memory of 844 1200 cmd.exe takeown.exe PID 1200 wrote to memory of 844 1200 cmd.exe takeown.exe PID 1200 wrote to memory of 616 1200 cmd.exe icacls.exe PID 1200 wrote to memory of 616 1200 cmd.exe icacls.exe PID 1200 wrote to memory of 616 1200 cmd.exe icacls.exe PID 1200 wrote to memory of 616 1200 cmd.exe icacls.exe PID 2004 wrote to memory of 1808 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 2004 wrote to memory of 1808 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 2004 wrote to memory of 1808 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe PID 2004 wrote to memory of 1808 2004 637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe"C:\Users\Admin\AppData\Local\Temp\637fc2260ea3a0d3d0b55953c2ff5bf23674c0fb881e92eb0437edb02906a7ac.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD51391ac37e7f2f0818d37fadce1cec329
SHA10fb505a17893daa666381f72bb2233ae36655378
SHA2565a1275a4b28cf2716531c05483c5b5f87c3e9185ff16ae00953039732cd899f6
SHA512b1265afe6179d77616a51fddba71451c34a70748cceb7da9ef97ca82d69b6d0af064fdb6daf64367535859c59b1d9d1cfb597c97d0f28b403d7e94111988ee27
-
\Users\Admin\AppData\Local\Temp\u7UwruIi.dllFilesize
4.8MB
MD5c6c05e5ebe47d0bc30af7f48aefea124
SHA1b3c9c4a4ac61c8e333221d75e740741ec92f784b
SHA25673ebfba01e135e16740a987f8d963da82835ef4b9da1acbc6d23ba0b2a27f610
SHA512f5a28373bf96aa4a5648ef53c46f887c20401a33525c5745230a79cf9710ef247b80ee13ae5a3d40264d621bd2cfd7dd984ecc1537218a14593b1f5dbc9260c7
-
\Windows\SysWOW64\wshtcpip.dllFilesize
19KB
MD5da88060551ceb258e9e68b200cae73a0
SHA112a8617edf52166841c47aa88b2182bbb713d251
SHA256819c5927a4e94fb9019218224adcf3da50d176ca10409a9d2521227daef4542e
SHA51242bdba9347a867c376dd36f5b505a1f85c242b8b9ce056cc2868440c66cac29a9d5990e15b806008a2ec21ef93c71633a6ef1f9aeb888a3e04fa5375782eb53e
-
memory/616-62-0x0000000000000000-mapping.dmp
-
memory/744-57-0x0000000000000000-mapping.dmp
-
memory/844-61-0x0000000000000000-mapping.dmp
-
memory/1200-60-0x0000000000000000-mapping.dmp
-
memory/1756-55-0x0000000000000000-mapping.dmp
-
memory/1808-67-0x0000000000000000-mapping.dmp
-
memory/2000-56-0x0000000000000000-mapping.dmp
-
memory/2004-58-0x0000000001000000-0x0000000001698000-memory.dmpFilesize
6.6MB
-
memory/2004-65-0x0000000001000000-0x0000000001698000-memory.dmpFilesize
6.6MB
-
memory/2004-66-0x00000000003C0000-0x00000000003E0000-memory.dmpFilesize
128KB
-
memory/2004-64-0x00000000719C1000-0x00000000719C5000-memory.dmpFilesize
16KB
-
memory/2004-59-0x00000000003C0000-0x00000000003E0000-memory.dmpFilesize
128KB
-
memory/2004-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/2004-70-0x0000000001000000-0x0000000001698000-memory.dmpFilesize
6.6MB
-
memory/2004-71-0x0000000010000000-0x00000000105DF000-memory.dmpFilesize
5.9MB