Analysis
-
max time kernel
169s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 05:30
Static task
static1
Behavioral task
behavioral1
Sample
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe
Resource
win7-20220812-en
General
-
Target
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe
-
Size
353KB
-
MD5
e1c977ff07875280a8d14f69546c5a0b
-
SHA1
390db57eb12b8bee5bc4e71f9d4a0a647b09cb71
-
SHA256
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696
-
SHA512
593d742d51e68da5f3852ca8f7cb5bfbf9bb546e594052ec72843f0061821d010c0b7781f4e513003dc97d0919f25a76162e3a10fe026a11c6eb21ba48e2bcd8
-
SSDEEP
6144:OxoXf3kubIutG5aiN7WPLo5OVFbIqn2ttsLqfcrSEgdGHDskf588g/PNsx3MmfGL:OxoXPkub7tHiNKTueLqfcrSEgUjscY3L
Malware Config
Extracted
cybergate
v1.07.5
2
84.120.59.104:4222
90.162.61.13:4332
84.120.55.87:4112
90.162.61.78:4442
leskieroatodos.no-ip.org:4552
L0V2CPUR4CU75S
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
acrobat
-
install_file
adobe.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
borito1010
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\adobe\\acrobat\\adobe.exe" 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\adobe\\acrobat\\adobe.exe" 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE -
Executes dropped EXE 2 IoCs
Processes:
adobe.exeadobe.EXEpid process 4984 adobe.exe 2008 adobe.EXE -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXEexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{8O01082G-OJJV-D460-NHL0-KARW7LP3QU6T} 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8O01082G-OJJV-D460-NHL0-KARW7LP3QU6T}\StubPath = "c:\\adobe\\acrobat\\adobe.exe Restart" 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{8O01082G-OJJV-D460-NHL0-KARW7LP3QU6T} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8O01082G-OJJV-D460-NHL0-KARW7LP3QU6T}\StubPath = "c:\\adobe\\acrobat\\adobe.exe" explorer.exe -
Processes:
resource yara_rule behavioral2/memory/2196-149-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/2068-157-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/2196-154-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/2068-160-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/2196-163-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral2/memory/3476-166-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral2/memory/3476-168-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral2/memory/3476-189-0x00000000104F0000-0x0000000010555000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXEdescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\adobe\\acrobat\\adobe.exe" 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\adobe\\acrobat\\adobe.exe" 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE -
Suspicious use of SetThreadContext 2 IoCs
Processes:
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exeadobe.exedescription pid process target process PID 4968 set thread context of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4984 set thread context of 2008 4984 adobe.exe adobe.EXE -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXEadobe.EXEpid process 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE 2008 adobe.EXE 2008 adobe.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 3476 explorer.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
explorer.exeexplorer.exedescription pid process Token: SeBackupPrivilege 2068 explorer.exe Token: SeRestorePrivilege 2068 explorer.exe Token: SeBackupPrivilege 3476 explorer.exe Token: SeRestorePrivilege 3476 explorer.exe Token: SeDebugPrivilege 3476 explorer.exe Token: SeDebugPrivilege 3476 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXEpid process 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exeadobe.exepid process 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 4984 adobe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXEdescription pid process target process PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 4968 wrote to memory of 2196 4968 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE PID 2196 wrote to memory of 2212 2196 8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE Explorer.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe"C:\Users\Admin\AppData\Local\Temp\8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696.EXE
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\adobe\acrobat\adobe.exe"C:\adobe\acrobat\adobe.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\adobe\acrobat\adobe.EXE
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
225KB
MD572bb982dcd2a9050eb329fb4859efcc6
SHA1faef850a1434a202d73f7b1a04c0fd4a3e93d2d7
SHA2569e1bb20c26f23d5c22a2d6c8fd7af0c673ab30a0864ca9907300e5397eb55354
SHA5122adc42f77fdbcf9250e9c2a1a1f7a0370d0d5a155c3cb46d3711a2cf9ed0f2296b040b44205348cf2888a89fbd224ed92ed7dbfdeeffc62cb8710fbd3ebb22dd
-
C:\adobe\acrobat\adobe.exeFilesize
353KB
MD5e1c977ff07875280a8d14f69546c5a0b
SHA1390db57eb12b8bee5bc4e71f9d4a0a647b09cb71
SHA2568cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696
SHA512593d742d51e68da5f3852ca8f7cb5bfbf9bb546e594052ec72843f0061821d010c0b7781f4e513003dc97d0919f25a76162e3a10fe026a11c6eb21ba48e2bcd8
-
C:\adobe\acrobat\adobe.exeFilesize
353KB
MD5e1c977ff07875280a8d14f69546c5a0b
SHA1390db57eb12b8bee5bc4e71f9d4a0a647b09cb71
SHA2568cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696
SHA512593d742d51e68da5f3852ca8f7cb5bfbf9bb546e594052ec72843f0061821d010c0b7781f4e513003dc97d0919f25a76162e3a10fe026a11c6eb21ba48e2bcd8
-
\??\c:\adobe\acrobat\adobe.exeFilesize
353KB
MD5e1c977ff07875280a8d14f69546c5a0b
SHA1390db57eb12b8bee5bc4e71f9d4a0a647b09cb71
SHA2568cf5480e62fdc25579f8b77b15945a8df485e7f741c8d0982ce43962eba18696
SHA512593d742d51e68da5f3852ca8f7cb5bfbf9bb546e594052ec72843f0061821d010c0b7781f4e513003dc97d0919f25a76162e3a10fe026a11c6eb21ba48e2bcd8
-
memory/2008-188-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2008-187-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2008-186-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2008-181-0x0000000000000000-mapping.dmp
-
memory/2068-153-0x0000000000000000-mapping.dmp
-
memory/2068-160-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/2068-157-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/2196-143-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2196-163-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/2196-146-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2196-147-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2196-149-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/2196-144-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2196-142-0x0000000000000000-mapping.dmp
-
memory/2196-154-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/2196-167-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/3476-189-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/3476-168-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/3476-166-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/3476-162-0x0000000000000000-mapping.dmp
-
memory/4968-132-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4968-139-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/4968-140-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/4968-141-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/4968-137-0x00000000006D0000-0x00000000006E0000-memory.dmpFilesize
64KB
-
memory/4968-138-0x00000000023D0000-0x00000000023E0000-memory.dmpFilesize
64KB
-
memory/4968-145-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4968-133-0x0000000000540000-0x0000000000550000-memory.dmpFilesize
64KB
-
memory/4968-134-0x00000000006A0000-0x00000000006B0000-memory.dmpFilesize
64KB
-
memory/4968-135-0x00000000006B0000-0x00000000006C0000-memory.dmpFilesize
64KB
-
memory/4968-136-0x00000000006C0000-0x00000000006D0000-memory.dmpFilesize
64KB
-
memory/4984-169-0x0000000000000000-mapping.dmp
-
memory/4984-177-0x0000000000530000-0x0000000000540000-memory.dmpFilesize
64KB
-
memory/4984-178-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/4984-179-0x0000000002900000-0x0000000002910000-memory.dmpFilesize
64KB
-
memory/4984-180-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4984-176-0x0000000000520000-0x0000000000530000-memory.dmpFilesize
64KB
-
memory/4984-175-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4984-184-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4984-174-0x00000000004F0000-0x0000000000500000-memory.dmpFilesize
64KB
-
memory/4984-173-0x00000000004D0000-0x00000000004E0000-memory.dmpFilesize
64KB
-
memory/4984-172-0x00000000004B0000-0x00000000004C0000-memory.dmpFilesize
64KB
-
memory/4984-171-0x00000000004A0000-0x00000000004B0000-memory.dmpFilesize
64KB