Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    249s
  • max time network
    285s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 00:35

General

  • Target

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe

  • Size

    8.6MB

  • MD5

    551f83e52d985497f7601601d95b85bd

  • SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

  • SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

  • SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • SSDEEP

    98304:J/tgS++cwcaS+/t3S++cwcaS+/tJS++cwcaS+/tcS++cwcaS+/t/tRcwcaS+/tBq:nJAiFVF6JAiFVs6JAiFV

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 15 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 4 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe
    "C:\Users\Admin\AppData\Local\Temp\bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Windows\SysWOW64\notpad.exe
      "C:\Windows\system32\notpad.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Users\Admin\AppData\Local\Temp\tmp240734531.exe
        C:\Users\Admin\AppData\Local\Temp\tmp240734531.exe
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1476
        • C:\Windows\SysWOW64\notpad.exe
          "C:\Windows\system32\notpad.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1776
          • C:\Users\Admin\AppData\Local\Temp\tmp240737609.exe
            C:\Users\Admin\AppData\Local\Temp\tmp240737609.exe
            5⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4292
            • C:\Windows\SysWOW64\notpad.exe
              "C:\Windows\system32\notpad.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1040
              • C:\Users\Admin\AppData\Local\Temp\tmp240792875.exe
                C:\Users\Admin\AppData\Local\Temp\tmp240792875.exe
                7⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies registry class
                PID:4852
              • C:\Users\Admin\AppData\Local\Temp\tmp240793187.exe
                C:\Users\Admin\AppData\Local\Temp\tmp240793187.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4172
                • C:\Users\Admin\AppData\Local\Temp\tmp240793421.exe
                  C:\Users\Admin\AppData\Local\Temp\tmp240793421.exe
                  8⤵
                  • Executes dropped EXE
                  PID:3352
                • C:\Users\Admin\AppData\Local\Temp\tmp240793921.exe
                  C:\Users\Admin\AppData\Local\Temp\tmp240793921.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1456
                  • C:\Users\Admin\AppData\Local\Temp\tmp240820437.exe
                    C:\Users\Admin\AppData\Local\Temp\tmp240820437.exe
                    9⤵
                    • Executes dropped EXE
                    PID:3192
                  • C:\Users\Admin\AppData\Local\Temp\tmp240820593.exe
                    C:\Users\Admin\AppData\Local\Temp\tmp240820593.exe
                    9⤵
                    • Executes dropped EXE
                    PID:4388
          • C:\Users\Admin\AppData\Local\Temp\tmp240738593.exe
            C:\Users\Admin\AppData\Local\Temp\tmp240738593.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4048
            • C:\Users\Admin\AppData\Local\Temp\tmp240739312.exe
              C:\Users\Admin\AppData\Local\Temp\tmp240739312.exe
              6⤵
              • Executes dropped EXE
              PID:2232
            • C:\Users\Admin\AppData\Local\Temp\tmp240791625.exe
              C:\Users\Admin\AppData\Local\Temp\tmp240791625.exe
              6⤵
              • Executes dropped EXE
              PID:4280
      • C:\Users\Admin\AppData\Local\Temp\tmp240735062.exe
        C:\Users\Admin\AppData\Local\Temp\tmp240735062.exe
        3⤵
        • Executes dropped EXE
        PID:3124

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp240734531.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240734531.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240735062.exe

    Filesize

    162KB

    MD5

    e92d3a824a0578a50d2dd81b5060145f

    SHA1

    50ef7c645fd5cbb95d50fbaddf6213800f9296ec

    SHA256

    87f53bc444c05230ce439dbb127c03f2e374067d6fb08e91c834371fd9ecf661

    SHA512

    40d0ac6fa5a424b099923fcdb465e9a2f44569af1c75cf05323315a8720517316a7e8627be248cff3a83382fb6db1cf026161f627a39bc1908e63f67a34c0fd5

  • C:\Users\Admin\AppData\Local\Temp\tmp240737609.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240737609.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240738593.exe

    Filesize

    8.8MB

    MD5

    50745b00ff2b3c0e60b015756c5987c4

    SHA1

    5899d28c3c20dd2cde98aabed45ba796a2994f23

    SHA256

    e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1

    SHA512

    87370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f

  • C:\Users\Admin\AppData\Local\Temp\tmp240738593.exe

    Filesize

    8.8MB

    MD5

    50745b00ff2b3c0e60b015756c5987c4

    SHA1

    5899d28c3c20dd2cde98aabed45ba796a2994f23

    SHA256

    e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1

    SHA512

    87370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f

  • C:\Users\Admin\AppData\Local\Temp\tmp240739312.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240739312.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240791625.exe

    Filesize

    162KB

    MD5

    e92d3a824a0578a50d2dd81b5060145f

    SHA1

    50ef7c645fd5cbb95d50fbaddf6213800f9296ec

    SHA256

    87f53bc444c05230ce439dbb127c03f2e374067d6fb08e91c834371fd9ecf661

    SHA512

    40d0ac6fa5a424b099923fcdb465e9a2f44569af1c75cf05323315a8720517316a7e8627be248cff3a83382fb6db1cf026161f627a39bc1908e63f67a34c0fd5

  • C:\Users\Admin\AppData\Local\Temp\tmp240792875.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240792875.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240793187.exe

    Filesize

    17.5MB

    MD5

    41486a32b10b383a6843dc728a556c55

    SHA1

    2a567ffb7f6d0c9ba6b85ee86b71f176acce4a3c

    SHA256

    428816fcd1dc36b389441b686f0b2c27f97555d13b0940def5bdc6f390e8d237

    SHA512

    bcd68380d3335eb8413d3ed3fd104e51d4d421f38b8648c1d04a679e1b5d64e918e7545fa362902b52d27698a42fe6e640319f356ca428b1f3b0275160d37ec6

  • C:\Users\Admin\AppData\Local\Temp\tmp240793187.exe

    Filesize

    17.5MB

    MD5

    41486a32b10b383a6843dc728a556c55

    SHA1

    2a567ffb7f6d0c9ba6b85ee86b71f176acce4a3c

    SHA256

    428816fcd1dc36b389441b686f0b2c27f97555d13b0940def5bdc6f390e8d237

    SHA512

    bcd68380d3335eb8413d3ed3fd104e51d4d421f38b8648c1d04a679e1b5d64e918e7545fa362902b52d27698a42fe6e640319f356ca428b1f3b0275160d37ec6

  • C:\Users\Admin\AppData\Local\Temp\tmp240793421.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240793421.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240793921.exe

    Filesize

    8.8MB

    MD5

    50745b00ff2b3c0e60b015756c5987c4

    SHA1

    5899d28c3c20dd2cde98aabed45ba796a2994f23

    SHA256

    e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1

    SHA512

    87370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f

  • C:\Users\Admin\AppData\Local\Temp\tmp240793921.exe

    Filesize

    8.8MB

    MD5

    50745b00ff2b3c0e60b015756c5987c4

    SHA1

    5899d28c3c20dd2cde98aabed45ba796a2994f23

    SHA256

    e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1

    SHA512

    87370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f

  • C:\Users\Admin\AppData\Local\Temp\tmp240820437.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240820437.exe

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Users\Admin\AppData\Local\Temp\tmp240820593.exe

    Filesize

    162KB

    MD5

    e92d3a824a0578a50d2dd81b5060145f

    SHA1

    50ef7c645fd5cbb95d50fbaddf6213800f9296ec

    SHA256

    87f53bc444c05230ce439dbb127c03f2e374067d6fb08e91c834371fd9ecf661

    SHA512

    40d0ac6fa5a424b099923fcdb465e9a2f44569af1c75cf05323315a8720517316a7e8627be248cff3a83382fb6db1cf026161f627a39bc1908e63f67a34c0fd5

  • C:\Windows\SysWOW64\fsb.stb

    Filesize

    10KB

    MD5

    280b12e4717c3a7cf2c39561b30bc9e6

    SHA1

    8bf777a28c25793357ce8305bf8b01987bc4d9f2

    SHA256

    f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc

    SHA512

    861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7

  • C:\Windows\SysWOW64\fsb.stb

    Filesize

    10KB

    MD5

    280b12e4717c3a7cf2c39561b30bc9e6

    SHA1

    8bf777a28c25793357ce8305bf8b01987bc4d9f2

    SHA256

    f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc

    SHA512

    861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7

  • C:\Windows\SysWOW64\fsb.stb

    Filesize

    10KB

    MD5

    280b12e4717c3a7cf2c39561b30bc9e6

    SHA1

    8bf777a28c25793357ce8305bf8b01987bc4d9f2

    SHA256

    f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc

    SHA512

    861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7

  • C:\Windows\SysWOW64\fsb.tmp

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Windows\SysWOW64\fsb.tmp

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Windows\SysWOW64\fsb.tmp

    Filesize

    8.6MB

    MD5

    551f83e52d985497f7601601d95b85bd

    SHA1

    1303d690f2089a91f5669e094ea2562e101e3b69

    SHA256

    bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce

    SHA512

    6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2

  • C:\Windows\SysWOW64\notpad.exe

    Filesize

    17.5MB

    MD5

    41486a32b10b383a6843dc728a556c55

    SHA1

    2a567ffb7f6d0c9ba6b85ee86b71f176acce4a3c

    SHA256

    428816fcd1dc36b389441b686f0b2c27f97555d13b0940def5bdc6f390e8d237

    SHA512

    bcd68380d3335eb8413d3ed3fd104e51d4d421f38b8648c1d04a679e1b5d64e918e7545fa362902b52d27698a42fe6e640319f356ca428b1f3b0275160d37ec6

  • C:\Windows\SysWOW64\notpad.exe

    Filesize

    17.5MB

    MD5

    41486a32b10b383a6843dc728a556c55

    SHA1

    2a567ffb7f6d0c9ba6b85ee86b71f176acce4a3c

    SHA256

    428816fcd1dc36b389441b686f0b2c27f97555d13b0940def5bdc6f390e8d237

    SHA512

    bcd68380d3335eb8413d3ed3fd104e51d4d421f38b8648c1d04a679e1b5d64e918e7545fa362902b52d27698a42fe6e640319f356ca428b1f3b0275160d37ec6

  • C:\Windows\SysWOW64\notpad.exe

    Filesize

    8.8MB

    MD5

    50745b00ff2b3c0e60b015756c5987c4

    SHA1

    5899d28c3c20dd2cde98aabed45ba796a2994f23

    SHA256

    e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1

    SHA512

    87370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f

  • C:\Windows\SysWOW64\notpad.exe

    Filesize

    8.8MB

    MD5

    50745b00ff2b3c0e60b015756c5987c4

    SHA1

    5899d28c3c20dd2cde98aabed45ba796a2994f23

    SHA256

    e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1

    SHA512

    87370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f

  • C:\Windows\SysWOW64\notpad.exe

    Filesize

    26.1MB

    MD5

    a8b967c7a389d5a61db8c935f19c1a8c

    SHA1

    6ba3a98c38564bc9d499506493aeacf5853bf2e3

    SHA256

    10ed8841a1ab69f48b0dbcbb92ba2d392964ce6c9cef78cb3807728792fbfe7a

    SHA512

    d2a2907f5584992558eb31d89a692216695940bd4473b4249e99b94c1a55d3e63a566da1d1739fdb0c6172790331cfd318e7cecaa80a03aff4db23a7be4297e4

  • C:\Windows\SysWOW64\notpad.exe

    Filesize

    26.1MB

    MD5

    a8b967c7a389d5a61db8c935f19c1a8c

    SHA1

    6ba3a98c38564bc9d499506493aeacf5853bf2e3

    SHA256

    10ed8841a1ab69f48b0dbcbb92ba2d392964ce6c9cef78cb3807728792fbfe7a

    SHA512

    d2a2907f5584992558eb31d89a692216695940bd4473b4249e99b94c1a55d3e63a566da1d1739fdb0c6172790331cfd318e7cecaa80a03aff4db23a7be4297e4

  • memory/1040-175-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1456-191-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1456-185-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1568-143-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1568-135-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1776-147-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1776-156-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4048-163-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4048-157-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4172-180-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4172-177-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4172-184-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB