Analysis
-
max time kernel
1802s -
max time network
1698s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2023 15:38
Static task
static1
Behavioral task
behavioral1
Sample
Agreement_138439_Mar4.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
Agreement_138439_Mar4.xll
Resource
win10v2004-20230220-en
General
-
Target
Agreement_138439a_Mar4.xll
-
Size
2.3MB
-
MD5
2c52dd0679d202b20f5252272853586f
-
SHA1
f35b6fe2bb2138a532ad8d9033a388eeb38f2559
-
SHA256
954df94e3c3fd61d04ae0f3e3afdcab2861e0c5810b44f9bcb6a486fd30f5c3f
-
SHA512
a2dc8dc26e29388ee4480140ac4131eb84fd6c1cc895baa3de22a7f14292fb18536e2cc5bb34d54bf1190f70b3bdec668099a73b051a262ed4782dd3b431a971
-
SSDEEP
49152:Wjryd3EfessB2KEAQ3PlAEIZ6QqrONloCt4nnM+DoRDPOjYvf9FB:aryd028KEl39AdZ/6y+9M7RDPZB
Malware Config
Extracted
Extracted
qakbot
404.266
obama242
1678805546
92.239.81.124:443
176.202.46.81:443
2.49.58.47:2222
86.225.214.138:2222
74.66.134.24:443
213.31.90.183:2222
12.172.173.82:50001
202.187.87.178:995
70.53.96.223:995
92.154.45.81:2222
186.64.67.54:443
81.158.112.20:2222
190.191.35.122:443
68.173.170.110:8443
12.172.173.82:993
98.145.23.67:443
12.172.173.82:22
37.186.55.60:2222
84.216.198.124:6881
73.161.176.218:443
94.30.98.134:32100
78.196.246.32:443
12.172.173.82:995
88.122.133.88:32100
173.18.126.3:443
201.244.108.183:995
24.178.201.230:2222
76.27.40.189:443
151.65.134.135:443
197.14.148.149:443
197.244.108.123:443
201.137.185.109:443
86.130.9.213:2222
190.75.139.66:2222
213.67.255.57:2222
90.104.22.28:2222
189.222.53.217:443
122.184.143.84:443
92.159.173.52:2222
70.121.198.103:2078
91.68.227.219:443
86.236.114.212:2222
80.12.88.148:2222
178.175.187.254:443
73.36.196.11:443
47.196.225.236:443
65.95.49.237:2222
12.172.173.82:2087
184.176.35.223:2222
186.48.181.17:995
2.14.105.160:2222
208.180.17.32:2222
190.218.125.145:443
109.11.175.42:2222
23.251.92.171:2222
196.70.212.80:443
75.156.125.215:995
184.189.41.80:443
31.48.18.52:443
103.12.133.134:2222
70.51.152.61:2222
47.203.229.168:443
104.35.24.154:443
190.28.116.106:443
92.154.17.149:2222
103.169.83.89:443
86.169.103.3:443
92.27.86.48:2222
92.1.170.110:995
183.87.163.165:443
85.241.180.94:443
76.170.252.153:995
92.20.204.198:2222
103.141.50.102:995
81.229.117.95:2222
50.68.204.71:995
47.34.30.133:443
173.178.151.233:443
47.16.77.194:2222
83.92.85.93:443
76.80.180.154:995
67.70.23.222:2222
24.117.237.157:443
35.143.97.145:995
87.202.101.164:50000
64.237.245.195:443
103.231.216.238:443
74.93.148.97:995
103.71.21.107:443
71.65.145.108:443
12.172.173.82:465
72.80.7.6:50003
184.153.132.82:443
86.178.33.20:2222
94.200.183.66:2222
70.55.187.152:2222
98.159.33.25:443
136.35.241.159:443
24.187.145.201:2222
72.88.245.71:443
65.94.87.200:2222
184.176.110.61:61202
49.245.82.178:2222
12.172.173.82:32101
46.10.198.134:443
84.35.26.14:995
103.252.7.231:443
187.199.103.21:32103
139.5.239.14:443
202.142.98.62:443
27.109.19.90:2078
86.190.223.11:2222
75.143.236.149:443
50.68.204.71:993
91.169.12.198:32100
88.126.94.4:50000
24.239.69.244:443
12.172.173.82:21
174.104.184.149:443
116.72.250.18:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exeschtasks.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1936 2240 cmd.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1336 2240 schtasks.exe EXCEL.EXE -
Loads dropped DLL 5 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exerundll32.exepid process 2240 EXCEL.EXE 2240 EXCEL.EXE 3332 rundll32.exe 4404 rundll32.exe 1092 rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1624 ipconfig.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2240 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exewermgr.exepid process 3332 rundll32.exe 3332 rundll32.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe 3048 wermgr.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
rundll32.exerundll32.exerundll32.exepid process 3332 rundll32.exe 4404 rundll32.exe 1092 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
whoami.exemsiexec.exedescription pid process Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeDebugPrivilege 4304 whoami.exe Token: SeSecurityPrivilege 4760 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 2240 EXCEL.EXE 2240 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE 2240 EXCEL.EXE -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
EXCEL.EXEcmd.exerundll32.exerundll32.execmd.EXErundll32.exerundll32.exewermgr.execmd.EXErundll32.exerundll32.exedescription pid process target process PID 2240 wrote to memory of 1936 2240 EXCEL.EXE cmd.exe PID 2240 wrote to memory of 1936 2240 EXCEL.EXE cmd.exe PID 2240 wrote to memory of 1336 2240 EXCEL.EXE schtasks.exe PID 2240 wrote to memory of 1336 2240 EXCEL.EXE schtasks.exe PID 1936 wrote to memory of 2596 1936 cmd.exe rundll32.exe PID 1936 wrote to memory of 2596 1936 cmd.exe rundll32.exe PID 2596 wrote to memory of 3332 2596 rundll32.exe rundll32.exe PID 2596 wrote to memory of 3332 2596 rundll32.exe rundll32.exe PID 2596 wrote to memory of 3332 2596 rundll32.exe rundll32.exe PID 3332 wrote to memory of 3048 3332 rundll32.exe wermgr.exe PID 3332 wrote to memory of 3048 3332 rundll32.exe wermgr.exe PID 3332 wrote to memory of 3048 3332 rundll32.exe wermgr.exe PID 3332 wrote to memory of 3048 3332 rundll32.exe wermgr.exe PID 3332 wrote to memory of 3048 3332 rundll32.exe wermgr.exe PID 1144 wrote to memory of 952 1144 cmd.EXE rundll32.exe PID 1144 wrote to memory of 952 1144 cmd.EXE rundll32.exe PID 952 wrote to memory of 4404 952 rundll32.exe rundll32.exe PID 952 wrote to memory of 4404 952 rundll32.exe rundll32.exe PID 952 wrote to memory of 4404 952 rundll32.exe rundll32.exe PID 4404 wrote to memory of 5056 4404 rundll32.exe wermgr.exe PID 4404 wrote to memory of 5056 4404 rundll32.exe wermgr.exe PID 4404 wrote to memory of 5056 4404 rundll32.exe wermgr.exe PID 4404 wrote to memory of 5056 4404 rundll32.exe wermgr.exe PID 4404 wrote to memory of 5056 4404 rundll32.exe wermgr.exe PID 3048 wrote to memory of 1624 3048 wermgr.exe ipconfig.exe PID 3048 wrote to memory of 1624 3048 wermgr.exe ipconfig.exe PID 3048 wrote to memory of 1624 3048 wermgr.exe ipconfig.exe PID 3048 wrote to memory of 4304 3048 wermgr.exe whoami.exe PID 3048 wrote to memory of 4304 3048 wermgr.exe whoami.exe PID 3048 wrote to memory of 4304 3048 wermgr.exe whoami.exe PID 3280 wrote to memory of 536 3280 cmd.EXE rundll32.exe PID 3280 wrote to memory of 536 3280 cmd.EXE rundll32.exe PID 536 wrote to memory of 1092 536 rundll32.exe rundll32.exe PID 536 wrote to memory of 1092 536 rundll32.exe rundll32.exe PID 536 wrote to memory of 1092 536 rundll32.exe rundll32.exe PID 1092 wrote to memory of 1080 1092 rundll32.exe wermgr.exe PID 1092 wrote to memory of 1080 1092 rundll32.exe wermgr.exe PID 1092 wrote to memory of 1080 1092 rundll32.exe wermgr.exe PID 1092 wrote to memory of 1080 1092 rundll32.exe wermgr.exe PID 1092 wrote to memory of 1080 1092 rundll32.exe wermgr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Agreement_138439a_Mar4.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c type "C:\Users\Admin\AppData\Roaming\1.dat" "C:\Users\Admin\AppData\Roaming\2.dat" > "C:\Users\Admin\AppData\Roaming\3.dat" && rundll32.exe "C:\Users\Admin\AppData\Roaming\3.dat",xlAutoOpen2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\3.dat",xlAutoOpen3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\3.dat",xlAutoOpen4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all6⤵
- Gathers network information
-
C:\Windows\SysWOW64\whoami.exewhoami /all6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /ST 15:41 /SC ONCE /tr "cmd /c type "C:\Users\Admin\AppData\Roaming\1.dat" "C:\Users\Admin\AppData\Roaming\2.dat" > "C:\Users\Admin\AppData\Roaming\3.dat" && rundll32.exe "C:\Users\Admin\AppData\Roaming\3.dat",xlAutoOpen" /tn "QQQ" /Z /ET 15:522⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c type C:\Users\Admin\AppData\Roaming\1.dat C:\Users\Admin\AppData\Roaming\2.dat > C:\Users\Admin\AppData\Roaming\3.dat && rundll32.exe C:\Users\Admin\AppData\Roaming\3.dat,xlAutoOpen1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Roaming\3.dat,xlAutoOpen2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Roaming\3.dat,xlAutoOpen3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c type C:\Users\Admin\AppData\Roaming\1.dat C:\Users\Admin\AppData\Roaming\2.dat > C:\Users\Admin\AppData\Roaming\3.dat && rundll32.exe C:\Users\Admin\AppData\Roaming\3.dat,xlAutoOpen1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Roaming\3.dat,xlAutoOpen2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Roaming\3.dat,xlAutoOpen3⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Agreement_138439a_Mar4.xllFilesize
2.3MB
MD52c52dd0679d202b20f5252272853586f
SHA1f35b6fe2bb2138a532ad8d9033a388eeb38f2559
SHA256954df94e3c3fd61d04ae0f3e3afdcab2861e0c5810b44f9bcb6a486fd30f5c3f
SHA512a2dc8dc26e29388ee4480140ac4131eb84fd6c1cc895baa3de22a7f14292fb18536e2cc5bb34d54bf1190f70b3bdec668099a73b051a262ed4782dd3b431a971
-
C:\Users\Admin\AppData\Local\Temp\Agreement_138439a_Mar4.xllFilesize
2.3MB
MD52c52dd0679d202b20f5252272853586f
SHA1f35b6fe2bb2138a532ad8d9033a388eeb38f2559
SHA256954df94e3c3fd61d04ae0f3e3afdcab2861e0c5810b44f9bcb6a486fd30f5c3f
SHA512a2dc8dc26e29388ee4480140ac4131eb84fd6c1cc895baa3de22a7f14292fb18536e2cc5bb34d54bf1190f70b3bdec668099a73b051a262ed4782dd3b431a971
-
C:\Users\Admin\AppData\Roaming\1.datFilesize
1024B
MD584a765f683860eedbb344a9a1aa0c883
SHA1f797c21a9e87eddf89f4894982d88741b9cbd56f
SHA256b119a36f1c4c98e6a5e2171fda99dd5ab552d73e1aa6d4696f90ef53c346ad17
SHA5125e12c9139315c507b20246d97e6cf693add400dab72431aa7adb62aeb66303defbba724e1b14f2dbc4c04e00a0be953a1fb54c87614f45b0ec35bc9b4170cc9e
-
C:\Users\Admin\AppData\Roaming\2.datFilesize
588KB
MD55d450b19aa1a0fd9ae4103fa84d5d09b
SHA1ece9e1d7edd90ff23e35a58ce1fda92ae64bcd3a
SHA2563d27c65ceff3e817f9d1c1f81b1151f32c13d42eef73da41eeae4c4e426f885c
SHA51248d8cd6da757843903706a5ec8cbddc4531ab4c0d6dfae5032c76b21ce5dad73522082f66be606afce3222fdb6a3e0250d31e188b9c237c4b94b0e996a30c403
-
C:\Users\Admin\AppData\Roaming\3.datFilesize
589KB
MD5ff58f9cf0740aead678d9e36c0782894
SHA15c2b6dd776b097dc0bff7a60361a4b026b19268d
SHA256b699dc3e5b1de51efb4e498cd2f1c7e9d3d08810ee8673c215f2aab0618e119c
SHA512a10c83ac5c47e316b4482d8f68e2a42973c055e39aaf5092e88abd58b45e60cb25a85f674a3328a490e8f06157a786600c56ce0af45b02b4743cdae590cdc9e9
-
C:\Users\Admin\AppData\Roaming\3.datFilesize
589KB
MD5ff58f9cf0740aead678d9e36c0782894
SHA15c2b6dd776b097dc0bff7a60361a4b026b19268d
SHA256b699dc3e5b1de51efb4e498cd2f1c7e9d3d08810ee8673c215f2aab0618e119c
SHA512a10c83ac5c47e316b4482d8f68e2a42973c055e39aaf5092e88abd58b45e60cb25a85f674a3328a490e8f06157a786600c56ce0af45b02b4743cdae590cdc9e9
-
C:\Users\Admin\AppData\Roaming\3.datFilesize
589KB
MD5ff58f9cf0740aead678d9e36c0782894
SHA15c2b6dd776b097dc0bff7a60361a4b026b19268d
SHA256b699dc3e5b1de51efb4e498cd2f1c7e9d3d08810ee8673c215f2aab0618e119c
SHA512a10c83ac5c47e316b4482d8f68e2a42973c055e39aaf5092e88abd58b45e60cb25a85f674a3328a490e8f06157a786600c56ce0af45b02b4743cdae590cdc9e9
-
C:\Users\Admin\AppData\Roaming\3.datFilesize
589KB
MD5ff58f9cf0740aead678d9e36c0782894
SHA15c2b6dd776b097dc0bff7a60361a4b026b19268d
SHA256b699dc3e5b1de51efb4e498cd2f1c7e9d3d08810ee8673c215f2aab0618e119c
SHA512a10c83ac5c47e316b4482d8f68e2a42973c055e39aaf5092e88abd58b45e60cb25a85f674a3328a490e8f06157a786600c56ce0af45b02b4743cdae590cdc9e9
-
C:\Users\Admin\AppData\Roaming\3.datFilesize
589KB
MD5ff58f9cf0740aead678d9e36c0782894
SHA15c2b6dd776b097dc0bff7a60361a4b026b19268d
SHA256b699dc3e5b1de51efb4e498cd2f1c7e9d3d08810ee8673c215f2aab0618e119c
SHA512a10c83ac5c47e316b4482d8f68e2a42973c055e39aaf5092e88abd58b45e60cb25a85f674a3328a490e8f06157a786600c56ce0af45b02b4743cdae590cdc9e9
-
C:\Users\Admin\AppData\Roaming\3.datFilesize
589KB
MD5ff58f9cf0740aead678d9e36c0782894
SHA15c2b6dd776b097dc0bff7a60361a4b026b19268d
SHA256b699dc3e5b1de51efb4e498cd2f1c7e9d3d08810ee8673c215f2aab0618e119c
SHA512a10c83ac5c47e316b4482d8f68e2a42973c055e39aaf5092e88abd58b45e60cb25a85f674a3328a490e8f06157a786600c56ce0af45b02b4743cdae590cdc9e9
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1080-246-0x0000000000140000-0x0000000000163000-memory.dmpFilesize
140KB
-
memory/1080-248-0x0000000000140000-0x0000000000163000-memory.dmpFilesize
140KB
-
memory/1092-244-0x0000000000800000-0x0000000000823000-memory.dmpFilesize
140KB
-
memory/1092-247-0x0000000000800000-0x0000000000823000-memory.dmpFilesize
140KB
-
memory/1092-245-0x0000000000800000-0x0000000000823000-memory.dmpFilesize
140KB
-
memory/2240-139-0x00007FFDC0B70000-0x00007FFDC0B80000-memory.dmpFilesize
64KB
-
memory/2240-154-0x000001BD80230000-0x000001BD802FF000-memory.dmpFilesize
828KB
-
memory/2240-156-0x000001BD80300000-0x000001BD803BB000-memory.dmpFilesize
748KB
-
memory/2240-138-0x00007FFDC0B70000-0x00007FFDC0B80000-memory.dmpFilesize
64KB
-
memory/2240-133-0x00007FFDC3390000-0x00007FFDC33A0000-memory.dmpFilesize
64KB
-
memory/2240-137-0x00007FFDC3390000-0x00007FFDC33A0000-memory.dmpFilesize
64KB
-
memory/2240-136-0x00007FFDC3390000-0x00007FFDC33A0000-memory.dmpFilesize
64KB
-
memory/2240-135-0x00007FFDC3390000-0x00007FFDC33A0000-memory.dmpFilesize
64KB
-
memory/2240-134-0x00007FFDC3390000-0x00007FFDC33A0000-memory.dmpFilesize
64KB
-
memory/2240-172-0x000001BD80300000-0x000001BD803BB000-memory.dmpFilesize
748KB
-
memory/3048-166-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-240-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-171-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-286-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-285-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-169-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-284-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-283-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-280-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-187-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-188-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-190-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-202-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-203-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-205-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-206-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-207-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-208-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-215-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-216-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-217-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-223-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-226-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-227-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-228-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-229-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-230-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-236-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-239-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-175-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-168-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-167-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-165-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-277-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-276-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-275-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-274-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-249-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-250-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-251-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-260-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-263-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-264-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-265-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-266-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-267-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-270-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3048-273-0x00000000005B0000-0x00000000005D3000-memory.dmpFilesize
140KB
-
memory/3332-158-0x0000000000D80000-0x0000000000DA3000-memory.dmpFilesize
140KB
-
memory/3332-159-0x0000000000B20000-0x0000000000B51000-memory.dmpFilesize
196KB
-
memory/3332-160-0x0000000000D80000-0x0000000000DA3000-memory.dmpFilesize
140KB
-
memory/3332-164-0x0000000000D80000-0x0000000000DA3000-memory.dmpFilesize
140KB
-
memory/4404-185-0x0000000000800000-0x0000000000823000-memory.dmpFilesize
140KB
-
memory/4404-182-0x0000000000800000-0x0000000000823000-memory.dmpFilesize
140KB
-
memory/4404-181-0x0000000000800000-0x0000000000823000-memory.dmpFilesize
140KB
-
memory/5056-186-0x0000000000840000-0x0000000000863000-memory.dmpFilesize
140KB
-
memory/5056-184-0x0000000000840000-0x0000000000863000-memory.dmpFilesize
140KB