Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 00:50
Static task
static1
General
-
Target
155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe
-
Size
1.0MB
-
MD5
5951334654a8769c74441424496f023b
-
SHA1
152056458b668e32e931f2068dca862faaa4b662
-
SHA256
155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc
-
SHA512
008d103b22aedffc16926b1cb04c7550dca2cd013c4984ef0a66512339f4edb207df6dc6038a99a6e6e1c308985abb151b115219fa1f9252e5b751ef832acd13
-
SSDEEP
24576:wysikbY8Ay96QUpSSt3BqURvQL5249g0V+t:3sjY8z6zpftRhoG0V+
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
rotik
193.233.20.32:4125
-
auth_value
74863478ae154e921eb729354d2bb4bd
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
aurora
212.87.204.93:8081
Extracted
redline
whitedoc
81.161.229.143:45156
-
auth_value
2020d22aaa2ecafa1b12e00dfcffae03
Signatures
-
Processes:
v0825Hx.exetz0331.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v0825Hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v0825Hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v0825Hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz0331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz0331.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v0825Hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz0331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v0825Hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v0825Hx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz0331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz0331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz0331.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/3092-209-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-210-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-212-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-214-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-216-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-218-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-220-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-223-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-227-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-228-0x0000000004860000-0x0000000004870000-memory.dmp family_redline behavioral1/memory/3092-232-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-230-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-234-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-236-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-238-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-240-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-242-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-244-0x0000000007730000-0x000000000776F000-memory.dmp family_redline behavioral1/memory/3092-246-0x0000000007730000-0x000000000776F000-memory.dmp family_redline -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
76783.exey77Pt22.exelegenda.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation 76783.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation y77Pt22.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation legenda.exe -
Executes dropped EXE 16 IoCs
Processes:
zap5763.exezap6486.exezap4803.exetz0331.exev0825Hx.exew05pb28.exexySZA53.exey77Pt22.exelegenda.exe76783.exeBlaubok.exeagent.exeBlaubok.exeBlaubok.exebuild.exelegenda.exepid process 1460 zap5763.exe 448 zap6486.exe 3152 zap4803.exe 1060 tz0331.exe 4260 v0825Hx.exe 3092 w05pb28.exe 3468 xySZA53.exe 4912 y77Pt22.exe 2256 legenda.exe 3628 76783.exe 1504 Blaubok.exe 1076 agent.exe 4232 Blaubok.exe 1852 Blaubok.exe 412 build.exe 2488 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4532 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz0331.exev0825Hx.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz0331.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v0825Hx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v0825Hx.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exezap5763.exezap6486.exezap4803.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap5763.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap5763.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap6486.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap6486.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap4803.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap4803.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
Blaubok.exe76783.exedescription pid process target process PID 1504 set thread context of 1852 1504 Blaubok.exe Blaubok.exe PID 3628 set thread context of 4916 3628 76783.exe InstallUtil.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4292 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3520 4260 WerFault.exe v0825Hx.exe 3556 3092 WerFault.exe w05pb28.exe 1396 1852 WerFault.exe Blaubok.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tz0331.exev0825Hx.exew05pb28.exexySZA53.exe76783.exepid process 1060 tz0331.exe 1060 tz0331.exe 4260 v0825Hx.exe 4260 v0825Hx.exe 3092 w05pb28.exe 3092 w05pb28.exe 3468 xySZA53.exe 3468 xySZA53.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe 3628 76783.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
tz0331.exev0825Hx.exew05pb28.exexySZA53.exe76783.exebuild.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1060 tz0331.exe Token: SeDebugPrivilege 4260 v0825Hx.exe Token: SeDebugPrivilege 3092 w05pb28.exe Token: SeDebugPrivilege 3468 xySZA53.exe Token: SeDebugPrivilege 3628 76783.exe Token: SeDebugPrivilege 412 build.exe Token: SeDebugPrivilege 4916 InstallUtil.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Blaubok.exepid process 1852 Blaubok.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exezap5763.exezap6486.exezap4803.exey77Pt22.exelegenda.execmd.exeBlaubok.exedescription pid process target process PID 2124 wrote to memory of 1460 2124 155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe zap5763.exe PID 2124 wrote to memory of 1460 2124 155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe zap5763.exe PID 2124 wrote to memory of 1460 2124 155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe zap5763.exe PID 1460 wrote to memory of 448 1460 zap5763.exe zap6486.exe PID 1460 wrote to memory of 448 1460 zap5763.exe zap6486.exe PID 1460 wrote to memory of 448 1460 zap5763.exe zap6486.exe PID 448 wrote to memory of 3152 448 zap6486.exe zap4803.exe PID 448 wrote to memory of 3152 448 zap6486.exe zap4803.exe PID 448 wrote to memory of 3152 448 zap6486.exe zap4803.exe PID 3152 wrote to memory of 1060 3152 zap4803.exe tz0331.exe PID 3152 wrote to memory of 1060 3152 zap4803.exe tz0331.exe PID 3152 wrote to memory of 4260 3152 zap4803.exe v0825Hx.exe PID 3152 wrote to memory of 4260 3152 zap4803.exe v0825Hx.exe PID 3152 wrote to memory of 4260 3152 zap4803.exe v0825Hx.exe PID 448 wrote to memory of 3092 448 zap6486.exe w05pb28.exe PID 448 wrote to memory of 3092 448 zap6486.exe w05pb28.exe PID 448 wrote to memory of 3092 448 zap6486.exe w05pb28.exe PID 1460 wrote to memory of 3468 1460 zap5763.exe xySZA53.exe PID 1460 wrote to memory of 3468 1460 zap5763.exe xySZA53.exe PID 1460 wrote to memory of 3468 1460 zap5763.exe xySZA53.exe PID 2124 wrote to memory of 4912 2124 155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe y77Pt22.exe PID 2124 wrote to memory of 4912 2124 155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe y77Pt22.exe PID 2124 wrote to memory of 4912 2124 155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe y77Pt22.exe PID 4912 wrote to memory of 2256 4912 y77Pt22.exe legenda.exe PID 4912 wrote to memory of 2256 4912 y77Pt22.exe legenda.exe PID 4912 wrote to memory of 2256 4912 y77Pt22.exe legenda.exe PID 2256 wrote to memory of 2784 2256 legenda.exe schtasks.exe PID 2256 wrote to memory of 2784 2256 legenda.exe schtasks.exe PID 2256 wrote to memory of 2784 2256 legenda.exe schtasks.exe PID 2256 wrote to memory of 708 2256 legenda.exe cmd.exe PID 2256 wrote to memory of 708 2256 legenda.exe cmd.exe PID 2256 wrote to memory of 708 2256 legenda.exe cmd.exe PID 708 wrote to memory of 4252 708 cmd.exe cmd.exe PID 708 wrote to memory of 4252 708 cmd.exe cmd.exe PID 708 wrote to memory of 4252 708 cmd.exe cmd.exe PID 708 wrote to memory of 1360 708 cmd.exe cacls.exe PID 708 wrote to memory of 1360 708 cmd.exe cacls.exe PID 708 wrote to memory of 1360 708 cmd.exe cacls.exe PID 708 wrote to memory of 4804 708 cmd.exe cacls.exe PID 708 wrote to memory of 4804 708 cmd.exe cacls.exe PID 708 wrote to memory of 4804 708 cmd.exe cacls.exe PID 708 wrote to memory of 4048 708 cmd.exe cmd.exe PID 708 wrote to memory of 4048 708 cmd.exe cmd.exe PID 708 wrote to memory of 4048 708 cmd.exe cmd.exe PID 708 wrote to memory of 2236 708 cmd.exe cacls.exe PID 708 wrote to memory of 2236 708 cmd.exe cacls.exe PID 708 wrote to memory of 2236 708 cmd.exe cacls.exe PID 708 wrote to memory of 2636 708 cmd.exe cacls.exe PID 708 wrote to memory of 2636 708 cmd.exe cacls.exe PID 708 wrote to memory of 2636 708 cmd.exe cacls.exe PID 2256 wrote to memory of 3628 2256 legenda.exe 76783.exe PID 2256 wrote to memory of 3628 2256 legenda.exe 76783.exe PID 2256 wrote to memory of 3628 2256 legenda.exe 76783.exe PID 2256 wrote to memory of 1504 2256 legenda.exe Blaubok.exe PID 2256 wrote to memory of 1504 2256 legenda.exe Blaubok.exe PID 2256 wrote to memory of 1504 2256 legenda.exe Blaubok.exe PID 1504 wrote to memory of 4232 1504 Blaubok.exe Blaubok.exe PID 1504 wrote to memory of 4232 1504 Blaubok.exe Blaubok.exe PID 1504 wrote to memory of 4232 1504 Blaubok.exe Blaubok.exe PID 2256 wrote to memory of 1076 2256 legenda.exe agent.exe PID 2256 wrote to memory of 1076 2256 legenda.exe agent.exe PID 2256 wrote to memory of 1076 2256 legenda.exe agent.exe PID 1504 wrote to memory of 4232 1504 Blaubok.exe Blaubok.exe PID 1504 wrote to memory of 1852 1504 Blaubok.exe Blaubok.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe"C:\Users\Admin\AppData\Local\Temp\155919833797cd44c842cd9130dd9b55486da8f29b2bc81dc70775cfd15f27cc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5763.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5763.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6486.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6486.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4803.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4803.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0331.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0331.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0825Hx.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0825Hx.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 10806⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w05pb28.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w05pb28.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 14965⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xySZA53.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xySZA53.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77Pt22.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77Pt22.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exe"C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe"C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeC:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeC:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe5⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 126⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\1000158000\agent.exe"C:\Users\Admin\AppData\Roaming\1000158000\agent.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4260 -ip 42601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1852 -ip 18521⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77Pt22.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y77Pt22.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5763.exeFilesize
857KB
MD5fe30e2bc05e35cdad50f48f64ef6a67f
SHA1ef80d8ef9662c5f0ba59d8d41598b1a6a9c180fb
SHA2566dfd57c39c30761c9f82a4af67e7dba5e7eb05b65da1daec036238cd59efcc32
SHA5126935d1288f544a439c4bc0fc24d5c30fd22eec9748b38919dec853e564a737c7966d2a92c76dbdaa450e22145d979e03ec18d9f944fc595a43cd9c47c9b2c472
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5763.exeFilesize
857KB
MD5fe30e2bc05e35cdad50f48f64ef6a67f
SHA1ef80d8ef9662c5f0ba59d8d41598b1a6a9c180fb
SHA2566dfd57c39c30761c9f82a4af67e7dba5e7eb05b65da1daec036238cd59efcc32
SHA5126935d1288f544a439c4bc0fc24d5c30fd22eec9748b38919dec853e564a737c7966d2a92c76dbdaa450e22145d979e03ec18d9f944fc595a43cd9c47c9b2c472
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xySZA53.exeFilesize
175KB
MD5efc3b1703bec9a0e79d4a9fdcedf4a20
SHA1d019bfe5fbf05fde5cae0029f9580dca9677a3b2
SHA2561d9b391ee239469206cf31022b982e66c2ab463d3106a38526103e1c1b8be855
SHA512f36bbf81fe3bb68c8c8a1fc19dd7c79b386cfdb13b1e5d5e617c4a5ef8a38ed4c4c717f466c9293e2e1067d0f94c9d1ebc1814919e5c572dc66365fdd6009b8a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xySZA53.exeFilesize
175KB
MD5efc3b1703bec9a0e79d4a9fdcedf4a20
SHA1d019bfe5fbf05fde5cae0029f9580dca9677a3b2
SHA2561d9b391ee239469206cf31022b982e66c2ab463d3106a38526103e1c1b8be855
SHA512f36bbf81fe3bb68c8c8a1fc19dd7c79b386cfdb13b1e5d5e617c4a5ef8a38ed4c4c717f466c9293e2e1067d0f94c9d1ebc1814919e5c572dc66365fdd6009b8a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6486.exeFilesize
715KB
MD532a5e0601dc19aee8531f8da9482b542
SHA167688a187b8bd084209b20aac4803fb23afa290e
SHA25697baef6432153fbf47eb2a5cb385d15096d3beb31d3f5baa97377b953895e9d2
SHA512742e8345513ab226b5e210493f07c50fd734ca00faa60cc4dd20f2c4125751bc6c220df14601c31e91e0e7fa303e43c474f3ae4a7ed22568db102542bf4de532
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6486.exeFilesize
715KB
MD532a5e0601dc19aee8531f8da9482b542
SHA167688a187b8bd084209b20aac4803fb23afa290e
SHA25697baef6432153fbf47eb2a5cb385d15096d3beb31d3f5baa97377b953895e9d2
SHA512742e8345513ab226b5e210493f07c50fd734ca00faa60cc4dd20f2c4125751bc6c220df14601c31e91e0e7fa303e43c474f3ae4a7ed22568db102542bf4de532
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w05pb28.exeFilesize
387KB
MD5421507bdb2836a02348a4920256ed49d
SHA14fe6b0e3344db7fac60d7d3d9dcc0dda940815cd
SHA256fca64b2bfee1bf821e81bd9537c0e416eb0e513553d759d2f915c5b9387dd6f3
SHA512d2c4fca7cdfac4f7a7aa74eb49dd68ea1d16640cc7fef5381e817380ed8c72c49538936dc9571c231ae87a26d5280da71bf4ac899b48b8713080bb19796293c4
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w05pb28.exeFilesize
387KB
MD5421507bdb2836a02348a4920256ed49d
SHA14fe6b0e3344db7fac60d7d3d9dcc0dda940815cd
SHA256fca64b2bfee1bf821e81bd9537c0e416eb0e513553d759d2f915c5b9387dd6f3
SHA512d2c4fca7cdfac4f7a7aa74eb49dd68ea1d16640cc7fef5381e817380ed8c72c49538936dc9571c231ae87a26d5280da71bf4ac899b48b8713080bb19796293c4
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4803.exeFilesize
355KB
MD5c7273fbedf0532764a7fed590925c68b
SHA1f1e65e2be2347838ccaebc26d20da05abbc0841b
SHA2565f9606bfb1648183c008246493faada14468d42ddc4f1b345371ee1384ba4bc3
SHA5121258528a983359030bf7f24a7aabef20754a26cb574eaeb325bbc66f2486f2ad18c435d051de6d8e9d788f6108142449a580d7317a1d0ad29133cb282b760d95
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4803.exeFilesize
355KB
MD5c7273fbedf0532764a7fed590925c68b
SHA1f1e65e2be2347838ccaebc26d20da05abbc0841b
SHA2565f9606bfb1648183c008246493faada14468d42ddc4f1b345371ee1384ba4bc3
SHA5121258528a983359030bf7f24a7aabef20754a26cb574eaeb325bbc66f2486f2ad18c435d051de6d8e9d788f6108142449a580d7317a1d0ad29133cb282b760d95
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0331.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0331.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0825Hx.exeFilesize
329KB
MD5eb80500cd0d2877032bfeeb17de30637
SHA16a39a9c858acfd5a6140e80d3c060b48f33c1cad
SHA256cc58fe6ca9f90483552c3e0175503b7b19a92e66d09b9032d04bfee8d506f438
SHA5126ec2a55fe055fd62cbf68280a2fc27571fca2b4f19dc7e3399c350ac2e8a8c1c37c884b493aa0c1e0b67c9bebb426c6f20133309416a795c69651ca9844af07f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0825Hx.exeFilesize
329KB
MD5eb80500cd0d2877032bfeeb17de30637
SHA16a39a9c858acfd5a6140e80d3c060b48f33c1cad
SHA256cc58fe6ca9f90483552c3e0175503b7b19a92e66d09b9032d04bfee8d506f438
SHA5126ec2a55fe055fd62cbf68280a2fc27571fca2b4f19dc7e3399c350ac2e8a8c1c37c884b493aa0c1e0b67c9bebb426c6f20133309416a795c69651ca9844af07f
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\1000158000\agent.exeFilesize
3.1MB
MD5ce117b0b7aff5bf55822e7e879b76fe9
SHA195ae4fb73efc7d9fcdd05664ac458787c8280a06
SHA25628f76833c4943138b2a119a8a66b65aff15b7b91b331865ac21b523fdca0f7f7
SHA51290bb0f400822e97bde74bf8f62d67235c948d355e86b21c508f61b793dc9fd5d0444308d947b661e0d51de42f4a93e8cbb1646193db66cd3c5210a385c0ca6e3
-
C:\Users\Admin\AppData\Roaming\1000158000\agent.exeFilesize
3.1MB
MD5ce117b0b7aff5bf55822e7e879b76fe9
SHA195ae4fb73efc7d9fcdd05664ac458787c8280a06
SHA25628f76833c4943138b2a119a8a66b65aff15b7b91b331865ac21b523fdca0f7f7
SHA51290bb0f400822e97bde74bf8f62d67235c948d355e86b21c508f61b793dc9fd5d0444308d947b661e0d51de42f4a93e8cbb1646193db66cd3c5210a385c0ca6e3
-
C:\Users\Admin\AppData\Roaming\1000158000\agent.exeFilesize
3.1MB
MD5ce117b0b7aff5bf55822e7e879b76fe9
SHA195ae4fb73efc7d9fcdd05664ac458787c8280a06
SHA25628f76833c4943138b2a119a8a66b65aff15b7b91b331865ac21b523fdca0f7f7
SHA51290bb0f400822e97bde74bf8f62d67235c948d355e86b21c508f61b793dc9fd5d0444308d947b661e0d51de42f4a93e8cbb1646193db66cd3c5210a385c0ca6e3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/412-1237-0x0000000000B00000-0x0000000000B40000-memory.dmpFilesize
256KB
-
memory/412-1238-0x0000000002C20000-0x0000000002C30000-memory.dmpFilesize
64KB
-
memory/412-1240-0x0000000002C20000-0x0000000002C30000-memory.dmpFilesize
64KB
-
memory/1060-161-0x0000000000950000-0x000000000095A000-memory.dmpFilesize
40KB
-
memory/1504-1198-0x00000000055A0000-0x00000000055B0000-memory.dmpFilesize
64KB
-
memory/1504-1196-0x0000000000C60000-0x0000000000D46000-memory.dmpFilesize
920KB
-
memory/3092-1120-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/3092-1123-0x0000000004860000-0x0000000004870000-memory.dmpFilesize
64KB
-
memory/3092-227-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-224-0x0000000004860000-0x0000000004870000-memory.dmpFilesize
64KB
-
memory/3092-228-0x0000000004860000-0x0000000004870000-memory.dmpFilesize
64KB
-
memory/3092-226-0x0000000004860000-0x0000000004870000-memory.dmpFilesize
64KB
-
memory/3092-232-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-230-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-234-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-236-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-238-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-240-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-242-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-244-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-246-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-1119-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/3092-223-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-1121-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/3092-1122-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/3092-222-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/3092-1125-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/3092-1126-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/3092-1127-0x0000000004860000-0x0000000004870000-memory.dmpFilesize
64KB
-
memory/3092-1128-0x0000000004860000-0x0000000004870000-memory.dmpFilesize
64KB
-
memory/3092-1129-0x0000000004860000-0x0000000004870000-memory.dmpFilesize
64KB
-
memory/3092-1130-0x0000000008C60000-0x0000000008CD6000-memory.dmpFilesize
472KB
-
memory/3092-1131-0x0000000008CF0000-0x0000000008D40000-memory.dmpFilesize
320KB
-
memory/3092-1132-0x0000000008D70000-0x0000000008F32000-memory.dmpFilesize
1.8MB
-
memory/3092-1133-0x0000000008F40000-0x000000000946C000-memory.dmpFilesize
5.2MB
-
memory/3092-1134-0x0000000004860000-0x0000000004870000-memory.dmpFilesize
64KB
-
memory/3092-220-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-218-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-209-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-210-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-216-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-214-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3092-212-0x0000000007730000-0x000000000776F000-memory.dmpFilesize
252KB
-
memory/3468-1141-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/3468-1140-0x0000000000950000-0x0000000000982000-memory.dmpFilesize
200KB
-
memory/3628-1223-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/3628-1199-0x00000000027E0000-0x00000000027EA000-memory.dmpFilesize
40KB
-
memory/3628-1245-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/3628-1174-0x0000000000D70000-0x0000000000EB0000-memory.dmpFilesize
1.2MB
-
memory/3628-1175-0x00000000060D0000-0x000000000663C000-memory.dmpFilesize
5.4MB
-
memory/3628-1242-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/3628-1185-0x0000000005E00000-0x0000000005E9C000-memory.dmpFilesize
624KB
-
memory/3628-1226-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/3628-1222-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/3628-1218-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/3628-1197-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/3628-1200-0x0000000005FB0000-0x0000000005FC0000-memory.dmpFilesize
64KB
-
memory/4260-184-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-178-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-192-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-190-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-188-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-186-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-196-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-202-0x00000000073F0000-0x0000000007400000-memory.dmpFilesize
64KB
-
memory/4260-204-0x0000000000400000-0x0000000002B7F000-memory.dmpFilesize
39.5MB
-
memory/4260-198-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-199-0x0000000000400000-0x0000000002B7F000-memory.dmpFilesize
39.5MB
-
memory/4260-182-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-180-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-194-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-176-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-174-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-172-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-171-0x0000000007220000-0x0000000007232000-memory.dmpFilesize
72KB
-
memory/4260-200-0x00000000073F0000-0x0000000007400000-memory.dmpFilesize
64KB
-
memory/4260-201-0x00000000073F0000-0x0000000007400000-memory.dmpFilesize
64KB
-
memory/4260-170-0x00000000073F0000-0x0000000007400000-memory.dmpFilesize
64KB
-
memory/4260-169-0x00000000073F0000-0x0000000007400000-memory.dmpFilesize
64KB
-
memory/4260-168-0x0000000002B80000-0x0000000002BAD000-memory.dmpFilesize
180KB
-
memory/4260-167-0x0000000007400000-0x00000000079A4000-memory.dmpFilesize
5.6MB
-
memory/4916-1267-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4916-1268-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/4916-1269-0x00000000061A0000-0x00000000061BE000-memory.dmpFilesize
120KB