Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2023 19:54
Static task
static1
Behavioral task
behavioral1
Sample
JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exe
Resource
win10v2004-20230831-en
General
-
Target
JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exe
-
Size
811KB
-
MD5
17d8eed14e292040cad0ce2bc9078821
-
SHA1
2cf81e6bf49c2967281dc50f6b9b80f2d647719a
-
SHA256
fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed
-
SHA512
b8a6613fd6f94047f2e4616c59186599644197c6ef468d44b44451d0c87249cbde56a82056c0a761d558c41c9662e60eb94741a300760d15bce8e2b488f35253
-
SSDEEP
24576:CyUJ/WtKkTu/iq9W5NqLL+gQ9yKBmW9TBQ9:p8/WtVTu/iq9CkLLE9yKB
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
-
install_dir
b40d11255d
-
install_file
saves.exe
-
strings_key
fa622dfc42544927a6471829ee1fa9fe
Extracted
redline
gena
77.91.124.82:19071
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Signatures
-
Processes:
g5655341.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g5655341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g5655341.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection g5655341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g5655341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g5655341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g5655341.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
saves.exeh9585596.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Control Panel\International\Geo\Nation saves.exe Key value queried \REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Control Panel\International\Geo\Nation h9585596.exe -
Executes dropped EXE 9 IoCs
Processes:
x4059712.exex0466006.exex8380768.exeg5655341.exeh9585596.exesaves.exei1117692.exesaves.exesaves.exepid process 3372 x4059712.exe 2208 x0466006.exe 3788 x8380768.exe 4812 g5655341.exe 2740 h9585596.exe 3912 saves.exe 1472 i1117692.exe 4368 saves.exe 2512 saves.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1028 rundll32.exe -
Processes:
g5655341.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features g5655341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" g5655341.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exex4059712.exex0466006.exex8380768.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x4059712.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x0466006.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x8380768.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
g5655341.exepid process 4812 g5655341.exe 4812 g5655341.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
g5655341.exedescription pid process Token: SeDebugPrivilege 4812 g5655341.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exex4059712.exex0466006.exex8380768.exeh9585596.exesaves.execmd.exedescription pid process target process PID 4504 wrote to memory of 3372 4504 JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exe x4059712.exe PID 4504 wrote to memory of 3372 4504 JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exe x4059712.exe PID 4504 wrote to memory of 3372 4504 JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exe x4059712.exe PID 3372 wrote to memory of 2208 3372 x4059712.exe x0466006.exe PID 3372 wrote to memory of 2208 3372 x4059712.exe x0466006.exe PID 3372 wrote to memory of 2208 3372 x4059712.exe x0466006.exe PID 2208 wrote to memory of 3788 2208 x0466006.exe x8380768.exe PID 2208 wrote to memory of 3788 2208 x0466006.exe x8380768.exe PID 2208 wrote to memory of 3788 2208 x0466006.exe x8380768.exe PID 3788 wrote to memory of 4812 3788 x8380768.exe g5655341.exe PID 3788 wrote to memory of 4812 3788 x8380768.exe g5655341.exe PID 3788 wrote to memory of 4812 3788 x8380768.exe g5655341.exe PID 3788 wrote to memory of 2740 3788 x8380768.exe h9585596.exe PID 3788 wrote to memory of 2740 3788 x8380768.exe h9585596.exe PID 3788 wrote to memory of 2740 3788 x8380768.exe h9585596.exe PID 2740 wrote to memory of 3912 2740 h9585596.exe saves.exe PID 2740 wrote to memory of 3912 2740 h9585596.exe saves.exe PID 2740 wrote to memory of 3912 2740 h9585596.exe saves.exe PID 2208 wrote to memory of 1472 2208 x0466006.exe i1117692.exe PID 2208 wrote to memory of 1472 2208 x0466006.exe i1117692.exe PID 2208 wrote to memory of 1472 2208 x0466006.exe i1117692.exe PID 3912 wrote to memory of 2528 3912 saves.exe schtasks.exe PID 3912 wrote to memory of 2528 3912 saves.exe schtasks.exe PID 3912 wrote to memory of 2528 3912 saves.exe schtasks.exe PID 3912 wrote to memory of 5048 3912 saves.exe cmd.exe PID 3912 wrote to memory of 5048 3912 saves.exe cmd.exe PID 3912 wrote to memory of 5048 3912 saves.exe cmd.exe PID 5048 wrote to memory of 3240 5048 cmd.exe cmd.exe PID 5048 wrote to memory of 3240 5048 cmd.exe cmd.exe PID 5048 wrote to memory of 3240 5048 cmd.exe cmd.exe PID 5048 wrote to memory of 2556 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 2556 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 2556 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 4360 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 4360 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 4360 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 4296 5048 cmd.exe cmd.exe PID 5048 wrote to memory of 4296 5048 cmd.exe cmd.exe PID 5048 wrote to memory of 4296 5048 cmd.exe cmd.exe PID 5048 wrote to memory of 1388 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 1388 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 1388 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 4732 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 4732 5048 cmd.exe cacls.exe PID 5048 wrote to memory of 4732 5048 cmd.exe cacls.exe PID 3912 wrote to memory of 1028 3912 saves.exe rundll32.exe PID 3912 wrote to memory of 1028 3912 saves.exe rundll32.exe PID 3912 wrote to memory of 1028 3912 saves.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exe"C:\Users\Admin\AppData\Local\Temp\JC_fcc086c3a09726858238f4037957625b5829e460c90142090451219549930aed.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4059712.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4059712.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0466006.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0466006.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x8380768.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x8380768.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5655341.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5655341.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9585596.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9585596.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1117692.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1117692.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4059712.exeFilesize
706KB
MD5e1b87b25d07b49e7e3c8f25c041798d3
SHA154828f4d6017b2740bcb3543c3119176ba1e7a59
SHA2561ef5a66797aeef442786945a182ab522208ecd33c0d764c47b2ee216ddc08185
SHA512c92391104707ddc4055907377f3198fa10256286ed2ecadaa5c612819a76c94117dda3b17b721f25ab410af29619d95f28852409af47ef1c384948feefe6011e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4059712.exeFilesize
706KB
MD5e1b87b25d07b49e7e3c8f25c041798d3
SHA154828f4d6017b2740bcb3543c3119176ba1e7a59
SHA2561ef5a66797aeef442786945a182ab522208ecd33c0d764c47b2ee216ddc08185
SHA512c92391104707ddc4055907377f3198fa10256286ed2ecadaa5c612819a76c94117dda3b17b721f25ab410af29619d95f28852409af47ef1c384948feefe6011e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0466006.exeFilesize
540KB
MD54f6cb4b7c013c562749f252915db2c46
SHA12eea9ec7044be1619123b9e204109cbbd80b497d
SHA2568627cd270f88c1a5c1a7f3b27ec164d3e915a1eef3ad461719e6148d30c503e8
SHA5128d8fc3840caf056194c0dd7d14470b8c9b783b49c50147b5825a4f4636a68de10092a3ad3753b6e502742085f253c15664c4d08458090dcd6215ce15c3f607ad
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0466006.exeFilesize
540KB
MD54f6cb4b7c013c562749f252915db2c46
SHA12eea9ec7044be1619123b9e204109cbbd80b497d
SHA2568627cd270f88c1a5c1a7f3b27ec164d3e915a1eef3ad461719e6148d30c503e8
SHA5128d8fc3840caf056194c0dd7d14470b8c9b783b49c50147b5825a4f4636a68de10092a3ad3753b6e502742085f253c15664c4d08458090dcd6215ce15c3f607ad
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1117692.exeFilesize
175KB
MD52b8199ad844ff3a01c9912c98b96a7ea
SHA1d3e3e567dc324908102353945d81b758f071b52f
SHA256a1b6c6e2fb697341192b47aa18d536b45ab61d01d53191d6aa48610941386fda
SHA5129706d15fc24d81ff5e6a7d900b61e231ffb45df577fd4beb08ae1781cde0db64c746007a323c91b2bb8ad8a2846ec3f7263e4fa9ae7f92c07fb523a6e040be42
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1117692.exeFilesize
175KB
MD52b8199ad844ff3a01c9912c98b96a7ea
SHA1d3e3e567dc324908102353945d81b758f071b52f
SHA256a1b6c6e2fb697341192b47aa18d536b45ab61d01d53191d6aa48610941386fda
SHA5129706d15fc24d81ff5e6a7d900b61e231ffb45df577fd4beb08ae1781cde0db64c746007a323c91b2bb8ad8a2846ec3f7263e4fa9ae7f92c07fb523a6e040be42
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x8380768.exeFilesize
384KB
MD5c34272d7dd17aad35d90ac70065284af
SHA192034a7d04ab90c318054c90d4ad443595d481b2
SHA256ef698cba0f58591601f52390fb116b43a351bb55696f08840bb33c84a1cbafa8
SHA512a0006dd27d29cd5962af66bd50298429a70499255c0e486c4d2919916f4d222b91b8ff4dfcef17734e6300c82e607fbb540deae3127276122a7f7d51c9942db2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x8380768.exeFilesize
384KB
MD5c34272d7dd17aad35d90ac70065284af
SHA192034a7d04ab90c318054c90d4ad443595d481b2
SHA256ef698cba0f58591601f52390fb116b43a351bb55696f08840bb33c84a1cbafa8
SHA512a0006dd27d29cd5962af66bd50298429a70499255c0e486c4d2919916f4d222b91b8ff4dfcef17734e6300c82e607fbb540deae3127276122a7f7d51c9942db2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5655341.exeFilesize
185KB
MD5f996eabadaba870da155eb120b7b1f0c
SHA18eb9d639fe844ce67e42f05a337f8cb2bd78f181
SHA2569b64e78955ff2b0c467f6cf24c300d7540ce9f0f572a051367a1d584ffa6e97d
SHA512d29004fefcaba04a5a3d35a447f3404d0db238136c90f3979bf99829168a732eaa2e54662b0423dd5b66fed77ce26f38b2054eca0d106d3f97d6eecf55b1432d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5655341.exeFilesize
185KB
MD5f996eabadaba870da155eb120b7b1f0c
SHA18eb9d639fe844ce67e42f05a337f8cb2bd78f181
SHA2569b64e78955ff2b0c467f6cf24c300d7540ce9f0f572a051367a1d584ffa6e97d
SHA512d29004fefcaba04a5a3d35a447f3404d0db238136c90f3979bf99829168a732eaa2e54662b0423dd5b66fed77ce26f38b2054eca0d106d3f97d6eecf55b1432d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9585596.exeFilesize
335KB
MD5d5d53f0ba21ac8e188493f9d5b93a1df
SHA1b1cee37b3c670db3c4d8ee17efb34f0320bd6f25
SHA2562a68151e12bbf89857f734e72388e181701367ee857dfd813d39570761600754
SHA512f26312b1403d47b032797272061780574862bb12fd44d3fa4e60e8f578e21528b3927aa971f69bfd26ca9ea40a70b884afacd42390a808723e9a14deaf32b529
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h9585596.exeFilesize
335KB
MD5d5d53f0ba21ac8e188493f9d5b93a1df
SHA1b1cee37b3c670db3c4d8ee17efb34f0320bd6f25
SHA2562a68151e12bbf89857f734e72388e181701367ee857dfd813d39570761600754
SHA512f26312b1403d47b032797272061780574862bb12fd44d3fa4e60e8f578e21528b3927aa971f69bfd26ca9ea40a70b884afacd42390a808723e9a14deaf32b529
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5d5d53f0ba21ac8e188493f9d5b93a1df
SHA1b1cee37b3c670db3c4d8ee17efb34f0320bd6f25
SHA2562a68151e12bbf89857f734e72388e181701367ee857dfd813d39570761600754
SHA512f26312b1403d47b032797272061780574862bb12fd44d3fa4e60e8f578e21528b3927aa971f69bfd26ca9ea40a70b884afacd42390a808723e9a14deaf32b529
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5d5d53f0ba21ac8e188493f9d5b93a1df
SHA1b1cee37b3c670db3c4d8ee17efb34f0320bd6f25
SHA2562a68151e12bbf89857f734e72388e181701367ee857dfd813d39570761600754
SHA512f26312b1403d47b032797272061780574862bb12fd44d3fa4e60e8f578e21528b3927aa971f69bfd26ca9ea40a70b884afacd42390a808723e9a14deaf32b529
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5d5d53f0ba21ac8e188493f9d5b93a1df
SHA1b1cee37b3c670db3c4d8ee17efb34f0320bd6f25
SHA2562a68151e12bbf89857f734e72388e181701367ee857dfd813d39570761600754
SHA512f26312b1403d47b032797272061780574862bb12fd44d3fa4e60e8f578e21528b3927aa971f69bfd26ca9ea40a70b884afacd42390a808723e9a14deaf32b529
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5d5d53f0ba21ac8e188493f9d5b93a1df
SHA1b1cee37b3c670db3c4d8ee17efb34f0320bd6f25
SHA2562a68151e12bbf89857f734e72388e181701367ee857dfd813d39570761600754
SHA512f26312b1403d47b032797272061780574862bb12fd44d3fa4e60e8f578e21528b3927aa971f69bfd26ca9ea40a70b884afacd42390a808723e9a14deaf32b529
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5d5d53f0ba21ac8e188493f9d5b93a1df
SHA1b1cee37b3c670db3c4d8ee17efb34f0320bd6f25
SHA2562a68151e12bbf89857f734e72388e181701367ee857dfd813d39570761600754
SHA512f26312b1403d47b032797272061780574862bb12fd44d3fa4e60e8f578e21528b3927aa971f69bfd26ca9ea40a70b884afacd42390a808723e9a14deaf32b529
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
memory/1472-81-0x00000000056B0000-0x0000000005CC8000-memory.dmpFilesize
6.1MB
-
memory/1472-80-0x00000000733D0000-0x0000000073B80000-memory.dmpFilesize
7.7MB
-
memory/1472-79-0x0000000000620000-0x0000000000650000-memory.dmpFilesize
192KB
-
memory/1472-82-0x00000000051B0000-0x00000000052BA000-memory.dmpFilesize
1.0MB
-
memory/1472-83-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/1472-84-0x00000000050F0000-0x0000000005102000-memory.dmpFilesize
72KB
-
memory/1472-85-0x0000000005150000-0x000000000518C000-memory.dmpFilesize
240KB
-
memory/1472-86-0x00000000733D0000-0x0000000073B80000-memory.dmpFilesize
7.7MB
-
memory/1472-87-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/4812-32-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-63-0x0000000074150000-0x0000000074900000-memory.dmpFilesize
7.7MB
-
memory/4812-61-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/4812-60-0x0000000074150000-0x0000000074900000-memory.dmpFilesize
7.7MB
-
memory/4812-59-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-51-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-57-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-53-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-55-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-47-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-49-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-45-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-43-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-41-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-39-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-37-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-35-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-33-0x0000000004990000-0x00000000049A6000-memory.dmpFilesize
88KB
-
memory/4812-31-0x00000000049D0000-0x0000000004F74000-memory.dmpFilesize
5.6MB
-
memory/4812-30-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/4812-29-0x00000000049C0000-0x00000000049D0000-memory.dmpFilesize
64KB
-
memory/4812-28-0x0000000074150000-0x0000000074900000-memory.dmpFilesize
7.7MB