Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2023 19:28
Static task
static1
Behavioral task
behavioral1
Sample
z5301432_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
z5301432_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
z5301432_JC.exe
-
Size
932KB
-
MD5
9e2bcbb4ad2a461b3774bde8ee67b553
-
SHA1
53daf439615a535ab799cbaee3cc490280a0a081
-
SHA256
9b615211ca5c5576ec18eed13d3da6d6ab14d629d4028945933b73996dd9756b
-
SHA512
99ae346e75e321f3e9e4ffc7a28be99d538e324906730053d68d2c70050ac3c7f501dfaa9cf5b82aeb4cd7f11b25519a1e38cbcac9646422439dc5190d8d4607
-
SSDEEP
24576:ty2mM89OvMEhlHSqnooddMaIxIsYd7r5+sBo:IAkBqrDEYJr8s
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
-
install_dir
b40d11255d
-
install_file
saves.exe
-
strings_key
fa622dfc42544927a6471829ee1fa9fe
Extracted
redline
gena
77.91.124.82:19071
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Signatures
-
Processes:
q1377288.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q1377288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q1377288.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection q1377288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q1377288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q1377288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q1377288.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
r0552195.exesaves.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Control Panel\International\Geo\Nation r0552195.exe Key value queried \REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Control Panel\International\Geo\Nation saves.exe -
Executes dropped EXE 10 IoCs
Processes:
z3089271.exez3919818.exez4767974.exeq1377288.exer0552195.exesaves.exes5062183.exet2978361.exesaves.exesaves.exepid process 3040 z3089271.exe 2720 z3919818.exe 2640 z4767974.exe 3580 q1377288.exe 388 r0552195.exe 3304 saves.exe 4596 s5062183.exe 3592 t2978361.exe 4824 saves.exe 3552 saves.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3668 rundll32.exe -
Processes:
q1377288.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features q1377288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" q1377288.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
z3919818.exez4767974.exez5301432_JC.exez3089271.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z3919818.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z4767974.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" z5301432_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3089271.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q1377288.exepid process 3580 q1377288.exe 3580 q1377288.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q1377288.exedescription pid process Token: SeDebugPrivilege 3580 q1377288.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
z5301432_JC.exez3089271.exez3919818.exez4767974.exer0552195.exesaves.execmd.exedescription pid process target process PID 412 wrote to memory of 3040 412 z5301432_JC.exe z3089271.exe PID 412 wrote to memory of 3040 412 z5301432_JC.exe z3089271.exe PID 412 wrote to memory of 3040 412 z5301432_JC.exe z3089271.exe PID 3040 wrote to memory of 2720 3040 z3089271.exe z3919818.exe PID 3040 wrote to memory of 2720 3040 z3089271.exe z3919818.exe PID 3040 wrote to memory of 2720 3040 z3089271.exe z3919818.exe PID 2720 wrote to memory of 2640 2720 z3919818.exe z4767974.exe PID 2720 wrote to memory of 2640 2720 z3919818.exe z4767974.exe PID 2720 wrote to memory of 2640 2720 z3919818.exe z4767974.exe PID 2640 wrote to memory of 3580 2640 z4767974.exe q1377288.exe PID 2640 wrote to memory of 3580 2640 z4767974.exe q1377288.exe PID 2640 wrote to memory of 3580 2640 z4767974.exe q1377288.exe PID 2640 wrote to memory of 388 2640 z4767974.exe r0552195.exe PID 2640 wrote to memory of 388 2640 z4767974.exe r0552195.exe PID 2640 wrote to memory of 388 2640 z4767974.exe r0552195.exe PID 388 wrote to memory of 3304 388 r0552195.exe saves.exe PID 388 wrote to memory of 3304 388 r0552195.exe saves.exe PID 388 wrote to memory of 3304 388 r0552195.exe saves.exe PID 2720 wrote to memory of 4596 2720 z3919818.exe s5062183.exe PID 2720 wrote to memory of 4596 2720 z3919818.exe s5062183.exe PID 2720 wrote to memory of 4596 2720 z3919818.exe s5062183.exe PID 3304 wrote to memory of 884 3304 saves.exe schtasks.exe PID 3304 wrote to memory of 884 3304 saves.exe schtasks.exe PID 3304 wrote to memory of 884 3304 saves.exe schtasks.exe PID 3304 wrote to memory of 4196 3304 saves.exe cmd.exe PID 3304 wrote to memory of 4196 3304 saves.exe cmd.exe PID 3304 wrote to memory of 4196 3304 saves.exe cmd.exe PID 4196 wrote to memory of 1152 4196 cmd.exe cmd.exe PID 4196 wrote to memory of 1152 4196 cmd.exe cmd.exe PID 4196 wrote to memory of 1152 4196 cmd.exe cmd.exe PID 4196 wrote to memory of 5012 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 5012 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 5012 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 2676 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 2676 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 2676 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 5044 4196 cmd.exe cmd.exe PID 4196 wrote to memory of 5044 4196 cmd.exe cmd.exe PID 4196 wrote to memory of 5044 4196 cmd.exe cmd.exe PID 4196 wrote to memory of 4980 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 4980 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 4980 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 4976 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 4976 4196 cmd.exe cacls.exe PID 4196 wrote to memory of 4976 4196 cmd.exe cacls.exe PID 3040 wrote to memory of 3592 3040 z3089271.exe t2978361.exe PID 3040 wrote to memory of 3592 3040 z3089271.exe t2978361.exe PID 3040 wrote to memory of 3592 3040 z3089271.exe t2978361.exe PID 3304 wrote to memory of 3668 3304 saves.exe rundll32.exe PID 3304 wrote to memory of 3668 3304 saves.exe rundll32.exe PID 3304 wrote to memory of 3668 3304 saves.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\z5301432_JC.exe"C:\Users\Admin\AppData\Local\Temp\z5301432_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3089271.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3089271.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3919818.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3919818.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4767974.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4767974.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q1377288.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q1377288.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r0552195.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r0552195.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s5062183.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s5062183.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t2978361.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t2978361.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3089271.exeFilesize
706KB
MD5bae488487825e385f0bb0d505012ab86
SHA1389724e409475fb8126be9a1b02ba2f9eaf71bef
SHA25669018b920928f09ccf7022a27218f8908c88a7e9b7b57c2bd99101e0703a0216
SHA51202f825c01938031cdf46bbac7c6ca03d736364ecb123a2dabb12a98270a1db06bd20ded90dd445f69fb4f7eb10e14416472ef62db86b30c0e07ff5cd20deb4ab
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3089271.exeFilesize
706KB
MD5bae488487825e385f0bb0d505012ab86
SHA1389724e409475fb8126be9a1b02ba2f9eaf71bef
SHA25669018b920928f09ccf7022a27218f8908c88a7e9b7b57c2bd99101e0703a0216
SHA51202f825c01938031cdf46bbac7c6ca03d736364ecb123a2dabb12a98270a1db06bd20ded90dd445f69fb4f7eb10e14416472ef62db86b30c0e07ff5cd20deb4ab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t2978361.exeFilesize
175KB
MD57b7c5af0b8abd9d86992e0eb52fc0422
SHA1366fd11059b4b56ccd40574690990005aeaec4fa
SHA256f79ae4bad0585178911ff9b281b1908a201d05f90ee3ed4771a1af33230d02c2
SHA512843edca7bf1d313f734e5e29e22b5f24d3ea18d99c4758f8333e1ddbce280367f8159ff71573f2bc102566544f3315d4a61f94e728104e796074183ff0464b96
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\t2978361.exeFilesize
175KB
MD57b7c5af0b8abd9d86992e0eb52fc0422
SHA1366fd11059b4b56ccd40574690990005aeaec4fa
SHA256f79ae4bad0585178911ff9b281b1908a201d05f90ee3ed4771a1af33230d02c2
SHA512843edca7bf1d313f734e5e29e22b5f24d3ea18d99c4758f8333e1ddbce280367f8159ff71573f2bc102566544f3315d4a61f94e728104e796074183ff0464b96
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3919818.exeFilesize
550KB
MD57cf3f8050075be32528cb7aa59eee769
SHA1a3e12f752f19363ce0ea06cb3741d849185159b5
SHA2564ab6858aac3eda2bc73bc605bf7bf4df5ce1fe1ef1972834b6a2cae2ac1bc635
SHA5124240eb8b0713133f170405a7667607db0461a17b0361c8abf2ac05490a4c08d9ac856fd76ff2f750fdedab2fe02ae5fed17cca486ce91b9106fdbeed04756537
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3919818.exeFilesize
550KB
MD57cf3f8050075be32528cb7aa59eee769
SHA1a3e12f752f19363ce0ea06cb3741d849185159b5
SHA2564ab6858aac3eda2bc73bc605bf7bf4df5ce1fe1ef1972834b6a2cae2ac1bc635
SHA5124240eb8b0713133f170405a7667607db0461a17b0361c8abf2ac05490a4c08d9ac856fd76ff2f750fdedab2fe02ae5fed17cca486ce91b9106fdbeed04756537
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s5062183.exeFilesize
141KB
MD506834e81b9b3bcc57920a38a7bd5c0a3
SHA121e4ec6ccd7ee15e24e36798ae4ec80c10b6f09c
SHA256e6c2dfd40216c51554af490d0f4f5104eb7bc2d439bbd866570afaf57983f476
SHA512974788769c07a8c038f60571df516db4eca1a7e0fb0f01898bb22f18d5dc61cacd46ec4eede9c540875c7162196d4648741c7ac00408cf758a2583094affd412
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s5062183.exeFilesize
141KB
MD506834e81b9b3bcc57920a38a7bd5c0a3
SHA121e4ec6ccd7ee15e24e36798ae4ec80c10b6f09c
SHA256e6c2dfd40216c51554af490d0f4f5104eb7bc2d439bbd866570afaf57983f476
SHA512974788769c07a8c038f60571df516db4eca1a7e0fb0f01898bb22f18d5dc61cacd46ec4eede9c540875c7162196d4648741c7ac00408cf758a2583094affd412
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4767974.exeFilesize
384KB
MD587a016f392408839ccb4f038dcce8224
SHA16d8053628b08a639c8745794397d95b748fe092e
SHA2568b51f3a6ed8c8557f083ec5a438999bb5580beae68b2f309b7a27e3e468454de
SHA512d17b514f84280ed15f3bda2dca11d7319180fda70f7d59cfd2fd89fe86fe7beebd4b700fa2bc06a533cfd0eda8d479f1b0e2eec30e4e02bb47e6d51299ebc7a6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4767974.exeFilesize
384KB
MD587a016f392408839ccb4f038dcce8224
SHA16d8053628b08a639c8745794397d95b748fe092e
SHA2568b51f3a6ed8c8557f083ec5a438999bb5580beae68b2f309b7a27e3e468454de
SHA512d17b514f84280ed15f3bda2dca11d7319180fda70f7d59cfd2fd89fe86fe7beebd4b700fa2bc06a533cfd0eda8d479f1b0e2eec30e4e02bb47e6d51299ebc7a6
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q1377288.exeFilesize
185KB
MD5630518d19354704258f0b6865def864d
SHA13976679def0ca0b9c73bfd88f5a4e803d22e3953
SHA25641059a34df1818c7cd28fc37c8ca9b5063a76ed6aac981b75bfc26f0f27884e6
SHA512484037f2c07da051645ac37c9b7bb5f6866c55df57d747023833c25e2b7e4cafb8ddbd07434c455118882ab03253685f4de0cb000460881995a1fb65ac747363
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\q1377288.exeFilesize
185KB
MD5630518d19354704258f0b6865def864d
SHA13976679def0ca0b9c73bfd88f5a4e803d22e3953
SHA25641059a34df1818c7cd28fc37c8ca9b5063a76ed6aac981b75bfc26f0f27884e6
SHA512484037f2c07da051645ac37c9b7bb5f6866c55df57d747023833c25e2b7e4cafb8ddbd07434c455118882ab03253685f4de0cb000460881995a1fb65ac747363
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r0552195.exeFilesize
335KB
MD5fbe3466aa976ab080c895eed7dca67f9
SHA1b60387daf32bc6c137611bc0af63b669b125b43c
SHA2562d817ade93decd822f3a2a5d88a8e582eb83c5d9df7a418ec587f4147a822289
SHA512b892256df2407892c69b45e688e5234daddb61a925b250d8b79bc500af788da4ad4e635c6e743e69eb639489ad6d1d4fe9c7949811adb3476ad73b001dcbbee0
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\r0552195.exeFilesize
335KB
MD5fbe3466aa976ab080c895eed7dca67f9
SHA1b60387daf32bc6c137611bc0af63b669b125b43c
SHA2562d817ade93decd822f3a2a5d88a8e582eb83c5d9df7a418ec587f4147a822289
SHA512b892256df2407892c69b45e688e5234daddb61a925b250d8b79bc500af788da4ad4e635c6e743e69eb639489ad6d1d4fe9c7949811adb3476ad73b001dcbbee0
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5fbe3466aa976ab080c895eed7dca67f9
SHA1b60387daf32bc6c137611bc0af63b669b125b43c
SHA2562d817ade93decd822f3a2a5d88a8e582eb83c5d9df7a418ec587f4147a822289
SHA512b892256df2407892c69b45e688e5234daddb61a925b250d8b79bc500af788da4ad4e635c6e743e69eb639489ad6d1d4fe9c7949811adb3476ad73b001dcbbee0
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5fbe3466aa976ab080c895eed7dca67f9
SHA1b60387daf32bc6c137611bc0af63b669b125b43c
SHA2562d817ade93decd822f3a2a5d88a8e582eb83c5d9df7a418ec587f4147a822289
SHA512b892256df2407892c69b45e688e5234daddb61a925b250d8b79bc500af788da4ad4e635c6e743e69eb639489ad6d1d4fe9c7949811adb3476ad73b001dcbbee0
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5fbe3466aa976ab080c895eed7dca67f9
SHA1b60387daf32bc6c137611bc0af63b669b125b43c
SHA2562d817ade93decd822f3a2a5d88a8e582eb83c5d9df7a418ec587f4147a822289
SHA512b892256df2407892c69b45e688e5234daddb61a925b250d8b79bc500af788da4ad4e635c6e743e69eb639489ad6d1d4fe9c7949811adb3476ad73b001dcbbee0
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5fbe3466aa976ab080c895eed7dca67f9
SHA1b60387daf32bc6c137611bc0af63b669b125b43c
SHA2562d817ade93decd822f3a2a5d88a8e582eb83c5d9df7a418ec587f4147a822289
SHA512b892256df2407892c69b45e688e5234daddb61a925b250d8b79bc500af788da4ad4e635c6e743e69eb639489ad6d1d4fe9c7949811adb3476ad73b001dcbbee0
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeFilesize
335KB
MD5fbe3466aa976ab080c895eed7dca67f9
SHA1b60387daf32bc6c137611bc0af63b669b125b43c
SHA2562d817ade93decd822f3a2a5d88a8e582eb83c5d9df7a418ec587f4147a822289
SHA512b892256df2407892c69b45e688e5234daddb61a925b250d8b79bc500af788da4ad4e635c6e743e69eb639489ad6d1d4fe9c7949811adb3476ad73b001dcbbee0
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
memory/3580-49-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-63-0x0000000074AC0000-0x0000000075270000-memory.dmpFilesize
7.7MB
-
memory/3580-47-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-43-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-51-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-53-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-55-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-41-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-39-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-37-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-35-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-57-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-59-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-60-0x0000000074AC0000-0x0000000075270000-memory.dmpFilesize
7.7MB
-
memory/3580-61-0x00000000006F0000-0x0000000000700000-memory.dmpFilesize
64KB
-
memory/3580-45-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-28-0x0000000074AC0000-0x0000000075270000-memory.dmpFilesize
7.7MB
-
memory/3580-29-0x00000000006F0000-0x0000000000700000-memory.dmpFilesize
64KB
-
memory/3580-30-0x00000000006F0000-0x0000000000700000-memory.dmpFilesize
64KB
-
memory/3580-31-0x0000000004940000-0x0000000004EE4000-memory.dmpFilesize
5.6MB
-
memory/3580-33-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3580-32-0x0000000004F50000-0x0000000004F66000-memory.dmpFilesize
88KB
-
memory/3592-88-0x00000000052B0000-0x00000000052EC000-memory.dmpFilesize
240KB
-
memory/3592-89-0x00000000734C0000-0x0000000073C70000-memory.dmpFilesize
7.7MB
-
memory/3592-90-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/3592-86-0x0000000005160000-0x0000000005170000-memory.dmpFilesize
64KB
-
memory/3592-87-0x0000000005110000-0x0000000005122000-memory.dmpFilesize
72KB
-
memory/3592-85-0x0000000005380000-0x000000000548A000-memory.dmpFilesize
1.0MB
-
memory/3592-84-0x0000000005890000-0x0000000005EA8000-memory.dmpFilesize
6.1MB
-
memory/3592-83-0x00000000734C0000-0x0000000073C70000-memory.dmpFilesize
7.7MB
-
memory/3592-82-0x0000000000890000-0x00000000008C0000-memory.dmpFilesize
192KB