Analysis
-
max time kernel
129s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 01:56
Static task
static1
Behavioral task
behavioral1
Sample
c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe
Resource
win10v2004-20240412-en
General
-
Target
c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe
-
Size
397KB
-
MD5
17d0b9ac75dfd038ac11c64940a5a6cb
-
SHA1
fdf4a6d488ba2220c808a8e233ea0e219273c3b2
-
SHA256
c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5
-
SHA512
0ffb63b421da1daa0ca2098ea35b6e5be5b8613b9b4855b723b2c6032bcf644f7d00ddb35ab1af443c5f765fa10c61cb5c28fe81734ea4e582b51ed56c1afecd
-
SSDEEP
6144:/IWyveo8OzcrumMozCE6+bIPEMMjAtUO3nDv4abP212gG7EXoiToLa:/IpvZDoruYeE6+EsPjA4a7mJWEZga
Malware Config
Extracted
revengerat
NyanCatRevenge
alice2019.myftp.biz:7777
a915f6c5466a49
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Detects executables packed with or use KoiVM 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2012-3-0x00000000005A0000-0x0000000000600000-memory.dmp INDICATOR_EXE_Packed_KoiVM -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2924 svchost.exe -
Loads dropped DLL 6 IoCs
Processes:
cmd.exeWerFault.exepid process 2516 cmd.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 2924 set thread context of 1912 2924 svchost.exe installutil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
installutil.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 installutil.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString installutil.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2432 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exesvchost.exechrome.exepid process 2012 c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe 2012 c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe 2012 c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe 2924 svchost.exe 1676 chrome.exe 1676 chrome.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exesvchost.exechrome.exedescription pid process Token: SeDebugPrivilege 2012 c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe Token: SeDebugPrivilege 2924 svchost.exe Token: SeShutdownPrivilege 1676 chrome.exe Token: SeShutdownPrivilege 1676 chrome.exe Token: SeShutdownPrivilege 1676 chrome.exe Token: SeShutdownPrivilege 1676 chrome.exe Token: SeShutdownPrivilege 1676 chrome.exe Token: SeShutdownPrivilege 1676 chrome.exe Token: SeShutdownPrivilege 1676 chrome.exe Token: SeShutdownPrivilege 1676 chrome.exe Token: SeShutdownPrivilege 1676 chrome.exe Token: SeShutdownPrivilege 1676 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe 1676 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.execmd.execmd.exesvchost.exechrome.exedescription pid process target process PID 2012 wrote to memory of 2984 2012 c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe cmd.exe PID 2012 wrote to memory of 2984 2012 c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe cmd.exe PID 2012 wrote to memory of 2984 2012 c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe cmd.exe PID 2012 wrote to memory of 2516 2012 c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe cmd.exe PID 2012 wrote to memory of 2516 2012 c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe cmd.exe PID 2012 wrote to memory of 2516 2012 c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe cmd.exe PID 2984 wrote to memory of 2464 2984 cmd.exe schtasks.exe PID 2984 wrote to memory of 2464 2984 cmd.exe schtasks.exe PID 2984 wrote to memory of 2464 2984 cmd.exe schtasks.exe PID 2516 wrote to memory of 2432 2516 cmd.exe timeout.exe PID 2516 wrote to memory of 2432 2516 cmd.exe timeout.exe PID 2516 wrote to memory of 2432 2516 cmd.exe timeout.exe PID 2516 wrote to memory of 2924 2516 cmd.exe svchost.exe PID 2516 wrote to memory of 2924 2516 cmd.exe svchost.exe PID 2516 wrote to memory of 2924 2516 cmd.exe svchost.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 1912 2924 svchost.exe installutil.exe PID 2924 wrote to memory of 2380 2924 svchost.exe WerFault.exe PID 2924 wrote to memory of 2380 2924 svchost.exe WerFault.exe PID 2924 wrote to memory of 2380 2924 svchost.exe WerFault.exe PID 1676 wrote to memory of 2988 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2988 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2988 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe PID 1676 wrote to memory of 2008 1676 chrome.exe chrome.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe"C:\Users\Admin\AppData\Local\Temp\c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp83DF.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"4⤵
- Checks processor information in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2924 -s 6764⤵
- Loads dropped DLL
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6829758,0x7fef6829768,0x7fef68297782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1364,i,5836758517412741999,16829323698424890512,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1364,i,5836758517412741999,16829323698424890512,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1364,i,5836758517412741999,16829323698424890512,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2236 --field-trial-handle=1364,i,5836758517412741999,16829323698424890512,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2260 --field-trial-handle=1364,i,5836758517412741999,16829323698424890512,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1428 --field-trial-handle=1364,i,5836758517412741999,16829323698424890512,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3228 --field-trial-handle=1364,i,5836758517412741999,16829323698424890512,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3412 --field-trial-handle=1364,i,5836758517412741999,16829323698424890512,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3420 --field-trial-handle=1364,i,5836758517412741999,16829323698424890512,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x57c1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD592766ed22745e8a3f76f65c3bfcbaf34
SHA14ff2eaf64e087cfa3d4297668fa59b9e9978e681
SHA256314f8d03c36c27aadba2bc65e70d4b3bd0b1e74ecab548b8779687112a7a3ad8
SHA512064fb0576d69d63971ddf389e22808024822798bc0ab291b95286013cf1442a603ec8aaaec4d0d0d25099169fce3cdf4794061343a3ceb35ab3f28b2225fa8e4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
265KB
MD5cb84ce52ba2eee94470633cd01ed9849
SHA1eafea5cdc9493d31db5706aa02d398b1cacafdff
SHA2562aecc95f31c6f9ef87b7c816cdb9447abc919916582f9e5cb161d5429528c37a
SHA5128c1723d5fc01c47e55dce030481fb972b6512873a3a29f8cbade61c9d29e27547959daa7185c976c41a067d815df0caa88975fc13a8dff6e371b20ad0905c011
-
C:\Users\Admin\AppData\Local\Temp\tmp83DF.tmp.batFilesize
151B
MD56bbb939a345e1a47eaa47ba42db2aec7
SHA13e69587570d9bcb20d82ab92fe2306efb2d3913e
SHA256f8af1c9554b39ed708486740e2c0eaf546131b0044068fbdf4b03e26f36df553
SHA512e8af0d981a5f286d083c4a5d763dede7e93fef5256d240f5507072dbee0eaa4e5a20a16a97522d1a41b0f90e1eb8c3238e2beed296371b5530d008dd88d469d7
-
\??\pipe\crashpad_1676_HZAWTELSIOVXLFYLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Roaming\svchost.exeFilesize
397KB
MD517d0b9ac75dfd038ac11c64940a5a6cb
SHA1fdf4a6d488ba2220c808a8e233ea0e219273c3b2
SHA256c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5
SHA5120ffb63b421da1daa0ca2098ea35b6e5be5b8613b9b4855b723b2c6032bcf644f7d00ddb35ab1af443c5f765fa10c61cb5c28fe81734ea4e582b51ed56c1afecd
-
memory/1452-120-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/1912-34-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1912-41-0x0000000004AB0000-0x0000000004AF0000-memory.dmpFilesize
256KB
-
memory/1912-21-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1912-23-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1912-25-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1912-27-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1912-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1912-30-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1912-137-0x0000000074470000-0x0000000074B5E000-memory.dmpFilesize
6.9MB
-
memory/1912-32-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1912-40-0x0000000074470000-0x0000000074B5E000-memory.dmpFilesize
6.9MB
-
memory/1912-45-0x00000000004C0000-0x00000000004D6000-memory.dmpFilesize
88KB
-
memory/1912-44-0x0000000004AB0000-0x0000000004AF0000-memory.dmpFilesize
256KB
-
memory/1912-43-0x0000000074470000-0x0000000074B5E000-memory.dmpFilesize
6.9MB
-
memory/2012-13-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmpFilesize
9.9MB
-
memory/2012-3-0x00000000005A0000-0x0000000000600000-memory.dmpFilesize
384KB
-
memory/2012-2-0x000000001B020000-0x000000001B0A0000-memory.dmpFilesize
512KB
-
memory/2012-1-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmpFilesize
9.9MB
-
memory/2012-0-0x0000000000840000-0x000000000084C000-memory.dmpFilesize
48KB
-
memory/2200-140-0x00000000027E0000-0x00000000027E1000-memory.dmpFilesize
4KB
-
memory/2924-42-0x000007FEF4770000-0x000007FEF515C000-memory.dmpFilesize
9.9MB
-
memory/2924-20-0x000000001AE50000-0x000000001AED0000-memory.dmpFilesize
512KB
-
memory/2924-18-0x0000000001220000-0x000000000122C000-memory.dmpFilesize
48KB
-
memory/2924-19-0x000007FEF4770000-0x000007FEF515C000-memory.dmpFilesize
9.9MB