Analysis

  • max time kernel
    125s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 04:56

General

  • Target

    75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe

  • Size

    7.5MB

  • MD5

    75552440685c9dc4644df81c7e365370

  • SHA1

    0935691adc68a97a6a677c3fa8751568b04b383e

  • SHA256

    f079f9374811130ef9b4df4ecb0d7b70cc253c2df7774ddb3f13363797f52124

  • SHA512

    74dd580f6f2ef2ca8b193d7d522034f1f2235cd95e176c646cf4aab4d975567fa096d3b66fa6df15e89abad5361e6b3812ea51df68e47e90d6fcc1fc6c50ed45

  • SSDEEP

    98304:3h5cyZ/K9NFLsO0MJdX1ezhQcSZcOb+sX1Zvbed4Z0FGRABTgtse6vzovkGx:3h5lZ/WFAnMJdehQcERCsXDjyZkJMY

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1328
    • C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\75552440685c9dc4644df81c7e365370_NeikiAnalytics.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c Update.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4224
        • C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe
          Update.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3236
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\gniOKJTyiy2L24587b.vbe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:5012
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\G8uE6tD633eayRxoVmMQKAQRLRgR.bat" "
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:984
              • C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe
                "C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon/msWinruntimebrokercrt.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3948
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\dwm.exe'
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2696
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1492
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3168
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\RuntimeBroker.exe'
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4900
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\msWinruntimebrokercrt.exe'
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5016
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DYS9JLSQ5I.bat"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2700
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    9⤵
                      PID:1608
                    • C:\Windows\system32\PING.EXE
                      ping -n 10 localhost
                      9⤵
                      • Runs ping.exe
                      PID:2740
                    • C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe
                      "C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe"
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1928
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8
      1⤵
        PID:676
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\dwm.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1196
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\it-IT\dwm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1524
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\it-IT\dwm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2020
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:316
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4984
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4468
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1868
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2596
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1608
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1540
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2924
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3508
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msWinruntimebrokercrtm" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Recent\msWinruntimebrokercrt.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3680
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msWinruntimebrokercrt" /sc ONLOGON /tr "'C:\Users\Default\Recent\msWinruntimebrokercrt.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1032
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msWinruntimebrokercrtm" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Recent\msWinruntimebrokercrt.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4236

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        d28a889fd956d5cb3accfbaf1143eb6f

        SHA1

        157ba54b365341f8ff06707d996b3635da8446f7

        SHA256

        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

        SHA512

        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

      • C:\Users\Admin\AppData\Local\Temp\DYS9JLSQ5I.bat

        Filesize

        182B

        MD5

        99de3325e034d64e5f848bc532ab8757

        SHA1

        73744b5080d9234dc3e24bd9dd30e1e41397ad5a

        SHA256

        12a54106c2faff75d0e0ae0f604339c14115b0a37dd0a424f986d8b69560b16a

        SHA512

        0539438c09dd85837e948408c386e13580b15ba8e84827512480e47bb38e709c765a2330b140e3a1b4a14807eb32d5691ea519fee24774a1467e0e5aeb487ab4

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.exe

        Filesize

        2.6MB

        MD5

        09a97734007a8bf914a52e703e3fab2a

        SHA1

        34b65e86de26e0214259cc23594c43d8ae3634dc

        SHA256

        4c4883f0ee5ad8b71c2256f2ee95c1956b6a47308d8223f82fb5f91d392b29bf

        SHA512

        ab0542b67d62d55ace25b1e5b0e6a786ef1064fb518e1d45df5e3db80610d030c20c318b4019d4859ac356f7299f1fe609a7638c772f35694b43ecb8f36f579a

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\Update.zip

        Filesize

        2.4MB

        MD5

        c3cda7c747788b44fae029d327ed3e13

        SHA1

        9bf9da89ec0c5da9ee5e30a2711444dcb930cd85

        SHA256

        45b919cfb1807ae86bd7cf8f9a6630708a81f7dc9799b5328177e1a25fa0e2cd

        SHA512

        5cdadc0801568fb7adc9de75eeb75a4f8e1d81297f95318c58229b7b09392ae8d1b88063e712481ff28020e12e9372e1e8049f0ed850142e76531adfbeb9c91f

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\VCRUNTIME140.dll

        Filesize

        93KB

        MD5

        4a365ffdbde27954e768358f4a4ce82e

        SHA1

        a1b31102eee1d2a4ed1290da2038b7b9f6a104a3

        SHA256

        6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c

        SHA512

        54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\_bz2.pyd

        Filesize

        84KB

        MD5

        e91b4f8e1592da26bacaceb542a220a8

        SHA1

        5459d4c2147fa6db75211c3ec6166b869738bd38

        SHA256

        20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f

        SHA512

        cb797fa758c65358e5b0fef739181f6b39e0629758a6f8d5c4bd7dc6422001769a19df0c746724fb2567a58708b18bbd098327bfbdf3378426049b113eb848e9

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\_decimal.pyd

        Filesize

        264KB

        MD5

        65287fd87a64bc756867a1afddec9e29

        SHA1

        cda1db353f81df7a4a818add8f87bca9ac840455

        SHA256

        df19c2e6ec3145166fa8d206c11db78bc1979a027105c4f21d40410b5082ba34

        SHA512

        3e3f19cf965b260ffc68e45d5101234e8a957411c076a0d487d307dcfa714a9801cb501224fe7621937aebdf90275f655c8a70dd6675bcfb5374404fda53236f

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\_hashlib.pyd

        Filesize

        64KB

        MD5

        7c69cb3cb3182a97e3e9a30d2241ebed

        SHA1

        1b8754ff57a14c32bcadc330d4880382c7fffc93

        SHA256

        12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20

        SHA512

        96dbabbc6b98d473cbe06dcd296f6c6004c485e57ac5ba10560a377393875192b22df8a7103fe4a22795b8d81b8b0ae14ce7646262f87cb609b9e2590a93169e

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\_lzma.pyd

        Filesize

        159KB

        MD5

        493c33ddf375b394b648c4283b326481

        SHA1

        59c87ee582ba550f064429cb26ad79622c594f08

        SHA256

        6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16

        SHA512

        a4a83f04c7fc321796ce6a932d572dca1ad6ecefd31002320aeaa2453701ed49ef9f0d9ba91c969737565a6512b94fbb0311aee53d355345a03e98f43e6f98b2

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\_socket.pyd

        Filesize

        78KB

        MD5

        fd1cfe0f0023c5780247f11d8d2802c9

        SHA1

        5b29a3b4c6edb6fa176077e1f1432e3b0178f2bc

        SHA256

        258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6

        SHA512

        b304a2e56829a557ec401c6fdda78d6d05b7495a610c1ed793d6b25fc5af891cb2a1581addb27ab5e2a6cb0be24d9678f67b97828015161bc875df9b7b5055ae

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\base_library.zip

        Filesize

        826KB

        MD5

        2abe470164e060916c6842da1263e5ad

        SHA1

        197163bfb26ce54420fa6eba03cf0fa0a5622934

        SHA256

        151a4c8ea261130b5ae94653e5470ac6fe4663de269c187b2b38d6fccadc1baa

        SHA512

        01e2c58b24f7d3d7b31df97c6dbe8aee0c0f61f457c78d62830fa954c17dffb74b4e5389ef389926b5ba78f96deb08ad4cd61c9ecea256bf35e0a99cd2366d65

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\libcrypto-1_1.dll

        Filesize

        3.2MB

        MD5

        89511df61678befa2f62f5025c8c8448

        SHA1

        df3961f833b4964f70fcf1c002d9fd7309f53ef8

        SHA256

        296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf

        SHA512

        9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\python39.dll

        Filesize

        4.3MB

        MD5

        5cd203d356a77646856341a0c9135fc6

        SHA1

        a1f4ac5cc2f5ecb075b3d0129e620784814a48f7

        SHA256

        a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a

        SHA512

        390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\select.pyd

        Filesize

        28KB

        MD5

        0e3cf5d792a3f543be8bbc186b97a27a

        SHA1

        50f4c70fce31504c6b746a2c8d9754a16ebc8d5e

        SHA256

        c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460

        SHA512

        224b42e05b4dbdf7275ee7c5d3eb190024fc55e22e38bd189c1685efee2a3dd527c6dfcb2feeec525b8d6dc35aded1eac2423ed62bb2599bb6a9ea34e842c340

      • C:\Users\Admin\AppData\Local\Temp\_MEI13282\unicodedata.pyd

        Filesize

        1.1MB

        MD5

        7af51031368619638cca688a7275db14

        SHA1

        64e2cc5ac5afe8a65af690047dc03858157e964c

        SHA256

        7f02a99a23cc3ff63ecb10ba6006e2da7bf685530bad43882ebf90d042b9eeb6

        SHA512

        fbde24501288ff9b06fc96faff5e7a1849765df239e816774c04a4a6ef54a0c641adf4325bfb116952082d3234baef12288174ad8c18b62407109f29aa5ab326

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_haitpdm5.ogp.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\G8uE6tD633eayRxoVmMQKAQRLRgR.bat

        Filesize

        106B

        MD5

        e24834f7ee8cf79c64bad3c8b584c544

        SHA1

        cfab87d796f5ea2d859c79b031f27989f5c8db8e

        SHA256

        396bc8928db2bf0bab219079382ab3d59f2583a520b04733536a06862f937737

        SHA512

        9c60f85ab02992a7aa33b0804908fe1750fa033ab5d706228095ff8eb2613c1bfb5fb3a50c96ff9ef00de449bd6b49f1de451066787ced637740e1245e424594

      • C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\gniOKJTyiy2L24587b.vbe

        Filesize

        236B

        MD5

        6e94c3b45fb8800584700c41110ede32

        SHA1

        d0f84586a043845f8c8f27699ed0bb6f2d65971c

        SHA256

        3c116f72cbd04239eeea6b4ec789d47c9fe9c946ff9cdc16bd792a9fc55bbde7

        SHA512

        c3cda3dadd3df7067812139d5598f9fd2d6cd9f7afeab51820a8fbf44d8ab489944cd8e04b73a8391ee043401c06e550bcf79b9892fb520e7ac6bb982b04f516

      • C:\Users\Admin\AppData\Roaming\chainProviderBrowserCommon\msWinruntimebrokercrt.exe

        Filesize

        2.2MB

        MD5

        25e509398197efe59f7f088c75833914

        SHA1

        3c0482b5e12a1df6f184b43b4f87041140e2d163

        SHA256

        66d0f44a9c53f8874252142bd6334ab2e3373e42bd4ba9fda3b337f8eb5d1805

        SHA512

        35eba476c6f013aabefdd192a64bf0b5debf87a7e66ec59b87c083f39cb6a496209ff73e7492432580b581a06ae1ebe1d4de6c225f470f17b371fe1f8c3b8452

      • memory/3168-3652-0x0000024A80010000-0x0000024A80032000-memory.dmp

        Filesize

        136KB

      • memory/3948-53-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-99-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-79-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-77-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-75-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-73-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-71-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-81-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-69-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-65-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-61-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-59-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-57-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-87-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-51-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-49-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-46-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-67-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-63-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-55-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-101-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-109-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-107-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-105-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-103-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-83-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-97-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-95-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-91-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-89-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-3603-0x0000000000BC0000-0x0000000000BCE000-memory.dmp

        Filesize

        56KB

      • memory/3948-3605-0x0000000002550000-0x000000000256C000-memory.dmp

        Filesize

        112KB

      • memory/3948-3606-0x0000000002700000-0x0000000002750000-memory.dmp

        Filesize

        320KB

      • memory/3948-3608-0x0000000002570000-0x0000000002588000-memory.dmp

        Filesize

        96KB

      • memory/3948-3610-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

        Filesize

        64KB

      • memory/3948-3612-0x0000000000C70000-0x0000000000C7E000-memory.dmp

        Filesize

        56KB

      • memory/3948-3614-0x0000000002530000-0x000000000253C000-memory.dmp

        Filesize

        48KB

      • memory/3948-3616-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/3948-3618-0x0000000002540000-0x000000000254C000-memory.dmp

        Filesize

        48KB

      • memory/3948-3620-0x0000000002770000-0x0000000002786000-memory.dmp

        Filesize

        88KB

      • memory/3948-3622-0x00000000026B0000-0x00000000026BC000-memory.dmp

        Filesize

        48KB

      • memory/3948-3624-0x00000000026C0000-0x00000000026CE000-memory.dmp

        Filesize

        56KB

      • memory/3948-3626-0x00000000026F0000-0x00000000026FC000-memory.dmp

        Filesize

        48KB

      • memory/3948-3628-0x000000001C410000-0x000000001C45E000-memory.dmp

        Filesize

        312KB

      • memory/3948-93-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-85-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-47-0x000000001B060000-0x000000001B2F2000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-45-0x000000001B060000-0x000000001B2F8000-memory.dmp

        Filesize

        2.6MB

      • memory/3948-44-0x0000000000400000-0x0000000000408000-memory.dmp

        Filesize

        32KB