Analysis
-
max time kernel
104s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 07:34
Behavioral task
behavioral1
Sample
Dishkum Tena.exe
Resource
win7-20240221-en
General
-
Target
Dishkum Tena.exe
-
Size
3.1MB
-
MD5
36970784c3736c71546d73e0773ee956
-
SHA1
2d09c257a3e09b079d23520400953bafc495e06e
-
SHA256
55d9f08bfa42b14a3bbb968df3b645e18ea4c311656c272c1b9522aa648f955d
-
SHA512
6f0fd26eb7f2b64c875f7021f82ddf8240beaba804a6649404ac8e33115d1372dc53cae94e242b1a77a4bf86f4836bc072b9e64563204b591d03357d3c82be2c
-
SSDEEP
49152:Gvht62XlaSFNWPjljiFa2RoUYI1C91JgLoGd9hTHHB72eh2NT:GvL62XlaSFNWPjljiFXRoUYI1CE
Malware Config
Extracted
quasar
1.4.1
Dani69
192.168.1.2:4782
9f26ad88-50ee-4f62-81ff-c770a798a67c
-
encryption_key
81B07382BFEB227CBA1AE8701042E7A26708E9ED
-
install_name
Dani69.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Dani69
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-1-0x0000000000810000-0x0000000000B34000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Dani69.exe family_quasar behavioral1/memory/3036-8-0x00000000009B0000-0x0000000000CD4000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Dani69.exepid process 3036 Dani69.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2892 schtasks.exe 2000 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 2720 chrome.exe 2720 chrome.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
Dishkum Tena.exeDani69.exechrome.exedescription pid process Token: SeDebugPrivilege 2916 Dishkum Tena.exe Token: SeDebugPrivilege 3036 Dani69.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe Token: SeShutdownPrivilege 2720 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
Dani69.exechrome.exepid process 3036 Dani69.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe -
Suspicious use of SendNotifyMessage 33 IoCs
Processes:
Dani69.exechrome.exepid process 3036 Dani69.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe 2720 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Dani69.exepid process 3036 Dani69.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Dishkum Tena.exeDani69.exewmplayer.exechrome.exedescription pid process target process PID 2916 wrote to memory of 2892 2916 Dishkum Tena.exe schtasks.exe PID 2916 wrote to memory of 2892 2916 Dishkum Tena.exe schtasks.exe PID 2916 wrote to memory of 2892 2916 Dishkum Tena.exe schtasks.exe PID 2916 wrote to memory of 3036 2916 Dishkum Tena.exe Dani69.exe PID 2916 wrote to memory of 3036 2916 Dishkum Tena.exe Dani69.exe PID 2916 wrote to memory of 3036 2916 Dishkum Tena.exe Dani69.exe PID 3036 wrote to memory of 2000 3036 Dani69.exe schtasks.exe PID 3036 wrote to memory of 2000 3036 Dani69.exe schtasks.exe PID 3036 wrote to memory of 2000 3036 Dani69.exe schtasks.exe PID 2696 wrote to memory of 2420 2696 wmplayer.exe setup_wm.exe PID 2696 wrote to memory of 2420 2696 wmplayer.exe setup_wm.exe PID 2696 wrote to memory of 2420 2696 wmplayer.exe setup_wm.exe PID 2696 wrote to memory of 2420 2696 wmplayer.exe setup_wm.exe PID 2696 wrote to memory of 2420 2696 wmplayer.exe setup_wm.exe PID 2696 wrote to memory of 2420 2696 wmplayer.exe setup_wm.exe PID 2696 wrote to memory of 2420 2696 wmplayer.exe setup_wm.exe PID 2720 wrote to memory of 2716 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 2716 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 2716 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1196 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1160 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1160 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1160 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1980 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1980 2720 chrome.exe chrome.exe PID 2720 wrote to memory of 1980 2720 chrome.exe chrome.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dishkum Tena.exe"C:\Users\Admin\AppData\Local\Temp\Dishkum Tena.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Dani69" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Dani69.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Dani69.exe"C:\Users\Admin\AppData\Roaming\SubDir\Dani69.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Dani69" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Dani69.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feeb439758,0x7feeb439768,0x7feeb4397782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1632 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2280 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1500 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1256 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1284 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3452 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3504 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 --field-trial-handle=1348,i,16316081378120497945,6699514552814711740,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmpFilesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD56f7a1cf48f44a33a2c5e1fd902e6e1d6
SHA189b964dc261690834af8b7bf3426227fafebdc38
SHA25669e7e2b535d8fe775b7fb02e1e73b7b4a23c3c50b68ca58c0177fe9ae58df164
SHA512912fbe22bec679960b30f1d59f48e4d4cb1e0d40f45d92337ff2932fd03d373451f08dcce8f2234f44ca666e4ea067b9e34c0897f815b2f2935ce32985df4cdc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Temp\tmp24421.WMC\allservices.xmlFilesize
546B
MD5df03e65b8e082f24dab09c57bc9c6241
SHA16b0dacbf38744c9a381830e6a5dc4c71bd7cedbf
SHA256155b9c588061c71832af329fafa5678835d9153b8fbb7592195ae953d0c455ba
SHA512ef1cc8d27fbc5da5daab854c933d3914b84ee539d4d2f0126dc1a04a830c5599e39a923c80257653638b1b99b0073a7174cc164be5887181730883c752ba2f99
-
C:\Users\Admin\AppData\Local\Temp\tmp26885.WMC\serviceinfo.xmlFilesize
523B
MD5d58da90d6dc51f97cb84dfbffe2b2300
SHA15f86b06b992a3146cb698a99932ead57a5ec4666
SHA25693acdb79543d9248ca3fca661f3ac287e6004e4b3dafd79d4c4070794ffbf2ad
SHA5127f1e95e5aa4c8a0e4c967135c78f22f4505f2a48bbc619924d0096bf4a94d469389b9e8488c12edacfba819517b8376546687d1145660ad1f49d8c20a744e636
-
C:\Users\Admin\AppData\Roaming\SubDir\Dani69.exeFilesize
3.1MB
MD536970784c3736c71546d73e0773ee956
SHA12d09c257a3e09b079d23520400953bafc495e06e
SHA25655d9f08bfa42b14a3bbb968df3b645e18ea4c311656c272c1b9522aa648f955d
SHA5126f0fd26eb7f2b64c875f7021f82ddf8240beaba804a6649404ac8e33115d1372dc53cae94e242b1a77a4bf86f4836bc072b9e64563204b591d03357d3c82be2c
-
\??\pipe\crashpad_2720_NRHLJLFYQXMFCBGAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2472-125-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2472-126-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2916-9-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmpFilesize
9.9MB
-
memory/2916-0-0x000007FEF5353000-0x000007FEF5354000-memory.dmpFilesize
4KB
-
memory/2916-2-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmpFilesize
9.9MB
-
memory/2916-1-0x0000000000810000-0x0000000000B34000-memory.dmpFilesize
3.1MB
-
memory/3036-8-0x00000000009B0000-0x0000000000CD4000-memory.dmpFilesize
3.1MB
-
memory/3036-12-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmpFilesize
9.9MB
-
memory/3036-11-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmpFilesize
9.9MB
-
memory/3036-10-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmpFilesize
9.9MB