Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows7_x64 -
resource
win7 -
submitted
25-10-2020 19:54
Static task
static1
Behavioral task
behavioral1
Sample
d1e4712d3aaa767f88370dd745cef939.exe
Resource
win7
General
-
Target
d1e4712d3aaa767f88370dd745cef939.exe
-
Size
952KB
-
MD5
d1e4712d3aaa767f88370dd745cef939
-
SHA1
a48f26a9d9e1c383938ca74be47c39dafcdf4a49
-
SHA256
81bb2960d19ec9b9c778b010051b08a27dcf29e9fa4ea382bc5163c7e60f55e3
-
SHA512
5613da65ca1cd568ddb2cb27014fe09339145976592ed318600019c022f771b297609b058ea740f47ab307c640e62375ebb6fdcb4634213dadb400d2cbfcce79
Malware Config
Extracted
darkcomet
Guest16
joylynch.ddns.net:100
DC_MUTEX-GUU4ZZV
-
gencode
USwcMCrQTcVd
-
install
false
-
offline_keylogger
true
-
persistence
false
Extracted
pony
http://lynch.herobo.com/pcss/gate.php
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
pony#904.exeNcbService.exeBthHFSrv.exepony#904.exeNcbService.exepid process 1584 pony#904.exe 1916 NcbService.exe 1000 BthHFSrv.exe 1892 pony#904.exe 1080 NcbService.exe -
Loads dropped DLL 4 IoCs
Processes:
d1e4712d3aaa767f88370dd745cef939.exeNcbService.exepony#904.exepid process 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1916 NcbService.exe 1584 pony#904.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
d1e4712d3aaa767f88370dd745cef939.exepony#904.exeBthHFSrv.exedescription pid process target process PID 1400 set thread context of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1584 set thread context of 1892 1584 pony#904.exe pony#904.exe PID 1000 set thread context of 528 1000 BthHFSrv.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d1e4712d3aaa767f88370dd745cef939.exeNcbService.exepid process 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1916 NcbService.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1916 NcbService.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1916 NcbService.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1916 NcbService.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe 1400 d1e4712d3aaa767f88370dd745cef939.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
d1e4712d3aaa767f88370dd745cef939.exevbc.exeNcbService.exepony#904.exeBthHFSrv.exeNcbService.exepony#904.exevbc.exedescription pid process Token: SeDebugPrivilege 1400 d1e4712d3aaa767f88370dd745cef939.exe Token: SeIncreaseQuotaPrivilege 1940 vbc.exe Token: SeSecurityPrivilege 1940 vbc.exe Token: SeTakeOwnershipPrivilege 1940 vbc.exe Token: SeLoadDriverPrivilege 1940 vbc.exe Token: SeSystemProfilePrivilege 1940 vbc.exe Token: SeSystemtimePrivilege 1940 vbc.exe Token: SeProfSingleProcessPrivilege 1940 vbc.exe Token: SeIncBasePriorityPrivilege 1940 vbc.exe Token: SeCreatePagefilePrivilege 1940 vbc.exe Token: SeBackupPrivilege 1940 vbc.exe Token: SeRestorePrivilege 1940 vbc.exe Token: SeShutdownPrivilege 1940 vbc.exe Token: SeDebugPrivilege 1940 vbc.exe Token: SeSystemEnvironmentPrivilege 1940 vbc.exe Token: SeChangeNotifyPrivilege 1940 vbc.exe Token: SeRemoteShutdownPrivilege 1940 vbc.exe Token: SeUndockPrivilege 1940 vbc.exe Token: SeManageVolumePrivilege 1940 vbc.exe Token: SeImpersonatePrivilege 1940 vbc.exe Token: SeCreateGlobalPrivilege 1940 vbc.exe Token: 33 1940 vbc.exe Token: 34 1940 vbc.exe Token: 35 1940 vbc.exe Token: SeDebugPrivilege 1916 NcbService.exe Token: SeDebugPrivilege 1584 pony#904.exe Token: SeDebugPrivilege 1000 BthHFSrv.exe Token: SeDebugPrivilege 1080 NcbService.exe Token: SeImpersonatePrivilege 1892 pony#904.exe Token: SeTcbPrivilege 1892 pony#904.exe Token: SeChangeNotifyPrivilege 1892 pony#904.exe Token: SeCreateTokenPrivilege 1892 pony#904.exe Token: SeBackupPrivilege 1892 pony#904.exe Token: SeRestorePrivilege 1892 pony#904.exe Token: SeIncreaseQuotaPrivilege 1892 pony#904.exe Token: SeAssignPrimaryTokenPrivilege 1892 pony#904.exe Token: SeIncreaseQuotaPrivilege 528 vbc.exe Token: SeSecurityPrivilege 528 vbc.exe Token: SeTakeOwnershipPrivilege 528 vbc.exe Token: SeLoadDriverPrivilege 528 vbc.exe Token: SeSystemProfilePrivilege 528 vbc.exe Token: SeSystemtimePrivilege 528 vbc.exe Token: SeProfSingleProcessPrivilege 528 vbc.exe Token: SeIncBasePriorityPrivilege 528 vbc.exe Token: SeCreatePagefilePrivilege 528 vbc.exe Token: SeBackupPrivilege 528 vbc.exe Token: SeRestorePrivilege 528 vbc.exe Token: SeShutdownPrivilege 528 vbc.exe Token: SeDebugPrivilege 528 vbc.exe Token: SeSystemEnvironmentPrivilege 528 vbc.exe Token: SeChangeNotifyPrivilege 528 vbc.exe Token: SeRemoteShutdownPrivilege 528 vbc.exe Token: SeUndockPrivilege 528 vbc.exe Token: SeManageVolumePrivilege 528 vbc.exe Token: SeImpersonatePrivilege 528 vbc.exe Token: SeCreateGlobalPrivilege 528 vbc.exe Token: 33 528 vbc.exe Token: 34 528 vbc.exe Token: 35 528 vbc.exe Token: SeImpersonatePrivilege 1892 pony#904.exe Token: SeTcbPrivilege 1892 pony#904.exe Token: SeChangeNotifyPrivilege 1892 pony#904.exe Token: SeCreateTokenPrivilege 1892 pony#904.exe Token: SeBackupPrivilege 1892 pony#904.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 1940 vbc.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
d1e4712d3aaa767f88370dd745cef939.exeNcbService.exepony#904.exeBthHFSrv.exedescription pid process target process PID 1400 wrote to memory of 1584 1400 d1e4712d3aaa767f88370dd745cef939.exe pony#904.exe PID 1400 wrote to memory of 1584 1400 d1e4712d3aaa767f88370dd745cef939.exe pony#904.exe PID 1400 wrote to memory of 1584 1400 d1e4712d3aaa767f88370dd745cef939.exe pony#904.exe PID 1400 wrote to memory of 1584 1400 d1e4712d3aaa767f88370dd745cef939.exe pony#904.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1940 1400 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 1400 wrote to memory of 1916 1400 d1e4712d3aaa767f88370dd745cef939.exe NcbService.exe PID 1400 wrote to memory of 1916 1400 d1e4712d3aaa767f88370dd745cef939.exe NcbService.exe PID 1400 wrote to memory of 1916 1400 d1e4712d3aaa767f88370dd745cef939.exe NcbService.exe PID 1400 wrote to memory of 1916 1400 d1e4712d3aaa767f88370dd745cef939.exe NcbService.exe PID 1400 wrote to memory of 1916 1400 d1e4712d3aaa767f88370dd745cef939.exe NcbService.exe PID 1400 wrote to memory of 1916 1400 d1e4712d3aaa767f88370dd745cef939.exe NcbService.exe PID 1400 wrote to memory of 1916 1400 d1e4712d3aaa767f88370dd745cef939.exe NcbService.exe PID 1916 wrote to memory of 1000 1916 NcbService.exe BthHFSrv.exe PID 1916 wrote to memory of 1000 1916 NcbService.exe BthHFSrv.exe PID 1916 wrote to memory of 1000 1916 NcbService.exe BthHFSrv.exe PID 1916 wrote to memory of 1000 1916 NcbService.exe BthHFSrv.exe PID 1584 wrote to memory of 1892 1584 pony#904.exe pony#904.exe PID 1584 wrote to memory of 1892 1584 pony#904.exe pony#904.exe PID 1584 wrote to memory of 1892 1584 pony#904.exe pony#904.exe PID 1584 wrote to memory of 1892 1584 pony#904.exe pony#904.exe PID 1584 wrote to memory of 1892 1584 pony#904.exe pony#904.exe PID 1584 wrote to memory of 1892 1584 pony#904.exe pony#904.exe PID 1584 wrote to memory of 1892 1584 pony#904.exe pony#904.exe PID 1584 wrote to memory of 1892 1584 pony#904.exe pony#904.exe PID 1584 wrote to memory of 1892 1584 pony#904.exe pony#904.exe PID 1584 wrote to memory of 1080 1584 pony#904.exe NcbService.exe PID 1584 wrote to memory of 1080 1584 pony#904.exe NcbService.exe PID 1584 wrote to memory of 1080 1584 pony#904.exe NcbService.exe PID 1584 wrote to memory of 1080 1584 pony#904.exe NcbService.exe PID 1584 wrote to memory of 1080 1584 pony#904.exe NcbService.exe PID 1584 wrote to memory of 1080 1584 pony#904.exe NcbService.exe PID 1584 wrote to memory of 1080 1584 pony#904.exe NcbService.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe PID 1000 wrote to memory of 528 1000 BthHFSrv.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1e4712d3aaa767f88370dd745cef939.exe"C:\Users\Admin\AppData\Local\Temp\d1e4712d3aaa767f88370dd745cef939.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\Desktop\pony#904.exe"C:\Users\Admin\Desktop\pony#904.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\Desktop\pony#904.exe"C:\Users\Admin\Desktop\pony#904.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1892 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1080 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1940 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\BthHFSrv.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\BthHFSrv3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:528
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\BthHFSrv.exeMD5
d1e4712d3aaa767f88370dd745cef939
SHA1a48f26a9d9e1c383938ca74be47c39dafcdf4a49
SHA25681bb2960d19ec9b9c778b010051b08a27dcf29e9fa4ea382bc5163c7e60f55e3
SHA5125613da65ca1cd568ddb2cb27014fe09339145976592ed318600019c022f771b297609b058ea740f47ab307c640e62375ebb6fdcb4634213dadb400d2cbfcce79
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\BthHFSrv.exeMD5
d1e4712d3aaa767f88370dd745cef939
SHA1a48f26a9d9e1c383938ca74be47c39dafcdf4a49
SHA25681bb2960d19ec9b9c778b010051b08a27dcf29e9fa4ea382bc5163c7e60f55e3
SHA5125613da65ca1cd568ddb2cb27014fe09339145976592ed318600019c022f771b297609b058ea740f47ab307c640e62375ebb6fdcb4634213dadb400d2cbfcce79
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exeMD5
9414df91ba64c4c82bfd956988879e61
SHA1d19a527f58c4102d92b4108a6564a4247e3aa844
SHA256fb407f6cdce0fbb2efc69e878f32b5d0ec4c86d928c726a27b4e98c843813bb7
SHA51241abec7d8c0416bc5bb61916c7dc78da1fa06a0cb8f87ccc9795bc8cebca84067640c6907b5eb3f89884509c8f7b4e61a6c0ea38f8b5da579eba650adb144309
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exeMD5
9414df91ba64c4c82bfd956988879e61
SHA1d19a527f58c4102d92b4108a6564a4247e3aa844
SHA256fb407f6cdce0fbb2efc69e878f32b5d0ec4c86d928c726a27b4e98c843813bb7
SHA51241abec7d8c0416bc5bb61916c7dc78da1fa06a0cb8f87ccc9795bc8cebca84067640c6907b5eb3f89884509c8f7b4e61a6c0ea38f8b5da579eba650adb144309
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exeMD5
9414df91ba64c4c82bfd956988879e61
SHA1d19a527f58c4102d92b4108a6564a4247e3aa844
SHA256fb407f6cdce0fbb2efc69e878f32b5d0ec4c86d928c726a27b4e98c843813bb7
SHA51241abec7d8c0416bc5bb61916c7dc78da1fa06a0cb8f87ccc9795bc8cebca84067640c6907b5eb3f89884509c8f7b4e61a6c0ea38f8b5da579eba650adb144309
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exeMD5
9414df91ba64c4c82bfd956988879e61
SHA1d19a527f58c4102d92b4108a6564a4247e3aa844
SHA256fb407f6cdce0fbb2efc69e878f32b5d0ec4c86d928c726a27b4e98c843813bb7
SHA51241abec7d8c0416bc5bb61916c7dc78da1fa06a0cb8f87ccc9795bc8cebca84067640c6907b5eb3f89884509c8f7b4e61a6c0ea38f8b5da579eba650adb144309
-
C:\Users\Admin\Desktop\pony#904.exeMD5
2c859cb22d53ca31d82916ba16dbde1a
SHA1150d442f694d8fe962f42f0db5531adcd0700851
SHA25622b74388c7b6da854adac2900b6577aab0e180a5d3daff90e1b1049751fd87b2
SHA512192a2f609624f4b6c92de626964fd3c967efec0ac68bf5cea2c315830a35dc5b13acb2da00be0ec2887e8472dbe4d2c27c86f9ceb9991f3a8ea41ed708720134
-
C:\Users\Admin\Desktop\pony#904.exeMD5
2c859cb22d53ca31d82916ba16dbde1a
SHA1150d442f694d8fe962f42f0db5531adcd0700851
SHA25622b74388c7b6da854adac2900b6577aab0e180a5d3daff90e1b1049751fd87b2
SHA512192a2f609624f4b6c92de626964fd3c967efec0ac68bf5cea2c315830a35dc5b13acb2da00be0ec2887e8472dbe4d2c27c86f9ceb9991f3a8ea41ed708720134
-
C:\Users\Admin\Desktop\pony#904.exeMD5
2c859cb22d53ca31d82916ba16dbde1a
SHA1150d442f694d8fe962f42f0db5531adcd0700851
SHA25622b74388c7b6da854adac2900b6577aab0e180a5d3daff90e1b1049751fd87b2
SHA512192a2f609624f4b6c92de626964fd3c967efec0ac68bf5cea2c315830a35dc5b13acb2da00be0ec2887e8472dbe4d2c27c86f9ceb9991f3a8ea41ed708720134
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\BthHFSrv.exeMD5
d1e4712d3aaa767f88370dd745cef939
SHA1a48f26a9d9e1c383938ca74be47c39dafcdf4a49
SHA25681bb2960d19ec9b9c778b010051b08a27dcf29e9fa4ea382bc5163c7e60f55e3
SHA5125613da65ca1cd568ddb2cb27014fe09339145976592ed318600019c022f771b297609b058ea740f47ab307c640e62375ebb6fdcb4634213dadb400d2cbfcce79
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exeMD5
9414df91ba64c4c82bfd956988879e61
SHA1d19a527f58c4102d92b4108a6564a4247e3aa844
SHA256fb407f6cdce0fbb2efc69e878f32b5d0ec4c86d928c726a27b4e98c843813bb7
SHA51241abec7d8c0416bc5bb61916c7dc78da1fa06a0cb8f87ccc9795bc8cebca84067640c6907b5eb3f89884509c8f7b4e61a6c0ea38f8b5da579eba650adb144309
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exeMD5
9414df91ba64c4c82bfd956988879e61
SHA1d19a527f58c4102d92b4108a6564a4247e3aa844
SHA256fb407f6cdce0fbb2efc69e878f32b5d0ec4c86d928c726a27b4e98c843813bb7
SHA51241abec7d8c0416bc5bb61916c7dc78da1fa06a0cb8f87ccc9795bc8cebca84067640c6907b5eb3f89884509c8f7b4e61a6c0ea38f8b5da579eba650adb144309
-
\Users\Admin\Desktop\pony#904.exeMD5
2c859cb22d53ca31d82916ba16dbde1a
SHA1150d442f694d8fe962f42f0db5531adcd0700851
SHA25622b74388c7b6da854adac2900b6577aab0e180a5d3daff90e1b1049751fd87b2
SHA512192a2f609624f4b6c92de626964fd3c967efec0ac68bf5cea2c315830a35dc5b13acb2da00be0ec2887e8472dbe4d2c27c86f9ceb9991f3a8ea41ed708720134
-
memory/528-24-0x000000000048F888-mapping.dmp
-
memory/720-31-0x000007FEF6AE0000-0x000007FEF6D5A000-memory.dmpFilesize
2.5MB
-
memory/1000-13-0x0000000000000000-mapping.dmp
-
memory/1080-20-0x0000000000000000-mapping.dmp
-
memory/1584-1-0x0000000000000000-mapping.dmp
-
memory/1892-15-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1892-16-0x000000000041003A-mapping.dmp
-
memory/1892-18-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1916-7-0x0000000000000000-mapping.dmp
-
memory/1940-4-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1940-5-0x000000000048F888-mapping.dmp
-
memory/1940-10-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB