Analysis
-
max time kernel
77s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-09-2021 13:05
Static task
static1
Behavioral task
behavioral1
Sample
f6200b9b9789794de4a8d78f4ae96d22.exe
Resource
win7-en-20210916
General
-
Target
f6200b9b9789794de4a8d78f4ae96d22.exe
-
Size
292KB
-
MD5
f6200b9b9789794de4a8d78f4ae96d22
-
SHA1
1d18c71e7e4de5c6216653db5effba586345597c
-
SHA256
85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a
-
SHA512
5fd2e93293bf2ebe5b68e747dbed842c2f4fcd74dce883ffa7daa6daf647e41f4b1926fdf2f05048b3024609ef6805fb2a6b501c92335ab37098dfb6d4defa72
Malware Config
Extracted
xpertrat
3.0.10
Test
kapasky-antivirus.firewall-gateway.net:4000
L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0
Signatures
-
XpertRAT Core Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2912-514-0x0000000000401364-mapping.dmp xpertrat -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2800-529-0x0000000000411654-mapping.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/1476-533-0x0000000000442F04-mapping.dmp WebBrowserPassView -
Nirsoft 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2800-529-0x0000000000411654-mapping.dmp Nirsoft behavioral2/memory/1476-533-0x0000000000442F04-mapping.dmp Nirsoft behavioral2/memory/2296-542-0x000000000040C2A8-mapping.dmp Nirsoft -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 3980 notepad.exe -
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" f6200b9b9789794de4a8d78f4ae96d22.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f6200b9b9789794de4a8d78f4ae96d22.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 820 4072 WerFault.exe iexplore.exe 1264 1332 WerFault.exe iexplore.exe -
Suspicious use of SetThreadContext 9 IoCs
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exef6200b9b9789794de4a8d78f4ae96d22.exeiexplore.exedescription pid process target process PID 604 set thread context of 1748 604 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 1748 set thread context of 4072 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 set thread context of 2912 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 2912 set thread context of 1332 2912 iexplore.exe iexplore.exe PID 2912 set thread context of 1328 2912 iexplore.exe iexplore.exe PID 2912 set thread context of 2800 2912 iexplore.exe iexplore.exe PID 2912 set thread context of 1476 2912 iexplore.exe iexplore.exe PID 2912 set thread context of 2728 2912 iexplore.exe iexplore.exe PID 2912 set thread context of 2296 2912 iexplore.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exef6200b9b9789794de4a8d78f4ae96d22.exef6200b9b9789794de4a8d78f4ae96d22.exeiexplore.exeiexplore.exepid process 1204 powershell.exe 1216 powershell.exe 1388 powershell.exe 1388 powershell.exe 1204 powershell.exe 1216 powershell.exe 1388 powershell.exe 1204 powershell.exe 1216 powershell.exe 2276 powershell.exe 2276 powershell.exe 2276 powershell.exe 604 f6200b9b9789794de4a8d78f4ae96d22.exe 604 f6200b9b9789794de4a8d78f4ae96d22.exe 1748 f6200b9b9789794de4a8d78f4ae96d22.exe 1748 f6200b9b9789794de4a8d78f4ae96d22.exe 1748 f6200b9b9789794de4a8d78f4ae96d22.exe 1748 f6200b9b9789794de4a8d78f4ae96d22.exe 1328 iexplore.exe 1328 iexplore.exe 1476 iexplore.exe 1476 iexplore.exe 1748 f6200b9b9789794de4a8d78f4ae96d22.exe 1748 f6200b9b9789794de4a8d78f4ae96d22.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1204 powershell.exe Token: SeDebugPrivilege 1216 powershell.exe Token: SeDebugPrivilege 1388 powershell.exe Token: SeIncreaseQuotaPrivilege 1388 powershell.exe Token: SeSecurityPrivilege 1388 powershell.exe Token: SeTakeOwnershipPrivilege 1388 powershell.exe Token: SeLoadDriverPrivilege 1388 powershell.exe Token: SeSystemProfilePrivilege 1388 powershell.exe Token: SeSystemtimePrivilege 1388 powershell.exe Token: SeProfSingleProcessPrivilege 1388 powershell.exe Token: SeIncBasePriorityPrivilege 1388 powershell.exe Token: SeCreatePagefilePrivilege 1388 powershell.exe Token: SeBackupPrivilege 1388 powershell.exe Token: SeRestorePrivilege 1388 powershell.exe Token: SeShutdownPrivilege 1388 powershell.exe Token: SeDebugPrivilege 1388 powershell.exe Token: SeSystemEnvironmentPrivilege 1388 powershell.exe Token: SeRemoteShutdownPrivilege 1388 powershell.exe Token: SeUndockPrivilege 1388 powershell.exe Token: SeManageVolumePrivilege 1388 powershell.exe Token: 33 1388 powershell.exe Token: 34 1388 powershell.exe Token: 35 1388 powershell.exe Token: 36 1388 powershell.exe Token: SeIncreaseQuotaPrivilege 1216 powershell.exe Token: SeSecurityPrivilege 1216 powershell.exe Token: SeTakeOwnershipPrivilege 1216 powershell.exe Token: SeLoadDriverPrivilege 1216 powershell.exe Token: SeSystemProfilePrivilege 1216 powershell.exe Token: SeSystemtimePrivilege 1216 powershell.exe Token: SeProfSingleProcessPrivilege 1216 powershell.exe Token: SeIncBasePriorityPrivilege 1216 powershell.exe Token: SeCreatePagefilePrivilege 1216 powershell.exe Token: SeBackupPrivilege 1216 powershell.exe Token: SeRestorePrivilege 1216 powershell.exe Token: SeShutdownPrivilege 1216 powershell.exe Token: SeDebugPrivilege 1216 powershell.exe Token: SeSystemEnvironmentPrivilege 1216 powershell.exe Token: SeRemoteShutdownPrivilege 1216 powershell.exe Token: SeUndockPrivilege 1216 powershell.exe Token: SeManageVolumePrivilege 1216 powershell.exe Token: 33 1216 powershell.exe Token: 34 1216 powershell.exe Token: 35 1216 powershell.exe Token: 36 1216 powershell.exe Token: SeIncreaseQuotaPrivilege 1204 powershell.exe Token: SeSecurityPrivilege 1204 powershell.exe Token: SeTakeOwnershipPrivilege 1204 powershell.exe Token: SeLoadDriverPrivilege 1204 powershell.exe Token: SeSystemProfilePrivilege 1204 powershell.exe Token: SeSystemtimePrivilege 1204 powershell.exe Token: SeProfSingleProcessPrivilege 1204 powershell.exe Token: SeIncBasePriorityPrivilege 1204 powershell.exe Token: SeCreatePagefilePrivilege 1204 powershell.exe Token: SeBackupPrivilege 1204 powershell.exe Token: SeRestorePrivilege 1204 powershell.exe Token: SeShutdownPrivilege 1204 powershell.exe Token: SeDebugPrivilege 1204 powershell.exe Token: SeSystemEnvironmentPrivilege 1204 powershell.exe Token: SeRemoteShutdownPrivilege 1204 powershell.exe Token: SeUndockPrivilege 1204 powershell.exe Token: SeManageVolumePrivilege 1204 powershell.exe Token: 33 1204 powershell.exe Token: 34 1204 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exeiexplore.exepid process 1748 f6200b9b9789794de4a8d78f4ae96d22.exe 2912 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exef6200b9b9789794de4a8d78f4ae96d22.exeiexplore.exedescription pid process target process PID 604 wrote to memory of 1216 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 1204 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 1216 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 1216 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 1204 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 1204 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 1388 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 1388 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 1388 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 2276 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 2276 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 2276 604 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 604 wrote to memory of 1748 604 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 604 wrote to memory of 1748 604 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 604 wrote to memory of 1748 604 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 604 wrote to memory of 1748 604 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 604 wrote to memory of 1748 604 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 604 wrote to memory of 1748 604 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 604 wrote to memory of 1748 604 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 1748 wrote to memory of 4072 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 4072 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 4072 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 4072 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 4072 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 4072 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 4072 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 4072 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 2912 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 2912 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 2912 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 2912 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 2912 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 2912 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 2912 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 1748 wrote to memory of 2912 1748 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 2912 wrote to memory of 3980 2912 iexplore.exe notepad.exe PID 2912 wrote to memory of 3980 2912 iexplore.exe notepad.exe PID 2912 wrote to memory of 3980 2912 iexplore.exe notepad.exe PID 2912 wrote to memory of 3980 2912 iexplore.exe notepad.exe PID 2912 wrote to memory of 1332 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1332 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1332 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1332 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1332 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1332 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1332 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1332 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1328 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1328 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1328 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1328 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1328 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1328 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1328 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 1328 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 2800 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 2800 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 2800 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 2800 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 2800 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 2800 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 2800 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 2800 2912 iexplore.exe iexplore.exe PID 2912 wrote to memory of 2800 2912 iexplore.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f6200b9b9789794de4a8d78f4ae96d22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe"C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.facebook.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.twitter.com2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exeC:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 924⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
- Deletes itself
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka0.txt"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 925⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka0.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka1.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka2.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka3.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka4.txt"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
e71a0a7e48b10bde0a9c54387762f33e
SHA1fed75947f1163b00096e24a46e67d9c21e7eeebd
SHA25683d7be67d0eb544d655cc8e8eb687c26f772d6a40ebf8394e5c12b248976a2de
SHA512394c25daef6143de894505189b1edcdffb82fd6ab9de1c9e43865fb790803ff5c384debfe16236d4a9d95a78d3eea548d3cef332ed5a6881ac9c50d252c3c34a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
8660a4637b572e5e873ef1f732a82261
SHA1296063f66b7c9147e4064edb938ee441284ac873
SHA25690867b5af926f1ae0ed73fea9f4cf778f96af16fdcd8595f9fef456db0be074a
SHA512b72cfdf0316db8beb6445c0710017222035c3ba7a7f47b8d72cdab9027c1e01524cc51930cf2cbfa2ce0912376ddf35f976095848e5ee3dc634e4a3421a4e3f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
0c13f05a12dc83f890009cb5385ab227
SHA1f1e7074e5cac5c93a0faa9abad3dbefdf4c5ed0e
SHA2560af61ea8a157a08e01529c7f67a53921e3a7a27c842b01797d0db7eb5cb67c8d
SHA51276022ac70111ab1c0329d6e791c31370bda7a4d38873b91c6e836001dc99e67a0d8d51bd6950f686d2401cbda518acf3ee035f512f8ca774fac2ef2717b39d00
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
2802260e694ebf1227e6e925af81980d
SHA18858ac84ed2b92df1298b129bd867ebe743a38b9
SHA256cc0a6c1a887d205958ef32c526fa2ab6d42f8799ca8b95d5324473fefe65c833
SHA51269c652e93c866c15b999ba641032be6a74f484441c6457df81d34fe13c2cb049a17144c19950dca1b5ec9e4099ff3829ea1285a71eb709095031bc15c9ea0773
-
C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka2.txtMD5
f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka4.txtMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/604-114-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB
-
memory/604-505-0x0000000005C30000-0x0000000005C60000-memory.dmpFilesize
192KB
-
memory/604-504-0x0000000007CE0000-0x0000000007D26000-memory.dmpFilesize
280KB
-
memory/604-119-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/604-118-0x0000000005810000-0x0000000005D0E000-memory.dmpFilesize
5.0MB
-
memory/604-117-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/604-116-0x0000000005D10000-0x0000000005D11000-memory.dmpFilesize
4KB
-
memory/1204-139-0x0000000006642000-0x0000000006643000-memory.dmpFilesize
4KB
-
memory/1204-174-0x0000000008CF0000-0x0000000008CF1000-memory.dmpFilesize
4KB
-
memory/1204-129-0x00000000064E0000-0x00000000064E1000-memory.dmpFilesize
4KB
-
memory/1204-141-0x0000000006AF0000-0x0000000006AF1000-memory.dmpFilesize
4KB
-
memory/1204-132-0x0000000006C80000-0x0000000006C81000-memory.dmpFilesize
4KB
-
memory/1204-121-0x0000000000000000-mapping.dmp
-
memory/1204-137-0x0000000006640000-0x0000000006641000-memory.dmpFilesize
4KB
-
memory/1204-211-0x0000000006643000-0x0000000006644000-memory.dmpFilesize
4KB
-
memory/1204-156-0x0000000007A30000-0x0000000007A31000-memory.dmpFilesize
4KB
-
memory/1216-207-0x00000000048C3000-0x00000000048C4000-memory.dmpFilesize
4KB
-
memory/1216-136-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/1216-180-0x00000000090E0000-0x00000000090E1000-memory.dmpFilesize
4KB
-
memory/1216-144-0x0000000007A00000-0x0000000007A01000-memory.dmpFilesize
4KB
-
memory/1216-120-0x0000000000000000-mapping.dmp
-
memory/1216-138-0x00000000048C2000-0x00000000048C3000-memory.dmpFilesize
4KB
-
memory/1216-153-0x0000000008090000-0x0000000008091000-memory.dmpFilesize
4KB
-
memory/1216-147-0x0000000007C50000-0x0000000007C51000-memory.dmpFilesize
4KB
-
memory/1328-525-0x0000000000423BC0-mapping.dmp
-
memory/1332-523-0x0000000000423BC0-mapping.dmp
-
memory/1388-135-0x0000000006E00000-0x0000000006E01000-memory.dmpFilesize
4KB
-
memory/1388-150-0x0000000007C50000-0x0000000007C51000-memory.dmpFilesize
4KB
-
memory/1388-159-0x00000000083D0000-0x00000000083D1000-memory.dmpFilesize
4KB
-
memory/1388-208-0x0000000006E03000-0x0000000006E04000-memory.dmpFilesize
4KB
-
memory/1388-204-0x000000000A420000-0x000000000A421000-memory.dmpFilesize
4KB
-
memory/1388-140-0x0000000006E02000-0x0000000006E03000-memory.dmpFilesize
4KB
-
memory/1388-122-0x0000000000000000-mapping.dmp
-
memory/1388-177-0x0000000009070000-0x0000000009071000-memory.dmpFilesize
4KB
-
memory/1476-533-0x0000000000442F04-mapping.dmp
-
memory/1748-506-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1748-507-0x00000000004010B8-mapping.dmp
-
memory/1748-512-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2276-415-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/2276-440-0x0000000004A33000-0x0000000004A34000-memory.dmpFilesize
4KB
-
memory/2276-416-0x0000000004A32000-0x0000000004A33000-memory.dmpFilesize
4KB
-
memory/2276-408-0x0000000000000000-mapping.dmp
-
memory/2296-542-0x000000000040C2A8-mapping.dmp
-
memory/2728-538-0x0000000000413750-mapping.dmp
-
memory/2800-529-0x0000000000411654-mapping.dmp
-
memory/2912-514-0x0000000000401364-mapping.dmp
-
memory/3980-521-0x0000000000000000-mapping.dmp
-
memory/4072-511-0x0000000000401364-mapping.dmp