1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79

General
Target

1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe

Filesize

460KB

Completed

23-09-2021 07:14

Score
10 /10
MD5

3b6f38ea6928bca0be7ce6cf39ec8959

SHA1

5ea0766825327580776bc88add0e9267d97965e5

SHA256

1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79

Malware Config

Extracted

Family njrat
Version Njrat 0.7 Golden By Hassan Amiri
Botnet v1
C2

xyz.videomarket.eu:1970

Attributes
reg_key
Windows Update
splitter
|Hassan|
Signatures 8

Filter: none

Defense Evasion
Discovery
Persistence
  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

  • Adds Run key to start application
    1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\gjkE = "\"C:\\Users\\Admin\\AppData\\Roaming\\gjkE.exe\""1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
  • Suspicious use of SetThreadContext
    1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 612 set thread context of 17526121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious behavior: EnumeratesProcesses
    powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe

    Reported IOCs

    pidprocess
    956powershell.exe
    1048powershell.exe
    1140powershell.exe
    1168powershell.exe
    1932powershell.exe
    1724powershell.exe
    1508powershell.exe
    1012powershell.exe
    1396powershell.exe
    1748powershell.exe
    6121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
    6121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
  • Suspicious behavior: GetForegroundWindowSpam
    1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe

    Reported IOCs

    pidprocess
    17521a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
  • Suspicious use of AdjustPrivilegeToken
    powershell.exepowershell.exepowershell.exepowershell.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege956powershell.exe
    Token: SeDebugPrivilege1048powershell.exe
    Token: SeIncreaseQuotaPrivilege1048powershell.exe
    Token: SeSecurityPrivilege1048powershell.exe
    Token: SeTakeOwnershipPrivilege1048powershell.exe
    Token: SeLoadDriverPrivilege1048powershell.exe
    Token: SeSystemProfilePrivilege1048powershell.exe
    Token: SeSystemtimePrivilege1048powershell.exe
    Token: SeProfSingleProcessPrivilege1048powershell.exe
    Token: SeIncBasePriorityPrivilege1048powershell.exe
    Token: SeCreatePagefilePrivilege1048powershell.exe
    Token: SeBackupPrivilege1048powershell.exe
    Token: SeRestorePrivilege1048powershell.exe
    Token: SeShutdownPrivilege1048powershell.exe
    Token: SeDebugPrivilege1048powershell.exe
    Token: SeSystemEnvironmentPrivilege1048powershell.exe
    Token: SeRemoteShutdownPrivilege1048powershell.exe
    Token: SeUndockPrivilege1048powershell.exe
    Token: SeManageVolumePrivilege1048powershell.exe
    Token: 331048powershell.exe
    Token: 341048powershell.exe
    Token: 351048powershell.exe
    Token: SeDebugPrivilege1140powershell.exe
    Token: SeIncreaseQuotaPrivilege1140powershell.exe
    Token: SeSecurityPrivilege1140powershell.exe
    Token: SeTakeOwnershipPrivilege1140powershell.exe
    Token: SeLoadDriverPrivilege1140powershell.exe
    Token: SeSystemProfilePrivilege1140powershell.exe
    Token: SeSystemtimePrivilege1140powershell.exe
    Token: SeProfSingleProcessPrivilege1140powershell.exe
    Token: SeIncBasePriorityPrivilege1140powershell.exe
    Token: SeCreatePagefilePrivilege1140powershell.exe
    Token: SeBackupPrivilege1140powershell.exe
    Token: SeRestorePrivilege1140powershell.exe
    Token: SeShutdownPrivilege1140powershell.exe
    Token: SeDebugPrivilege1140powershell.exe
    Token: SeSystemEnvironmentPrivilege1140powershell.exe
    Token: SeRemoteShutdownPrivilege1140powershell.exe
    Token: SeUndockPrivilege1140powershell.exe
    Token: SeManageVolumePrivilege1140powershell.exe
    Token: 331140powershell.exe
    Token: 341140powershell.exe
    Token: 351140powershell.exe
    Token: SeDebugPrivilege1168powershell.exe
    Token: SeIncreaseQuotaPrivilege1168powershell.exe
    Token: SeSecurityPrivilege1168powershell.exe
    Token: SeTakeOwnershipPrivilege1168powershell.exe
    Token: SeLoadDriverPrivilege1168powershell.exe
    Token: SeSystemProfilePrivilege1168powershell.exe
    Token: SeSystemtimePrivilege1168powershell.exe
    Token: SeProfSingleProcessPrivilege1168powershell.exe
    Token: SeIncBasePriorityPrivilege1168powershell.exe
    Token: SeCreatePagefilePrivilege1168powershell.exe
    Token: SeBackupPrivilege1168powershell.exe
    Token: SeRestorePrivilege1168powershell.exe
    Token: SeShutdownPrivilege1168powershell.exe
    Token: SeDebugPrivilege1168powershell.exe
    Token: SeSystemEnvironmentPrivilege1168powershell.exe
    Token: SeRemoteShutdownPrivilege1168powershell.exe
    Token: SeUndockPrivilege1168powershell.exe
    Token: SeManageVolumePrivilege1168powershell.exe
    Token: 331168powershell.exe
    Token: 341168powershell.exe
    Token: 351168powershell.exe
  • Suspicious use of WriteProcessMemory
    1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 612 wrote to memory of 9566121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 9566121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 9566121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 9566121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 10486121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 10486121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 10486121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 10486121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 11406121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 11406121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 11406121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 11406121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 11686121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 11686121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 11686121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 11686121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 19326121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 19326121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 19326121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 19326121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 17246121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 17246121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 17246121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 17246121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 15086121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 15086121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 15086121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 15086121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 10126121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 10126121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 10126121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 10126121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 13966121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 13966121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 13966121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 13966121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 17486121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 17486121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 17486121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 17486121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exepowershell.exe
    PID 612 wrote to memory of 17526121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
    PID 612 wrote to memory of 17526121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
    PID 612 wrote to memory of 17526121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
    PID 612 wrote to memory of 17526121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
    PID 612 wrote to memory of 17526121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
    PID 612 wrote to memory of 17526121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
    PID 612 wrote to memory of 17526121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
    PID 612 wrote to memory of 17526121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
    PID 612 wrote to memory of 17526121a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
Processes 12
  • C:\Users\Admin\AppData\Local\Temp\1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
    "C:\Users\Admin\AppData\Local\Temp\1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe"
    Adds Run key to start application
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:612
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:956
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1048
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1140
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1168
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      Suspicious behavior: EnumeratesProcesses
      PID:1932
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      Suspicious behavior: EnumeratesProcesses
      PID:1724
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      Suspicious behavior: EnumeratesProcesses
      PID:1508
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      Suspicious behavior: EnumeratesProcesses
      PID:1012
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      Suspicious behavior: EnumeratesProcesses
      PID:1396
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
      Suspicious behavior: EnumeratesProcesses
      PID:1748
    • C:\Users\Admin\AppData\Local\Temp\1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
      C:\Users\Admin\AppData\Local\Temp\1a3b100043d6e616674e8ccf0bd086eacccb6985aa8182029a2717aa57be5f79.exe
      Suspicious behavior: GetForegroundWindowSpam
      PID:1752
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      MD5

                      ab8ac382902844e55e422e4430b0af98

                      SHA1

                      5b1a88fea8df7bac5f9bb613dad70b1626932ca2

                      SHA256

                      519a16c0fd52076af8d1aafaf836fa70226bccb4574705b43598bea3fb4f50f1

                      SHA512

                      ae2468652cd0424a52a02ae0340a05ffdf45aef8782d6dbc1220e03ecc6e20cb488d9dca9c9cff743820504c615cd0de6a30e861eeacf361076f63278923d14b

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      MD5

                      ab8ac382902844e55e422e4430b0af98

                      SHA1

                      5b1a88fea8df7bac5f9bb613dad70b1626932ca2

                      SHA256

                      519a16c0fd52076af8d1aafaf836fa70226bccb4574705b43598bea3fb4f50f1

                      SHA512

                      ae2468652cd0424a52a02ae0340a05ffdf45aef8782d6dbc1220e03ecc6e20cb488d9dca9c9cff743820504c615cd0de6a30e861eeacf361076f63278923d14b

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      MD5

                      ab8ac382902844e55e422e4430b0af98

                      SHA1

                      5b1a88fea8df7bac5f9bb613dad70b1626932ca2

                      SHA256

                      519a16c0fd52076af8d1aafaf836fa70226bccb4574705b43598bea3fb4f50f1

                      SHA512

                      ae2468652cd0424a52a02ae0340a05ffdf45aef8782d6dbc1220e03ecc6e20cb488d9dca9c9cff743820504c615cd0de6a30e861eeacf361076f63278923d14b

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      MD5

                      ab8ac382902844e55e422e4430b0af98

                      SHA1

                      5b1a88fea8df7bac5f9bb613dad70b1626932ca2

                      SHA256

                      519a16c0fd52076af8d1aafaf836fa70226bccb4574705b43598bea3fb4f50f1

                      SHA512

                      ae2468652cd0424a52a02ae0340a05ffdf45aef8782d6dbc1220e03ecc6e20cb488d9dca9c9cff743820504c615cd0de6a30e861eeacf361076f63278923d14b

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      MD5

                      ab8ac382902844e55e422e4430b0af98

                      SHA1

                      5b1a88fea8df7bac5f9bb613dad70b1626932ca2

                      SHA256

                      519a16c0fd52076af8d1aafaf836fa70226bccb4574705b43598bea3fb4f50f1

                      SHA512

                      ae2468652cd0424a52a02ae0340a05ffdf45aef8782d6dbc1220e03ecc6e20cb488d9dca9c9cff743820504c615cd0de6a30e861eeacf361076f63278923d14b

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      MD5

                      ab8ac382902844e55e422e4430b0af98

                      SHA1

                      5b1a88fea8df7bac5f9bb613dad70b1626932ca2

                      SHA256

                      519a16c0fd52076af8d1aafaf836fa70226bccb4574705b43598bea3fb4f50f1

                      SHA512

                      ae2468652cd0424a52a02ae0340a05ffdf45aef8782d6dbc1220e03ecc6e20cb488d9dca9c9cff743820504c615cd0de6a30e861eeacf361076f63278923d14b

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      MD5

                      ab8ac382902844e55e422e4430b0af98

                      SHA1

                      5b1a88fea8df7bac5f9bb613dad70b1626932ca2

                      SHA256

                      519a16c0fd52076af8d1aafaf836fa70226bccb4574705b43598bea3fb4f50f1

                      SHA512

                      ae2468652cd0424a52a02ae0340a05ffdf45aef8782d6dbc1220e03ecc6e20cb488d9dca9c9cff743820504c615cd0de6a30e861eeacf361076f63278923d14b

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      MD5

                      ab8ac382902844e55e422e4430b0af98

                      SHA1

                      5b1a88fea8df7bac5f9bb613dad70b1626932ca2

                      SHA256

                      519a16c0fd52076af8d1aafaf836fa70226bccb4574705b43598bea3fb4f50f1

                      SHA512

                      ae2468652cd0424a52a02ae0340a05ffdf45aef8782d6dbc1220e03ecc6e20cb488d9dca9c9cff743820504c615cd0de6a30e861eeacf361076f63278923d14b

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                      MD5

                      ab8ac382902844e55e422e4430b0af98

                      SHA1

                      5b1a88fea8df7bac5f9bb613dad70b1626932ca2

                      SHA256

                      519a16c0fd52076af8d1aafaf836fa70226bccb4574705b43598bea3fb4f50f1

                      SHA512

                      ae2468652cd0424a52a02ae0340a05ffdf45aef8782d6dbc1220e03ecc6e20cb488d9dca9c9cff743820504c615cd0de6a30e861eeacf361076f63278923d14b

                    • \??\PIPE\srvsvc

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \??\PIPE\srvsvc

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \??\PIPE\srvsvc

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \??\PIPE\srvsvc

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • memory/612-101-0x0000000004850000-0x00000000048A5000-memory.dmp

                    • memory/612-107-0x00000000048D5000-0x00000000048E6000-memory.dmp

                    • memory/612-106-0x0000000005CB0000-0x0000000005D13000-memory.dmp

                    • memory/612-54-0x0000000000D30000-0x0000000000D31000-memory.dmp

                    • memory/612-56-0x00000000048D0000-0x00000000048D1000-memory.dmp

                    • memory/956-59-0x00000000024D0000-0x00000000024D1000-memory.dmp

                    • memory/956-58-0x0000000075651000-0x0000000075653000-memory.dmp

                    • memory/956-57-0x0000000000000000-mapping.dmp

                    • memory/956-61-0x00000000024D2000-0x00000000024D4000-memory.dmp

                    • memory/956-60-0x00000000024D1000-0x00000000024D2000-memory.dmp

                    • memory/1012-90-0x0000000000000000-mapping.dmp

                    • memory/1048-62-0x0000000000000000-mapping.dmp

                    • memory/1048-65-0x00000000025B0000-0x00000000031FA000-memory.dmp

                    • memory/1140-66-0x0000000000000000-mapping.dmp

                    • memory/1168-70-0x0000000000000000-mapping.dmp

                    • memory/1168-74-0x00000000022E0000-0x0000000002F2A000-memory.dmp

                    • memory/1396-93-0x0000000000000000-mapping.dmp

                    • memory/1508-88-0x0000000002350000-0x0000000002F9A000-memory.dmp

                    • memory/1508-87-0x0000000002350000-0x0000000002F9A000-memory.dmp

                    • memory/1508-89-0x0000000002350000-0x0000000002F9A000-memory.dmp

                    • memory/1508-83-0x0000000000000000-mapping.dmp

                    • memory/1724-82-0x0000000002300000-0x0000000002F4A000-memory.dmp

                    • memory/1724-78-0x0000000000000000-mapping.dmp

                    • memory/1724-81-0x0000000002300000-0x0000000002F4A000-memory.dmp

                    • memory/1748-100-0x0000000002430000-0x000000000307A000-memory.dmp

                    • memory/1748-97-0x0000000000000000-mapping.dmp

                    • memory/1752-108-0x0000000000400000-0x0000000000412000-memory.dmp

                    • memory/1752-109-0x000000000040C26E-mapping.dmp

                    • memory/1752-110-0x0000000000400000-0x0000000000412000-memory.dmp

                    • memory/1752-112-0x0000000004F30000-0x0000000004F31000-memory.dmp

                    • memory/1932-75-0x0000000000000000-mapping.dmp