Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
26-09-2021 21:52
Behavioral task
behavioral1
Sample
86a06db94a3a3536566f8214033e5abd.exe
Resource
win7-en-20210920
General
-
Target
86a06db94a3a3536566f8214033e5abd.exe
-
Size
112KB
-
MD5
86a06db94a3a3536566f8214033e5abd
-
SHA1
505c3d741abf69813b4ceb825b628fc8e416ae10
-
SHA256
75359481a80ae7253f5a8859cc9d899020a24af197b95f8ef2716a9f011dc3b1
-
SHA512
4e661a0f42fefeac1f42428172ea834739cf023ab24045c7d84ded85c5de4d8a8a66d745f02c35553fded7a540d259824bd120339ce1c727448173d879a56fcb
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
fl.exesvchost32.exebsdedit.exesvchost32.exesihost32.exepid process 992 fl.exe 1768 svchost32.exe 1756 bsdedit.exe 1644 svchost32.exe 1736 sihost32.exe -
Loads dropped DLL 5 IoCs
Processes:
86a06db94a3a3536566f8214033e5abd.execmd.exesvchost32.execmd.exesvchost32.exepid process 1756 86a06db94a3a3536566f8214033e5abd.exe 1920 cmd.exe 1768 svchost32.exe 1140 cmd.exe 1644 svchost32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 7 IoCs
Processes:
powershell.exesvchost32.exesvchost32.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Windows\system32\Microsoft\Telemetry\sihost32.exe svchost32.exe File created C:\Windows\system32\bsdedit.exe svchost32.exe File opened for modification C:\Windows\system32\bsdedit.exe svchost32.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
86a06db94a3a3536566f8214033e5abd.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost32.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost32.exepid process 1756 86a06db94a3a3536566f8214033e5abd.exe 1756 86a06db94a3a3536566f8214033e5abd.exe 1992 powershell.exe 1144 powershell.exe 1480 powershell.exe 1592 powershell.exe 1768 svchost32.exe 1604 powershell.exe 1444 powershell.exe 792 powershell.exe 2000 powershell.exe 1644 svchost32.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
86a06db94a3a3536566f8214033e5abd.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost32.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost32.exedescription pid process Token: SeDebugPrivilege 1756 86a06db94a3a3536566f8214033e5abd.exe Token: SeDebugPrivilege 1992 powershell.exe Token: SeDebugPrivilege 1144 powershell.exe Token: SeDebugPrivilege 1480 powershell.exe Token: SeDebugPrivilege 1592 powershell.exe Token: SeDebugPrivilege 1768 svchost32.exe Token: SeDebugPrivilege 1604 powershell.exe Token: SeDebugPrivilege 1444 powershell.exe Token: SeDebugPrivilege 792 powershell.exe Token: SeDebugPrivilege 2000 powershell.exe Token: SeDebugPrivilege 1644 svchost32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
86a06db94a3a3536566f8214033e5abd.exefl.execmd.execmd.exesvchost32.execmd.exebsdedit.execmd.execmd.execmd.exesvchost32.exedescription pid process target process PID 1756 wrote to memory of 992 1756 86a06db94a3a3536566f8214033e5abd.exe fl.exe PID 1756 wrote to memory of 992 1756 86a06db94a3a3536566f8214033e5abd.exe fl.exe PID 1756 wrote to memory of 992 1756 86a06db94a3a3536566f8214033e5abd.exe fl.exe PID 1756 wrote to memory of 992 1756 86a06db94a3a3536566f8214033e5abd.exe fl.exe PID 992 wrote to memory of 1396 992 fl.exe cmd.exe PID 992 wrote to memory of 1396 992 fl.exe cmd.exe PID 992 wrote to memory of 1396 992 fl.exe cmd.exe PID 1396 wrote to memory of 1992 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1992 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1992 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1144 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1144 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1144 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1480 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1480 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1480 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1592 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1592 1396 cmd.exe powershell.exe PID 1396 wrote to memory of 1592 1396 cmd.exe powershell.exe PID 992 wrote to memory of 1920 992 fl.exe cmd.exe PID 992 wrote to memory of 1920 992 fl.exe cmd.exe PID 992 wrote to memory of 1920 992 fl.exe cmd.exe PID 1920 wrote to memory of 1768 1920 cmd.exe svchost32.exe PID 1920 wrote to memory of 1768 1920 cmd.exe svchost32.exe PID 1920 wrote to memory of 1768 1920 cmd.exe svchost32.exe PID 1768 wrote to memory of 1636 1768 svchost32.exe cmd.exe PID 1768 wrote to memory of 1636 1768 svchost32.exe cmd.exe PID 1768 wrote to memory of 1636 1768 svchost32.exe cmd.exe PID 1636 wrote to memory of 984 1636 cmd.exe schtasks.exe PID 1636 wrote to memory of 984 1636 cmd.exe schtasks.exe PID 1636 wrote to memory of 984 1636 cmd.exe schtasks.exe PID 1768 wrote to memory of 1756 1768 svchost32.exe bsdedit.exe PID 1768 wrote to memory of 1756 1768 svchost32.exe bsdedit.exe PID 1768 wrote to memory of 1756 1768 svchost32.exe bsdedit.exe PID 1768 wrote to memory of 1372 1768 svchost32.exe cmd.exe PID 1768 wrote to memory of 1372 1768 svchost32.exe cmd.exe PID 1768 wrote to memory of 1372 1768 svchost32.exe cmd.exe PID 1756 wrote to memory of 1948 1756 bsdedit.exe cmd.exe PID 1756 wrote to memory of 1948 1756 bsdedit.exe cmd.exe PID 1756 wrote to memory of 1948 1756 bsdedit.exe cmd.exe PID 1372 wrote to memory of 1572 1372 cmd.exe choice.exe PID 1372 wrote to memory of 1572 1372 cmd.exe choice.exe PID 1372 wrote to memory of 1572 1372 cmd.exe choice.exe PID 1948 wrote to memory of 1604 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 1604 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 1604 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 1444 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 1444 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 1444 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 792 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 792 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 792 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 2000 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 2000 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 2000 1948 cmd.exe powershell.exe PID 1756 wrote to memory of 1140 1756 bsdedit.exe cmd.exe PID 1756 wrote to memory of 1140 1756 bsdedit.exe cmd.exe PID 1756 wrote to memory of 1140 1756 bsdedit.exe cmd.exe PID 1140 wrote to memory of 1644 1140 cmd.exe svchost32.exe PID 1140 wrote to memory of 1644 1140 cmd.exe svchost32.exe PID 1140 wrote to memory of 1644 1140 cmd.exe svchost32.exe PID 1644 wrote to memory of 1176 1644 svchost32.exe cmd.exe PID 1644 wrote to memory of 1176 1644 svchost32.exe cmd.exe PID 1644 wrote to memory of 1176 1644 svchost32.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86a06db94a3a3536566f8214033e5abd.exe"C:\Users\Admin\AppData\Local\Temp\86a06db94a3a3536566f8214033e5abd.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\fl.exe"C:\Users\Admin\AppData\Local\Temp\fl.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\system32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit3⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\fl.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\svchost32.exeC:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\fl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "bsdedit" /tr '"C:\Windows\system32\bsdedit.exe"' & exit5⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "bsdedit" /tr '"C:\Windows\system32\bsdedit.exe"'6⤵
- Creates scheduled task(s)
PID:984 -
C:\Windows\system32\bsdedit.exe"C:\Windows\system32\bsdedit.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\cmd.exe"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit6⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'7⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'7⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'7⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'7⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\bsdedit.exe"6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\svchost32.exeC:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\bsdedit.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "bsdedit" /tr '"C:\Windows\system32\bsdedit.exe"' & exit8⤵PID:1176
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "bsdedit" /tr '"C:\Windows\system32\bsdedit.exe"'9⤵
- Creates scheduled task(s)
PID:1088 -
C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"8⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"8⤵PID:1892
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:1896
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:1572
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fl.exeMD5
605299ab524fe98acbe5628e341482e3
SHA192ee737f936b3b8d811c8169839415cb6f97142b
SHA2563a4b5c0c302fdd8b9980e6d497ea2477ecc10357dcc73108d62f3a0f97fd356b
SHA512eaa7282a628c9d4a3365c777354d7174dd5cbaca61f9a2e2428ec5264d33c40fbe8e5eec5b07f5422196925aa198739d6b7f7d04c669f6ea69a4d90073192140
-
C:\Users\Admin\AppData\Local\Temp\fl.exeMD5
605299ab524fe98acbe5628e341482e3
SHA192ee737f936b3b8d811c8169839415cb6f97142b
SHA2563a4b5c0c302fdd8b9980e6d497ea2477ecc10357dcc73108d62f3a0f97fd356b
SHA512eaa7282a628c9d4a3365c777354d7174dd5cbaca61f9a2e2428ec5264d33c40fbe8e5eec5b07f5422196925aa198739d6b7f7d04c669f6ea69a4d90073192140
-
C:\Users\Admin\AppData\Local\Temp\svchost32.exeMD5
3d97c858e1f5fae2e00520c40fc1ce4c
SHA12e8605f20278d4e32244dfe2b98422df24fa798e
SHA256741782ef9c8f092ad20c2f80695a7788126953d37adbeb59e8a232ad41f54586
SHA512f8f79bb95b42bbbbc98e1008897853ab9d884cfa3ed48e33426dbe41624a32aea8dc96614590dfd121c128cb3500c56c9455407ba456712750efdb0d241f5b0e
-
C:\Users\Admin\AppData\Local\Temp\svchost32.exeMD5
3d97c858e1f5fae2e00520c40fc1ce4c
SHA12e8605f20278d4e32244dfe2b98422df24fa798e
SHA256741782ef9c8f092ad20c2f80695a7788126953d37adbeb59e8a232ad41f54586
SHA512f8f79bb95b42bbbbc98e1008897853ab9d884cfa3ed48e33426dbe41624a32aea8dc96614590dfd121c128cb3500c56c9455407ba456712750efdb0d241f5b0e
-
C:\Users\Admin\AppData\Local\Temp\svchost32.exeMD5
3d97c858e1f5fae2e00520c40fc1ce4c
SHA12e8605f20278d4e32244dfe2b98422df24fa798e
SHA256741782ef9c8f092ad20c2f80695a7788126953d37adbeb59e8a232ad41f54586
SHA512f8f79bb95b42bbbbc98e1008897853ab9d884cfa3ed48e33426dbe41624a32aea8dc96614590dfd121c128cb3500c56c9455407ba456712750efdb0d241f5b0e
-
C:\Users\Admin\AppData\Local\Temp\svchost32.exeMD5
3d97c858e1f5fae2e00520c40fc1ce4c
SHA12e8605f20278d4e32244dfe2b98422df24fa798e
SHA256741782ef9c8f092ad20c2f80695a7788126953d37adbeb59e8a232ad41f54586
SHA512f8f79bb95b42bbbbc98e1008897853ab9d884cfa3ed48e33426dbe41624a32aea8dc96614590dfd121c128cb3500c56c9455407ba456712750efdb0d241f5b0e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
a26372ef411538f3238439005998ae7a
SHA128c0b3cb51bf5961555e890d74330894a26fc28f
SHA25657d86dbebf01d420d9393e965cbab1627708f693d6c6fb41af15c4a106bf2a2c
SHA512f2c1280b96c13f8c463b8f6103ec69a9d26a013e6cbcd5bc3b11548ce87247a600e96e639d7052eded8c2a395d4dd9cb42314e2d83e620959e925307cbef1430
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
a26372ef411538f3238439005998ae7a
SHA128c0b3cb51bf5961555e890d74330894a26fc28f
SHA25657d86dbebf01d420d9393e965cbab1627708f693d6c6fb41af15c4a106bf2a2c
SHA512f2c1280b96c13f8c463b8f6103ec69a9d26a013e6cbcd5bc3b11548ce87247a600e96e639d7052eded8c2a395d4dd9cb42314e2d83e620959e925307cbef1430
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
9a35f72ad86ff61ed69c8c91c11166b8
SHA180abc6f43e31d0dedf1c617d8604fdbdc1c0eb15
SHA2566428fc67d71a6e2ad92f20537efd21d123d756ef12c28aa456966e3294889a30
SHA51235a37a6f932d2498945573ff19ca911c276b384aebe6825c4cde53928e928c9e417610b9394b91ffd67de631aedf519e43ce894468f009f34220cb1dcd68f555
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
9a35f72ad86ff61ed69c8c91c11166b8
SHA180abc6f43e31d0dedf1c617d8604fdbdc1c0eb15
SHA2566428fc67d71a6e2ad92f20537efd21d123d756ef12c28aa456966e3294889a30
SHA51235a37a6f932d2498945573ff19ca911c276b384aebe6825c4cde53928e928c9e417610b9394b91ffd67de631aedf519e43ce894468f009f34220cb1dcd68f555
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
9a35f72ad86ff61ed69c8c91c11166b8
SHA180abc6f43e31d0dedf1c617d8604fdbdc1c0eb15
SHA2566428fc67d71a6e2ad92f20537efd21d123d756ef12c28aa456966e3294889a30
SHA51235a37a6f932d2498945573ff19ca911c276b384aebe6825c4cde53928e928c9e417610b9394b91ffd67de631aedf519e43ce894468f009f34220cb1dcd68f555
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
9a35f72ad86ff61ed69c8c91c11166b8
SHA180abc6f43e31d0dedf1c617d8604fdbdc1c0eb15
SHA2566428fc67d71a6e2ad92f20537efd21d123d756ef12c28aa456966e3294889a30
SHA51235a37a6f932d2498945573ff19ca911c276b384aebe6825c4cde53928e928c9e417610b9394b91ffd67de631aedf519e43ce894468f009f34220cb1dcd68f555
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
a26372ef411538f3238439005998ae7a
SHA128c0b3cb51bf5961555e890d74330894a26fc28f
SHA25657d86dbebf01d420d9393e965cbab1627708f693d6c6fb41af15c4a106bf2a2c
SHA512f2c1280b96c13f8c463b8f6103ec69a9d26a013e6cbcd5bc3b11548ce87247a600e96e639d7052eded8c2a395d4dd9cb42314e2d83e620959e925307cbef1430
-
C:\Windows\System32\Microsoft\Telemetry\sihost32.exeMD5
683cd4c3d0949d6095b54a19ef081314
SHA10bcaec9aa2617c8f81efe755c3bb808e8d3c941a
SHA2563f6dca67fca9ea9ac8327191c3b3c89b0121d8c8f2d2b335ff15c309448133e2
SHA512d0affd177417bfd0dadc5d998cb4d8cdae018b3b7f13fcf63ce5b3fba734b7b65612d20072e76ac11f49367fa02fa4bcce468f1fe8629c8b2444f8aadc75a90b
-
C:\Windows\System32\bsdedit.exeMD5
605299ab524fe98acbe5628e341482e3
SHA192ee737f936b3b8d811c8169839415cb6f97142b
SHA2563a4b5c0c302fdd8b9980e6d497ea2477ecc10357dcc73108d62f3a0f97fd356b
SHA512eaa7282a628c9d4a3365c777354d7174dd5cbaca61f9a2e2428ec5264d33c40fbe8e5eec5b07f5422196925aa198739d6b7f7d04c669f6ea69a4d90073192140
-
C:\Windows\system32\Microsoft\Telemetry\sihost32.exeMD5
683cd4c3d0949d6095b54a19ef081314
SHA10bcaec9aa2617c8f81efe755c3bb808e8d3c941a
SHA2563f6dca67fca9ea9ac8327191c3b3c89b0121d8c8f2d2b335ff15c309448133e2
SHA512d0affd177417bfd0dadc5d998cb4d8cdae018b3b7f13fcf63ce5b3fba734b7b65612d20072e76ac11f49367fa02fa4bcce468f1fe8629c8b2444f8aadc75a90b
-
C:\Windows\system32\bsdedit.exeMD5
605299ab524fe98acbe5628e341482e3
SHA192ee737f936b3b8d811c8169839415cb6f97142b
SHA2563a4b5c0c302fdd8b9980e6d497ea2477ecc10357dcc73108d62f3a0f97fd356b
SHA512eaa7282a628c9d4a3365c777354d7174dd5cbaca61f9a2e2428ec5264d33c40fbe8e5eec5b07f5422196925aa198739d6b7f7d04c669f6ea69a4d90073192140
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\fl.exeMD5
605299ab524fe98acbe5628e341482e3
SHA192ee737f936b3b8d811c8169839415cb6f97142b
SHA2563a4b5c0c302fdd8b9980e6d497ea2477ecc10357dcc73108d62f3a0f97fd356b
SHA512eaa7282a628c9d4a3365c777354d7174dd5cbaca61f9a2e2428ec5264d33c40fbe8e5eec5b07f5422196925aa198739d6b7f7d04c669f6ea69a4d90073192140
-
\Users\Admin\AppData\Local\Temp\svchost32.exeMD5
3d97c858e1f5fae2e00520c40fc1ce4c
SHA12e8605f20278d4e32244dfe2b98422df24fa798e
SHA256741782ef9c8f092ad20c2f80695a7788126953d37adbeb59e8a232ad41f54586
SHA512f8f79bb95b42bbbbc98e1008897853ab9d884cfa3ed48e33426dbe41624a32aea8dc96614590dfd121c128cb3500c56c9455407ba456712750efdb0d241f5b0e
-
\Users\Admin\AppData\Local\Temp\svchost32.exeMD5
3d97c858e1f5fae2e00520c40fc1ce4c
SHA12e8605f20278d4e32244dfe2b98422df24fa798e
SHA256741782ef9c8f092ad20c2f80695a7788126953d37adbeb59e8a232ad41f54586
SHA512f8f79bb95b42bbbbc98e1008897853ab9d884cfa3ed48e33426dbe41624a32aea8dc96614590dfd121c128cb3500c56c9455407ba456712750efdb0d241f5b0e
-
\Windows\System32\Microsoft\Telemetry\sihost32.exeMD5
683cd4c3d0949d6095b54a19ef081314
SHA10bcaec9aa2617c8f81efe755c3bb808e8d3c941a
SHA2563f6dca67fca9ea9ac8327191c3b3c89b0121d8c8f2d2b335ff15c309448133e2
SHA512d0affd177417bfd0dadc5d998cb4d8cdae018b3b7f13fcf63ce5b3fba734b7b65612d20072e76ac11f49367fa02fa4bcce468f1fe8629c8b2444f8aadc75a90b
-
\Windows\System32\bsdedit.exeMD5
605299ab524fe98acbe5628e341482e3
SHA192ee737f936b3b8d811c8169839415cb6f97142b
SHA2563a4b5c0c302fdd8b9980e6d497ea2477ecc10357dcc73108d62f3a0f97fd356b
SHA512eaa7282a628c9d4a3365c777354d7174dd5cbaca61f9a2e2428ec5264d33c40fbe8e5eec5b07f5422196925aa198739d6b7f7d04c669f6ea69a4d90073192140
-
memory/792-137-0x000007FEED660000-0x000007FEEE1BD000-memory.dmpFilesize
11.4MB
-
memory/792-146-0x000000000277B000-0x000000000279A000-memory.dmpFilesize
124KB
-
memory/792-138-0x0000000002770000-0x0000000002772000-memory.dmpFilesize
8KB
-
memory/792-139-0x0000000002772000-0x0000000002774000-memory.dmpFilesize
8KB
-
memory/792-140-0x0000000002774000-0x0000000002777000-memory.dmpFilesize
12KB
-
memory/792-134-0x0000000000000000-mapping.dmp
-
memory/984-105-0x0000000000000000-mapping.dmp
-
memory/992-66-0x000000001BCB0000-0x000000001BCB2000-memory.dmpFilesize
8KB
-
memory/992-60-0x000000013F540000-0x000000013F541000-memory.dmpFilesize
4KB
-
memory/992-57-0x0000000000000000-mapping.dmp
-
memory/1088-165-0x0000000000000000-mapping.dmp
-
memory/1140-152-0x0000000000000000-mapping.dmp
-
memory/1144-78-0x00000000025F4000-0x00000000025F7000-memory.dmpFilesize
12KB
-
memory/1144-79-0x00000000025FB000-0x000000000261A000-memory.dmpFilesize
124KB
-
memory/1144-76-0x00000000025F0000-0x00000000025F2000-memory.dmpFilesize
8KB
-
memory/1144-77-0x00000000025F2000-0x00000000025F4000-memory.dmpFilesize
8KB
-
memory/1144-75-0x000007FEEE250000-0x000007FEEEDAD000-memory.dmpFilesize
11.4MB
-
memory/1144-72-0x0000000000000000-mapping.dmp
-
memory/1176-160-0x0000000000000000-mapping.dmp
-
memory/1372-111-0x0000000000000000-mapping.dmp
-
memory/1396-62-0x0000000000000000-mapping.dmp
-
memory/1444-133-0x000000000232B000-0x000000000234A000-memory.dmpFilesize
124KB
-
memory/1444-124-0x0000000000000000-mapping.dmp
-
memory/1444-128-0x000007FEED660000-0x000007FEEE1BD000-memory.dmpFilesize
11.4MB
-
memory/1444-130-0x0000000002320000-0x0000000002322000-memory.dmpFilesize
8KB
-
memory/1444-131-0x0000000002322000-0x0000000002324000-memory.dmpFilesize
8KB
-
memory/1444-132-0x0000000002324000-0x0000000002327000-memory.dmpFilesize
12KB
-
memory/1480-85-0x00000000022A2000-0x00000000022A4000-memory.dmpFilesize
8KB
-
memory/1480-92-0x00000000022AB000-0x00000000022CA000-memory.dmpFilesize
124KB
-
memory/1480-86-0x00000000022A4000-0x00000000022A7000-memory.dmpFilesize
12KB
-
memory/1480-84-0x00000000022A0000-0x00000000022A2000-memory.dmpFilesize
8KB
-
memory/1480-83-0x000007FEEE250000-0x000007FEEEDAD000-memory.dmpFilesize
11.4MB
-
memory/1480-80-0x0000000000000000-mapping.dmp
-
memory/1572-115-0x0000000000000000-mapping.dmp
-
memory/1592-87-0x0000000000000000-mapping.dmp
-
memory/1592-91-0x000007FEEE250000-0x000007FEEEDAD000-memory.dmpFilesize
11.4MB
-
memory/1592-96-0x0000000002594000-0x0000000002597000-memory.dmpFilesize
12KB
-
memory/1592-95-0x000000000259B000-0x00000000025BA000-memory.dmpFilesize
124KB
-
memory/1592-93-0x0000000002590000-0x0000000002592000-memory.dmpFilesize
8KB
-
memory/1592-94-0x0000000002592000-0x0000000002594000-memory.dmpFilesize
8KB
-
memory/1604-122-0x0000000002732000-0x0000000002734000-memory.dmpFilesize
8KB
-
memory/1604-129-0x000000000273B000-0x000000000275A000-memory.dmpFilesize
124KB
-
memory/1604-121-0x0000000002730000-0x0000000002732000-memory.dmpFilesize
8KB
-
memory/1604-120-0x000007FEED660000-0x000007FEEE1BD000-memory.dmpFilesize
11.4MB
-
memory/1604-116-0x0000000000000000-mapping.dmp
-
memory/1604-123-0x0000000002734000-0x0000000002737000-memory.dmpFilesize
12KB
-
memory/1636-104-0x0000000000000000-mapping.dmp
-
memory/1644-154-0x0000000000000000-mapping.dmp
-
memory/1644-159-0x000000001AE90000-0x000000001AE92000-memory.dmpFilesize
8KB
-
memory/1644-157-0x000000013FA30000-0x000000013FA31000-memory.dmpFilesize
4KB
-
memory/1736-170-0x000000001B7B0000-0x000000001B7B2000-memory.dmpFilesize
8KB
-
memory/1736-166-0x000000013F420000-0x000000013F421000-memory.dmpFilesize
4KB
-
memory/1736-162-0x0000000000000000-mapping.dmp
-
memory/1756-53-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/1756-117-0x000000001BB40000-0x000000001BB42000-memory.dmpFilesize
8KB
-
memory/1756-55-0x0000000004890000-0x0000000004891000-memory.dmpFilesize
4KB
-
memory/1756-112-0x000000013F360000-0x000000013F361000-memory.dmpFilesize
4KB
-
memory/1756-108-0x0000000000000000-mapping.dmp
-
memory/1768-99-0x0000000000000000-mapping.dmp
-
memory/1768-106-0x000000001BDC0000-0x000000001BDC2000-memory.dmpFilesize
8KB
-
memory/1768-102-0x000000013FCF0000-0x000000013FCF1000-memory.dmpFilesize
4KB
-
memory/1892-168-0x0000000000000000-mapping.dmp
-
memory/1896-169-0x0000000000000000-mapping.dmp
-
memory/1920-97-0x0000000000000000-mapping.dmp
-
memory/1948-114-0x0000000000000000-mapping.dmp
-
memory/1992-69-0x0000000002634000-0x0000000002637000-memory.dmpFilesize
12KB
-
memory/1992-63-0x0000000000000000-mapping.dmp
-
memory/1992-68-0x0000000002632000-0x0000000002634000-memory.dmpFilesize
8KB
-
memory/1992-65-0x000007FEEE250000-0x000007FEEEDAD000-memory.dmpFilesize
11.4MB
-
memory/1992-70-0x000000001B910000-0x000000001BC0F000-memory.dmpFilesize
3.0MB
-
memory/1992-67-0x0000000002630000-0x0000000002632000-memory.dmpFilesize
8KB
-
memory/1992-64-0x000007FEFC4F1000-0x000007FEFC4F3000-memory.dmpFilesize
8KB
-
memory/1992-71-0x000000000263B000-0x000000000265A000-memory.dmpFilesize
124KB
-
memory/2000-151-0x00000000028BB000-0x00000000028DA000-memory.dmpFilesize
124KB
-
memory/2000-150-0x000000001B770000-0x000000001BA6F000-memory.dmpFilesize
3.0MB
-
memory/2000-149-0x00000000028B4000-0x00000000028B7000-memory.dmpFilesize
12KB
-
memory/2000-148-0x00000000028B2000-0x00000000028B4000-memory.dmpFilesize
8KB
-
memory/2000-141-0x0000000000000000-mapping.dmp
-
memory/2000-147-0x00000000028B0000-0x00000000028B2000-memory.dmpFilesize
8KB
-
memory/2000-145-0x000007FEED660000-0x000007FEEE1BD000-memory.dmpFilesize
11.4MB