xmrig | 51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c

Analysis

max time kernel
133s
max time network
151s
platform
windows10_x64
resource
win10-en-20210920
submitted
26-09-2021 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe
Size

3.1MB
MD5

a8a946ab8b01f067b80e93ebaf1a6752
SHA1

39322050bbd3ac2c8455bbe6a3495e48db505605
SHA256

51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c
SHA512

8b79073fff6f062454b6e2c00a2992b6d2204a71371eb9c6bd22072056c246ecbd4d17dd24e0bb929f626a02b9d9b1a96231c0abcf61af8799d36da7602517b5

Score

10^/10

xmrig discovery evasion miner spyware stealer themida trojan

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file
Executes dropped EXE 5 IoCs

Processes:

fl.exesvchost32.exedascHost.exesvchost32.exesihost32.exe

pid process

1136 fl.exe
2652 svchost32.exe
1076 dascHost.exe
2720 svchost32.exe
2240 sihost32.exe

pid	process
1136	fl.exe
2652	svchost32.exe
1076	dascHost.exe
2720	svchost32.exe
2240	sihost32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2648-116-0x0000000000AD0000-0x0000000000AD1000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe

Drops file in System32 directory 3 IoCs

Processes:

svchost32.exesvchost32.exe

description	ioc	process
File created	C:\Windows\system32\dascHost.exe	svchost32.exe
File opened for modification	C:\Windows\system32\dascHost.exe	svchost32.exe
File created	C:\Windows\system32\Microsoft\Telemetry\sihost32.exe	svchost32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe

pid process

2648 51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3496 schtasks.exe
2088 schtasks.exe

pid	process
3496	schtasks.exe
2088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost32.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost32.exe

pid	process
2648	51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe
2648	51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe
2648	51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe
2648	51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe
2956	powershell.exe
2956	powershell.exe
2956	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe
4076	powershell.exe
4076	powershell.exe
4076	powershell.exe
2652	svchost32.exe
2704	powershell.exe
2704	powershell.exe
2704	powershell.exe
2608	powershell.exe
2608	powershell.exe
2608	powershell.exe
1300	powershell.exe
1300	powershell.exe
1300	powershell.exe
2688	powershell.exe
2688	powershell.exe
2688	powershell.exe
2720	svchost32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2648	51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeIncreaseQuotaPrivilege	2956	powershell.exe
Token: SeSecurityPrivilege	2956	powershell.exe
Token: SeTakeOwnershipPrivilege	2956	powershell.exe
Token: SeLoadDriverPrivilege	2956	powershell.exe
Token: SeSystemProfilePrivilege	2956	powershell.exe
Token: SeSystemtimePrivilege	2956	powershell.exe
Token: SeProfSingleProcessPrivilege	2956	powershell.exe
Token: SeIncBasePriorityPrivilege	2956	powershell.exe
Token: SeCreatePagefilePrivilege	2956	powershell.exe
Token: SeBackupPrivilege	2956	powershell.exe
Token: SeRestorePrivilege	2956	powershell.exe
Token: SeShutdownPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeSystemEnvironmentPrivilege	2956	powershell.exe
Token: SeRemoteShutdownPrivilege	2956	powershell.exe
Token: SeUndockPrivilege	2956	powershell.exe
Token: SeManageVolumePrivilege	2956	powershell.exe
Token: 33	2956	powershell.exe
Token: 34	2956	powershell.exe
Token: 35	2956	powershell.exe
Token: 36	2956	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeIncreaseQuotaPrivilege	2664	powershell.exe
Token: SeSecurityPrivilege	2664	powershell.exe
Token: SeTakeOwnershipPrivilege	2664	powershell.exe
Token: SeLoadDriverPrivilege	2664	powershell.exe
Token: SeSystemProfilePrivilege	2664	powershell.exe
Token: SeSystemtimePrivilege	2664	powershell.exe
Token: SeProfSingleProcessPrivilege	2664	powershell.exe
Token: SeIncBasePriorityPrivilege	2664	powershell.exe
Token: SeCreatePagefilePrivilege	2664	powershell.exe
Token: SeBackupPrivilege	2664	powershell.exe
Token: SeRestorePrivilege	2664	powershell.exe
Token: SeShutdownPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeSystemEnvironmentPrivilege	2664	powershell.exe
Token: SeRemoteShutdownPrivilege	2664	powershell.exe
Token: SeUndockPrivilege	2664	powershell.exe
Token: SeManageVolumePrivilege	2664	powershell.exe
Token: 33	2664	powershell.exe
Token: 34	2664	powershell.exe
Token: 35	2664	powershell.exe
Token: 36	2664	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeIncreaseQuotaPrivilege	3244	powershell.exe
Token: SeSecurityPrivilege	3244	powershell.exe
Token: SeTakeOwnershipPrivilege	3244	powershell.exe
Token: SeLoadDriverPrivilege	3244	powershell.exe
Token: SeSystemProfilePrivilege	3244	powershell.exe
Token: SeSystemtimePrivilege	3244	powershell.exe
Token: SeProfSingleProcessPrivilege	3244	powershell.exe
Token: SeIncBasePriorityPrivilege	3244	powershell.exe
Token: SeCreatePagefilePrivilege	3244	powershell.exe
Token: SeBackupPrivilege	3244	powershell.exe
Token: SeRestorePrivilege	3244	powershell.exe
Token: SeShutdownPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeSystemEnvironmentPrivilege	3244	powershell.exe
Token: SeRemoteShutdownPrivilege	3244	powershell.exe
Token: SeUndockPrivilege	3244	powershell.exe
Token: SeManageVolumePrivilege	3244	powershell.exe
Token: 33	3244	powershell.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exefl.execmd.execmd.exesvchost32.execmd.exedascHost.execmd.execmd.execmd.exesvchost32.execmd.execmd.exe

description	pid	process	target process
PID 2648 wrote to memory of 1136	2648	51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe	fl.exe
PID 2648 wrote to memory of 1136	2648	51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe	fl.exe
PID 1136 wrote to memory of 1176	1136	fl.exe	cmd.exe
PID 1136 wrote to memory of 1176	1136	fl.exe	cmd.exe
PID 1176 wrote to memory of 2956	1176	cmd.exe	powershell.exe
PID 1176 wrote to memory of 2956	1176	cmd.exe	powershell.exe
PID 1176 wrote to memory of 2664	1176	cmd.exe	powershell.exe
PID 1176 wrote to memory of 2664	1176	cmd.exe	powershell.exe
PID 1176 wrote to memory of 3244	1176	cmd.exe	powershell.exe
PID 1176 wrote to memory of 3244	1176	cmd.exe	powershell.exe
PID 1176 wrote to memory of 4076	1176	cmd.exe	powershell.exe
PID 1176 wrote to memory of 4076	1176	cmd.exe	powershell.exe
PID 1136 wrote to memory of 3824	1136	fl.exe	cmd.exe
PID 1136 wrote to memory of 3824	1136	fl.exe	cmd.exe
PID 3824 wrote to memory of 2652	3824	cmd.exe	svchost32.exe
PID 3824 wrote to memory of 2652	3824	cmd.exe	svchost32.exe
PID 2652 wrote to memory of 1852	2652	svchost32.exe	cmd.exe
PID 2652 wrote to memory of 1852	2652	svchost32.exe	cmd.exe
PID 1852 wrote to memory of 3496	1852	cmd.exe	schtasks.exe
PID 1852 wrote to memory of 3496	1852	cmd.exe	schtasks.exe
PID 2652 wrote to memory of 1076	2652	svchost32.exe	dascHost.exe
PID 2652 wrote to memory of 1076	2652	svchost32.exe	dascHost.exe
PID 2652 wrote to memory of 3388	2652	svchost32.exe	cmd.exe
PID 2652 wrote to memory of 3388	2652	svchost32.exe	cmd.exe
PID 1076 wrote to memory of 1132	1076	dascHost.exe	cmd.exe
PID 1076 wrote to memory of 1132	1076	dascHost.exe	cmd.exe
PID 3388 wrote to memory of 2708	3388	cmd.exe	choice.exe
PID 3388 wrote to memory of 2708	3388	cmd.exe	choice.exe
PID 1132 wrote to memory of 2704	1132	cmd.exe	powershell.exe
PID 1132 wrote to memory of 2704	1132	cmd.exe	powershell.exe
PID 1132 wrote to memory of 2608	1132	cmd.exe	powershell.exe
PID 1132 wrote to memory of 2608	1132	cmd.exe	powershell.exe
PID 1132 wrote to memory of 1300	1132	cmd.exe	powershell.exe
PID 1132 wrote to memory of 1300	1132	cmd.exe	powershell.exe
PID 1132 wrote to memory of 2688	1132	cmd.exe	powershell.exe
PID 1132 wrote to memory of 2688	1132	cmd.exe	powershell.exe
PID 1076 wrote to memory of 2744	1076	dascHost.exe	cmd.exe
PID 1076 wrote to memory of 2744	1076	dascHost.exe	cmd.exe
PID 2744 wrote to memory of 2720	2744	cmd.exe	svchost32.exe
PID 2744 wrote to memory of 2720	2744	cmd.exe	svchost32.exe
PID 2720 wrote to memory of 1220	2720	svchost32.exe	cmd.exe
PID 2720 wrote to memory of 1220	2720	svchost32.exe	cmd.exe
PID 2720 wrote to memory of 2240	2720	svchost32.exe	sihost32.exe
PID 2720 wrote to memory of 2240	2720	svchost32.exe	sihost32.exe
PID 1220 wrote to memory of 2088	1220	cmd.exe	schtasks.exe
PID 1220 wrote to memory of 2088	1220	cmd.exe	schtasks.exe
PID 2720 wrote to memory of 1988	2720	svchost32.exe	cmd.exe
PID 2720 wrote to memory of 1988	2720	svchost32.exe	cmd.exe
PID 1988 wrote to memory of 1344	1988	cmd.exe	choice.exe
PID 1988 wrote to memory of 1344	1988	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe
"C:\Users\Admin\AppData\Local\Temp\51b18e70a20148aac8b4a7dcc35dc0fbea56f618c268c3263a73c2d7930f242c.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648

C:\Users\Admin\AppData\Local\Temp\fl.exe
"C:\Users\Admin\AppData\Local\Temp\fl.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\fl.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3824

C:\Users\Admin\AppData\Local\Temp\svchost32.exe
C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\fl.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dascHost" /tr '"C:\Windows\system32\dascHost.exe"' & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "dascHost" /tr '"C:\Windows\system32\dascHost.exe"'
6⤵
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\dascHost.exe
"C:\Windows\system32\dascHost.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\system32\cmd.exe
"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:1132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\dascHost.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:2744

C:\Users\Admin\AppData\Local\Temp\svchost32.exe
C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\dascHost.exe"
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dascHost" /tr '"C:\Windows\system32\dascHost.exe"' & exit
8⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "dascHost" /tr '"C:\Windows\system32\dascHost.exe"'
9⤵
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
8⤵
- Executes dropped EXE
PID:2240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
8⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:1344

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:3388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:2708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost32.exe.log
MD5
84f2160705ac9a032c002f966498ef74

SHA1
e9f3db2e1ad24a4f7e5c203af03bbc07235e704c

SHA256
7840ca7ea27e8a24ebc4877774be6013ab4f81d1eb83c121e4c3290ceb532d93

SHA512
f41c289770d8817ee612e53880d3f6492d50d08fb5104bf76440c2a93539dd25f6f15179b318e67b9202aabbe802941f80ac2dbadfd6ff1081b0d37c33f9da57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
a1dabde7f5a9a509a357b47ae42e1691

SHA1
8027f69b39473907c7ea5be929d8d3f412542051

SHA256
5eac53763ef1b20f75acae4040c645d99ae17ae1ba55856101de8d48f50d5461

SHA512
ce68838e0a1601dacd4551fe99d2c71c3d336734a415b370a13637aaedef19766bb7bca52adef366476b13e4aa1ed396954463fcdedb95c8a55a54ce472330ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
a85bd0cf7aa7303dff1784bfcccb69ef

SHA1
c5c1007eca15d49d158bc76e6ca710c77f7be89f

SHA256
aad18ccb07901a68d33de38bb6b8b7af4e27ff4c5756da3cf8379f4a9572bb70

SHA512
aba5d9fae6af45c31d069a111bd47ea49c438166afb3b6c266310a4167b1eb8feb6a093f6eb6907c43fca6aae774a9eb98ff37eac4ca4a9dac9f7e8f25884306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
0820253e467035fdee88730316f6ae7c

SHA1
ddcac76f97f99713b12edb515905af398bf94ad9

SHA256
a96fbe6e915821acd0720a2c9c2e7dacfa77eaee0305d263aa088e95db32a670

SHA512
448b500b6168aacdbc41a164732f48decb0f4c14307f9a82b0e0ed95d0040900c405d97b08ebe01678b8ea99fa9997e454b27e9640d05988a4840e2e756b7f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
b4ed24219ead5e59f329416aea7a605a

SHA1
39d0965fd4dfd02fbe0868122454c1ee4ed96385

SHA256
aa01658009b2d30f37b10564a57654db7b40cf162975b550fef66bed1a6e2faf

SHA512
9898a32e2e5f38eec0038f666080ee2624c51afabe3407ac2636255901f0adeeab301569b24c2e617c37128ed427093b6772deaaa2d26bc4b7092a53edae3b6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
016c2f5ec7c648e8355ee10d275d9bd1

SHA1
184cba9cafc12260c44cc760f3367b5aa7881733

SHA256
f0972e40814024b5114d233781f5c1d1ee5c10b4faee92c443fc0c7827df4329

SHA512
ddf4034a5278230acce816f7de5fa5cf0e7c6aaf97935fc570f39ab1dc52e99e708cb8c4659656cf584c52125ffb8d38f6f78cfa541f8801561621e4f48e4fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
efb3f5290cb73e1cdcb31c5f5ad0157b

SHA1
94bb659aec811ccda9b9ac1d6451620333e807ac

SHA256
9df0c0e70af1f8e95368f9a9a041fe049747f8ba227a9c4de0da23659d8692cb

SHA512
41764cb13933718ca1104c29a6afbece6c132f6e1692d0776678c640dfd3308980af968e4dd48d05b12cb34b001cc015a80656bb2a716d792d239d54034d5dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
8afff33de4f61a0e6adb82a525e780ea

SHA1
66205707197ddf6b8ec7c5006869f6f25a9d88e8

SHA256
88216e320b5db8eb9b183fae0a54c0511dc80d76e316fb7ddbc739a18bad2fde

SHA512
4e866d533692f3f69da2e19a750dc6165f4de70f7612a9cb29f3982fbb7162f1a99228eebb388565e2a508a7cf7c91657995ad31b85dcf7696904daa70ce7279

Download Submit
C:\Users\Admin\AppData\Local\Temp\fl.exe
MD5
863c021ab6d46dcc5f5b8a2cdab814fd

SHA1
fb1f5831b886e702a0a6e994188ce3e102935192

SHA256
25fa15664bb857af7bd264779f9d1d7b898cae1afcb992e0e3a6923f0c1d1992

SHA512
23dcac03b2f030fda00624c6b8eec18be72e4a47dd2c8006a227bccd11875767804c67fc295b9933ac82e52fec451318ae61a50c9c71ac6398fb6d76a25b2cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\fl.exe
MD5
863c021ab6d46dcc5f5b8a2cdab814fd

SHA1
fb1f5831b886e702a0a6e994188ce3e102935192

SHA256
25fa15664bb857af7bd264779f9d1d7b898cae1afcb992e0e3a6923f0c1d1992

SHA512
23dcac03b2f030fda00624c6b8eec18be72e4a47dd2c8006a227bccd11875767804c67fc295b9933ac82e52fec451318ae61a50c9c71ac6398fb6d76a25b2cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost32.exe
MD5
bc74a0b1eeeced279cd2088b27f8ffe2

SHA1
308d89755701eb813436560393d37173c04dc646

SHA256
692300a92b7741887214d6578af1ddac7a123fb058e6af0e2cab5d6dfa096ba2

SHA512
f81e8bbf854191d70d69d55c044d1ce7e2c271e76adb34406415db11ce029b6e614a06d12bf53779fb6aac85756e7d8b15411c053386e22b1dcc914e80098f0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost32.exe
MD5
bc74a0b1eeeced279cd2088b27f8ffe2

SHA1
308d89755701eb813436560393d37173c04dc646

SHA256
692300a92b7741887214d6578af1ddac7a123fb058e6af0e2cab5d6dfa096ba2

SHA512
f81e8bbf854191d70d69d55c044d1ce7e2c271e76adb34406415db11ce029b6e614a06d12bf53779fb6aac85756e7d8b15411c053386e22b1dcc914e80098f0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost32.exe
MD5
bc74a0b1eeeced279cd2088b27f8ffe2

SHA1
308d89755701eb813436560393d37173c04dc646

SHA256
692300a92b7741887214d6578af1ddac7a123fb058e6af0e2cab5d6dfa096ba2

SHA512
f81e8bbf854191d70d69d55c044d1ce7e2c271e76adb34406415db11ce029b6e614a06d12bf53779fb6aac85756e7d8b15411c053386e22b1dcc914e80098f0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost32.exe
MD5
bc74a0b1eeeced279cd2088b27f8ffe2

SHA1
308d89755701eb813436560393d37173c04dc646

SHA256
692300a92b7741887214d6578af1ddac7a123fb058e6af0e2cab5d6dfa096ba2

SHA512
f81e8bbf854191d70d69d55c044d1ce7e2c271e76adb34406415db11ce029b6e614a06d12bf53779fb6aac85756e7d8b15411c053386e22b1dcc914e80098f0e

Download Submit
C:\Windows\System32\Microsoft\Telemetry\sihost32.exe
MD5
84d1e96c80f25a1a9256b468a9f8257f

SHA1
b310707940a721bf8aaa310c141edb0df53cdc76

SHA256
24409df45885818a92793183122b07298d66508d552d4d3be07108448e891ca1

SHA512
3a36fe0486c4560b43314e67aa7bbb60f29343ef2e01e33f1c7ce74c81810609eec200f954d8c82313ed11a198343e092ef216b86725271f0fd06a0e9773d993

Download Submit
C:\Windows\System32\dascHost.exe
MD5
863c021ab6d46dcc5f5b8a2cdab814fd

SHA1
fb1f5831b886e702a0a6e994188ce3e102935192

SHA256
25fa15664bb857af7bd264779f9d1d7b898cae1afcb992e0e3a6923f0c1d1992

SHA512
23dcac03b2f030fda00624c6b8eec18be72e4a47dd2c8006a227bccd11875767804c67fc295b9933ac82e52fec451318ae61a50c9c71ac6398fb6d76a25b2cf3

Download Submit
C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
MD5
84d1e96c80f25a1a9256b468a9f8257f

SHA1
b310707940a721bf8aaa310c141edb0df53cdc76

SHA256
24409df45885818a92793183122b07298d66508d552d4d3be07108448e891ca1

SHA512
3a36fe0486c4560b43314e67aa7bbb60f29343ef2e01e33f1c7ce74c81810609eec200f954d8c82313ed11a198343e092ef216b86725271f0fd06a0e9773d993

Download Submit
C:\Windows\system32\dascHost.exe
MD5
863c021ab6d46dcc5f5b8a2cdab814fd

SHA1
fb1f5831b886e702a0a6e994188ce3e102935192

SHA256
25fa15664bb857af7bd264779f9d1d7b898cae1afcb992e0e3a6923f0c1d1992

SHA512
23dcac03b2f030fda00624c6b8eec18be72e4a47dd2c8006a227bccd11875767804c67fc295b9933ac82e52fec451318ae61a50c9c71ac6398fb6d76a25b2cf3

Download Submit
memory/1076-306-0x0000000000000000-mapping.dmp

Download
memory/1076-312-0x000000001C640000-0x000000001C642000-memory.dmp

Filesize
8KB

Download
memory/1132-313-0x0000000000000000-mapping.dmp

Download
memory/1136-148-0x000000001BFD0000-0x000000001BFD2000-memory.dmp

Filesize
8KB

Download
memory/1136-133-0x0000000000000000-mapping.dmp

Download
memory/1136-136-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1176-138-0x0000000000000000-mapping.dmp

Download
memory/1220-478-0x0000000000000000-mapping.dmp

Download
memory/1300-392-0x0000000000000000-mapping.dmp

Download
memory/1300-427-0x000001E31F806000-0x000001E31F808000-memory.dmp

Filesize
8KB

Download
memory/1300-425-0x000001E31F800000-0x000001E31F802000-memory.dmp

Filesize
8KB

Download
memory/1300-458-0x000001E31F808000-0x000001E31F809000-memory.dmp

Filesize
4KB

Download
memory/1300-426-0x000001E31F803000-0x000001E31F805000-memory.dmp

Filesize
8KB

Download
memory/1344-486-0x0000000000000000-mapping.dmp

Download
memory/1852-303-0x0000000000000000-mapping.dmp

Download
memory/1988-485-0x0000000000000000-mapping.dmp

Download
memory/2088-484-0x0000000000000000-mapping.dmp

Download
memory/2240-479-0x0000000000000000-mapping.dmp

Download
memory/2240-482-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/2240-488-0x000000001C400000-0x000000001C402000-memory.dmp

Filesize
8KB

Download
memory/2608-424-0x000001D8E8D48000-0x000001D8E8D49000-memory.dmp

Filesize
4KB

Download
memory/2608-388-0x000001D8E8D46000-0x000001D8E8D48000-memory.dmp

Filesize
8KB

Download
memory/2608-353-0x0000000000000000-mapping.dmp

Download
memory/2608-386-0x000001D8E8D40000-0x000001D8E8D42000-memory.dmp

Filesize
8KB

Download
memory/2608-387-0x000001D8E8D43000-0x000001D8E8D45000-memory.dmp

Filesize
8KB

Download
memory/2648-119-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/2648-118-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

Filesize
4KB

Download
memory/2648-116-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/2648-126-0x0000000007410000-0x0000000007411000-memory.dmp

Filesize
4KB

Download
memory/2648-125-0x0000000006D10000-0x0000000006D11000-memory.dmp

Filesize
4KB

Download
memory/2648-127-0x0000000006EE0000-0x0000000006EE1000-memory.dmp

Filesize
4KB

Download
memory/2648-123-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/2648-124-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/2648-120-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/2648-128-0x0000000007020000-0x0000000007021000-memory.dmp

Filesize
4KB

Download
memory/2648-122-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/2648-129-0x0000000007E40000-0x0000000007E41000-memory.dmp

Filesize
4KB

Download
memory/2648-121-0x0000000077AB0000-0x0000000077C3E000-memory.dmp

Filesize
1.6MB

Download
memory/2648-132-0x0000000007940000-0x0000000007941000-memory.dmp

Filesize
4KB

Download
memory/2648-131-0x00000000079B0000-0x00000000079B1000-memory.dmp

Filesize
4KB

Download
memory/2648-130-0x00000000071E0000-0x00000000071E1000-memory.dmp

Filesize
4KB

Download
memory/2652-297-0x0000000000000000-mapping.dmp

Download
memory/2652-305-0x0000000001310000-0x0000000001312000-memory.dmp

Filesize
8KB

Download
memory/2652-302-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/2652-300-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/2664-216-0x000001C065A68000-0x000001C065A69000-memory.dmp

Filesize
4KB

Download
memory/2664-177-0x0000000000000000-mapping.dmp

Download
memory/2664-214-0x000001C065A63000-0x000001C065A65000-memory.dmp

Filesize
8KB

Download
memory/2664-215-0x000001C065A66000-0x000001C065A68000-memory.dmp

Filesize
8KB

Download
memory/2664-213-0x000001C065A60000-0x000001C065A62000-memory.dmp

Filesize
8KB

Download
memory/2688-469-0x0000024786BE8000-0x0000024786BE9000-memory.dmp

Filesize
4KB

Download
memory/2688-460-0x0000024786BE0000-0x0000024786BE2000-memory.dmp

Filesize
8KB

Download
memory/2688-430-0x0000000000000000-mapping.dmp

Download
memory/2688-464-0x0000024786BE6000-0x0000024786BE8000-memory.dmp

Filesize
8KB

Download
memory/2688-462-0x0000024786BE3000-0x0000024786BE5000-memory.dmp

Filesize
8KB

Download
memory/2704-315-0x0000000000000000-mapping.dmp

Download
memory/2704-349-0x00000134A49E6000-0x00000134A49E8000-memory.dmp

Filesize
8KB

Download
memory/2704-348-0x00000134A49E3000-0x00000134A49E5000-memory.dmp

Filesize
8KB

Download
memory/2704-347-0x00000134A49E0000-0x00000134A49E2000-memory.dmp

Filesize
8KB

Download
memory/2704-385-0x00000134A49E8000-0x00000134A49E9000-memory.dmp

Filesize
4KB

Download
memory/2708-314-0x0000000000000000-mapping.dmp

Download
memory/2720-487-0x0000000003420000-0x0000000003422000-memory.dmp

Filesize
8KB

Download
memory/2720-471-0x0000000000000000-mapping.dmp

Download
memory/2744-470-0x0000000000000000-mapping.dmp

Download
memory/2956-139-0x0000000000000000-mapping.dmp

Download
memory/2956-147-0x000001E922E80000-0x000001E922E81000-memory.dmp

Filesize
4KB

Download
memory/2956-173-0x000001E908DF6000-0x000001E908DF8000-memory.dmp

Filesize
8KB

Download
memory/2956-150-0x000001E908DF3000-0x000001E908DF5000-memory.dmp

Filesize
8KB

Download
memory/2956-212-0x000001E908DF8000-0x000001E908DF9000-memory.dmp

Filesize
4KB

Download
memory/2956-144-0x000001E90AC80000-0x000001E90AC81000-memory.dmp

Filesize
4KB

Download
memory/2956-149-0x000001E908DF0000-0x000001E908DF2000-memory.dmp

Filesize
8KB

Download
memory/3244-253-0x000002B1FC1B8000-0x000002B1FC1B9000-memory.dmp

Filesize
4KB

Download
memory/3244-255-0x000002B1FC1B6000-0x000002B1FC1B8000-memory.dmp

Filesize
8KB

Download
memory/3244-252-0x000002B1FC1B0000-0x000002B1FC1B2000-memory.dmp

Filesize
8KB

Download
memory/3244-254-0x000002B1FC1B3000-0x000002B1FC1B5000-memory.dmp

Filesize
8KB

Download
memory/3244-218-0x0000000000000000-mapping.dmp

Download
memory/3388-310-0x0000000000000000-mapping.dmp

Download
memory/3496-304-0x0000000000000000-mapping.dmp

Download
memory/3824-296-0x0000000000000000-mapping.dmp

Download
memory/4076-289-0x000001D622150000-0x000001D622152000-memory.dmp

Filesize
8KB

Download
memory/4076-257-0x0000000000000000-mapping.dmp

Download
memory/4076-290-0x000001D622153000-0x000001D622155000-memory.dmp

Filesize
8KB

Download
memory/4076-291-0x000001D622156000-0x000001D622158000-memory.dmp

Filesize
8KB

Download
memory/4076-295-0x000001D622158000-0x000001D622159000-memory.dmp

Filesize
4KB

Download