Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 13:39
Behavioral task
behavioral1
Sample
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe
Resource
win7-20220718-en
General
-
Target
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe
-
Size
337KB
-
MD5
4f8e31356bf04b080c5ba8e47756c50f
-
SHA1
3b5eb07249e213865f1f0f4e779b2db126346c2b
-
SHA256
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905
-
SHA512
2c93d7ffad05bea58635a2445aab9b2a5d050b41c7c940bf74a066b2f4db8e4ecda110c7145a7b7de98904b40f3e8251d9a142cc1aaf4308c653aec26759a71f
Malware Config
Extracted
darkcomet
Guest16
globalgarus.bounceme.net:5552
DC_MUTEX-1A53RNC
-
InstallPath
MSDCSC\testinform.exe
-
gencode
qQc4wjtBrTS4
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\testinform.exe" 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe -
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
testinform.exeiexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile testinform.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" testinform.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" testinform.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe -
Modifies security service 2 TTPs 2 IoCs
Processes:
testinform.exeiexplore.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" testinform.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" iexplore.exe -
Processes:
iexplore.exetestinform.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" testinform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" testinform.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
testinform.exeiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" testinform.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe -
Executes dropped EXE 7 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeDesktopLayer.exetestinform.exetestinformSrv.exeDesktopLayer.exeiexploreSrv.exeDesktopLayer.exepid process 4760 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe 676 DesktopLayer.exe 4228 testinform.exe 2168 testinformSrv.exe 1648 DesktopLayer.exe 1636 iexploreSrv.exe 2828 DesktopLayer.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 4616 attrib.exe 4896 attrib.exe -
Processes:
resource yara_rule behavioral2/memory/4760-133-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/4760-137-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/676-139-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/2816-140-0x0000000000400000-0x00000000004D5000-memory.dmp upx C:\Users\Admin\Documents\MSDCSC\testinform.exe upx C:\Users\Admin\Documents\MSDCSC\testinform.exe upx behavioral2/memory/2168-154-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/memory/4228-152-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4228-159-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/2816-170-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/1636-167-0x0000000000400000-0x0000000000413000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe -
Processes:
testinform.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" testinform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" testinform.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exetestinform.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\testinform.exe" 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\testinform.exe" testinform.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\testinform.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
testinform.exedescription pid process target process PID 4228 set thread context of 3380 4228 testinform.exe iexplore.exe -
Drops file in Program Files directory 8 IoCs
Processes:
testinformSrv.exeiexplore.exeiexploreSrv.exe9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxACFE.tmp testinformSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe testinformSrv.exe File created C:\Program Files (x86)\Internet Explorer\iexploreSrv.exe iexplore.exe File opened for modification C:\Program Files (x86)\Microsoft\pxAF01.tmp iexploreSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe iexploreSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\px9E87.tmp 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4273090683" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30974072" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30974072" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4217153097" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30974072" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4244653793" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30974072" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "365554398" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2703CD54-0C6C-11ED-9262-5A835EAE57D3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4217153097" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4261999004" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30974072" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Modifies registry class 1 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
DesktopLayer.exeDesktopLayer.exeDesktopLayer.exepid process 676 DesktopLayer.exe 676 DesktopLayer.exe 676 DesktopLayer.exe 676 DesktopLayer.exe 676 DesktopLayer.exe 676 DesktopLayer.exe 676 DesktopLayer.exe 676 DesktopLayer.exe 1648 DesktopLayer.exe 1648 DesktopLayer.exe 1648 DesktopLayer.exe 1648 DesktopLayer.exe 1648 DesktopLayer.exe 1648 DesktopLayer.exe 1648 DesktopLayer.exe 1648 DesktopLayer.exe 2828 DesktopLayer.exe 2828 DesktopLayer.exe 2828 DesktopLayer.exe 2828 DesktopLayer.exe 2828 DesktopLayer.exe 2828 DesktopLayer.exe 2828 DesktopLayer.exe 2828 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 3380 iexplore.exe 4248 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exetestinform.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeSecurityPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeTakeOwnershipPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeLoadDriverPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeSystemProfilePrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeSystemtimePrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeProfSingleProcessPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeIncBasePriorityPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeCreatePagefilePrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeBackupPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeRestorePrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeShutdownPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeDebugPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeSystemEnvironmentPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeChangeNotifyPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeRemoteShutdownPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeUndockPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeManageVolumePrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeImpersonatePrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeCreateGlobalPrivilege 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: 33 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: 34 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: 35 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: 36 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeIncreaseQuotaPrivilege 4228 testinform.exe Token: SeSecurityPrivilege 4228 testinform.exe Token: SeTakeOwnershipPrivilege 4228 testinform.exe Token: SeLoadDriverPrivilege 4228 testinform.exe Token: SeSystemProfilePrivilege 4228 testinform.exe Token: SeSystemtimePrivilege 4228 testinform.exe Token: SeProfSingleProcessPrivilege 4228 testinform.exe Token: SeIncBasePriorityPrivilege 4228 testinform.exe Token: SeCreatePagefilePrivilege 4228 testinform.exe Token: SeBackupPrivilege 4228 testinform.exe Token: SeRestorePrivilege 4228 testinform.exe Token: SeShutdownPrivilege 4228 testinform.exe Token: SeDebugPrivilege 4228 testinform.exe Token: SeSystemEnvironmentPrivilege 4228 testinform.exe Token: SeChangeNotifyPrivilege 4228 testinform.exe Token: SeRemoteShutdownPrivilege 4228 testinform.exe Token: SeUndockPrivilege 4228 testinform.exe Token: SeManageVolumePrivilege 4228 testinform.exe Token: SeImpersonatePrivilege 4228 testinform.exe Token: SeCreateGlobalPrivilege 4228 testinform.exe Token: 33 4228 testinform.exe Token: 34 4228 testinform.exe Token: 35 4228 testinform.exe Token: 36 4228 testinform.exe Token: SeIncreaseQuotaPrivilege 3380 iexplore.exe Token: SeSecurityPrivilege 3380 iexplore.exe Token: SeTakeOwnershipPrivilege 3380 iexplore.exe Token: SeLoadDriverPrivilege 3380 iexplore.exe Token: SeSystemProfilePrivilege 3380 iexplore.exe Token: SeSystemtimePrivilege 3380 iexplore.exe Token: SeProfSingleProcessPrivilege 3380 iexplore.exe Token: SeIncBasePriorityPrivilege 3380 iexplore.exe Token: SeCreatePagefilePrivilege 3380 iexplore.exe Token: SeBackupPrivilege 3380 iexplore.exe Token: SeRestorePrivilege 3380 iexplore.exe Token: SeShutdownPrivilege 3380 iexplore.exe Token: SeDebugPrivilege 3380 iexplore.exe Token: SeSystemEnvironmentPrivilege 3380 iexplore.exe Token: SeChangeNotifyPrivilege 3380 iexplore.exe Token: SeRemoteShutdownPrivilege 3380 iexplore.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exepid process 4248 iexplore.exe 4248 iexplore.exe 4248 iexplore.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 4248 iexplore.exe 4248 iexplore.exe 2896 IEXPLORE.EXE 2896 IEXPLORE.EXE 3380 iexplore.exe 4248 iexplore.exe 4248 iexplore.exe 4248 iexplore.exe 4248 iexplore.exe 4016 IEXPLORE.EXE 4016 IEXPLORE.EXE 1820 IEXPLORE.EXE 1820 IEXPLORE.EXE 1820 IEXPLORE.EXE 1820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeDesktopLayer.exeiexplore.execmd.execmd.exetestinform.exetestinformSrv.exeiexplore.exeDesktopLayer.exedescription pid process target process PID 2816 wrote to memory of 4760 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe PID 2816 wrote to memory of 4760 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe PID 2816 wrote to memory of 4760 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe PID 4760 wrote to memory of 676 4760 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe DesktopLayer.exe PID 4760 wrote to memory of 676 4760 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe DesktopLayer.exe PID 4760 wrote to memory of 676 4760 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe DesktopLayer.exe PID 676 wrote to memory of 4248 676 DesktopLayer.exe iexplore.exe PID 676 wrote to memory of 4248 676 DesktopLayer.exe iexplore.exe PID 4248 wrote to memory of 2896 4248 iexplore.exe IEXPLORE.EXE PID 4248 wrote to memory of 2896 4248 iexplore.exe IEXPLORE.EXE PID 4248 wrote to memory of 2896 4248 iexplore.exe IEXPLORE.EXE PID 2816 wrote to memory of 872 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 2816 wrote to memory of 872 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 2816 wrote to memory of 872 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 2816 wrote to memory of 2940 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 2816 wrote to memory of 2940 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 2816 wrote to memory of 2940 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 2816 wrote to memory of 520 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 872 wrote to memory of 4896 872 cmd.exe attrib.exe PID 872 wrote to memory of 4896 872 cmd.exe attrib.exe PID 872 wrote to memory of 4896 872 cmd.exe attrib.exe PID 2940 wrote to memory of 4616 2940 cmd.exe attrib.exe PID 2940 wrote to memory of 4616 2940 cmd.exe attrib.exe PID 2940 wrote to memory of 4616 2940 cmd.exe attrib.exe PID 2816 wrote to memory of 4228 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe testinform.exe PID 2816 wrote to memory of 4228 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe testinform.exe PID 2816 wrote to memory of 4228 2816 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe testinform.exe PID 4228 wrote to memory of 2168 4228 testinform.exe testinformSrv.exe PID 4228 wrote to memory of 2168 4228 testinform.exe testinformSrv.exe PID 4228 wrote to memory of 2168 4228 testinform.exe testinformSrv.exe PID 4228 wrote to memory of 3380 4228 testinform.exe iexplore.exe PID 4228 wrote to memory of 3380 4228 testinform.exe iexplore.exe PID 4228 wrote to memory of 3380 4228 testinform.exe iexplore.exe PID 2168 wrote to memory of 1648 2168 testinformSrv.exe DesktopLayer.exe PID 2168 wrote to memory of 1648 2168 testinformSrv.exe DesktopLayer.exe PID 2168 wrote to memory of 1648 2168 testinformSrv.exe DesktopLayer.exe PID 4228 wrote to memory of 3380 4228 testinform.exe iexplore.exe PID 4228 wrote to memory of 3380 4228 testinform.exe iexplore.exe PID 3380 wrote to memory of 1636 3380 iexplore.exe iexploreSrv.exe PID 3380 wrote to memory of 1636 3380 iexplore.exe iexploreSrv.exe PID 3380 wrote to memory of 1636 3380 iexplore.exe iexploreSrv.exe PID 1648 wrote to memory of 212 1648 DesktopLayer.exe iexplore.exe PID 1648 wrote to memory of 212 1648 DesktopLayer.exe iexplore.exe PID 3380 wrote to memory of 4644 3380 iexplore.exe notepad.exe PID 3380 wrote to memory of 4644 3380 iexplore.exe notepad.exe PID 3380 wrote to memory of 4644 3380 iexplore.exe notepad.exe PID 3380 wrote to memory of 4644 3380 iexplore.exe notepad.exe PID 3380 wrote to memory of 4644 3380 iexplore.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
testinform.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion testinform.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern testinform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" testinform.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4896 attrib.exe 4616 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe"C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeC:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4248 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4248 CREDAT:82948 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4248 CREDAT:17412 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\Users\Admin\Documents\MSDCSC\testinform.exe"C:\Users\Admin\Documents\MSDCSC\testinform.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\Documents\MSDCSC\testinformSrv.exeC:\Users\Admin\Documents\MSDCSC\testinformSrv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
-
C:\Program Files (x86)\Internet Explorer\iexploreSrv.exe"C:\Program Files (x86)\Internet Explorer\iexploreSrv.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"1⤵
- Modifies Internet Explorer settings
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Internet Explorer\iexploreSrv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Internet Explorer\iexploreSrv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\Documents\MSDCSC\testinform.exeFilesize
337KB
MD54f8e31356bf04b080c5ba8e47756c50f
SHA13b5eb07249e213865f1f0f4e779b2db126346c2b
SHA2569b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905
SHA5122c93d7ffad05bea58635a2445aab9b2a5d050b41c7c940bf74a066b2f4db8e4ecda110c7145a7b7de98904b40f3e8251d9a142cc1aaf4308c653aec26759a71f
-
C:\Users\Admin\Documents\MSDCSC\testinform.exeFilesize
337KB
MD54f8e31356bf04b080c5ba8e47756c50f
SHA13b5eb07249e213865f1f0f4e779b2db126346c2b
SHA2569b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905
SHA5122c93d7ffad05bea58635a2445aab9b2a5d050b41c7c940bf74a066b2f4db8e4ecda110c7145a7b7de98904b40f3e8251d9a142cc1aaf4308c653aec26759a71f
-
C:\Users\Admin\Documents\MSDCSC\testinformSrv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\Documents\MSDCSC\testinformSrv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
memory/520-143-0x0000000000000000-mapping.dmp
-
memory/676-139-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/676-134-0x0000000000000000-mapping.dmp
-
memory/872-141-0x0000000000000000-mapping.dmp
-
memory/1636-167-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1636-157-0x0000000000000000-mapping.dmp
-
memory/1648-155-0x0000000000000000-mapping.dmp
-
memory/2168-149-0x0000000000000000-mapping.dmp
-
memory/2168-154-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2816-140-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/2816-170-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/2828-165-0x0000000000000000-mapping.dmp
-
memory/2940-142-0x0000000000000000-mapping.dmp
-
memory/4228-152-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/4228-159-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/4228-146-0x0000000000000000-mapping.dmp
-
memory/4616-145-0x0000000000000000-mapping.dmp
-
memory/4644-163-0x0000000000000000-mapping.dmp
-
memory/4760-130-0x0000000000000000-mapping.dmp
-
memory/4760-137-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4760-133-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4896-144-0x0000000000000000-mapping.dmp