Analysis
-
max time kernel
191s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 19:53
Behavioral task
behavioral1
Sample
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe
Resource
win7-20221111-en
General
-
Target
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe
-
Size
308KB
-
MD5
733874ca87d54ba711a1a366e9601261
-
SHA1
69fbaa4bb1f9f4b3736041f374d2f3f108672b38
-
SHA256
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf
-
SHA512
885524d4c8271fc1cc6daf6203abbcb182dcb349b8ddabe87d037a557a84be292a87747cb1271babcce0a51809523edb43cdc358cf8de07140292618b0c7de90
-
SSDEEP
6144:CcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQWBDhr3H:CcWkbgTYWnYnt/IDYhPLj
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\FgFBfDLSxflB\\winlogon/winlogon.exe *32" c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe -
Executes dropped EXE 2 IoCs
Processes:
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exeDesktopLayer.exepid process 2896 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe 2488 DesktopLayer.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1212 attrib.exe 5076 attrib.exe -
Processes:
resource yara_rule behavioral2/memory/2964-132-0x0000000000400000-0x00000000004C6000-memory.dmp upx behavioral2/memory/2964-133-0x0000000000400000-0x00000000004C6000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe upx behavioral2/memory/2896-136-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2896-137-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2896-139-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/2488-144-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon.exe *32 = "C:\\Windows\\system32\\FgFBfDLSxflB\\winlogon/winlogon.exe *32" c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe -
Drops file in System32 directory 4 IoCs
Processes:
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exedescription ioc process File created C:\Windows\SysWOW64\winlogon\winlogon.exe *32 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe File created C:\Windows\SysWOW64\FgFBfDLSxflB\winlogon\winlogon.exe *32 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe File opened for modification C:\Windows\SysWOW64\FgFBfDLSxflB\winlogon\winlogon.exe *32 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe File opened for modification C:\Windows\SysWOW64\FgFBfDLSxflB\ c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe -
Drops file in Program Files directory 3 IoCs
Processes:
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxE5AD.tmp c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{35B60471-705B-11ED-BF5F-6683CF8C50C7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "255466056" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999656" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999656" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "255466056" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376542254" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 2488 DesktopLayer.exe 2488 DesktopLayer.exe 2488 DesktopLayer.exe 2488 DesktopLayer.exe 2488 DesktopLayer.exe 2488 DesktopLayer.exe 2488 DesktopLayer.exe 2488 DesktopLayer.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exedescription pid process Token: SeIncreaseQuotaPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeSecurityPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeTakeOwnershipPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeLoadDriverPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeSystemProfilePrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeSystemtimePrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeProfSingleProcessPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeIncBasePriorityPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeCreatePagefilePrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeBackupPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeRestorePrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeShutdownPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeDebugPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeSystemEnvironmentPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeChangeNotifyPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeRemoteShutdownPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeUndockPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeManageVolumePrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeImpersonatePrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: SeCreateGlobalPrivilege 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: 33 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: 34 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: 35 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe Token: 36 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2520 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
iexplore.exec13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exeIEXPLORE.EXEpid process 2520 iexplore.exe 2520 iexplore.exe 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe 4984 IEXPLORE.EXE 4984 IEXPLORE.EXE 4984 IEXPLORE.EXE 4984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exec13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exeDesktopLayer.exeiexplore.execmd.execmd.exedescription pid process target process PID 2964 wrote to memory of 2896 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe PID 2964 wrote to memory of 2896 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe PID 2964 wrote to memory of 2896 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe PID 2896 wrote to memory of 2488 2896 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe DesktopLayer.exe PID 2896 wrote to memory of 2488 2896 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe DesktopLayer.exe PID 2896 wrote to memory of 2488 2896 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe DesktopLayer.exe PID 2488 wrote to memory of 2520 2488 DesktopLayer.exe iexplore.exe PID 2488 wrote to memory of 2520 2488 DesktopLayer.exe iexplore.exe PID 2520 wrote to memory of 4984 2520 iexplore.exe IEXPLORE.EXE PID 2520 wrote to memory of 4984 2520 iexplore.exe IEXPLORE.EXE PID 2520 wrote to memory of 4984 2520 iexplore.exe IEXPLORE.EXE PID 2964 wrote to memory of 8 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe cmd.exe PID 2964 wrote to memory of 8 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe cmd.exe PID 2964 wrote to memory of 8 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe cmd.exe PID 2964 wrote to memory of 2516 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe cmd.exe PID 2964 wrote to memory of 2516 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe cmd.exe PID 2964 wrote to memory of 2516 2964 c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe cmd.exe PID 2516 wrote to memory of 5076 2516 cmd.exe attrib.exe PID 2516 wrote to memory of 5076 2516 cmd.exe attrib.exe PID 2516 wrote to memory of 5076 2516 cmd.exe attrib.exe PID 8 wrote to memory of 1212 8 cmd.exe attrib.exe PID 8 wrote to memory of 1212 8 cmd.exe attrib.exe PID 8 wrote to memory of 1212 8 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1212 attrib.exe 5076 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe"C:\Users\Admin\AppData\Local\Temp\c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exeC:\Users\Admin\AppData\Local\Temp\c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cf.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\c13f35c0dc3c57838ad8166202fe4f1785bed9c8b13ea1c83a4f49c0809254cfSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
memory/8-145-0x0000000000000000-mapping.dmp
-
memory/1212-148-0x0000000000000000-mapping.dmp
-
memory/2488-144-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2488-141-0x0000000000000000-mapping.dmp
-
memory/2516-146-0x0000000000000000-mapping.dmp
-
memory/2896-139-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2896-138-0x0000000000580000-0x000000000058F000-memory.dmpFilesize
60KB
-
memory/2896-137-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2896-136-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2896-134-0x0000000000000000-mapping.dmp
-
memory/2964-132-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2964-133-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/5076-147-0x0000000000000000-mapping.dmp