Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 22:59
Static task
static1
Behavioral task
behavioral1
Sample
9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe
Resource
win7-20220901-en
General
-
Target
9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe
-
Size
220KB
-
MD5
2b8767529bdf678f3b6adb26da46f393
-
SHA1
d375c1af8dda778fbfb2898447838ffe245a9f8d
-
SHA256
9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c
-
SHA512
57bd41e3284fa5ce51544a0301dfc677ca82ac1149240fffc6d5fe6a36ac2ae82a5b9ff948b3c66ac535bbf3e9b01b7133e2e6109d09fb831b689e95bdf3f27b
-
SSDEEP
6144:vU5B0NZ2oFsETmEY83TN5ZZDbDBH+RBE0/F:QOtFsoVYAjmhF
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\ZSBSJ5MBR9.exe = "C:\\Users\\Admin\\AppData\\Roaming\\ZSBSJ5MBR9.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Executes dropped EXE 3 IoCs
Processes:
explorer.exelsam.exespolsv.exepid process 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe -
Processes:
resource yara_rule behavioral1/memory/832-65-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/832-68-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/832-69-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/832-72-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/832-75-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/832-76-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/832-77-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 1344 explorer.exe -
Loads dropped DLL 6 IoCs
Processes:
9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exeexplorer.exelsam.exepid process 1720 9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe 1720 9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe 1344 explorer.exe 1344 explorer.exe 980 lsam.exe 980 lsam.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
lsam.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\lsam.exe" lsam.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
explorer.exespolsv.exedescription pid process target process PID 1344 set thread context of 832 1344 explorer.exe AppLaunch.exe PID 1860 set thread context of 988 1860 spolsv.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exepid process 840 reg.exe 968 reg.exe 1736 reg.exe 1504 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
explorer.exelsam.exespolsv.exepid process 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe 980 lsam.exe 1860 spolsv.exe 1344 explorer.exe -
Suspicious use of AdjustPrivilegeToken 39 IoCs
Processes:
9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exeexplorer.exeAppLaunch.exelsam.exespolsv.exedescription pid process Token: SeDebugPrivilege 1720 9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe Token: SeDebugPrivilege 1344 explorer.exe Token: 1 832 AppLaunch.exe Token: SeCreateTokenPrivilege 832 AppLaunch.exe Token: SeAssignPrimaryTokenPrivilege 832 AppLaunch.exe Token: SeLockMemoryPrivilege 832 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 832 AppLaunch.exe Token: SeMachineAccountPrivilege 832 AppLaunch.exe Token: SeTcbPrivilege 832 AppLaunch.exe Token: SeSecurityPrivilege 832 AppLaunch.exe Token: SeTakeOwnershipPrivilege 832 AppLaunch.exe Token: SeLoadDriverPrivilege 832 AppLaunch.exe Token: SeSystemProfilePrivilege 832 AppLaunch.exe Token: SeSystemtimePrivilege 832 AppLaunch.exe Token: SeProfSingleProcessPrivilege 832 AppLaunch.exe Token: SeIncBasePriorityPrivilege 832 AppLaunch.exe Token: SeCreatePagefilePrivilege 832 AppLaunch.exe Token: SeCreatePermanentPrivilege 832 AppLaunch.exe Token: SeBackupPrivilege 832 AppLaunch.exe Token: SeRestorePrivilege 832 AppLaunch.exe Token: SeShutdownPrivilege 832 AppLaunch.exe Token: SeDebugPrivilege 832 AppLaunch.exe Token: SeAuditPrivilege 832 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 832 AppLaunch.exe Token: SeChangeNotifyPrivilege 832 AppLaunch.exe Token: SeRemoteShutdownPrivilege 832 AppLaunch.exe Token: SeUndockPrivilege 832 AppLaunch.exe Token: SeSyncAgentPrivilege 832 AppLaunch.exe Token: SeEnableDelegationPrivilege 832 AppLaunch.exe Token: SeManageVolumePrivilege 832 AppLaunch.exe Token: SeImpersonatePrivilege 832 AppLaunch.exe Token: SeCreateGlobalPrivilege 832 AppLaunch.exe Token: 31 832 AppLaunch.exe Token: 32 832 AppLaunch.exe Token: 33 832 AppLaunch.exe Token: 34 832 AppLaunch.exe Token: 35 832 AppLaunch.exe Token: SeDebugPrivilege 980 lsam.exe Token: SeDebugPrivilege 1860 spolsv.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AppLaunch.exeAppLaunch.exepid process 832 AppLaunch.exe 832 AppLaunch.exe 832 AppLaunch.exe 988 AppLaunch.exe 988 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exeexplorer.exeAppLaunch.exelsam.execmd.execmd.exedescription pid process target process PID 1720 wrote to memory of 1344 1720 9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe explorer.exe PID 1720 wrote to memory of 1344 1720 9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe explorer.exe PID 1720 wrote to memory of 1344 1720 9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe explorer.exe PID 1720 wrote to memory of 1344 1720 9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe explorer.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 1344 wrote to memory of 832 1344 explorer.exe AppLaunch.exe PID 832 wrote to memory of 1524 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1524 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1524 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1524 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1524 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1524 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1524 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1040 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1040 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1040 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1040 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1040 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1040 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1040 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1540 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1540 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1540 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1540 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1540 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1540 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1540 832 AppLaunch.exe cmd.exe PID 1344 wrote to memory of 980 1344 explorer.exe lsam.exe PID 1344 wrote to memory of 980 1344 explorer.exe lsam.exe PID 1344 wrote to memory of 980 1344 explorer.exe lsam.exe PID 1344 wrote to memory of 980 1344 explorer.exe lsam.exe PID 832 wrote to memory of 1128 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1128 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1128 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1128 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1128 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1128 832 AppLaunch.exe cmd.exe PID 832 wrote to memory of 1128 832 AppLaunch.exe cmd.exe PID 980 wrote to memory of 1860 980 lsam.exe spolsv.exe PID 980 wrote to memory of 1860 980 lsam.exe spolsv.exe PID 980 wrote to memory of 1860 980 lsam.exe spolsv.exe PID 980 wrote to memory of 1860 980 lsam.exe spolsv.exe PID 1128 wrote to memory of 1736 1128 cmd.exe reg.exe PID 1128 wrote to memory of 1736 1128 cmd.exe reg.exe PID 1128 wrote to memory of 1736 1128 cmd.exe reg.exe PID 1128 wrote to memory of 1736 1128 cmd.exe reg.exe PID 1128 wrote to memory of 1736 1128 cmd.exe reg.exe PID 1128 wrote to memory of 1736 1128 cmd.exe reg.exe PID 1128 wrote to memory of 1736 1128 cmd.exe reg.exe PID 1040 wrote to memory of 968 1040 cmd.exe reg.exe PID 1040 wrote to memory of 968 1040 cmd.exe reg.exe PID 1040 wrote to memory of 968 1040 cmd.exe reg.exe PID 1040 wrote to memory of 968 1040 cmd.exe reg.exe PID 1040 wrote to memory of 968 1040 cmd.exe reg.exe PID 1040 wrote to memory of 968 1040 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe"C:\Users\Admin\AppData\Local\Temp\9f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ZSBSJ5MBR9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ZSBSJ5MBR9.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ZSBSJ5MBR9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ZSBSJ5MBR9.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
-
C:\Users\Admin\AppData\Local\Temp\System\lsam.exe"C:\Users\Admin\AppData\Local\Temp\System\lsam.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe"C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f1⤵
- Modifies firewall policy service
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
102B
MD5029a6f5aa81356b56a20e48e3a8b0000
SHA1f991d6237acc68b0d8332409071ac63b602298ca
SHA256177871646137e558b8746ee66f634f7d29a56112dbbcb4eed8bba87136b08568
SHA5129d0d1aa7244cc8ba54ada413ce54e03e3d128b59fb7c80d7518c5d1944e870e9d666a418d8656ca703ee88059c05c70aa9845b38b5a536025e091681c6f1d780
-
C:\Users\Admin\AppData\Local\Temp\System\lsam.exeFilesize
25KB
MD539b9e0ce01f0a0b715241051b26f765b
SHA1e64bef34105060532a57ad4d1bc0a91e0f1413d1
SHA2568a1774770a9d2d651e01c38cff95cbe2014cf0fa09fc7c8d69bd96b9e2e443a4
SHA5123c79f33e9ac36d6911320929ea591387ba532ad872667bc2d76551cc5260772d8e7db6528ac11fbfa013c3cd8c3c1506c3cb35402122ebbcbd34a2ee726261e4
-
C:\Users\Admin\AppData\Local\Temp\System\lsam.exeFilesize
25KB
MD539b9e0ce01f0a0b715241051b26f765b
SHA1e64bef34105060532a57ad4d1bc0a91e0f1413d1
SHA2568a1774770a9d2d651e01c38cff95cbe2014cf0fa09fc7c8d69bd96b9e2e443a4
SHA5123c79f33e9ac36d6911320929ea591387ba532ad872667bc2d76551cc5260772d8e7db6528ac11fbfa013c3cd8c3c1506c3cb35402122ebbcbd34a2ee726261e4
-
C:\Users\Admin\AppData\Local\Temp\System\spolsv.exeFilesize
220KB
MD52b8767529bdf678f3b6adb26da46f393
SHA1d375c1af8dda778fbfb2898447838ffe245a9f8d
SHA2569f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c
SHA51257bd41e3284fa5ce51544a0301dfc677ca82ac1149240fffc6d5fe6a36ac2ae82a5b9ff948b3c66ac535bbf3e9b01b7133e2e6109d09fb831b689e95bdf3f27b
-
C:\Users\Admin\AppData\Local\Temp\System\spolsv.exeFilesize
220KB
MD52b8767529bdf678f3b6adb26da46f393
SHA1d375c1af8dda778fbfb2898447838ffe245a9f8d
SHA2569f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c
SHA51257bd41e3284fa5ce51544a0301dfc677ca82ac1149240fffc6d5fe6a36ac2ae82a5b9ff948b3c66ac535bbf3e9b01b7133e2e6109d09fb831b689e95bdf3f27b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exeFilesize
220KB
MD52b8767529bdf678f3b6adb26da46f393
SHA1d375c1af8dda778fbfb2898447838ffe245a9f8d
SHA2569f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c
SHA51257bd41e3284fa5ce51544a0301dfc677ca82ac1149240fffc6d5fe6a36ac2ae82a5b9ff948b3c66ac535bbf3e9b01b7133e2e6109d09fb831b689e95bdf3f27b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exeFilesize
220KB
MD52b8767529bdf678f3b6adb26da46f393
SHA1d375c1af8dda778fbfb2898447838ffe245a9f8d
SHA2569f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c
SHA51257bd41e3284fa5ce51544a0301dfc677ca82ac1149240fffc6d5fe6a36ac2ae82a5b9ff948b3c66ac535bbf3e9b01b7133e2e6109d09fb831b689e95bdf3f27b
-
\Users\Admin\AppData\Local\Temp\System\lsam.exeFilesize
25KB
MD539b9e0ce01f0a0b715241051b26f765b
SHA1e64bef34105060532a57ad4d1bc0a91e0f1413d1
SHA2568a1774770a9d2d651e01c38cff95cbe2014cf0fa09fc7c8d69bd96b9e2e443a4
SHA5123c79f33e9ac36d6911320929ea591387ba532ad872667bc2d76551cc5260772d8e7db6528ac11fbfa013c3cd8c3c1506c3cb35402122ebbcbd34a2ee726261e4
-
\Users\Admin\AppData\Local\Temp\System\lsam.exeFilesize
25KB
MD539b9e0ce01f0a0b715241051b26f765b
SHA1e64bef34105060532a57ad4d1bc0a91e0f1413d1
SHA2568a1774770a9d2d651e01c38cff95cbe2014cf0fa09fc7c8d69bd96b9e2e443a4
SHA5123c79f33e9ac36d6911320929ea591387ba532ad872667bc2d76551cc5260772d8e7db6528ac11fbfa013c3cd8c3c1506c3cb35402122ebbcbd34a2ee726261e4
-
\Users\Admin\AppData\Local\Temp\System\spolsv.exeFilesize
220KB
MD52b8767529bdf678f3b6adb26da46f393
SHA1d375c1af8dda778fbfb2898447838ffe245a9f8d
SHA2569f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c
SHA51257bd41e3284fa5ce51544a0301dfc677ca82ac1149240fffc6d5fe6a36ac2ae82a5b9ff948b3c66ac535bbf3e9b01b7133e2e6109d09fb831b689e95bdf3f27b
-
\Users\Admin\AppData\Local\Temp\System\spolsv.exeFilesize
220KB
MD52b8767529bdf678f3b6adb26da46f393
SHA1d375c1af8dda778fbfb2898447838ffe245a9f8d
SHA2569f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c
SHA51257bd41e3284fa5ce51544a0301dfc677ca82ac1149240fffc6d5fe6a36ac2ae82a5b9ff948b3c66ac535bbf3e9b01b7133e2e6109d09fb831b689e95bdf3f27b
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exeFilesize
220KB
MD52b8767529bdf678f3b6adb26da46f393
SHA1d375c1af8dda778fbfb2898447838ffe245a9f8d
SHA2569f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c
SHA51257bd41e3284fa5ce51544a0301dfc677ca82ac1149240fffc6d5fe6a36ac2ae82a5b9ff948b3c66ac535bbf3e9b01b7133e2e6109d09fb831b689e95bdf3f27b
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exeFilesize
220KB
MD52b8767529bdf678f3b6adb26da46f393
SHA1d375c1af8dda778fbfb2898447838ffe245a9f8d
SHA2569f932b1a95863ee39911bd5ea8d49ff17b0930f34ebcebae70d7f2ea6b130a2c
SHA51257bd41e3284fa5ce51544a0301dfc677ca82ac1149240fffc6d5fe6a36ac2ae82a5b9ff948b3c66ac535bbf3e9b01b7133e2e6109d09fb831b689e95bdf3f27b
-
memory/832-64-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/832-65-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/832-72-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/832-75-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/832-76-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/832-77-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/832-130-0x0000000000449000-0x0000000000472000-memory.dmpFilesize
164KB
-
memory/832-126-0x0000000000449000-0x0000000000472000-memory.dmpFilesize
164KB
-
memory/832-69-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/832-68-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/832-70-0x00000000004710F0-mapping.dmp
-
memory/840-104-0x0000000000000000-mapping.dmp
-
memory/968-100-0x0000000000000000-mapping.dmp
-
memory/980-131-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/980-127-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/980-86-0x0000000000000000-mapping.dmp
-
memory/988-125-0x0000000000449000-0x0000000000472000-memory.dmpFilesize
164KB
-
memory/988-114-0x00000000004710F0-mapping.dmp
-
memory/1040-82-0x0000000000000000-mapping.dmp
-
memory/1128-87-0x0000000000000000-mapping.dmp
-
memory/1344-129-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1344-58-0x0000000000000000-mapping.dmp
-
memory/1344-66-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1504-101-0x0000000000000000-mapping.dmp
-
memory/1524-81-0x0000000000000000-mapping.dmp
-
memory/1540-84-0x0000000000000000-mapping.dmp
-
memory/1720-55-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1720-54-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/1720-62-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1736-99-0x0000000000000000-mapping.dmp
-
memory/1860-128-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB
-
memory/1860-98-0x0000000000000000-mapping.dmp
-
memory/1860-132-0x00000000749D0000-0x0000000074F7B000-memory.dmpFilesize
5.7MB