Analysis
-
max time kernel
182s -
max time network
240s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-05-2023 20:23
Static task
static1
Behavioral task
behavioral1
Sample
vpn.exe
Resource
win7-20230220-en
General
-
Target
vpn.exe
-
Size
3.0MB
-
MD5
4b32941cd92e048e6a2d16c6069edf62
-
SHA1
5d167b4588575ffbc7a06cd9fa22552dced38951
-
SHA256
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d
-
SHA512
8b5c75642960991648fd18fb2c5421f8d082f0982a4b5950dd091547dc53943fccb287a404593fbb08282188c3c94d75e05c28f1a58f83a5b6559f34a516442e
-
SSDEEP
98304:6fFbrdnYUGkQqOSlBk1G4QBeKW0wnpTX5OIX:6fFbhBMqOxFgW3nRr
Malware Config
Extracted
aurora
94.142.138.215:8081
Signatures
-
Detects any file with a triage score of 10 4 IoCs
This file has been assigned a triage score of 10, indicating a high likelihood of malicious behavior.
Processes:
resource yara_rule behavioral1/memory/1736-55-0x0000000000A30000-0x0000000001252000-memory.dmp triage_score_10 behavioral1/memory/1736-57-0x0000000000A30000-0x0000000001252000-memory.dmp triage_score_10 behavioral1/memory/1736-58-0x0000000000A30000-0x0000000001252000-memory.dmp triage_score_10 behavioral1/memory/1736-59-0x0000000000A30000-0x0000000001252000-memory.dmp triage_score_10 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
vpn.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ vpn.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
vpn.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vpn.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vpn.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
vpn.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vpn.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
vpn.exepid process 1736 vpn.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
vpn.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1736 vpn.exe 1032 powershell.exe 1560 powershell.exe 1876 powershell.exe 1240 powershell.exe 920 powershell.exe 1356 powershell.exe 1232 powershell.exe 2044 powershell.exe 1932 powershell.exe 2032 powershell.exe 1584 powershell.exe 760 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 1880 WMIC.exe Token: SeSecurityPrivilege 1880 WMIC.exe Token: SeTakeOwnershipPrivilege 1880 WMIC.exe Token: SeLoadDriverPrivilege 1880 WMIC.exe Token: SeSystemProfilePrivilege 1880 WMIC.exe Token: SeSystemtimePrivilege 1880 WMIC.exe Token: SeProfSingleProcessPrivilege 1880 WMIC.exe Token: SeIncBasePriorityPrivilege 1880 WMIC.exe Token: SeCreatePagefilePrivilege 1880 WMIC.exe Token: SeBackupPrivilege 1880 WMIC.exe Token: SeRestorePrivilege 1880 WMIC.exe Token: SeShutdownPrivilege 1880 WMIC.exe Token: SeDebugPrivilege 1880 WMIC.exe Token: SeSystemEnvironmentPrivilege 1880 WMIC.exe Token: SeRemoteShutdownPrivilege 1880 WMIC.exe Token: SeUndockPrivilege 1880 WMIC.exe Token: SeManageVolumePrivilege 1880 WMIC.exe Token: 33 1880 WMIC.exe Token: 34 1880 WMIC.exe Token: 35 1880 WMIC.exe Token: SeIncreaseQuotaPrivilege 1880 WMIC.exe Token: SeSecurityPrivilege 1880 WMIC.exe Token: SeTakeOwnershipPrivilege 1880 WMIC.exe Token: SeLoadDriverPrivilege 1880 WMIC.exe Token: SeSystemProfilePrivilege 1880 WMIC.exe Token: SeSystemtimePrivilege 1880 WMIC.exe Token: SeProfSingleProcessPrivilege 1880 WMIC.exe Token: SeIncBasePriorityPrivilege 1880 WMIC.exe Token: SeCreatePagefilePrivilege 1880 WMIC.exe Token: SeBackupPrivilege 1880 WMIC.exe Token: SeRestorePrivilege 1880 WMIC.exe Token: SeShutdownPrivilege 1880 WMIC.exe Token: SeDebugPrivilege 1880 WMIC.exe Token: SeSystemEnvironmentPrivilege 1880 WMIC.exe Token: SeRemoteShutdownPrivilege 1880 WMIC.exe Token: SeUndockPrivilege 1880 WMIC.exe Token: SeManageVolumePrivilege 1880 WMIC.exe Token: 33 1880 WMIC.exe Token: 34 1880 WMIC.exe Token: 35 1880 WMIC.exe Token: SeIncreaseQuotaPrivilege 872 wmic.exe Token: SeSecurityPrivilege 872 wmic.exe Token: SeTakeOwnershipPrivilege 872 wmic.exe Token: SeLoadDriverPrivilege 872 wmic.exe Token: SeSystemProfilePrivilege 872 wmic.exe Token: SeSystemtimePrivilege 872 wmic.exe Token: SeProfSingleProcessPrivilege 872 wmic.exe Token: SeIncBasePriorityPrivilege 872 wmic.exe Token: SeCreatePagefilePrivilege 872 wmic.exe Token: SeBackupPrivilege 872 wmic.exe Token: SeRestorePrivilege 872 wmic.exe Token: SeShutdownPrivilege 872 wmic.exe Token: SeDebugPrivilege 872 wmic.exe Token: SeSystemEnvironmentPrivilege 872 wmic.exe Token: SeRemoteShutdownPrivilege 872 wmic.exe Token: SeUndockPrivilege 872 wmic.exe Token: SeManageVolumePrivilege 872 wmic.exe Token: 33 872 wmic.exe Token: 34 872 wmic.exe Token: 35 872 wmic.exe Token: SeIncreaseQuotaPrivilege 872 wmic.exe Token: SeSecurityPrivilege 872 wmic.exe Token: SeTakeOwnershipPrivilege 872 wmic.exe Token: SeLoadDriverPrivilege 872 wmic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
vpn.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1736 wrote to memory of 1352 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 1352 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 1352 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 1352 1736 vpn.exe cmd.exe PID 1352 wrote to memory of 1880 1352 cmd.exe WMIC.exe PID 1352 wrote to memory of 1880 1352 cmd.exe WMIC.exe PID 1352 wrote to memory of 1880 1352 cmd.exe WMIC.exe PID 1352 wrote to memory of 1880 1352 cmd.exe WMIC.exe PID 1736 wrote to memory of 872 1736 vpn.exe wmic.exe PID 1736 wrote to memory of 872 1736 vpn.exe wmic.exe PID 1736 wrote to memory of 872 1736 vpn.exe wmic.exe PID 1736 wrote to memory of 872 1736 vpn.exe wmic.exe PID 1736 wrote to memory of 1240 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 1240 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 1240 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 1240 1736 vpn.exe cmd.exe PID 1240 wrote to memory of 876 1240 cmd.exe WMIC.exe PID 1240 wrote to memory of 876 1240 cmd.exe WMIC.exe PID 1240 wrote to memory of 876 1240 cmd.exe WMIC.exe PID 1240 wrote to memory of 876 1240 cmd.exe WMIC.exe PID 1736 wrote to memory of 1820 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 1820 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 1820 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 1820 1736 vpn.exe cmd.exe PID 1820 wrote to memory of 1624 1820 cmd.exe WMIC.exe PID 1820 wrote to memory of 1624 1820 cmd.exe WMIC.exe PID 1820 wrote to memory of 1624 1820 cmd.exe WMIC.exe PID 1820 wrote to memory of 1624 1820 cmd.exe WMIC.exe PID 1736 wrote to memory of 944 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 944 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 944 1736 vpn.exe cmd.exe PID 1736 wrote to memory of 944 1736 vpn.exe cmd.exe PID 944 wrote to memory of 1180 944 cmd.exe systeminfo.exe PID 944 wrote to memory of 1180 944 cmd.exe systeminfo.exe PID 944 wrote to memory of 1180 944 cmd.exe systeminfo.exe PID 944 wrote to memory of 1180 944 cmd.exe systeminfo.exe PID 1736 wrote to memory of 1032 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1032 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1032 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1032 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1560 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1560 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1560 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1560 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1876 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1876 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1876 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1876 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1240 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1240 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1240 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1240 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 920 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 920 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 920 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 920 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1356 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1356 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1356 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1356 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1232 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1232 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1232 1736 vpn.exe powershell.exe PID 1736 wrote to memory of 1232 1736 vpn.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vpn.exe"C:\Users\Admin\AppData\Local\Temp\vpn.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wmic csproduct get uuid"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\cmd.execmd "/c " systeminfo2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo3⤵
- Gathers system information
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\XVlBzgbaiC\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History\" \"C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHc\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\tcuAxhxKQFDaFpL\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFf\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\RsWxPLDnJObCsNV\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\lgTeMaPEZQ\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\leQYhYzRyWJjPjz\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\pfRFEgmota\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\FetHsbZRjxAwnwe\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\krBEmfdzdc\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\EkXBAkjQZLCtTMt\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Windows\History\" \"C:\Users\Admin\AppData\Local\Temp\TCoaNatyyi\""2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\EkXBAkjQZLCtTMtFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\FetHsbZRjxAwnweFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHcFilesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\Local\Temp\RsWxPLDnJObCsNVFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFfFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\krBEmfdzdcFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\krBEmfdzdcFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\leQYhYzRyWJjPjzFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\lgTeMaPEZQFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\pfRFEgmotaFilesize
92KB
MD5747ae56c4c143d35c9f4deb890d470c3
SHA11bbe23d6c5eeb56f8a3ea5459bbd00cb825dc22a
SHA256e847489244a60ca420a700898a700fc01002a84aed20b1af9d4ffde6b0a3214e
SHA512f492b8d634c02d680e906f3827b53b41d69905ad59eda7c419f1f8af33a795f6330d1d88243eeab0365a1f25cf524070231ce4720034a4d0cf85a8acf5b05395
-
C:\Users\Admin\AppData\Local\Temp\tcuAxhxKQFDaFpLFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3JFFVN7JNUSJKA1P0OOZ.tempFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD506fb7716b17aa759e3fb03257bb2ca86
SHA119f7ef51d7c7c081806670568e0f5a042c229f3d
SHA2562d642fe0c0f9983f8f7ec5e2a14a12f137baa08e83242a8946e6b31576c333f2
SHA5122f5ad059407b4b5cd338e53387ffa232219ed761df97164e25ffe64f7aae7d9079427aef7f1da611500d038f19a896236b8b40fb6cd8f87801fb272c3152bdae
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/760-159-0x0000000002510000-0x0000000002550000-memory.dmpFilesize
256KB
-
memory/760-158-0x0000000002510000-0x0000000002550000-memory.dmpFilesize
256KB
-
memory/1032-69-0x00000000025F0000-0x0000000002630000-memory.dmpFilesize
256KB
-
memory/1032-68-0x00000000025F0000-0x0000000002630000-memory.dmpFilesize
256KB
-
memory/1736-58-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-54-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-64-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-118-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-63-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-62-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-121-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-165-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-161-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-130-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-61-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-160-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-60-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-65-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-59-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-88-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-83-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-97-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-57-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-55-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1736-76-0x0000000000A30000-0x0000000001252000-memory.dmpFilesize
8.1MB
-
memory/1876-86-0x0000000002830000-0x0000000002870000-memory.dmpFilesize
256KB
-
memory/1876-85-0x0000000002830000-0x0000000002870000-memory.dmpFilesize
256KB
-
memory/2044-126-0x0000000002550000-0x0000000002590000-memory.dmpFilesize
256KB
-
memory/2044-127-0x0000000002550000-0x0000000002590000-memory.dmpFilesize
256KB