Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 01:33
Behavioral task
behavioral1
Sample
a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe
Resource
win10v2004-20240419-en
General
-
Target
a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe
-
Size
124KB
-
MD5
21d6b63327f1f57348899d5992d43102
-
SHA1
c1f72ac6dedd7817c094c41df3d9dd505675d93d
-
SHA256
a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62
-
SHA512
0af75df0a6dfe44b33b03f4dc716c48db3a479f438fe0a9332b82cc832ffdb2d56254b073bfb67feed8c0f5516ede72a93f1de70e62c8ae9e9e9fd09f600d1cf
-
SSDEEP
1536:IFaM5mTEVEQnqrZM5V3J6fgNWbMb+KR0Nc8QsJq3:iaMqEVEUWZulJGgNAe0Nc8QsC
Malware Config
Extracted
metasploit
windows/reverse_tcp
86.104.74.31:9981
Extracted
metasploit
windows/reverse_winhttp
https://86.104.74.31:2526/fd3zz0jliLkQrhGvdpeVpgk3G__x63mWh1gI58R0JEHOZwCxT5ADz_cyqt144D8WxjMAXj9F
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule \Windows\System32\WindowsUpdate.exe family_xmrig \Windows\System32\WindowsUpdate.exe xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
pvkXkIR.exepvkXkIR.exepvkXkIR.exeWindowsUpdate.exePython-deamon.exepid process 2252 pvkXkIR.exe 1728 pvkXkIR.exe 2768 pvkXkIR.exe 2952 WindowsUpdate.exe 772 Python-deamon.exe -
Loads dropped DLL 5 IoCs
Processes:
cmd.exepvkXkIR.exeservices.exepid process 2988 cmd.exe 2988 cmd.exe 1728 pvkXkIR.exe 480 services.exe 1972 -
Drops file in System32 directory 11 IoCs
Processes:
services.exeWindowsUpdate.exepvkXkIR.exedescription ioc process File created C:\Windows\System32\WinRing0x64.sys services.exe File created \??\c:\windows\system32\WindowsUpdate.exe services.exe File opened for modification C:\Windows\System32\loger2.log WindowsUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 pvkXkIR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 pvkXkIR.exe File created C:\Windows\System32\config.json services.exe File opened for modification \??\c:\windows\system32\config.json WindowsUpdate.exe File created \??\c:\windows\system32\Python-deamon.exe services.exe File created \??\c:\windows\system32\patch-updated.txt services.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 pvkXkIR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 pvkXkIR.exe -
Detects Pyinstaller 1 IoCs
Processes:
resource yara_rule C:\Windows\System32\Python-deamon.exe pyinstaller -
Modifies data under HKEY_USERS 42 IoCs
Processes:
pvkXkIR.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs pvkXkIR.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs pvkXkIR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates pvkXkIR.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exeservices.exepid process 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe 480 services.exe 480 services.exe 480 services.exe 480 services.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
Processes:
a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exeservices.exeWindowsUpdate.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeAuditPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeBackupPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeChangeNotifyPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeCreateGlobalPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeCreatePagefilePrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeCreatePermanentPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: 35 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeCreateTokenPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeDebugPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: 0 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeEnableDelegationPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeImpersonatePrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeIncBasePriorityPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeIncreaseQuotaPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: 33 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeLoadDriverPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeLockMemoryPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeMachineAccountPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeManageVolumePrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeProfSingleProcessPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: 32 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeRemoteShutdownPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeRestorePrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeSecurityPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeShutdownPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeSyncAgentPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeSystemEnvironmentPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeSystemProfilePrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeSystemtimePrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeTakeOwnershipPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeTcbPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: 34 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: 31 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeUndockPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: 0 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeDebugPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeDebugPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeDebugPrivilege 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe Token: SeDebugPrivilege 480 services.exe Token: SeDebugPrivilege 480 services.exe Token: SeDebugPrivilege 480 services.exe Token: SeDebugPrivilege 480 services.exe Token: SeLockMemoryPrivilege 2952 WindowsUpdate.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WindowsUpdate.exepid process 2952 WindowsUpdate.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
services.exepid process 480 services.exe 480 services.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.execmd.exepvkXkIR.exeservices.exedescription pid process target process PID 756 wrote to memory of 2988 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe cmd.exe PID 756 wrote to memory of 2988 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe cmd.exe PID 756 wrote to memory of 2988 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe cmd.exe PID 756 wrote to memory of 2988 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe cmd.exe PID 2988 wrote to memory of 2252 2988 cmd.exe pvkXkIR.exe PID 2988 wrote to memory of 2252 2988 cmd.exe pvkXkIR.exe PID 2988 wrote to memory of 2252 2988 cmd.exe pvkXkIR.exe PID 2988 wrote to memory of 2252 2988 cmd.exe pvkXkIR.exe PID 1728 wrote to memory of 2768 1728 pvkXkIR.exe pvkXkIR.exe PID 1728 wrote to memory of 2768 1728 pvkXkIR.exe pvkXkIR.exe PID 1728 wrote to memory of 2768 1728 pvkXkIR.exe pvkXkIR.exe PID 1728 wrote to memory of 2768 1728 pvkXkIR.exe pvkXkIR.exe PID 756 wrote to memory of 480 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe services.exe PID 756 wrote to memory of 480 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe services.exe PID 756 wrote to memory of 480 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe services.exe PID 756 wrote to memory of 480 756 a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe services.exe PID 480 wrote to memory of 2952 480 services.exe WindowsUpdate.exe PID 480 wrote to memory of 2952 480 services.exe WindowsUpdate.exe PID 480 wrote to memory of 2952 480 services.exe WindowsUpdate.exe PID 480 wrote to memory of 772 480 services.exe Python-deamon.exe PID 480 wrote to memory of 772 480 services.exe Python-deamon.exe PID 480 wrote to memory of 772 480 services.exe Python-deamon.exe PID 480 wrote to memory of 772 480 services.exe Python-deamon.exe
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\system32\cmd.execmd.exe /c echo fjyqbk > \\.\pipe\fjyqbk2⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\pvkXkIR.exe"C:\Users\Admin\AppData\Local\Temp\pvkXkIR.exe" geKvtKt2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\pvkXkIR.exeC:\Users\Admin\AppData\Local\Temp\pvkXkIR.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2768 -
\??\c:\windows\system32\WindowsUpdate.exec:/windows/system32/\WindowsUpdate.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2952 -
\??\c:\windows\system32\Python-deamon.exec:/windows/system32/\Python-deamon.exe2⤵
- Executes dropped EXE
PID:772
-
C:\Users\Admin\AppData\Local\Temp\a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe"C:\Users\Admin\AppData\Local\Temp\a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pvkXkIR.exe" YLsGHv2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\pvkXkIR.exeC:\Users\Admin\AppData\Local\Temp\pvkXkIR.exe YLsGHv3⤵
- Executes dropped EXE
PID:2252
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Windows\System32\Python-deamon.exeFilesize
4.9MB
MD52213c24bf5f894162377e83435bf6394
SHA134d35d4fefa2464c7a7adcf844a2055161283fcb
SHA256920ddce9db19abbde837de204acf2c28abdc93525d50c74e686f2b64560dc6a2
SHA5124fbccf72968372841668a4860ac5201138458c98eaf6dd034e435ae0741dba143cc5d5241cf19c1aee18ac425eb25ad3f9dd04452bc302b27f825313785fd554
-
C:\Windows\Temp\Tar4E83.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
\??\c:\windows\system32\config.jsonFilesize
4KB
MD5ffe25900f192333490e126339df8e160
SHA15131bd56ba2ce72be36e6af7fda8958756a226ed
SHA2568c8a4dd8bd002bf109efd8580b461d9e6e7f819d87e665c205887e92c2ac3bd5
SHA51237eaa4d95a429cf00718509214df1de5f97f49e98f1c29e1d2fb772f7f153121cf8985ab6c91eb5c04ff7170f1e6ced6dc4d90a3dcc301e8c4f74067b5ca6b31
-
\Users\Admin\AppData\Local\Temp\pvkXkIR.exeFilesize
8KB
MD54bb03ecd3dba7df3fb2336c85347be06
SHA1704141d55c05ff4f0783625b530eca4c8eddbbc6
SHA256bf71bc6ea25a21b995a12e5278e916bd8e2be8daf1ee127444f182edda2a8df8
SHA5121a06dccbcb4ace65319aeb6a5184a448562ab13519bbc168231a7432db8c1e5944430eba139ff554ad51ff140ae24f9755aaf27da80417c01e689afdc6fb1ff6
-
\Windows\System32\WindowsUpdate.exeFilesize
5.4MB
MD51ce931c7db9f11fe942e34857e16100e
SHA118aa4aa3d4f4653ca3c8fb706b004f911a5dd9de
SHA2567fac868eff64e2fae4e1d2cc9ef2d30b6e865e91f48782d5400f7f1376aeb543
SHA51244d99eb110efd3e636a8c74015277f13b24306e41965a67a1b970e7a07cb63343a7e6d1dc48308a6a115330e568ea5c7e50e2ec8897e639de2d322278fa67a9e
-
memory/480-161-0x00000000002B0000-0x00000000002E2000-memory.dmpFilesize
200KB
-
memory/756-41-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/756-19-0x00000000020E0000-0x00000000021E0000-memory.dmpFilesize
1024KB
-
memory/756-40-0x00000000020E0000-0x00000000021E0000-memory.dmpFilesize
1024KB
-
memory/756-0-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/756-61-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/756-66-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/756-20-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/756-1-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/756-5-0x0000000000300000-0x000000000032C000-memory.dmpFilesize
176KB
-
memory/756-125-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/756-35-0x0000000002520000-0x0000000002545000-memory.dmpFilesize
148KB
-
memory/756-14-0x0000000000420000-0x0000000000483000-memory.dmpFilesize
396KB
-
memory/756-7-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/756-6-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/2768-96-0x0000000003590000-0x0000000003990000-memory.dmpFilesize
4.0MB
-
memory/2768-76-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB