Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    22/05/2024, 17:01

General

  • Target

    656feea079f74b94c31e4ad4fcdb2cb0b6c4f61a861db5084af2857c6a456c47.exe

  • Size

    8.7MB

  • MD5

    8b8262ee5164a7cad79367a6a7e5d1ad

  • SHA1

    043f4ab26eb710aa336e0cac2868311407d360e4

  • SHA256

    656feea079f74b94c31e4ad4fcdb2cb0b6c4f61a861db5084af2857c6a456c47

  • SHA512

    b92beac1eedacd24e4bd0cf5fd5c1d75be2e59a5ff478e084afdbdc2a6324dd82cced1e0bd5a1df7c7d2abb5be7a83a33a6cdca5298370ef0f9df8ad90be6dc3

  • SSDEEP

    196608:vDA4AqUb+3ahxQgpRdGOWPcwYXJ6Ii+CeaoLP2D+los2o2hT2rkOs:vDA407hxlpmOWPcT5VTCdmuD+DUhmE

Malware Config

Signatures

  • Modifies security service 2 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 22 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:432
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
      • Sets service image path in registry
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:476
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch
        2⤵
          PID:616
          • C:\Windows\system32\wbem\wmiprvse.exe
            C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
            3⤵
            • Checks processor information in registry
            PID:1072
          • C:\Windows\system32\wbem\wmiprvse.exe
            C:\Windows\system32\wbem\wmiprvse.exe -Embedding
            3⤵
              PID:1168
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k RPCSS
            2⤵
              PID:696
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
              2⤵
              • Modifies security service
              • Drops file in System32 directory
              PID:776
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
              2⤵
                PID:828
                • C:\Windows\system32\Dwm.exe
                  "C:\Windows\system32\Dwm.exe"
                  3⤵
                    PID:1172
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs
                  2⤵
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:864
                  • C:\Windows\system32\wbem\WMIADAP.EXE
                    wmiadap.exe /F /T /R
                    3⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    PID:1756
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService
                  2⤵
                    PID:988
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k NetworkService
                    2⤵
                      PID:272
                    • C:\Windows\System32\spoolsv.exe
                      C:\Windows\System32\spoolsv.exe
                      2⤵
                        PID:556
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                        2⤵
                          PID:1076
                        • C:\Windows\system32\taskhost.exe
                          "taskhost.exe"
                          2⤵
                            PID:1124
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                            2⤵
                              PID:2160
                            • C:\Windows\system32\sppsvc.exe
                              C:\Windows\system32\sppsvc.exe
                              2⤵
                                PID:2464
                              • C:\ProgramData\axuqfibwrmou\hsuuyddhbzpg.exe
                                C:\ProgramData\axuqfibwrmou\hsuuyddhbzpg.exe
                                2⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Drops file in System32 directory
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:2632
                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1368
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2840
                                  • C:\Windows\system32\wusa.exe
                                    wusa /uninstall /kb:890830 /quiet /norestart
                                    4⤵
                                    • Drops file in Windows directory
                                    PID:444
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop UsoSvc
                                  3⤵
                                  • Launches sc.exe
                                  PID:2060
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                  3⤵
                                  • Launches sc.exe
                                  PID:2724
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop wuauserv
                                  3⤵
                                  • Launches sc.exe
                                  PID:1820
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop bits
                                  3⤵
                                  • Launches sc.exe
                                  PID:1344
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop dosvc
                                  3⤵
                                  • Launches sc.exe
                                  PID:2740
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:820
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2716
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2848
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2692
                                • C:\Windows\system32\dialer.exe
                                  C:\Windows\system32\dialer.exe
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2556
                                • C:\Windows\system32\dialer.exe
                                  C:\Windows\system32\dialer.exe
                                  3⤵
                                    PID:1740
                                  • C:\Windows\system32\dialer.exe
                                    dialer.exe
                                    3⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:580
                              • C:\Windows\system32\lsass.exe
                                C:\Windows\system32\lsass.exe
                                1⤵
                                  PID:488
                                • C:\Windows\system32\lsm.exe
                                  C:\Windows\system32\lsm.exe
                                  1⤵
                                    PID:496
                                  • C:\Windows\Explorer.EXE
                                    C:\Windows\Explorer.EXE
                                    1⤵
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:1208
                                    • C:\Users\Admin\AppData\Local\Temp\656feea079f74b94c31e4ad4fcdb2cb0b6c4f61a861db5084af2857c6a456c47.exe
                                      "C:\Users\Admin\AppData\Local\Temp\656feea079f74b94c31e4ad4fcdb2cb0b6c4f61a861db5084af2857c6a456c47.exe"
                                      2⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Drops file in System32 directory
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:2128
                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                        3⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Drops file in System32 directory
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2600
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                        3⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3064
                                        • C:\Windows\system32\wusa.exe
                                          wusa /uninstall /kb:890830 /quiet /norestart
                                          4⤵
                                          • Drops file in Windows directory
                                          PID:2780
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop UsoSvc
                                        3⤵
                                        • Launches sc.exe
                                        PID:2624
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                        3⤵
                                        • Launches sc.exe
                                        PID:2792
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop wuauserv
                                        3⤵
                                        • Launches sc.exe
                                        PID:2660
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop bits
                                        3⤵
                                        • Launches sc.exe
                                        PID:2804
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop dosvc
                                        3⤵
                                        • Launches sc.exe
                                        PID:2856
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                        3⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1664
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                        3⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2680
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                        3⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2628
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                        3⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2788
                                      • C:\Windows\system32\dialer.exe
                                        C:\Windows\system32\dialer.exe
                                        3⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:2588
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe delete "updater"
                                        3⤵
                                        • Launches sc.exe
                                        PID:3000
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe create "updater" binpath= "C:\ProgramData\axuqfibwrmou\hsuuyddhbzpg.exe" start= "auto"
                                        3⤵
                                        • Launches sc.exe
                                        PID:2320
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop eventlog
                                        3⤵
                                        • Launches sc.exe
                                        PID:276
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe start "updater"
                                        3⤵
                                        • Launches sc.exe
                                        PID:1532
                                  • C:\Windows\system32\conhost.exe
                                    \??\C:\Windows\system32\conhost.exe "619069098-170145123619336167352080494064-1953294123-16842400161040464363-530463535"
                                    1⤵
                                      PID:2800
                                    • C:\Windows\system32\conhost.exe
                                      \??\C:\Windows\system32\conhost.exe "183277780-1898519799-814137797-57724599373066781-837071331-1211087599-1848193352"
                                      1⤵
                                        PID:2516
                                      • C:\Windows\system32\conhost.exe
                                        \??\C:\Windows\system32\conhost.exe "6165246829327916471905242196930685106-15882110561612436069-723408452-158364644"
                                        1⤵
                                          PID:2512
                                        • C:\Windows\system32\conhost.exe
                                          \??\C:\Windows\system32\conhost.exe "-15377490121603777624171819126-146750911518336791131109551174810303718-925493238"
                                          1⤵
                                            PID:2532
                                          • C:\Windows\system32\conhost.exe
                                            \??\C:\Windows\system32\conhost.exe "7625293641382574181795852263-1272295793179500931320760090893173651030999709"
                                            1⤵
                                              PID:2568
                                            • C:\Windows\system32\conhost.exe
                                              \??\C:\Windows\system32\conhost.exe "-889474866-6309151731089284668-1125576270-1961479087-693473692703337358433098262"
                                              1⤵
                                                PID:2224
                                              • C:\Windows\system32\conhost.exe
                                                \??\C:\Windows\system32\conhost.exe "107533333-18552607191827403-1269805286176832014-1330358721-1654974543-1161410089"
                                                1⤵
                                                  PID:1460
                                                • C:\Windows\system32\conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe "-1869703891-155038111-1606170740830609259-20664575781551530209-2703646681488728407"
                                                  1⤵
                                                    PID:1600
                                                  • C:\Windows\system32\conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe "14016603819158746202077832877901799528-236567300792555009372994342360616734"
                                                    1⤵
                                                      PID:2996
                                                    • C:\Windows\system32\conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe "17520337541300834623-3060447621395376067-1755731619-3823632676368568741345488430"
                                                      1⤵
                                                        PID:1488
                                                      • C:\Windows\system32\conhost.exe
                                                        \??\C:\Windows\system32\conhost.exe "1803200041-929801643-1533981358-19397259131952881744-13660664231695820785-176150747"
                                                        1⤵
                                                          PID:2296
                                                        • C:\Windows\system32\conhost.exe
                                                          \??\C:\Windows\system32\conhost.exe "1185305578180444996616158644511014942889-684146504-581847260548733120-1565439669"
                                                          1⤵
                                                            PID:1424
                                                          • C:\Windows\system32\conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe "-1659075601-587800230-12673756291467567263980614025-1835985671-284399702-217976916"
                                                            1⤵
                                                              PID:320
                                                            • C:\Windows\system32\conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe "1778323196-1538062461-674464925-6451466781945824703-656861665-143168620-2028176373"
                                                              1⤵
                                                                PID:608

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Windows\System32\perfc007.dat

                                                                Filesize

                                                                141KB

                                                                MD5

                                                                0f3d76321f0a7986b42b25a3aa554f82

                                                                SHA1

                                                                7036bba62109cc25da5d6a84d22b6edb954987c0

                                                                SHA256

                                                                dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460

                                                                SHA512

                                                                bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0

                                                              • C:\Windows\System32\perfc00A.dat

                                                                Filesize

                                                                150KB

                                                                MD5

                                                                540138285295c68de32a419b7d9de687

                                                                SHA1

                                                                1cf6a2a0f53f0516ff9fe5ac733dbb5a9255ae56

                                                                SHA256

                                                                33867c52f756f2b0f645f4bd503c65969d73676dcb14e6a6fdb2ffb11c7562eb

                                                                SHA512

                                                                7c17c10d4b6165aa0c208811dc6d98e2f4e75e3da1cc2313cc7da9d657626beb3e4ec00b07b71376a7c549725d40db20d8952753e70acc86e87a8390e224a64a

                                                              • C:\Windows\System32\perfc00C.dat

                                                                Filesize

                                                                141KB

                                                                MD5

                                                                831dbe568992299e589143ee8898e131

                                                                SHA1

                                                                737726173aab8b76fe1f98104d72bb91abd273bf

                                                                SHA256

                                                                4f22ef1625fb2a2370779d0992f80b8e5e5da8dc727aa99ade152044d28e9405

                                                                SHA512

                                                                39015d29d593c9df59cdafbff95a6ddc000a5dbf767665b65f8ec65751e70315918c93d3583b922d32e9b6261b8c07023da660098ca79c5420b782c150b5c139

                                                              • C:\Windows\System32\perfc010.dat

                                                                Filesize

                                                                138KB

                                                                MD5

                                                                cf82e7354e591c1408eb2cc0e29dd274

                                                                SHA1

                                                                7e91bd50c3e6b64b81e2b5c1ce723f52e34748e9

                                                                SHA256

                                                                59b5e6fbbe68f47db14a3c045b0ac1abb026c626ca4bee708fbd3940e6d2e06d

                                                                SHA512

                                                                98bd4809c1c418be4100096bc9df328d2ad435c5615c082fa2bfa424935203107015862cd9c1737800b7f7bd020fea4538c325707927c1557bc3efebffb27620

                                                              • C:\Windows\System32\perfc011.dat

                                                                Filesize

                                                                114KB

                                                                MD5

                                                                1f998386566e5f9b7f11cc79254d1820

                                                                SHA1

                                                                e1da5fe1f305099b94de565d06bc6f36c6794481

                                                                SHA256

                                                                1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea

                                                                SHA512

                                                                a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

                                                              • C:\Windows\System32\perfh007.dat

                                                                Filesize

                                                                680KB

                                                                MD5

                                                                b69ab3aeddb720d6ef8c05ff88c23b38

                                                                SHA1

                                                                d830c2155159656ed1806c7c66cae2a54a2441fa

                                                                SHA256

                                                                24c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625

                                                                SHA512

                                                                4c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d

                                                              • C:\Windows\System32\perfh009.dat

                                                                Filesize

                                                                646KB

                                                                MD5

                                                                aecab86cc5c705d7a036cba758c1d7b0

                                                                SHA1

                                                                e88cf81fd282d91c7fc0efae13c13c55f4857b5e

                                                                SHA256

                                                                9bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066

                                                                SHA512

                                                                e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8

                                                              • C:\Windows\System32\perfh00A.dat

                                                                Filesize

                                                                727KB

                                                                MD5

                                                                7d0bac4e796872daa3f6dc82c57f4ca8

                                                                SHA1

                                                                b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a

                                                                SHA256

                                                                ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879

                                                                SHA512

                                                                145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e

                                                              • C:\Windows\System32\perfh00C.dat

                                                                Filesize

                                                                727KB

                                                                MD5

                                                                5f684ce126de17a7d4433ed2494c5ca9

                                                                SHA1

                                                                ce1a30a477daa1bac2ec358ce58731429eafe911

                                                                SHA256

                                                                2e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c

                                                                SHA512

                                                                4d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b

                                                              • C:\Windows\System32\perfh010.dat

                                                                Filesize

                                                                722KB

                                                                MD5

                                                                4623482c106cf6cc1bac198f31787b65

                                                                SHA1

                                                                5abb0decf7b42ef5daf7db012a742311932f6dad

                                                                SHA256

                                                                eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349

                                                                SHA512

                                                                afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

                                                              • C:\Windows\System32\perfh011.dat

                                                                Filesize

                                                                406KB

                                                                MD5

                                                                54c674d19c0ff72816402f66f6c3d37c

                                                                SHA1

                                                                2dcc0269545a213648d59dc84916d9ec2d62a138

                                                                SHA256

                                                                646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5

                                                                SHA512

                                                                4d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f

                                                              • C:\Windows\System32\wbem\Performance\WmiApRpl.h

                                                                Filesize

                                                                3KB

                                                                MD5

                                                                b133a676d139032a27de3d9619e70091

                                                                SHA1

                                                                1248aa89938a13640252a79113930ede2f26f1fa

                                                                SHA256

                                                                ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15

                                                                SHA512

                                                                c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

                                                              • C:\Windows\System32\wbem\Performance\WmiApRpl.ini

                                                                Filesize

                                                                27KB

                                                                MD5

                                                                46d08e3a55f007c523ac64dce6dcf478

                                                                SHA1

                                                                62edf88697e98d43f32090a2197bead7e7244245

                                                                SHA256

                                                                5b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614

                                                                SHA512

                                                                b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42

                                                              • \ProgramData\axuqfibwrmou\hsuuyddhbzpg.exe

                                                                Filesize

                                                                8.7MB

                                                                MD5

                                                                8b8262ee5164a7cad79367a6a7e5d1ad

                                                                SHA1

                                                                043f4ab26eb710aa336e0cac2868311407d360e4

                                                                SHA256

                                                                656feea079f74b94c31e4ad4fcdb2cb0b6c4f61a861db5084af2857c6a456c47

                                                                SHA512

                                                                b92beac1eedacd24e4bd0cf5fd5c1d75be2e59a5ff478e084afdbdc2a6324dd82cced1e0bd5a1df7c7d2abb5be7a83a33a6cdca5298370ef0f9df8ad90be6dc3

                                                              • memory/432-30-0x0000000000B90000-0x0000000000BB4000-memory.dmp

                                                                Filesize

                                                                144KB

                                                              • memory/432-33-0x0000000037BB0000-0x0000000037BC0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/432-31-0x0000000000BC0000-0x0000000000BEB000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/432-32-0x000007FEBFB30000-0x000007FEBFB40000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/432-28-0x0000000000B90000-0x0000000000BB4000-memory.dmp

                                                                Filesize

                                                                144KB

                                                              • memory/476-293-0x0000000140000000-0x00000001411C0000-memory.dmp

                                                                Filesize

                                                                17.8MB

                                                              • memory/476-49-0x000007FEBFB30000-0x000007FEBFB40000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/476-287-0x0000000140000000-0x00000001411C0000-memory.dmp

                                                                Filesize

                                                                17.8MB

                                                              • memory/476-50-0x0000000037BB0000-0x0000000037BC0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/476-608-0x0000000140000000-0x00000001411C0000-memory.dmp

                                                                Filesize

                                                                17.8MB

                                                              • memory/476-47-0x00000000000A0000-0x00000000000CB000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/488-60-0x0000000000180000-0x00000000001AB000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/488-62-0x000007FEBFB30000-0x000007FEBFB40000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/488-63-0x0000000037BB0000-0x0000000037BC0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/496-75-0x0000000037BB0000-0x0000000037BC0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/496-73-0x00000000003E0000-0x000000000040B000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/496-74-0x000007FEBFB30000-0x000007FEBFB40000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/616-77-0x0000000000310000-0x000000000033B000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/616-78-0x000007FEBFB30000-0x000007FEBFB40000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/1368-311-0x0000000000540000-0x0000000000548000-memory.dmp

                                                                Filesize

                                                                32KB

                                                              • memory/1368-303-0x000000001A0C0000-0x000000001A3A2000-memory.dmp

                                                                Filesize

                                                                2.9MB

                                                              • memory/2128-1-0x0000000077BC0000-0x0000000077BC2000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/2128-2-0x0000000140000000-0x00000001411C0000-memory.dmp

                                                                Filesize

                                                                17.8MB

                                                              • memory/2128-250-0x0000000140000000-0x00000001411C0000-memory.dmp

                                                                Filesize

                                                                17.8MB

                                                              • memory/2128-3-0x0000000140000000-0x00000001411C0000-memory.dmp

                                                                Filesize

                                                                17.8MB

                                                              • memory/2128-14-0x0000000140000000-0x00000001411C0000-memory.dmp

                                                                Filesize

                                                                17.8MB

                                                              • memory/2128-0-0x0000000140000000-0x00000001411C0000-memory.dmp

                                                                Filesize

                                                                17.8MB

                                                              • memory/2588-18-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/2588-17-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/2588-20-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/2588-22-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/2588-24-0x0000000077950000-0x0000000077A6F000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                              • memory/2588-23-0x0000000077B70000-0x0000000077D19000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                              • memory/2588-25-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/2588-19-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                Filesize

                                                                172KB

                                                              • memory/2600-8-0x000000001B510000-0x000000001B7F2000-memory.dmp

                                                                Filesize

                                                                2.9MB

                                                              • memory/2600-11-0x0000000077B70000-0x0000000077D19000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                              • memory/2600-12-0x0000000077B70000-0x0000000077D19000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                              • memory/2600-13-0x0000000077B70000-0x0000000077D19000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                              • memory/2600-9-0x0000000077B70000-0x0000000077D19000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                              • memory/2600-10-0x0000000002200000-0x0000000002208000-memory.dmp

                                                                Filesize

                                                                32KB

                                                              • memory/2600-15-0x0000000077B70000-0x0000000077D19000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                              • memory/2600-16-0x0000000077B70000-0x0000000077D19000-memory.dmp

                                                                Filesize

                                                                1.7MB

                                                              • memory/2632-294-0x0000000140000000-0x00000001411C0000-memory.dmp

                                                                Filesize

                                                                17.8MB

                                                              • memory/2632-530-0x0000000140000000-0x00000001411C0000-memory.dmp

                                                                Filesize

                                                                17.8MB