zloader | 0d245d45e6c96ffa4baf8b8be6cc7b0d15165b2398c420a9ad70788e7a1f88d7

Resubmissions

16-09-2021 04:18

210916-ew37psehdl 8

08-06-2021 15:32

210608-l4es4wqfv6 10

Analysis

max time kernel
61s
max time network
183s
platform
windows7_x64
resource
win7v20210410
submitted
08-06-2021 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Java.msi
Size

4.3MB
MD5

65455fe14bb0f3baa9d43c4cf2b421f7
SHA1

08ba1973c2ad37142163d0f3067d12d26cf5ad61
SHA256

0d245d45e6c96ffa4baf8b8be6cc7b0d15165b2398c420a9ad70788e7a1f88d7
SHA512

6fb0c692eed60957b5da7edb4eb60a1693a86491b7f512e341ede7db2571717aeea152fd01b37c092f7ef8bf8d77900d7269537e8b60c9d793e0c9ac70d99bab

Score

10^/10

zloader personal personal botnet trojan

Malware Config

Extracted

Family

zloader

Botnet

personal

Campaign

personal

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php

rc4.plain

rsa_pubkey.plain

Signatures

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader
Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

2 1836 msiexec.exe
4 1836 msiexec.exe
6 1836 msiexec.exe
Executes dropped EXE 2 IoCs

Processes:

j_service.exeRegister.exe

pid process

532 j_service.exe
316 Register.exe

flow	pid	process
2	1836	msiexec.exe
4	1836	msiexec.exe
6	1836	msiexec.exe

pid	process
532	j_service.exe
316	Register.exe

Loads dropped DLL 45 IoCs

Processes:

MsiExec.exeMsiExec.exej_service.exeRegister.exeregsvr32.exe

pid	process
1444	MsiExec.exe
1108	MsiExec.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
532	j_service.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
316	Register.exe
532	j_service.exe
532	j_service.exe
588	regsvr32.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Program Files directory 31 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\msvcp140.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\NSudo.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\j_service.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-processthreads-l1-1-1.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\libcurl.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\Register.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-file-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-multibyte-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-stdio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-locale-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-time-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\libcrypto-1_1.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\libssl-1_1.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\AccessibleHandler.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-synch-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\setup.bat	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-conio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-private-l1-1-0.dll	msiexec.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIBE42.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC113.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{A22123CC-FEB4-4470-9D68-581CAB998559}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{A22123CC-FEB4-4470-9D68-581CAB998559}\Logo.ico	msiexec.exe
File created	C:\Windows\Installer\f74bbef.msi	msiexec.exe
File created	C:\Windows\Installer\f74bbf0.ipi	msiexec.exe
File created	C:\Windows\Installer\f74bbf2.msi	msiexec.exe
File created	C:\Windows\Installer\{A22123CC-FEB4-4470-9D68-581CAB998559}\Logo.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\f74bbf0.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f74bbef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC32122A4BEF0744D98685C1BA995895	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC32122A4BEF0744D98685C1BA995895\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\ProductName = "Windows Security Update"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4283AD5241F3747428B68F1D87E32188	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\SourceList\PackageName = "Java.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\PackageCode = "C2B82E66163816847A8E9D819CED961E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\Version = "17367040"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\ProductIcon = "C:\\Windows\\Installer\\{A22123CC-FEB4-4470-9D68-581CAB998559}\\Logo.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4283AD5241F3747428B68F1D87E32188\CC32122A4BEF0744D98685C1BA995895	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC32122A4BEF0744D98685C1BA995895\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1588 msiexec.exe
1588 msiexec.exe

pid	process
1588	msiexec.exe
1588	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exeMsiExec.exe

description	pid	process
Token: SeShutdownPrivilege	1836	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeSecurityPrivilege	1588	msiexec.exe
Token: SeCreateTokenPrivilege	1836	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1836	msiexec.exe
Token: SeLockMemoryPrivilege	1836	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1836	msiexec.exe
Token: SeMachineAccountPrivilege	1836	msiexec.exe
Token: SeTcbPrivilege	1836	msiexec.exe
Token: SeSecurityPrivilege	1836	msiexec.exe
Token: SeTakeOwnershipPrivilege	1836	msiexec.exe
Token: SeLoadDriverPrivilege	1836	msiexec.exe
Token: SeSystemProfilePrivilege	1836	msiexec.exe
Token: SeSystemtimePrivilege	1836	msiexec.exe
Token: SeProfSingleProcessPrivilege	1836	msiexec.exe
Token: SeIncBasePriorityPrivilege	1836	msiexec.exe
Token: SeCreatePagefilePrivilege	1836	msiexec.exe
Token: SeCreatePermanentPrivilege	1836	msiexec.exe
Token: SeBackupPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1836	msiexec.exe
Token: SeShutdownPrivilege	1836	msiexec.exe
Token: SeDebugPrivilege	1836	msiexec.exe
Token: SeAuditPrivilege	1836	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1836	msiexec.exe
Token: SeChangeNotifyPrivilege	1836	msiexec.exe
Token: SeRemoteShutdownPrivilege	1836	msiexec.exe
Token: SeUndockPrivilege	1836	msiexec.exe
Token: SeSyncAgentPrivilege	1836	msiexec.exe
Token: SeEnableDelegationPrivilege	1836	msiexec.exe
Token: SeManageVolumePrivilege	1836	msiexec.exe
Token: SeImpersonatePrivilege	1836	msiexec.exe
Token: SeCreateGlobalPrivilege	1836	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeShutdownPrivilege	1108	MsiExec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe
Token: SeTakeOwnershipPrivilege	1588	msiexec.exe
Token: SeRestorePrivilege	1588	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1836 msiexec.exe
1836 msiexec.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Register.exe

pid process

316 Register.exe
316 Register.exe

pid	process
1836	msiexec.exe
1836	msiexec.exe

pid	process
316	Register.exe
316	Register.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

msiexec.exej_service.exe

description	pid	process	target process
PID 1588 wrote to memory of 1444	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1444	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1444	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1444	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1444	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1444	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1444	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1108	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1108	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1108	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1108	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1108	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1108	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 1108	1588	msiexec.exe	MsiExec.exe
PID 1588 wrote to memory of 316	1588	msiexec.exe	Register.exe
PID 1588 wrote to memory of 316	1588	msiexec.exe	Register.exe
PID 1588 wrote to memory of 316	1588	msiexec.exe	Register.exe
PID 1588 wrote to memory of 316	1588	msiexec.exe	Register.exe
PID 532 wrote to memory of 588	532	j_service.exe	regsvr32.exe
PID 532 wrote to memory of 588	532	j_service.exe	regsvr32.exe
PID 532 wrote to memory of 588	532	j_service.exe	regsvr32.exe
PID 532 wrote to memory of 588	532	j_service.exe	regsvr32.exe
PID 532 wrote to memory of 588	532	j_service.exe	regsvr32.exe
PID 532 wrote to memory of 588	532	j_service.exe	regsvr32.exe
PID 532 wrote to memory of 588	532	j_service.exe	regsvr32.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Java.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1836

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A37D5203345E93569FA82E1C4ED0DD32
2⤵
- Loads dropped DLL
PID:1444

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D3CC541791C120B6B65C479986CE40FC M Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\Register.exe
"C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\Register.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:316

C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\j_service.exe
"C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\j_service.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Roaming\microsoft_shared.tmp"
2⤵
- Loads dropped DLL
PID:588

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
3⤵
PID:1980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\MSVCP140.dll
MD5
9dda681b0406c3575e666f52cbde4f80

SHA1
1951c5b2c689534cdc2fbfbc14abbf9600a66086

SHA256
1ecd899f18b58a7915069e17582b8bf9f491a907c3fdf22b1ba1cbb2727b69b3

SHA512
753d0af201d5c91b50e7d1ed54f44ee3c336f8124ba7a5e86b53836df520eb2733b725b877f83fda6a9a7768379b5f6fafa0bd3890766b4188ebd337272e9512

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\Register.exe
MD5
8b8d748c4ec675ea95258a75c74ada28

SHA1
644ae693be80dfbf5d65badddd2fb7b39748a313

SHA256
3e1f22fd85ab9f5c28da27ae86ac2310d0675f9af84779bc39595156b3ff9b76

SHA512
82d231919d6dfa2bd7ef795439a8cb0ee48928aba003fccf746973dd5b59385cf8946735bc2d13dc50ec43dfaf8aced1dfd78a79d16610e65bb01ea0fd760947

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\VCRUNTIME140.dll
MD5
e79ef25890b214b13a7473e52330d0ec

SHA1
e47cbd0000a1f6132d74f5e767ad91973bd772d8

SHA256
7a114a9c1ca86e532d7f38e81c48f24ef2bfe6084f6056b3d4c3566ba43003d6

SHA512
dabed378fccfabc10486747fc70cf51a4fcc5b88f869c8a2fa4df30caa83a3af086c89e23806b7a291756da957a97c80a9b834a05e1d8ee7bd5c7159458c537a

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-file-l1-2-0.dll
MD5
79ee4a2fcbe24e9a65106de834ccda4a

SHA1
fd1ba674371af7116ea06ad42886185f98ba137b

SHA256
9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613

SHA512
6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-file-l2-1-0.dll
MD5
3f224766fe9b090333fdb43d5a22f9ea

SHA1
548d1bb707ae7a3dfccc0c2d99908561a305f57b

SHA256
ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357

SHA512
c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-localization-l1-2-0.dll
MD5
23bd405a6cfd1e38c74c5150eec28d0a

SHA1
1d3be98e7dfe565e297e837a7085731ecd368c7b

SHA256
a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41

SHA512
c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-processthreads-l1-1-1.dll
MD5
95c5b49af7f2c7d3cd0bc14b1e9efacb

SHA1
c400205c81140e60dffa8811c1906ce87c58971e

SHA256
ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1

SHA512
f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-synch-l1-2-0.dll
MD5
6e704280d632c2f8f2cadefcae25ad85

SHA1
699c5a1c553d64d7ff3cf4fe57da72bb151caede

SHA256
758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893

SHA512
ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-timezone-l1-1-0.dll
MD5
c9a55de62e53d747c5a7fddedef874f9

SHA1
c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad

SHA256
b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b

SHA512
adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-convert-l1-1-0.dll
MD5
9ddea3cc96e0fdd3443cc60d649931b3

SHA1
af3cb7036318a8427f20b8561079e279119dca0e

SHA256
b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5

SHA512
1427193b31b64715f5712db9c431593bdc56ef512fe353147ddb7544c1c39ded4371cd72055d82818e965aff0441b7cbe0b811d828efb0ece28471716659e162

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-environment-l1-1-0.dll
MD5
39325e5f023eb564c87d30f7e06dff23

SHA1
03dd79a7fbe3de1a29359b94ba2d554776bdd3fe

SHA256
56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a

SHA512
087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-filesystem-l1-1-0.dll
MD5
228c6bbe1bce84315e4927392a3baee5

SHA1
ba274aa567ad1ec663a2f9284af2e3cb232698fb

SHA256
ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065

SHA512
37a60cce69e81f68ef62c58bba8f2843e99e8ba1b87df9a5b561d358309e672ae5e3434a10a3dde01ae624d1638da226d42c64316f72f3d63b08015b43c56cab

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-heap-l1-1-0.dll
MD5
1776a2b85378b27825cf5e5a3a132d9a

SHA1
626f0e7f2f18f31ec304fe7a7af1a87cbbebb1df

SHA256
675b1b82dd485cc8c8a099272db9241d0d2a7f45424901f35231b79186ec47ee

SHA512
541a5dd997fc5fec31c17b4f95f03c3a52e106d6fb590cb46bdf5adad23ed4a895853768229f3fbb9049f614d9bae031e6c43cec43fb38c89f13163721bb8348

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-locale-l1-1-0.dll
MD5
034379bcea45eb99db8cdfeacbc5e281

SHA1
bbf93d82e7e306e827efeb9612e8eab2b760e2b7

SHA256
8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65

SHA512
7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-math-l1-1-0.dll
MD5
8da414c3524a869e5679c0678d1640c1

SHA1
60cf28792c68e9894878c31b323e68feb4676865

SHA256
39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672

SHA512
6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-runtime-l1-1-0.dll
MD5
fb0ca6cbfff46be87ad729a1c4fde138

SHA1
2c302d1c535d5c40f31c3a75393118b40e1b2af9

SHA256
1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df

SHA512
99144c67c33e89b8283c5b39b8bf68d55638daa6acc2715a2ac8c5dba4170dd12299d3a2dffb39ae38ef0872c2c68a64d7cdc6ceba5e660a53942761cb9eca83

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-stdio-l1-1-0.dll
MD5
d5166ab3034f0e1aa679bfa1907e5844

SHA1
851dd640cb34177c43b5f47b218a686c09fa6b4c

SHA256
7bcab4ca00fb1f85fea29dd3375f709317b984a6f3b9ba12b8cf1952f97beee5

SHA512
8f2d7442191de22457c1b8402faad594af2fe0c38280aaafc876c797ca79f7f4b6860e557e37c3dbe084fe7262a85c358e3eeaf91e16855a91b7535cb0ac832e

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-string-l1-1-0.dll
MD5
ad99c2362f64cde7756b16f9a016a60f

SHA1
07c9a78ee658bfa81db61dab039cffc9145cc6cb

SHA256
73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa

SHA512
9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-time-l1-1-0.dll
MD5
9b79fda359a269c63dcac69b2c81caa4

SHA1
a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb

SHA256
4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138

SHA512
e69d275c5ec5eae5c95b0596f0cc681b7d287b3e2f9c78a9b5e658949e6244f754f96ad7d40214d22ed28d64e4e8bd507363cdf99999fea93cfe319078c1f541

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-utility-l1-1-0.dll
MD5
70e9104e743069b573ca12a3cd87ec33

SHA1
4290755b6a49212b2e969200e7a088d1713b84a2

SHA256
7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95

SHA512
e979f28451d271f405b780fc2025707c8a29dcb4c28980ca42e33d4033666de0e4a4644defec6c1d5d4bdd3c73d405fafcffe3320c60134681f62805c965bfd9

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\j_service.exe
MD5
1c0cbc7b9df0831070a0b8074d166644

SHA1
69c84d17775c60a67e76b7a86178819af41280d3

SHA256
15a5a2459338444dba67c7caae3685d23783220a9c131e7da798807cb2eba1fe

SHA512
033f39008cdba9d5433f0e10ce4a4c7e284898a32cf1fa271bbdeeb3c6956cd351728e286ef88a931c17179727e2c68305058b8ee15b88465a959ed72c5eaf4b

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\libcrypto-1_1.dll
MD5
3fc11548faa83a695554241402111832

SHA1
169635206517e7a29f0a2f9909dfd9704b7eada2

SHA256
0d821c35183a867247364f147b149e9eabea0d50b198aa009e46fd2a7843ec34

SHA512
329e99b80d63ac1861165ab6d8bf60553d3a6434beceadacf19cb15cea98f6e6769ff93d4a0fc379164bc54da93529c6623413d5ae0e321ffe3814d13e480bc7

Download Submit
C:\Program Files (x86)\Microsoft Corporation\Windows Security Update\libssl-1_1.dll
MD5
444539941a2f245a2e1993c63276edb0

SHA1
3ac7a82153e59296cf1bdfd4a9b3d1566c8c9c51

SHA256
7c0b15fe11ea29b1006213c31f3e7f96d1a587a7261e70eca75f0ca613359553

SHA512
9d61c173f2f481febf15c20aba6f52167b3af038abc843a9a7c22d9791efe40fa89fd4eb51e14c837dd6fd4c8818334688e278f5824e22b798ba7dd72098590d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
MD5
96b73821e674dbc29b2a836492820ada

SHA1
bf04903f7e579c078af843fa1b64ef89d5cfed73

SHA256
0c1d02fc97231f095bffcc6972f495d96d183d7cfa63add9fecdfe3fddfc9645

SHA512
ac68ca142a3061e732821523a12dc98bed6e89bb20078739830db356582777742f83161f6d739ee7c26a96439347410777078413696a92a143ebe0072bbcf01d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
6045baccf49e1eba0e674945311a06e6

SHA1
379c6234849eecede26fad192c2ee59e0f0221cb

SHA256
65830a65cb913bee83258e4ac3e140faf131e7eb084d39f7020c7acc825b0a58

SHA512
da32af6a730884e73956e4eb6bff61a1326b3ef8ba0a213b5b4aad6de4fbd471b3550b6ac2110f1d0b2091e33c70d44e498f897376f8e1998b1d2afac789abeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_4ACA30C8349CC6FA330F1EC1B1009DAC
MD5
1c8d3df8ae5084a49e8a176eaaad1357

SHA1
aca9a8421adfc48fb891b3f25773f19361ca6081

SHA256
b96ff31e5b81b1ec0c3cf2ce4cfe55e8c925e26fad7fa1471d20be3f89bda817

SHA512
ce39157d851e01a1393ae63cc13a5ecfb878d8aa7e42e3a9a763ceb7bf6e6ad07db7e45e12ed0076bf02cd635efcf609d9a53c8b3b78d11b5abf65e75d16218b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
MD5
f79f65fbb4d6628997054a0b01cc9074

SHA1
8779aa5fb672b3c64c5f3bb0c8f6166c55ada631

SHA256
c1471fe23d75c261b307a5f2d457a4a52b447bdd9cd3cfe6fc73e5757553acbb

SHA512
9e53d9d3e933bd79cb8dbc67eb56502e9bfaaa60cf99be78e2057c92f8a6d19b91ee160b21082e5cae4273c8e8cd074266cfd73d0440d659983b0bf1c8f24450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
6b9829e88c4b0da7652ac29ef9fd0770

SHA1
8d238b4a7d24e920f079ea43e45c711c3e9f97cf

SHA256
db44f4dd4de86953c653452a2e3ffa816864dd9cfe221a4a8d4385e61f86df0b

SHA512
5593b4e32baf62fd23eba5470f5402107c590a3e77e05d86fb03dcc0eb7b501a617006543088594ecaa10f38b084eb4c6974ef42bcfdc2950d5f639b49c5ed00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_4ACA30C8349CC6FA330F1EC1B1009DAC
MD5
27d31be7f29ed63106fb490457a3e3e0

SHA1
742925e66312a0aa0b02537b1dfbbfb4791f3547

SHA256
05700c472f23a8fcc111432e5941159be13cf3becbbc1c86fbf1ec04e272c857

SHA512
4c8a145f92ca1ebc03e5433664e3564a1fbdf154962a2db891ffbfa35796c545d5ebd82b98fcc0583736c21a772e888108c90db8cead81bf9806701b48310586

Download Submit
C:\Windows\Installer\MSIBE91.tmp
MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIC113.tmp
MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-file-l1-2-0.dll
MD5
79ee4a2fcbe24e9a65106de834ccda4a

SHA1
fd1ba674371af7116ea06ad42886185f98ba137b

SHA256
9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613

SHA512
6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-file-l1-2-0.dll
MD5
79ee4a2fcbe24e9a65106de834ccda4a

SHA1
fd1ba674371af7116ea06ad42886185f98ba137b

SHA256
9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613

SHA512
6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-file-l2-1-0.dll
MD5
3f224766fe9b090333fdb43d5a22f9ea

SHA1
548d1bb707ae7a3dfccc0c2d99908561a305f57b

SHA256
ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357

SHA512
c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-file-l2-1-0.dll
MD5
3f224766fe9b090333fdb43d5a22f9ea

SHA1
548d1bb707ae7a3dfccc0c2d99908561a305f57b

SHA256
ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357

SHA512
c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-localization-l1-2-0.dll
MD5
23bd405a6cfd1e38c74c5150eec28d0a

SHA1
1d3be98e7dfe565e297e837a7085731ecd368c7b

SHA256
a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41

SHA512
c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-localization-l1-2-0.dll
MD5
23bd405a6cfd1e38c74c5150eec28d0a

SHA1
1d3be98e7dfe565e297e837a7085731ecd368c7b

SHA256
a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41

SHA512
c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-processthreads-l1-1-1.dll
MD5
95c5b49af7f2c7d3cd0bc14b1e9efacb

SHA1
c400205c81140e60dffa8811c1906ce87c58971e

SHA256
ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1

SHA512
f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-processthreads-l1-1-1.dll
MD5
95c5b49af7f2c7d3cd0bc14b1e9efacb

SHA1
c400205c81140e60dffa8811c1906ce87c58971e

SHA256
ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1

SHA512
f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-synch-l1-2-0.dll
MD5
6e704280d632c2f8f2cadefcae25ad85

SHA1
699c5a1c553d64d7ff3cf4fe57da72bb151caede

SHA256
758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893

SHA512
ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-synch-l1-2-0.dll
MD5
6e704280d632c2f8f2cadefcae25ad85

SHA1
699c5a1c553d64d7ff3cf4fe57da72bb151caede

SHA256
758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893

SHA512
ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-timezone-l1-1-0.dll
MD5
c9a55de62e53d747c5a7fddedef874f9

SHA1
c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad

SHA256
b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b

SHA512
adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-core-timezone-l1-1-0.dll
MD5
c9a55de62e53d747c5a7fddedef874f9

SHA1
c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad

SHA256
b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b

SHA512
adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-convert-l1-1-0.dll
MD5
9ddea3cc96e0fdd3443cc60d649931b3

SHA1
af3cb7036318a8427f20b8561079e279119dca0e

SHA256
b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5

SHA512
1427193b31b64715f5712db9c431593bdc56ef512fe353147ddb7544c1c39ded4371cd72055d82818e965aff0441b7cbe0b811d828efb0ece28471716659e162

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-environment-l1-1-0.dll
MD5
39325e5f023eb564c87d30f7e06dff23

SHA1
03dd79a7fbe3de1a29359b94ba2d554776bdd3fe

SHA256
56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a

SHA512
087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-filesystem-l1-1-0.dll
MD5
228c6bbe1bce84315e4927392a3baee5

SHA1
ba274aa567ad1ec663a2f9284af2e3cb232698fb

SHA256
ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065

SHA512
37a60cce69e81f68ef62c58bba8f2843e99e8ba1b87df9a5b561d358309e672ae5e3434a10a3dde01ae624d1638da226d42c64316f72f3d63b08015b43c56cab

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-heap-l1-1-0.dll
MD5
1776a2b85378b27825cf5e5a3a132d9a

SHA1
626f0e7f2f18f31ec304fe7a7af1a87cbbebb1df

SHA256
675b1b82dd485cc8c8a099272db9241d0d2a7f45424901f35231b79186ec47ee

SHA512
541a5dd997fc5fec31c17b4f95f03c3a52e106d6fb590cb46bdf5adad23ed4a895853768229f3fbb9049f614d9bae031e6c43cec43fb38c89f13163721bb8348

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-locale-l1-1-0.dll
MD5
034379bcea45eb99db8cdfeacbc5e281

SHA1
bbf93d82e7e306e827efeb9612e8eab2b760e2b7

SHA256
8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65

SHA512
7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-math-l1-1-0.dll
MD5
8da414c3524a869e5679c0678d1640c1

SHA1
60cf28792c68e9894878c31b323e68feb4676865

SHA256
39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672

SHA512
6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-runtime-l1-1-0.dll
MD5
fb0ca6cbfff46be87ad729a1c4fde138

SHA1
2c302d1c535d5c40f31c3a75393118b40e1b2af9

SHA256
1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df

SHA512
99144c67c33e89b8283c5b39b8bf68d55638daa6acc2715a2ac8c5dba4170dd12299d3a2dffb39ae38ef0872c2c68a64d7cdc6ceba5e660a53942761cb9eca83

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-runtime-l1-1-0.dll
MD5
fb0ca6cbfff46be87ad729a1c4fde138

SHA1
2c302d1c535d5c40f31c3a75393118b40e1b2af9

SHA256
1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df

SHA512
99144c67c33e89b8283c5b39b8bf68d55638daa6acc2715a2ac8c5dba4170dd12299d3a2dffb39ae38ef0872c2c68a64d7cdc6ceba5e660a53942761cb9eca83

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-stdio-l1-1-0.dll
MD5
d5166ab3034f0e1aa679bfa1907e5844

SHA1
851dd640cb34177c43b5f47b218a686c09fa6b4c

SHA256
7bcab4ca00fb1f85fea29dd3375f709317b984a6f3b9ba12b8cf1952f97beee5

SHA512
8f2d7442191de22457c1b8402faad594af2fe0c38280aaafc876c797ca79f7f4b6860e557e37c3dbe084fe7262a85c358e3eeaf91e16855a91b7535cb0ac832e

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-string-l1-1-0.dll
MD5
ad99c2362f64cde7756b16f9a016a60f

SHA1
07c9a78ee658bfa81db61dab039cffc9145cc6cb

SHA256
73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa

SHA512
9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-string-l1-1-0.dll
MD5
ad99c2362f64cde7756b16f9a016a60f

SHA1
07c9a78ee658bfa81db61dab039cffc9145cc6cb

SHA256
73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa

SHA512
9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-time-l1-1-0.dll
MD5
9b79fda359a269c63dcac69b2c81caa4

SHA1
a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb

SHA256
4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138

SHA512
e69d275c5ec5eae5c95b0596f0cc681b7d287b3e2f9c78a9b5e658949e6244f754f96ad7d40214d22ed28d64e4e8bd507363cdf99999fea93cfe319078c1f541

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\api-ms-win-crt-utility-l1-1-0.dll
MD5
70e9104e743069b573ca12a3cd87ec33

SHA1
4290755b6a49212b2e969200e7a088d1713b84a2

SHA256
7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95

SHA512
e979f28451d271f405b780fc2025707c8a29dcb4c28980ca42e33d4033666de0e4a4644defec6c1d5d4bdd3c73d405fafcffe3320c60134681f62805c965bfd9

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\libcrypto-1_1.dll
MD5
3fc11548faa83a695554241402111832

SHA1
169635206517e7a29f0a2f9909dfd9704b7eada2

SHA256
0d821c35183a867247364f147b149e9eabea0d50b198aa009e46fd2a7843ec34

SHA512
329e99b80d63ac1861165ab6d8bf60553d3a6434beceadacf19cb15cea98f6e6769ff93d4a0fc379164bc54da93529c6623413d5ae0e321ffe3814d13e480bc7

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\libssl-1_1.dll
MD5
444539941a2f245a2e1993c63276edb0

SHA1
3ac7a82153e59296cf1bdfd4a9b3d1566c8c9c51

SHA256
7c0b15fe11ea29b1006213c31f3e7f96d1a587a7261e70eca75f0ca613359553

SHA512
9d61c173f2f481febf15c20aba6f52167b3af038abc843a9a7c22d9791efe40fa89fd4eb51e14c837dd6fd4c8818334688e278f5824e22b798ba7dd72098590d

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\msvcp140.dll
MD5
9dda681b0406c3575e666f52cbde4f80

SHA1
1951c5b2c689534cdc2fbfbc14abbf9600a66086

SHA256
1ecd899f18b58a7915069e17582b8bf9f491a907c3fdf22b1ba1cbb2727b69b3

SHA512
753d0af201d5c91b50e7d1ed54f44ee3c336f8124ba7a5e86b53836df520eb2733b725b877f83fda6a9a7768379b5f6fafa0bd3890766b4188ebd337272e9512

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\msvcp140.dll
MD5
9dda681b0406c3575e666f52cbde4f80

SHA1
1951c5b2c689534cdc2fbfbc14abbf9600a66086

SHA256
1ecd899f18b58a7915069e17582b8bf9f491a907c3fdf22b1ba1cbb2727b69b3

SHA512
753d0af201d5c91b50e7d1ed54f44ee3c336f8124ba7a5e86b53836df520eb2733b725b877f83fda6a9a7768379b5f6fafa0bd3890766b4188ebd337272e9512

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\vcruntime140.dll
MD5
e79ef25890b214b13a7473e52330d0ec

SHA1
e47cbd0000a1f6132d74f5e767ad91973bd772d8

SHA256
7a114a9c1ca86e532d7f38e81c48f24ef2bfe6084f6056b3d4c3566ba43003d6

SHA512
dabed378fccfabc10486747fc70cf51a4fcc5b88f869c8a2fa4df30caa83a3af086c89e23806b7a291756da957a97c80a9b834a05e1d8ee7bd5c7159458c537a

Download Submit
\Program Files (x86)\Microsoft Corporation\Windows Security Update\vcruntime140.dll
MD5
e79ef25890b214b13a7473e52330d0ec

SHA1
e47cbd0000a1f6132d74f5e767ad91973bd772d8

SHA256
7a114a9c1ca86e532d7f38e81c48f24ef2bfe6084f6056b3d4c3566ba43003d6

SHA512
dabed378fccfabc10486747fc70cf51a4fcc5b88f869c8a2fa4df30caa83a3af086c89e23806b7a291756da957a97c80a9b834a05e1d8ee7bd5c7159458c537a

Download Submit
\Windows\Installer\MSIBE91.tmp
MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
\Windows\Installer\MSIC113.tmp
MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
memory/316-119-0x0000000000000000-mapping.dmp

Download
memory/588-133-0x0000000000000000-mapping.dmp

Download
memory/588-135-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/588-136-0x0000000010000000-0x000000001008C000-memory.dmp

Filesize
560KB

Download
memory/1108-72-0x0000000000000000-mapping.dmp

Download
memory/1444-69-0x00000000757D1000-0x00000000757D3000-memory.dmp

Filesize
8KB

Download
memory/1444-68-0x0000000000000000-mapping.dmp

Download
memory/1836-60-0x000007FEFBDA1000-0x000007FEFBDA3000-memory.dmp

Filesize
8KB

Download
memory/1980-137-0x0000000000000000-mapping.dmp

Download
memory/1980-139-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download