Analysis
-
max time kernel
171s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:56
Static task
static1
Behavioral task
behavioral1
Sample
a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe
Resource
win10v2004-20220812-en
General
-
Target
a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe
-
Size
680KB
-
MD5
2ce13b8500b10591a8e5842f6ec6b6c2
-
SHA1
6dc3ed9a7a294f1dc938826d0ed24b00c30bbd50
-
SHA256
a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163
-
SHA512
2ff4855b63b80fcd12aa43c10457811933579f265ff8a970d9c27a74256b0a018366cff89153a0ad87db4d758855f6a8611a1df536e9448ca14c9ef509cf3f9a
-
SSDEEP
12288:7ClephVMo7IYJAB++2RrxRAjbeNC2v+clES+vYOqH:mOhKpYyB/MrxRAZMES+b+
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
svcnost.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List svcnost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile svcnost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications svcnost.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\xycvf2oobtihreyqmxasp3vwfx3gcz3l2\svcnost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\xycvf2oobtihreyqmxasp3vwfx3gcz3l2\\svcnost.exe:*:Enabled:ldrsoft" svcnost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
GFW6ssUz.exekzveom.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" GFW6ssUz.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kzveom.exe -
Drops file in Drivers directory 1 IoCs
Processes:
4kaq.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts 4kaq.exe -
Executes dropped EXE 12 IoCs
Processes:
GFW6ssUz.exekzveom.exe2kaq.exe2kaq.exe2kaq.exe2kaq.exe2kaq.exe2kaq.exe3kaq.exeX4kaq.exesvcnost.exepid process 4860 GFW6ssUz.exe 1180 kzveom.exe 520 2kaq.exe 1524 2kaq.exe 2836 2kaq.exe 1316 2kaq.exe 1296 2kaq.exe 1528 2kaq.exe 2068 3kaq.exe 2112 X 3848 4kaq.exe 3716 svcnost.exe -
Processes:
resource yara_rule behavioral2/memory/1524-152-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1524-156-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1524-158-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2836-157-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2836-161-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2836-162-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1316-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1316-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1316-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1296-171-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1296-176-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1296-178-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1524-181-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2836-182-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1316-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1296-184-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1524-193-0x0000000000400000-0x0000000000407000-memory.dmp upx C:\Users\Admin\4kaq.exe upx C:\Users\Admin\4kaq.exe upx behavioral2/memory/3848-198-0x0000000000400000-0x0000000000B19000-memory.dmp upx C:\Users\Admin\AppData\Roaming\xycvf2oobtihreyqmxasp3vwfx3gcz3l2\svcnost.exe upx behavioral2/memory/3716-201-0x0000000000400000-0x0000000000B19000-memory.dmp upx behavioral2/memory/3848-206-0x0000000000400000-0x0000000000B19000-memory.dmp upx behavioral2/memory/3716-209-0x0000000000400000-0x0000000000B19000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
GFW6ssUz.exea1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation GFW6ssUz.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe -
Loads dropped DLL 2 IoCs
Processes:
svcnost.exepid process 3716 svcnost.exe 3716 svcnost.exe -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 56 IoCs
Processes:
4kaq.exekzveom.exeGFW6ssUz.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Init = "\"C:\\Users\\Admin\\AppData\\Roaming\\xycvf2oobtihreyqmxasp3vwfx3gcz3l2\\svcnost.exe\"" 4kaq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /T" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /h" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /E" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /d" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /H" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /t" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /L" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /g" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /k" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /O" kzveom.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /u" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /q" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /Y" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /F" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /P" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /r" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /b" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /f" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /w" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /s" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /N" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /W" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /l" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /J" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /n" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /m" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /A" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /R" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /C" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /y" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /c" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /e" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /M" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /v" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /j" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /Z" GFW6ssUz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /Q" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /x" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /i" kzveom.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ GFW6ssUz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /X" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /p" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /a" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /B" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /V" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /D" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /z" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /U" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /Z" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /S" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /K" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /I" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /G" kzveom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzveom = "C:\\Users\\Admin\\kzveom.exe /o" kzveom.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
svcnost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\desktop.ini svcnost.exe File opened for modification C:\Users\Admin\AppData\Roaming\desktop.ini svcnost.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2kaq.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2kaq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2kaq.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
2kaq.exedescription pid process target process PID 520 set thread context of 1524 520 2kaq.exe 2kaq.exe PID 520 set thread context of 2836 520 2kaq.exe 2kaq.exe PID 520 set thread context of 1316 520 2kaq.exe 2kaq.exe PID 520 set thread context of 1296 520 2kaq.exe 2kaq.exe PID 520 set thread context of 1528 520 2kaq.exe 2kaq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 32 1528 WerFault.exe 2kaq.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 4840 tasklist.exe 4420 tasklist.exe -
Processes:
svcnost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry svcnost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\SavedLegacySettingsML = 343131343530383133 svcnost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
GFW6ssUz.exe2kaq.exe2kaq.exekzveom.exe3kaq.exeX4kaq.exepid process 4860 GFW6ssUz.exe 4860 GFW6ssUz.exe 4860 GFW6ssUz.exe 4860 GFW6ssUz.exe 2836 2kaq.exe 2836 2kaq.exe 1316 2kaq.exe 1316 2kaq.exe 1180 kzveom.exe 1180 kzveom.exe 2068 3kaq.exe 2068 3kaq.exe 2112 X 2112 X 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 2836 2kaq.exe 2836 2kaq.exe 1316 2kaq.exe 1316 2kaq.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 2836 2kaq.exe 2836 2kaq.exe 1180 kzveom.exe 1180 kzveom.exe 3848 4kaq.exe 3848 4kaq.exe 2836 2kaq.exe 2836 2kaq.exe 2836 2kaq.exe 2836 2kaq.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 2836 2kaq.exe 2836 2kaq.exe 1180 kzveom.exe 1180 kzveom.exe 2836 2kaq.exe 2836 2kaq.exe 1180 kzveom.exe 1180 kzveom.exe 2836 2kaq.exe 2836 2kaq.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 1180 kzveom.exe 2836 2kaq.exe 2836 2kaq.exe 1180 kzveom.exe 1180 kzveom.exe 2836 2kaq.exe 2836 2kaq.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2804 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
tasklist.exe3kaq.exeExplorer.EXEtasklist.exedescription pid process Token: SeDebugPrivilege 4840 tasklist.exe Token: SeDebugPrivilege 2068 3kaq.exe Token: SeDebugPrivilege 2068 3kaq.exe Token: SeShutdownPrivilege 2804 Explorer.EXE Token: SeCreatePagefilePrivilege 2804 Explorer.EXE Token: SeShutdownPrivilege 2804 Explorer.EXE Token: SeCreatePagefilePrivilege 2804 Explorer.EXE Token: SeShutdownPrivilege 2804 Explorer.EXE Token: SeCreatePagefilePrivilege 2804 Explorer.EXE Token: SeShutdownPrivilege 2804 Explorer.EXE Token: SeCreatePagefilePrivilege 2804 Explorer.EXE Token: SeDebugPrivilege 4420 tasklist.exe Token: SeShutdownPrivilege 2804 Explorer.EXE Token: SeCreatePagefilePrivilege 2804 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exeGFW6ssUz.exekzveom.exe2kaq.exe2kaq.exe2kaq.exepid process 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe 4860 GFW6ssUz.exe 1180 kzveom.exe 520 2kaq.exe 1524 2kaq.exe 1296 2kaq.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exeGFW6ssUz.execmd.exe2kaq.exe3kaq.exeX4kaq.exedescription pid process target process PID 3104 wrote to memory of 4860 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe GFW6ssUz.exe PID 3104 wrote to memory of 4860 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe GFW6ssUz.exe PID 3104 wrote to memory of 4860 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe GFW6ssUz.exe PID 4860 wrote to memory of 1180 4860 GFW6ssUz.exe kzveom.exe PID 4860 wrote to memory of 1180 4860 GFW6ssUz.exe kzveom.exe PID 4860 wrote to memory of 1180 4860 GFW6ssUz.exe kzveom.exe PID 3104 wrote to memory of 520 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe 2kaq.exe PID 3104 wrote to memory of 520 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe 2kaq.exe PID 3104 wrote to memory of 520 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe 2kaq.exe PID 4860 wrote to memory of 4916 4860 GFW6ssUz.exe cmd.exe PID 4860 wrote to memory of 4916 4860 GFW6ssUz.exe cmd.exe PID 4860 wrote to memory of 4916 4860 GFW6ssUz.exe cmd.exe PID 4916 wrote to memory of 4840 4916 cmd.exe tasklist.exe PID 4916 wrote to memory of 4840 4916 cmd.exe tasklist.exe PID 4916 wrote to memory of 4840 4916 cmd.exe tasklist.exe PID 520 wrote to memory of 1524 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1524 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1524 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1524 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1524 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1524 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1524 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1524 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 2836 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 2836 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 2836 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 2836 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 2836 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 2836 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 2836 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 2836 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1316 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1316 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1316 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1316 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1316 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1316 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1316 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1316 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1296 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1296 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1296 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1296 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1296 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1296 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1296 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1296 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1528 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1528 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1528 520 2kaq.exe 2kaq.exe PID 520 wrote to memory of 1528 520 2kaq.exe 2kaq.exe PID 3104 wrote to memory of 2068 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe 3kaq.exe PID 3104 wrote to memory of 2068 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe 3kaq.exe PID 3104 wrote to memory of 2068 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe 3kaq.exe PID 2068 wrote to memory of 2112 2068 3kaq.exe X PID 2068 wrote to memory of 2112 2068 3kaq.exe X PID 2112 wrote to memory of 2804 2112 X Explorer.EXE PID 3104 wrote to memory of 3848 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe 4kaq.exe PID 3104 wrote to memory of 3848 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe 4kaq.exe PID 3104 wrote to memory of 3848 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe 4kaq.exe PID 3848 wrote to memory of 3716 3848 4kaq.exe svcnost.exe PID 3848 wrote to memory of 3716 3848 4kaq.exe svcnost.exe PID 3848 wrote to memory of 3716 3848 4kaq.exe svcnost.exe PID 3104 wrote to memory of 2400 3104 a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe"C:\Users\Admin\AppData\Local\Temp\a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\GFW6ssUz.exeC:\Users\Admin\GFW6ssUz.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\kzveom.exe"C:\Users\Admin\kzveom.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del GFW6ssUz.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\2kaq.exeC:\Users\Admin\2kaq.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\2kaq.exe"C:\Users\Admin\2kaq.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\2kaq.exe"C:\Users\Admin\2kaq.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\2kaq.exe"C:\Users\Admin\2kaq.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\2kaq.exe"C:\Users\Admin\2kaq.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\2kaq.exe"C:\Users\Admin\2kaq.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 845⤵
- Program crash
-
C:\Users\Admin\3kaq.exeC:\Users\Admin\3kaq.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\2aebb42b\X*0*bc*6a2e4306*31.193.3.240:534⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\4kaq.exeC:\Users\Admin\4kaq.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\xycvf2oobtihreyqmxasp3vwfx3gcz3l2\svcnost.exe"C:\Users\Admin\AppData\Roaming\xycvf2oobtihreyqmxasp3vwfx3gcz3l2\svcnost.exe"4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del a1650ae10f6d11c084fad9e3b1a17247eadd417f6343dec8a999c1c323eaf163.exe3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1528 -ip 15281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\2kaq.exeFilesize
132KB
MD5d7dbb57f65cb963477a8fa11714ec0be
SHA1756d29032644973b9f48980a1e30448206811119
SHA25694242fda567e2b4dc0be9d4ca5370ff0ddee2d25751dd191c3fed995837c10ec
SHA5121db3577abd73c8c8667da426faedf63ad9c7a75462cbeac0be19a525690baaa9f1d8446d3b804abbf24550d73cbefecf6c77c224539e8dd5db37f34f7e975fdc
-
C:\Users\Admin\2kaq.exeFilesize
132KB
MD5d7dbb57f65cb963477a8fa11714ec0be
SHA1756d29032644973b9f48980a1e30448206811119
SHA25694242fda567e2b4dc0be9d4ca5370ff0ddee2d25751dd191c3fed995837c10ec
SHA5121db3577abd73c8c8667da426faedf63ad9c7a75462cbeac0be19a525690baaa9f1d8446d3b804abbf24550d73cbefecf6c77c224539e8dd5db37f34f7e975fdc
-
C:\Users\Admin\2kaq.exeFilesize
132KB
MD5d7dbb57f65cb963477a8fa11714ec0be
SHA1756d29032644973b9f48980a1e30448206811119
SHA25694242fda567e2b4dc0be9d4ca5370ff0ddee2d25751dd191c3fed995837c10ec
SHA5121db3577abd73c8c8667da426faedf63ad9c7a75462cbeac0be19a525690baaa9f1d8446d3b804abbf24550d73cbefecf6c77c224539e8dd5db37f34f7e975fdc
-
C:\Users\Admin\2kaq.exeFilesize
132KB
MD5d7dbb57f65cb963477a8fa11714ec0be
SHA1756d29032644973b9f48980a1e30448206811119
SHA25694242fda567e2b4dc0be9d4ca5370ff0ddee2d25751dd191c3fed995837c10ec
SHA5121db3577abd73c8c8667da426faedf63ad9c7a75462cbeac0be19a525690baaa9f1d8446d3b804abbf24550d73cbefecf6c77c224539e8dd5db37f34f7e975fdc
-
C:\Users\Admin\2kaq.exeFilesize
132KB
MD5d7dbb57f65cb963477a8fa11714ec0be
SHA1756d29032644973b9f48980a1e30448206811119
SHA25694242fda567e2b4dc0be9d4ca5370ff0ddee2d25751dd191c3fed995837c10ec
SHA5121db3577abd73c8c8667da426faedf63ad9c7a75462cbeac0be19a525690baaa9f1d8446d3b804abbf24550d73cbefecf6c77c224539e8dd5db37f34f7e975fdc
-
C:\Users\Admin\2kaq.exeFilesize
132KB
MD5d7dbb57f65cb963477a8fa11714ec0be
SHA1756d29032644973b9f48980a1e30448206811119
SHA25694242fda567e2b4dc0be9d4ca5370ff0ddee2d25751dd191c3fed995837c10ec
SHA5121db3577abd73c8c8667da426faedf63ad9c7a75462cbeac0be19a525690baaa9f1d8446d3b804abbf24550d73cbefecf6c77c224539e8dd5db37f34f7e975fdc
-
C:\Users\Admin\2kaq.exeFilesize
132KB
MD5d7dbb57f65cb963477a8fa11714ec0be
SHA1756d29032644973b9f48980a1e30448206811119
SHA25694242fda567e2b4dc0be9d4ca5370ff0ddee2d25751dd191c3fed995837c10ec
SHA5121db3577abd73c8c8667da426faedf63ad9c7a75462cbeac0be19a525690baaa9f1d8446d3b804abbf24550d73cbefecf6c77c224539e8dd5db37f34f7e975fdc
-
C:\Users\Admin\3kaq.exeFilesize
277KB
MD500b72668c42555c6d9e3cee383730fc0
SHA1509a7c39baf2b9a46813c641cca687b37e244d5a
SHA256baaacce5c3f18154d4925ec6568ccf66f4ab9ee5477bd0faf44f08d9397641dd
SHA5121bfa5cd6081a5e8556b452cf4741831da829fcc9e2b51c77c92a4fdacfa1b934d14bc049f8185be09b1447664f55956f69e7fd16a868c9655eb32f9b9ef02e78
-
C:\Users\Admin\3kaq.exeFilesize
277KB
MD500b72668c42555c6d9e3cee383730fc0
SHA1509a7c39baf2b9a46813c641cca687b37e244d5a
SHA256baaacce5c3f18154d4925ec6568ccf66f4ab9ee5477bd0faf44f08d9397641dd
SHA5121bfa5cd6081a5e8556b452cf4741831da829fcc9e2b51c77c92a4fdacfa1b934d14bc049f8185be09b1447664f55956f69e7fd16a868c9655eb32f9b9ef02e78
-
C:\Users\Admin\4kaq.exeFilesize
120KB
MD5ee3508d5206de400e5792c826ae71aae
SHA1b448132f604b7e886343b911cc56371a7f251c04
SHA256f6226f935ea3d5ecc4be3ccf6a59caff31ed3e6bd35c5d26fbe3906b4379b35d
SHA512233f72bf8cf5d72b7f7c09bf546220fa0c34511330349fa28ef4c746b19f59696b5e515a7d345862430979800be354ab954aa55f79747a83d601abdf32bd24fb
-
C:\Users\Admin\4kaq.exeFilesize
120KB
MD5ee3508d5206de400e5792c826ae71aae
SHA1b448132f604b7e886343b911cc56371a7f251c04
SHA256f6226f935ea3d5ecc4be3ccf6a59caff31ed3e6bd35c5d26fbe3906b4379b35d
SHA512233f72bf8cf5d72b7f7c09bf546220fa0c34511330349fa28ef4c746b19f59696b5e515a7d345862430979800be354ab954aa55f79747a83d601abdf32bd24fb
-
C:\Users\Admin\AppData\Local\2aebb42b\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
C:\Users\Admin\AppData\Local\2aebb42b\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
C:\Users\Admin\AppData\Roaming\desktop.iniFilesize
9KB
MD54a27242b307c6a836993353035fafc16
SHA15fea7a41b8f9071848108015d8a952e6f944eea0
SHA25602fd93f64bda51e1e2991184cac13f077d509712e462c9e44be9cf8e22c06de1
SHA51235e9c87642b82df2bf0a9312bb0e9abfb98282db1e34032a4d0150d82c5e2f2e13150ddc896f1e954f02288a1e696a4306ee595b94b1e404c6ec17bac64c44be
-
C:\Users\Admin\AppData\Roaming\ntuser.datFilesize
54KB
MD57e8e966927e04a35aec644602b8a9e05
SHA1d201b0b41e8701818d60ddbf9f334332a512c4da
SHA25646f18d9fbf63f378d86962cbf24f5ce57ce257555acd4effdcc41c1e2f1adf5c
SHA512246777c79129a5076b71ca5d3f7e59b06d344f6b5e771892ae8ee68c0b5af9207cd1868b1336b49e6a84665309ad379a33ec6c8e72d7ce41de72153637921a51
-
C:\Users\Admin\AppData\Roaming\xycvf2oobtihreyqmxasp3vwfx3gcz3l2\svcnost.exeFilesize
120KB
MD5ee3508d5206de400e5792c826ae71aae
SHA1b448132f604b7e886343b911cc56371a7f251c04
SHA256f6226f935ea3d5ecc4be3ccf6a59caff31ed3e6bd35c5d26fbe3906b4379b35d
SHA512233f72bf8cf5d72b7f7c09bf546220fa0c34511330349fa28ef4c746b19f59696b5e515a7d345862430979800be354ab954aa55f79747a83d601abdf32bd24fb
-
C:\Users\Admin\GFW6ssUz.exeFilesize
312KB
MD5d0250c92bd9e6c62c0c8227ea7bc0df4
SHA19a9fd691422b105c5e008764b980d1568c2df957
SHA256ee113e2ee5cd0d396af0e79c2390d059355d24e426886bbacda44d7f39a28007
SHA51299ab659dd56fabf0bd488f754cc7d1b166e1727b5a742d4262062946b5aa79577499fff55e434b6dbe05efa11e9ce2ce58cf68f30e29d9b5580e20de4e974200
-
C:\Users\Admin\GFW6ssUz.exeFilesize
312KB
MD5d0250c92bd9e6c62c0c8227ea7bc0df4
SHA19a9fd691422b105c5e008764b980d1568c2df957
SHA256ee113e2ee5cd0d396af0e79c2390d059355d24e426886bbacda44d7f39a28007
SHA51299ab659dd56fabf0bd488f754cc7d1b166e1727b5a742d4262062946b5aa79577499fff55e434b6dbe05efa11e9ce2ce58cf68f30e29d9b5580e20de4e974200
-
C:\Users\Admin\kzveom.exeFilesize
312KB
MD56dd0b33307265cd54b23bcea8ab59f63
SHA150829682edf21043f7e94a1674c0ba79106d2dc0
SHA25605edce80ec202899e476d32888a9f8f20be610e4951fa379942c3a76b22c21e4
SHA5127ea3fdf0ed13497ffe9b4da646c1b564e029804190b14bd81319a23ec75af160df6fbc1bf10a2df909c414f53136191e66d92793b0f80f086728b2359ffabb55
-
C:\Users\Admin\kzveom.exeFilesize
312KB
MD56dd0b33307265cd54b23bcea8ab59f63
SHA150829682edf21043f7e94a1674c0ba79106d2dc0
SHA25605edce80ec202899e476d32888a9f8f20be610e4951fa379942c3a76b22c21e4
SHA5127ea3fdf0ed13497ffe9b4da646c1b564e029804190b14bd81319a23ec75af160df6fbc1bf10a2df909c414f53136191e66d92793b0f80f086728b2359ffabb55
-
memory/520-142-0x0000000000000000-mapping.dmp
-
memory/1180-139-0x0000000000000000-mapping.dmp
-
memory/1296-184-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1296-171-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1296-169-0x0000000000000000-mapping.dmp
-
memory/1296-176-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1296-178-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1316-165-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1316-170-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1316-163-0x0000000000000000-mapping.dmp
-
memory/1316-172-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1316-183-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1524-158-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1524-193-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1524-152-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1524-156-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1524-151-0x0000000000000000-mapping.dmp
-
memory/1524-181-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1528-175-0x0000000000000000-mapping.dmp
-
memory/2068-185-0x0000000000000000-mapping.dmp
-
memory/2068-191-0x0000000030670000-0x00000000306C3000-memory.dmpFilesize
332KB
-
memory/2068-192-0x00000000000F3000-0x0000000000129000-memory.dmpFilesize
216KB
-
memory/2068-194-0x00000000000F3000-0x0000000000129000-memory.dmpFilesize
216KB
-
memory/2112-188-0x0000000000000000-mapping.dmp
-
memory/2400-207-0x0000000000000000-mapping.dmp
-
memory/2836-155-0x0000000000000000-mapping.dmp
-
memory/2836-157-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2836-161-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2836-162-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2836-182-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/3716-203-0x0000000000CA0000-0x0000000000CBD000-memory.dmpFilesize
116KB
-
memory/3716-199-0x0000000000000000-mapping.dmp
-
memory/3716-201-0x0000000000400000-0x0000000000B19000-memory.dmpFilesize
7.1MB
-
memory/3716-209-0x0000000000400000-0x0000000000B19000-memory.dmpFilesize
7.1MB
-
memory/3716-210-0x0000000000CA0000-0x0000000000CBD000-memory.dmpFilesize
116KB
-
memory/3848-198-0x0000000000400000-0x0000000000B19000-memory.dmpFilesize
7.1MB
-
memory/3848-195-0x0000000000000000-mapping.dmp
-
memory/3848-206-0x0000000000400000-0x0000000000B19000-memory.dmpFilesize
7.1MB
-
memory/4420-208-0x0000000000000000-mapping.dmp
-
memory/4840-150-0x0000000000000000-mapping.dmp
-
memory/4860-134-0x0000000000000000-mapping.dmp
-
memory/4916-149-0x0000000000000000-mapping.dmp