Analysis
-
max time kernel
282s -
max time network
309s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
09-10-2023 04:51
Static task
static1
Behavioral task
behavioral1
Sample
70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe
Resource
win7-20230831-en
General
-
Target
70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe
-
Size
15.7MB
-
MD5
3141032e3b1e4f3ee0d0a1fe68ccc6e8
-
SHA1
37adc7f63e2c38b2ad803c49d2782be701da9b56
-
SHA256
70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d
-
SHA512
d063301b2c07d8722594dd2eec9fbcb100385bcaac9843c5f329537845888803c3a6ae68ac33983b9ea429bb15d74b43a189ef4bc359c80dbb19e46ae938f0e5
-
SSDEEP
393216:g8EDE090yXtcYODN8EDE090yXtcYODCef/GyF3ibKL4BCXtU/PS:gjg09jtcYyjg09jtcYyxFSbi4StU6
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
Glupteba payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2720-52-0x0000000004480000-0x0000000004D6B000-memory.dmp family_glupteba behavioral1/memory/2720-69-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2720-124-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2308-128-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2308-134-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2308-141-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2720-150-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1108-170-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1596-172-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1108-175-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1596-176-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1108-196-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/1596-198-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2836-208-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2836-237-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2268-240-0x0000000000A60000-0x0000000000C51000-memory.dmp family_glupteba behavioral1/memory/2836-311-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2836-317-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2836-325-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2836-332-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba behavioral1/memory/2836-339-0x0000000000400000-0x0000000002675000-memory.dmp family_glupteba -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
Processes:
latestX.exeupdater.exedescription pid process target process PID 1540 created 1216 1540 latestX.exe Explorer.EXE PID 1540 created 1216 1540 latestX.exe Explorer.EXE PID 1540 created 1216 1540 latestX.exe Explorer.EXE PID 1540 created 1216 1540 latestX.exe Explorer.EXE PID 1540 created 1216 1540 latestX.exe Explorer.EXE PID 664 created 1216 664 updater.exe Explorer.EXE PID 664 created 1216 664 updater.exe Explorer.EXE PID 664 created 1216 664 updater.exe Explorer.EXE PID 664 created 1216 664 updater.exe Explorer.EXE PID 664 created 1216 664 updater.exe Explorer.EXE PID 664 created 1216 664 updater.exe Explorer.EXE -
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exee0cbefcb1af40c7d4aff4aca26621a98.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\e0cbefcb1af40c7d4aff4aca26621a98.exe = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Modifies boot configuration data using bcdedit 14 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 1532 bcdedit.exe 1376 bcdedit.exe 1804 bcdedit.exe 2720 bcdedit.exe 1864 bcdedit.exe 2052 bcdedit.exe 2980 bcdedit.exe 1720 bcdedit.exe 984 bcdedit.exe 1236 bcdedit.exe 2112 bcdedit.exe 2020 bcdedit.exe 1116 bcdedit.exe 1608 bcdedit.exe -
Drops file in Drivers directory 3 IoCs
Processes:
latestX.exeupdater.execsrss.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts latestX.exe File created C:\Windows\System32\drivers\etc\hosts updater.exe File created C:\Windows\system32\drivers\Winmon.sys csrss.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 21 IoCs
Processes:
toolspub2.exee0cbefcb1af40c7d4aff4aca26621a98.exekos1.exelatestX.exetoolspub2.exeset16.exe31839b57a4f11171d6abc8bbc4451ee4.exekos.exeis-5TRH7.tmppreviewer.exe31839b57a4f11171d6abc8bbc4451ee4.exee0cbefcb1af40c7d4aff4aca26621a98.exepreviewer.execsrss.exepatch.exeinjector.exeupdater.exedsefix.exewindefender.exewindefender.exef801950a962ddba14caaa44bf084b55c.exepid process 2376 toolspub2.exe 2720 e0cbefcb1af40c7d4aff4aca26621a98.exe 2732 kos1.exe 1540 latestX.exe 2556 toolspub2.exe 3060 set16.exe 2308 31839b57a4f11171d6abc8bbc4451ee4.exe 2788 kos.exe 2464 is-5TRH7.tmp 2068 previewer.exe 1108 31839b57a4f11171d6abc8bbc4451ee4.exe 1596 e0cbefcb1af40c7d4aff4aca26621a98.exe 2268 previewer.exe 2836 csrss.exe 2280 patch.exe 2796 injector.exe 664 updater.exe 1332 dsefix.exe 1564 windefender.exe 1952 windefender.exe 3004 f801950a962ddba14caaa44bf084b55c.exe -
Loads dropped DLL 41 IoCs
Processes:
70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exetoolspub2.exekos1.exeset16.exeis-5TRH7.tmppreviewer.exepreviewer.exe31839b57a4f11171d6abc8bbc4451ee4.execsrss.exepatch.exetaskeng.exepid process 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 2376 toolspub2.exe 2732 kos1.exe 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 3060 set16.exe 3060 set16.exe 3060 set16.exe 2732 kos1.exe 3060 set16.exe 2464 is-5TRH7.tmp 2464 is-5TRH7.tmp 2464 is-5TRH7.tmp 2464 is-5TRH7.tmp 2464 is-5TRH7.tmp 2068 previewer.exe 2068 previewer.exe 2464 is-5TRH7.tmp 2268 previewer.exe 2268 previewer.exe 1108 31839b57a4f11171d6abc8bbc4451ee4.exe 1108 31839b57a4f11171d6abc8bbc4451ee4.exe 844 2836 csrss.exe 2280 patch.exe 2280 patch.exe 2280 patch.exe 2280 patch.exe 2280 patch.exe 2612 taskeng.exe 2280 patch.exe 2280 patch.exe 2280 patch.exe 2836 csrss.exe 2836 csrss.exe 2836 csrss.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe upx -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 51.159.66.125 -
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exee0cbefcb1af40c7d4aff4aca26621a98.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\e0cbefcb1af40c7d4aff4aca26621a98.exe = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
csrss.exe31839b57a4f11171d6abc8bbc4451ee4.exee0cbefcb1af40c7d4aff4aca26621a98.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" e0cbefcb1af40c7d4aff4aca26621a98.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMon csrss.exe -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
updater.exedescription pid process target process PID 2376 set thread context of 2556 2376 toolspub2.exe PID 664 set thread context of 2260 664 updater.exe conhost.exe PID 664 set thread context of 872 664 updater.exe explorer.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exee0cbefcb1af40c7d4aff4aca26621a98.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe File opened (read-only) \??\VBoxMiniRdrDN e0cbefcb1af40c7d4aff4aca26621a98.exe -
Drops file in Program Files directory 9 IoCs
Processes:
is-5TRH7.tmplatestX.exeupdater.exedescription ioc process File created C:\Program Files (x86)\PA Previewer\unins000.dat is-5TRH7.tmp File created C:\Program Files\Google\Chrome\updater.exe latestX.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files (x86)\PA Previewer\is-RKGG6.tmp is-5TRH7.tmp File created C:\Program Files (x86)\PA Previewer\is-CFRGJ.tmp is-5TRH7.tmp File created C:\Program Files (x86)\PA Previewer\is-FLIPS.tmp is-5TRH7.tmp File created C:\Program Files (x86)\PA Previewer\is-5IGCG.tmp is-5TRH7.tmp File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat is-5TRH7.tmp File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe is-5TRH7.tmp -
Drops file in Windows directory 7 IoCs
Processes:
csrss.exemakecab.exe31839b57a4f11171d6abc8bbc4451ee4.exee0cbefcb1af40c7d4aff4aca26621a98.exedescription ioc process File opened for modification C:\Windows\windefender.exe csrss.exe File created C:\Windows\Logs\CBS\CbsPersist_20231009045133.cab makecab.exe File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe File opened for modification C:\Windows\rss e0cbefcb1af40c7d4aff4aca26621a98.exe File created C:\Windows\rss\csrss.exe e0cbefcb1af40c7d4aff4aca26621a98.exe File created C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2752 sc.exe 2800 sc.exe 2604 sc.exe 2624 sc.exe 2520 sc.exe 2904 sc.exe 1640 sc.exe 2916 sc.exe 2532 sc.exe 2872 sc.exe 1768 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspub2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2028 schtasks.exe 2960 schtasks.exe 1560 schtasks.exe 1652 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exe31839b57a4f11171d6abc8bbc4451ee4.exenetsh.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-472 = "Ekaterinburg Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-551 = "North Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-21 = "Cape Verde Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-521 = "N. Central Asia Daylight Time" windefender.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-522 = "N. Central Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-581 = "North Asia East Daylight Time" windefender.exe -
Processes:
csrss.exepatch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
toolspub2.exeExplorer.EXEpid process 2556 toolspub2.exe 2556 toolspub2.exe 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 464 464 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
toolspub2.exepid process 2556 toolspub2.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
Explorer.EXEpreviewer.exekos.exe31839b57a4f11171d6abc8bbc4451ee4.exee0cbefcb1af40c7d4aff4aca26621a98.exepreviewer.exepowershell.execsrss.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exeupdater.exeexplorer.exesc.exedescription pid process Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeDebugPrivilege 2068 previewer.exe Token: SeDebugPrivilege 2788 kos.exe Token: SeDebugPrivilege 2308 31839b57a4f11171d6abc8bbc4451ee4.exe Token: SeImpersonatePrivilege 2308 31839b57a4f11171d6abc8bbc4451ee4.exe Token: SeDebugPrivilege 2720 e0cbefcb1af40c7d4aff4aca26621a98.exe Token: SeImpersonatePrivilege 2720 e0cbefcb1af40c7d4aff4aca26621a98.exe Token: SeDebugPrivilege 2268 previewer.exe Token: SeDebugPrivilege 2024 powershell.exe Token: SeSystemEnvironmentPrivilege 2836 csrss.exe Token: SeShutdownPrivilege 2424 powercfg.exe Token: SeDebugPrivilege 2104 powershell.exe Token: SeShutdownPrivilege 580 powercfg.exe Token: SeShutdownPrivilege 2760 powercfg.exe Token: SeShutdownPrivilege 2368 powercfg.exe Token: SeDebugPrivilege 1756 powershell.exe Token: SeShutdownPrivilege 1028 powercfg.exe Token: SeDebugPrivilege 2692 powershell.exe Token: SeShutdownPrivilege 2872 powercfg.exe Token: SeShutdownPrivilege 2752 powercfg.exe Token: SeShutdownPrivilege 2764 powercfg.exe Token: SeDebugPrivilege 664 updater.exe Token: SeLockMemoryPrivilege 872 explorer.exe Token: SeSecurityPrivilege 2532 sc.exe Token: SeSecurityPrivilege 2532 sc.exe Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 1216 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exetoolspub2.exekos1.exeset16.exeis-5TRH7.tmpnet.exedescription pid process target process PID 1924 wrote to memory of 2376 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe toolspub2.exe PID 1924 wrote to memory of 2376 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe toolspub2.exe PID 1924 wrote to memory of 2376 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe toolspub2.exe PID 1924 wrote to memory of 2376 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe toolspub2.exe PID 1924 wrote to memory of 2720 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe e0cbefcb1af40c7d4aff4aca26621a98.exe PID 1924 wrote to memory of 2720 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe e0cbefcb1af40c7d4aff4aca26621a98.exe PID 1924 wrote to memory of 2720 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe e0cbefcb1af40c7d4aff4aca26621a98.exe PID 1924 wrote to memory of 2720 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe e0cbefcb1af40c7d4aff4aca26621a98.exe PID 1924 wrote to memory of 2732 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe kos1.exe PID 1924 wrote to memory of 2732 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe kos1.exe PID 1924 wrote to memory of 2732 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe kos1.exe PID 1924 wrote to memory of 2732 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe kos1.exe PID 1924 wrote to memory of 1540 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe latestX.exe PID 1924 wrote to memory of 1540 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe latestX.exe PID 1924 wrote to memory of 1540 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe latestX.exe PID 1924 wrote to memory of 1540 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe latestX.exe PID 2376 wrote to memory of 2556 2376 toolspub2.exe toolspub2.exe PID 2376 wrote to memory of 2556 2376 toolspub2.exe toolspub2.exe PID 2376 wrote to memory of 2556 2376 toolspub2.exe toolspub2.exe PID 2376 wrote to memory of 2556 2376 toolspub2.exe toolspub2.exe PID 2376 wrote to memory of 2556 2376 toolspub2.exe PID 2376 wrote to memory of 2556 2376 toolspub2.exe PID 2376 wrote to memory of 2556 2376 toolspub2.exe PID 1924 wrote to memory of 2308 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 1924 wrote to memory of 2308 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 1924 wrote to memory of 2308 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 1924 wrote to memory of 2308 1924 70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 2732 wrote to memory of 3060 2732 kos1.exe set16.exe PID 2732 wrote to memory of 3060 2732 kos1.exe set16.exe PID 2732 wrote to memory of 3060 2732 kos1.exe set16.exe PID 2732 wrote to memory of 3060 2732 kos1.exe set16.exe PID 2732 wrote to memory of 3060 2732 kos1.exe set16.exe PID 2732 wrote to memory of 3060 2732 kos1.exe set16.exe PID 2732 wrote to memory of 3060 2732 kos1.exe set16.exe PID 2732 wrote to memory of 2788 2732 kos1.exe kos.exe PID 2732 wrote to memory of 2788 2732 kos1.exe kos.exe PID 2732 wrote to memory of 2788 2732 kos1.exe kos.exe PID 2732 wrote to memory of 2788 2732 kos1.exe kos.exe PID 3060 wrote to memory of 2464 3060 set16.exe is-5TRH7.tmp PID 3060 wrote to memory of 2464 3060 set16.exe is-5TRH7.tmp PID 3060 wrote to memory of 2464 3060 set16.exe is-5TRH7.tmp PID 3060 wrote to memory of 2464 3060 set16.exe is-5TRH7.tmp PID 3060 wrote to memory of 2464 3060 set16.exe is-5TRH7.tmp PID 3060 wrote to memory of 2464 3060 set16.exe is-5TRH7.tmp PID 3060 wrote to memory of 2464 3060 set16.exe is-5TRH7.tmp PID 2464 wrote to memory of 1652 2464 is-5TRH7.tmp net.exe PID 2464 wrote to memory of 1652 2464 is-5TRH7.tmp net.exe PID 2464 wrote to memory of 1652 2464 is-5TRH7.tmp net.exe PID 2464 wrote to memory of 1652 2464 is-5TRH7.tmp net.exe PID 2464 wrote to memory of 1652 2464 is-5TRH7.tmp net.exe PID 2464 wrote to memory of 1652 2464 is-5TRH7.tmp net.exe PID 2464 wrote to memory of 1652 2464 is-5TRH7.tmp net.exe PID 2464 wrote to memory of 2068 2464 is-5TRH7.tmp previewer.exe PID 2464 wrote to memory of 2068 2464 is-5TRH7.tmp previewer.exe PID 2464 wrote to memory of 2068 2464 is-5TRH7.tmp previewer.exe PID 2464 wrote to memory of 2068 2464 is-5TRH7.tmp previewer.exe PID 2464 wrote to memory of 2068 2464 is-5TRH7.tmp previewer.exe PID 2464 wrote to memory of 2068 2464 is-5TRH7.tmp previewer.exe PID 2464 wrote to memory of 2068 2464 is-5TRH7.tmp previewer.exe PID 1652 wrote to memory of 2120 1652 net.exe net1.exe PID 1652 wrote to memory of 2120 1652 net.exe net1.exe PID 1652 wrote to memory of 2120 1652 net.exe net1.exe PID 1652 wrote to memory of 2120 1652 net.exe net1.exe PID 1652 wrote to memory of 2120 1652 net.exe net1.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe"C:\Users\Admin\AppData\Local\Temp\70af1a1c350554270883747e70ff85910cb2cc2c02d3ec133b4457100a05694d.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\Temp\kos1.exe"C:\Users\Admin\AppData\Local\Temp\kos1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\set16.exe"C:\Users\Admin\AppData\Local\Temp\set16.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6E722.tmp\is-5TRH7.tmp"C:\Users\Admin\AppData\Local\Temp\is-6E722.tmp\is-5TRH7.tmp" /SL4 $90150 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 522245⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 86⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 87⤵
-
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -i6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -s6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\kos.exe"C:\Users\Admin\AppData\Local\Temp\kos.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Manipulates WinMon driver.
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 07⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 17⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 07⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}7⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v6⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe6⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe6⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn "csrss" /f7⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn "ScheduledUpdate" /f7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231009045133.log C:\Windows\Logs\CBS\CbsPersist_20231009045133.cab1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {ED9899FA-FA87-4D6D-8871-FB14A2CB2CF7} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Loads dropped DLL
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
4Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
C:\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
C:\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
C:\Program Files\Google\Chrome\updater.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Program Files\Google\Chrome\updater.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Users\Admin\AppData\Local\Temp\Cab2010.tmpFilesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.errorFilesize
8.3MB
MD5fd2727132edd0b59fa33733daa11d9ef
SHA163e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA2563a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA5123e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e
-
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.errorFilesize
395KB
MD55da3a881ef991e8010deed799f1a5aaf
SHA1fea1acea7ed96d7c9788783781e90a2ea48c1a53
SHA256f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4
SHA51224fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09
-
C:\Users\Admin\AppData\Local\Temp\Tar20CF.tmpFilesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeFilesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.2MB
MD54c05c54dd3007dced398eb41ab68992f
SHA11a737edff587c6acc830c8897ccf6128c718530c
SHA2567a0417d7440e50f8156d6487b9e58fd1c5cb55eafe6e2dc95ab1627f7b099e6a
SHA51271c1ebd7b0e6038fda5d970af409bf1a00171c44ade366482226348907e335abbd32c4daa89b0e3407f272e0302a9c0900120aec5ff57041fc26c91951815ca0
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.2MB
MD54c05c54dd3007dced398eb41ab68992f
SHA11a737edff587c6acc830c8897ccf6128c718530c
SHA2567a0417d7440e50f8156d6487b9e58fd1c5cb55eafe6e2dc95ab1627f7b099e6a
SHA51271c1ebd7b0e6038fda5d970af409bf1a00171c44ade366482226348907e335abbd32c4daa89b0e3407f272e0302a9c0900120aec5ff57041fc26c91951815ca0
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.2MB
MD54c05c54dd3007dced398eb41ab68992f
SHA11a737edff587c6acc830c8897ccf6128c718530c
SHA2567a0417d7440e50f8156d6487b9e58fd1c5cb55eafe6e2dc95ab1627f7b099e6a
SHA51271c1ebd7b0e6038fda5d970af409bf1a00171c44ade366482226348907e335abbd32c4daa89b0e3407f272e0302a9c0900120aec5ff57041fc26c91951815ca0
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.2MB
MD54c05c54dd3007dced398eb41ab68992f
SHA11a737edff587c6acc830c8897ccf6128c718530c
SHA2567a0417d7440e50f8156d6487b9e58fd1c5cb55eafe6e2dc95ab1627f7b099e6a
SHA51271c1ebd7b0e6038fda5d970af409bf1a00171c44ade366482226348907e335abbd32c4daa89b0e3407f272e0302a9c0900120aec5ff57041fc26c91951815ca0
-
C:\Users\Admin\AppData\Local\Temp\is-6E722.tmp\is-5TRH7.tmpFilesize
647KB
MD52fba5642cbcaa6857c3995ccb5d2ee2a
SHA191fe8cd860cba7551fbf78bc77cc34e34956e8cc
SHA256ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa
SHA51230613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c
-
C:\Users\Admin\AppData\Local\Temp\is-6E722.tmp\is-5TRH7.tmpFilesize
647KB
MD52fba5642cbcaa6857c3995ccb5d2ee2a
SHA191fe8cd860cba7551fbf78bc77cc34e34956e8cc
SHA256ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa
SHA51230613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c
-
C:\Users\Admin\AppData\Local\Temp\kos.exeFilesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
C:\Users\Admin\AppData\Local\Temp\kos.exeFilesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
C:\Users\Admin\AppData\Local\Temp\kos1.exeFilesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
C:\Users\Admin\AppData\Local\Temp\kos1.exeFilesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
C:\Users\Admin\AppData\Local\Temp\osloader.exeFilesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
C:\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
C:\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4SFO1XP6KZYDPXH5JXOJ.tempFilesize
7KB
MD517de8464325f1632f59de3d1d0b12fca
SHA15d97d30b96822c2f06449cc27943907e29e3d57a
SHA256dbf763e72742c370d7ea39b6322fae18ebee85951288400ff0bfd9b6a4dd95ca
SHA51292b83840a4cdc171f47a9579a869e027d811caca67f0c0b6d945b2a23c63a3e19d71ffada02f91b17c9e4765d48f955fe97f695e7c08fc4db7c46fff43bba94e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5eb9ee7e16f20c4f0434c37fc013999be
SHA1e5461e1c6773d57fa6f9ffca5d3816a94601d977
SHA256e86f795b8eb1b290c0e5554cf823d60d86318ba8f6ede2e1be1b26d87736e604
SHA5129eea4fe74aaa34a3e3f643913b1f25d2464e677bd32094136574fea9c08cba3d5b6bca03b70f5348ec4414c0546068e9e85088929b5c80ba21dc7da18d8e894b
-
C:\Windows\System32\drivers\etc\hostsFilesize
2KB
MD53e9af076957c5b2f9c9ce5ec994bea05
SHA1a8c7326f6bceffaeed1c2bb8d7165e56497965fe
SHA256e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e
SHA512933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
\Program Files (x86)\PA Previewer\previewer.exeFilesize
1.9MB
MD527b85a95804a760da4dbee7ca800c9b4
SHA1f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7
-
\Program Files\Google\Chrome\updater.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
\Users\Admin\AppData\Local\Temp\dbghelp.dllFilesize
1.5MB
MD5f0616fa8bc54ece07e3107057f74e4db
SHA1b33995c4f9a004b7d806c4bb36040ee844781fca
SHA2566e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026
SHA51215242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c
-
\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.2MB
MD54c05c54dd3007dced398eb41ab68992f
SHA11a737edff587c6acc830c8897ccf6128c718530c
SHA2567a0417d7440e50f8156d6487b9e58fd1c5cb55eafe6e2dc95ab1627f7b099e6a
SHA51271c1ebd7b0e6038fda5d970af409bf1a00171c44ade366482226348907e335abbd32c4daa89b0e3407f272e0302a9c0900120aec5ff57041fc26c91951815ca0
-
\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.2MB
MD54c05c54dd3007dced398eb41ab68992f
SHA11a737edff587c6acc830c8897ccf6128c718530c
SHA2567a0417d7440e50f8156d6487b9e58fd1c5cb55eafe6e2dc95ab1627f7b099e6a
SHA51271c1ebd7b0e6038fda5d970af409bf1a00171c44ade366482226348907e335abbd32c4daa89b0e3407f272e0302a9c0900120aec5ff57041fc26c91951815ca0
-
\Users\Admin\AppData\Local\Temp\is-6E722.tmp\is-5TRH7.tmpFilesize
647KB
MD52fba5642cbcaa6857c3995ccb5d2ee2a
SHA191fe8cd860cba7551fbf78bc77cc34e34956e8cc
SHA256ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa
SHA51230613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c
-
\Users\Admin\AppData\Local\Temp\is-F7KCI.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-F7KCI.tmp\_isetup\_isdecmp.dllFilesize
32KB
MD5b4786eb1e1a93633ad1b4c112514c893
SHA1734750b771d0809c88508e4feb788d7701e6dada
SHA2562ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f
SHA5120882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6
-
\Users\Admin\AppData\Local\Temp\is-F7KCI.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-F7KCI.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\kos.exeFilesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
\Users\Admin\AppData\Local\Temp\kos1.exeFilesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
\Users\Admin\AppData\Local\Temp\symsrv.dllFilesize
163KB
MD55c399d34d8dc01741269ff1f1aca7554
SHA1e0ceed500d3cef5558f3f55d33ba9c3a709e8f55
SHA256e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
SHA5128ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d
-
\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
292KB
MD539baa178f1fc5ec2111eb95008ee6e38
SHA18a36b6d95d6453e9eed8df12eaed71580384f2a3
SHA2560990c73e4389e3b912fff43e2ed3363e9f9af367741fc285b3aa5168b5646c74
SHA5123b50e27da905b4c8cd8a5dcc7c4c37015d1c1bc3187f1572d3bea7caffdd278a00f73844024cc04d06f47374425fc4c7cbfa4752678f9f40269d2979369b2d74
-
\Windows\rss\csrss.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
\Windows\rss\csrss.exeFilesize
4.2MB
MD5906e8dd59115761a98c0308313a2ad3b
SHA1b2f9debeea9624b2e64e8062bf40382318cc42bd
SHA25656d6788b4b40af4a7c0329a9d91b1b4407beef8bd9395ef852851f53a3d36dcf
SHA51218cbbddc8e85acb236cd15c122adaa9537efc18216c394ba368ab0e391afe40b3dd6130dc1c60bb812da616f37897725c0ea6a695a93e9b25eb665f82bca870e
-
memory/664-337-0x000000013F580000-0x000000013FB21000-memory.dmpFilesize
5.6MB
-
memory/1108-149-0x00000000041A0000-0x0000000004598000-memory.dmpFilesize
4.0MB
-
memory/1108-170-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1108-168-0x00000000041A0000-0x0000000004598000-memory.dmpFilesize
4.0MB
-
memory/1108-175-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1108-196-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1216-107-0x0000000002AD0000-0x0000000002AE6000-memory.dmpFilesize
88KB
-
memory/1540-323-0x000000013F970000-0x000000013FF11000-memory.dmpFilesize
5.6MB
-
memory/1540-212-0x000000013F970000-0x000000013FF11000-memory.dmpFilesize
5.6MB
-
memory/1540-308-0x000000013F970000-0x000000013FF11000-memory.dmpFilesize
5.6MB
-
memory/1540-125-0x000000013F970000-0x000000013FF11000-memory.dmpFilesize
5.6MB
-
memory/1596-148-0x0000000003EC0000-0x00000000042B8000-memory.dmpFilesize
4.0MB
-
memory/1596-172-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1596-198-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1596-176-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/1596-171-0x0000000003EC0000-0x00000000042B8000-memory.dmpFilesize
4.0MB
-
memory/1756-349-0x000007FEEE800000-0x000007FEEF19D000-memory.dmpFilesize
9.6MB
-
memory/1756-348-0x0000000000940000-0x0000000000948000-memory.dmpFilesize
32KB
-
memory/1756-350-0x000007FEEE800000-0x000007FEEF19D000-memory.dmpFilesize
9.6MB
-
memory/1756-351-0x0000000001110000-0x0000000001190000-memory.dmpFilesize
512KB
-
memory/1924-62-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/1924-0-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/1924-1-0x0000000001020000-0x0000000001FD8000-memory.dmpFilesize
15.7MB
-
memory/2024-206-0x0000000002210000-0x0000000002290000-memory.dmpFilesize
512KB
-
memory/2024-204-0x000007FEEF330000-0x000007FEEFCCD000-memory.dmpFilesize
9.6MB
-
memory/2024-202-0x000007FEEF330000-0x000007FEEFCCD000-memory.dmpFilesize
9.6MB
-
memory/2024-201-0x0000000002214000-0x0000000002217000-memory.dmpFilesize
12KB
-
memory/2024-186-0x000000001B2B0000-0x000000001B592000-memory.dmpFilesize
2.9MB
-
memory/2024-200-0x000000000221B000-0x0000000002282000-memory.dmpFilesize
412KB
-
memory/2024-188-0x00000000022E0000-0x00000000022E8000-memory.dmpFilesize
32KB
-
memory/2024-316-0x0000000002210000-0x0000000002290000-memory.dmpFilesize
512KB
-
memory/2068-127-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2068-139-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2068-136-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2068-135-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2068-129-0x0000000000D50000-0x0000000000F41000-memory.dmpFilesize
1.9MB
-
memory/2068-130-0x0000000000D50000-0x0000000000F41000-memory.dmpFilesize
1.9MB
-
memory/2104-253-0x000007FEEF1A0000-0x000007FEEFB3D000-memory.dmpFilesize
9.6MB
-
memory/2104-249-0x000000001B200000-0x000000001B4E2000-memory.dmpFilesize
2.9MB
-
memory/2104-319-0x000007FEEF1A0000-0x000007FEEFB3D000-memory.dmpFilesize
9.6MB
-
memory/2104-312-0x00000000027C0000-0x0000000002840000-memory.dmpFilesize
512KB
-
memory/2104-251-0x000007FEEF1A0000-0x000007FEEFB3D000-memory.dmpFilesize
9.6MB
-
memory/2104-315-0x00000000027C0000-0x0000000002840000-memory.dmpFilesize
512KB
-
memory/2104-313-0x00000000027C0000-0x0000000002840000-memory.dmpFilesize
512KB
-
memory/2104-250-0x0000000002260000-0x0000000002268000-memory.dmpFilesize
32KB
-
memory/2104-252-0x00000000027C0000-0x0000000002840000-memory.dmpFilesize
512KB
-
memory/2268-329-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2268-314-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2268-341-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2268-153-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2268-239-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2268-166-0x0000000000A60000-0x0000000000C51000-memory.dmpFilesize
1.9MB
-
memory/2268-240-0x0000000000A60000-0x0000000000C51000-memory.dmpFilesize
1.9MB
-
memory/2268-241-0x0000000000A60000-0x0000000000C51000-memory.dmpFilesize
1.9MB
-
memory/2268-167-0x0000000000A60000-0x0000000000C51000-memory.dmpFilesize
1.9MB
-
memory/2268-177-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2268-336-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2268-242-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2280-234-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2280-215-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2308-83-0x0000000004000000-0x00000000043F8000-memory.dmpFilesize
4.0MB
-
memory/2308-134-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2308-141-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2308-132-0x0000000004000000-0x00000000043F8000-memory.dmpFilesize
4.0MB
-
memory/2308-128-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2376-46-0x0000000002370000-0x0000000002470000-memory.dmpFilesize
1024KB
-
memory/2376-48-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2464-152-0x0000000003860000-0x0000000003A51000-memory.dmpFilesize
1.9MB
-
memory/2464-179-0x0000000003860000-0x0000000003A51000-memory.dmpFilesize
1.9MB
-
memory/2464-238-0x0000000003860000-0x0000000003A51000-memory.dmpFilesize
1.9MB
-
memory/2464-126-0x0000000003860000-0x0000000003A51000-memory.dmpFilesize
1.9MB
-
memory/2464-138-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2556-49-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2556-45-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2556-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2556-108-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2720-44-0x0000000004080000-0x0000000004478000-memory.dmpFilesize
4.0MB
-
memory/2720-150-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2720-52-0x0000000004480000-0x0000000004D6B000-memory.dmpFilesize
8.9MB
-
memory/2720-29-0x0000000004080000-0x0000000004478000-memory.dmpFilesize
4.0MB
-
memory/2720-69-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2720-124-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2732-30-0x0000000001170000-0x00000000012E4000-memory.dmpFilesize
1.5MB
-
memory/2732-87-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/2732-31-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/2788-123-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmpFilesize
9.9MB
-
memory/2788-180-0x000000001A7C0000-0x000000001A840000-memory.dmpFilesize
512KB
-
memory/2788-173-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmpFilesize
9.9MB
-
memory/2788-131-0x000000001A7C0000-0x000000001A840000-memory.dmpFilesize
512KB
-
memory/2788-92-0x0000000000180000-0x0000000000188000-memory.dmpFilesize
32KB
-
memory/2836-339-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2836-325-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2836-237-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2836-317-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2836-332-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2836-208-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2836-197-0x0000000003ED0000-0x00000000042C8000-memory.dmpFilesize
4.0MB
-
memory/2836-311-0x0000000000400000-0x0000000002675000-memory.dmpFilesize
34.5MB
-
memory/2836-207-0x0000000003ED0000-0x00000000042C8000-memory.dmpFilesize
4.0MB
-
memory/3060-80-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3060-67-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB