Malware Analysis Report

2025-08-11 01:36

Sample ID 231206-3dd2vsgbdm
Target 4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c
SHA256 4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c
Tags
upx vmprotect
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c

Threat Level: Known bad

The file 4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c was found to be: Known bad.

Malicious Activity Summary

upx vmprotect

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops file in Drivers directory

Checks computer location settings

Unexpected DNS network traffic destination

UPX packed file

Executes dropped EXE

VMProtect packed file

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Delays execution with timeout.exe

Modifies data under HKEY_USERS

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

Checks SCSI registry key(s)

Suspicious use of UnmapMainImage

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-06 23:23

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-06 23:23

Reported

2023-12-06 23:26

Platform

win7-20231130-en

Max time kernel

140s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe

"C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 f9b03f5bc3f119f2.vbnm34567.xyz udp
US 114.114.114.114:53 down.nugong.asia udp
CN 118.212.235.102:443 down.nugong.asia tcp
CN 118.212.235.102:443 down.nugong.asia tcp
US 8.8.8.8:53 dns.alidns.com udp
CN 223.5.5.5:443 dns.alidns.com tcp
US 8.8.8.8:53 www.microsoft.com udp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 58.144.226.248:443 down.nugong.asia tcp
CN 58.144.226.248:443 down.nugong.asia tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 1.62.64.108:443 down.nugong.asia tcp

Files

memory/856-0-0x0000000000A50000-0x0000000000ABE000-memory.dmp

memory/856-1-0x0000000000A50000-0x0000000000ABE000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarB936.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

memory/856-45-0x0000000000A50000-0x0000000000ABE000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 25a9df52787bf0b967392547dc950ce6
SHA1 399eaf592e7ab8625b7bb9932a22ab8869f75f4e
SHA256 2bc27e399afbc2120cd4f1293ef521b99e70879c54d14a95e8304b1a085848f0
SHA512 2a8e79651067e1837c5047c9a6f3e4ab6f5762b117ae65335130ef665ac144b735c842df062b83028143340390ae45eea544b12816e1f6f86a38ad92f6e62621

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

memory/856-133-0x0000000000A50000-0x0000000000ABE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-06 23:23

Reported

2023-12-06 23:26

Platform

win10v2004-20231127-en

Max time kernel

150s

Max time network

149s

Command Line

winlogon.exe

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3380 created 620 N/A C:\Windows\Explorer.EXE C:\Windows\system32\winlogon.exe

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\pxs0YzD1Vj2ML.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\drivers\3gOPRn0Xw8hS1.bcz C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\drivers\A0Gdl2lErgx.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\drivers\yVOnk0jR5IF.jyw C:\Windows\sdchange.exe N/A
File created C:\Windows\System32\drivers\VOh6a6.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\drivers\Rc36LdYvcnmkX.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\drivers\ziIgmRGTDrCieo.jze C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\drivers\9xlhSZVZnAP.nab C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\drivers\3xH2PSnzWIE.sys C:\Windows\sdchange.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\sdchange.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 114.114.114.114 N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\W5zCsgqlngcK.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\xmdkViJFTUB6Kl.zbl C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\1bQ5HKfXg8.qfd C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\hdZau05NFvK.syz C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\3iYtN0J4tjc.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475 C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\JswYo166c0dWw.dqm C:\Windows\sdchange.exe N/A
File created C:\Windows\system32\ \Windows\System32\FtD7s4.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\xdqQwbhOqk.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D440AC65793A7BBE167BE882B99F465E C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D440AC65793A7BBE167BE882B99F465E C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475 C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\system32\aqPnu4oZpmC.sys C:\Windows\sdchange.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\685kCuRzPh8dR.ihu C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files (x86)\i9KKAKDYVK.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\Windows Multimedia Platform\47b78981.html C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files (x86)\JX3WueR66f.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\sIL7v5u8Crs.tqx C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\Microsoft Office\manifest.json C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\xRCM7N0n1vi.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\Windows Multimedia Platform\manifest.json C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\Windows Multimedia Platform\395fa134.js C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\Microsoft Office\395fa3a4.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\Microsoft Office\560f7576.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\YuyeuBiLjb7X.eps C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\Windows Multimedia Platform\560f71ce.js C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\Microsoft Office\lib\64675e5f.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\SMQZreD2wVIoK.tgo C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\kfSSTKGLjp.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\7hMGnLoD4Mw.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\StyuPRR61n0Xs.vvj C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files (x86)\J6tsc9pTOiXh.oby C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files (x86)\0lYeGcaZJ8pa.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\Microsoft Office\47b78c8d.html C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\ZxhT9wbbJLT80.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\lpGtw5q0YDU.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\LcG2R4JOhhh.fxo C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files (x86)\d9rx68l1YKRvD.ttc C:\Windows\sdchange.exe N/A
File opened for modification C:\Program Files\Windows Multimedia Platform\lib\64675a1b.js C:\Windows\sdchange.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\wJzoTrND6pr7v8.smz C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\n3SZnMg44H4k.sys C:\Windows\sdchange.exe N/A
File created C:\Windows\XzUiDfJ.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\Mm4xg8LU9AUi0.zej C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\XnEokxfDcXH.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\WRUdpILD7Vj.jbq C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\7fdprvKyY3o.sys C:\Windows\sdchange.exe N/A
File opened for modification C:\Windows\5ZwCWpkziuT.bda C:\Windows\sdchange.exe N/A
File created C:\Windows\sdchange.exe C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\sdchange.exe C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\zvBJe5E3An6.sys C:\Windows\sdchange.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\sdchange.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\sdchange.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\sdchange.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\system32\wbadmin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\sdchange.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\sdchange.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\sdchange.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\sdchange.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\sdchange.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\sdchange.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\sdchange.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\sdchange.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\sdchange.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\system32\wbadmin.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\system32\wbadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A
N/A N/A C:\Windows\sdchange.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\sdchange.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\sdchange.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\sdchange.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\sdchange.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\sdchange.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\sdchange.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\sdchange.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\sdchange.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\sdchange.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\dwm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 376 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\Explorer.EXE
PID 376 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\Explorer.EXE
PID 376 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\Explorer.EXE
PID 376 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\Explorer.EXE
PID 376 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\Explorer.EXE
PID 3380 wrote to memory of 2500 N/A C:\Windows\Explorer.EXE C:\Windows\sdchange.exe
PID 3380 wrote to memory of 2500 N/A C:\Windows\Explorer.EXE C:\Windows\sdchange.exe
PID 3380 wrote to memory of 2500 N/A C:\Windows\Explorer.EXE C:\Windows\sdchange.exe
PID 3380 wrote to memory of 2500 N/A C:\Windows\Explorer.EXE C:\Windows\sdchange.exe
PID 3380 wrote to memory of 2500 N/A C:\Windows\Explorer.EXE C:\Windows\sdchange.exe
PID 3380 wrote to memory of 2500 N/A C:\Windows\Explorer.EXE C:\Windows\sdchange.exe
PID 3380 wrote to memory of 2500 N/A C:\Windows\Explorer.EXE C:\Windows\sdchange.exe
PID 376 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\system32\winlogon.exe
PID 376 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\system32\winlogon.exe
PID 376 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\system32\winlogon.exe
PID 376 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\system32\winlogon.exe
PID 376 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\system32\winlogon.exe
PID 376 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\SysWOW64\cmd.exe
PID 376 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 4708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2184 wrote to memory of 4708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2184 wrote to memory of 4708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2500 wrote to memory of 3580 N/A C:\Windows\sdchange.exe C:\Windows\system32\wbadmin.exe
PID 2500 wrote to memory of 3580 N/A C:\Windows\sdchange.exe C:\Windows\system32\wbadmin.exe
PID 2500 wrote to memory of 3580 N/A C:\Windows\sdchange.exe C:\Windows\system32\wbadmin.exe
PID 2500 wrote to memory of 3580 N/A C:\Windows\sdchange.exe C:\Windows\system32\wbadmin.exe
PID 2500 wrote to memory of 3580 N/A C:\Windows\sdchange.exe C:\Windows\system32\wbadmin.exe
PID 2500 wrote to memory of 3580 N/A C:\Windows\sdchange.exe C:\Windows\system32\wbadmin.exe
PID 2500 wrote to memory of 3580 N/A C:\Windows\sdchange.exe C:\Windows\system32\wbadmin.exe
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE
PID 2500 wrote to memory of 3380 N/A C:\Windows\sdchange.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe

"C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe"

C:\Windows\sdchange.exe

"C:\Windows\sdchange.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\4d8dc797e6ef160e1e41ca980981d27ca1823d78fd6345f7c29c02e5493fb47c.exe"

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

C:\Windows\system32\wbadmin.exe

"C:\Windows\system32\wbadmin.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 f9b03f5bc3f119f2.vbnm34567.xyz udp
US 114.114.114.114:53 down.nugong.asia udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 114.114.114.114.in-addr.arpa udp
CN 119.167.229.212:443 down.nugong.asia tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 226.173.246.72.in-addr.arpa udp
US 8.8.8.8:53 212.229.167.119.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
CN 119.167.229.212:80 down.nugong.asia tcp
US 8.8.8.8:53 apps.game.qq.com udp
CN 101.227.134.49:443 apps.game.qq.com tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
US 8.8.8.8:53 49.134.227.101.in-addr.arpa udp
NL 47.246.48.205:80 ocsp.digicert.cn tcp
CN 119.167.229.212:443 down.nugong.asia tcp
US 8.8.8.8:53 205.48.246.47.in-addr.arpa udp
US 8.8.8.8:53 ocsp.trust-provider.cn udp
US 8.8.8.8:53 sp1.baidu.com udp
CN 119.36.90.164:80 ocsp.trust-provider.cn tcp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 104.193.88.123:443 sp1.baidu.com tcp
US 8.8.8.8:53 164.90.36.119.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 123.88.193.104.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
N/A 234.2.2.2:27428 udp
N/A 233.123.112.211:23207 udp
US 8.8.8.8:53 2.2.2.234.in-addr.arpa udp
US 8.8.8.8:53 211.112.123.233.in-addr.arpa udp
CN 119.167.229.212:80 down.nugong.asia tcp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 down.nugong.asia udp
CN 118.212.235.102:80 down.nugong.asia tcp
US 8.8.8.8:53 102.235.212.118.in-addr.arpa udp
US 8.8.8.8:53 sp0.baidu.com udp
US 104.193.88.123:80 sp0.baidu.com tcp
US 8.8.8.8:53 dns.alidns.com udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
US 8.8.8.8:53 5.5.5.223.in-addr.arpa udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 178.113.50.184.in-addr.arpa udp
N/A 234.2.2.2:27428 udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
N/A 234.2.2.2:27428 udp
US 8.8.8.8:53 77.239.69.13.in-addr.arpa udp

Files

memory/376-0-0x00000000005E0000-0x000000000064E000-memory.dmp

memory/3380-1-0x00000000023A0000-0x00000000023A3000-memory.dmp

memory/3380-2-0x00000000023A0000-0x00000000023A3000-memory.dmp

memory/3380-4-0x0000000007DF0000-0x0000000007EE7000-memory.dmp

memory/3380-6-0x00000000023C0000-0x00000000023C1000-memory.dmp

C:\Windows\sdchange.exe

MD5 26ff03d565d4d68bf80602a8d21f46ee
SHA1 8b2e151fe31eb875aedffb6dda5d1cf761ba3631
SHA256 4113eea6d5998515b9a460c4de0be96bb00de07a36f87cd7215d29932ed02ed7
SHA512 083dbf9996fa36418cf6dcafb4915b25595c7cfc831e46241f10a78dee8555c5a2c8709747ebc8be95d9d10a7816a827011547975617d9cc06e84fd55c9398bf

memory/2500-13-0x0000028D30860000-0x0000028D3092B000-memory.dmp

memory/2500-12-0x00007FFB21FF0000-0x00007FFB22000000-memory.dmp

memory/2500-11-0x0000028D30860000-0x0000028D3092B000-memory.dmp

memory/2500-14-0x0000028D2F0A0000-0x0000028D2F0A1000-memory.dmp

memory/620-17-0x0000020CC1D50000-0x0000020CC1D78000-memory.dmp

memory/376-42-0x00000000005E0000-0x000000000064E000-memory.dmp

memory/2500-49-0x00007FFB21FF0000-0x00007FFB22000000-memory.dmp

memory/2500-50-0x0000028D30F60000-0x0000028D30F61000-memory.dmp

memory/2500-51-0x0000028D31170000-0x0000028D31171000-memory.dmp

memory/2500-52-0x0000028D31170000-0x0000028D31171000-memory.dmp

memory/3380-53-0x0000000007DF0000-0x0000000007EE7000-memory.dmp

memory/2500-54-0x0000028D31180000-0x0000028D31181000-memory.dmp

memory/2500-55-0x0000028D30860000-0x0000028D3092B000-memory.dmp

memory/2500-56-0x0000028D2F0A0000-0x0000028D2F0A1000-memory.dmp

memory/620-57-0x0000020CC1D90000-0x0000020CC1D91000-memory.dmp

memory/2500-58-0x0000028D31180000-0x0000028D3118F000-memory.dmp

memory/2500-59-0x0000028D311D0000-0x0000028D311FE000-memory.dmp

memory/2500-60-0x0000028D31850000-0x0000028D31907000-memory.dmp

memory/2500-62-0x0000028D30F60000-0x0000028D30F61000-memory.dmp

memory/2500-61-0x0000028D31170000-0x0000028D31171000-memory.dmp

memory/2500-63-0x0000028D32A00000-0x0000028D32BCA000-memory.dmp

memory/2500-64-0x0000028D31180000-0x0000028D31181000-memory.dmp

memory/3580-66-0x000001FA24380000-0x000001FA24526000-memory.dmp

memory/2500-68-0x0000028D32D20000-0x0000028D32E42000-memory.dmp

memory/3380-71-0x0000000002370000-0x0000000002371000-memory.dmp

memory/2500-69-0x0000028D31170000-0x0000028D31171000-memory.dmp

memory/2500-85-0x0000028D32A00000-0x0000028D32BCA000-memory.dmp

C:\Windows\zvBJe5E3An6.sys

MD5 d15f5f23df8036bd5089ce8d151b0e0d
SHA1 4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256 f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512 feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

memory/3380-120-0x0000000002370000-0x0000000002371000-memory.dmp

memory/2500-151-0x0000028D32D20000-0x0000028D32E42000-memory.dmp

memory/3380-174-0x0000000002370000-0x0000000002371000-memory.dmp

C:\Windows\XnEokxfDcXH.sys

MD5 db5d4252dbfe3c6a8ed839012a0501fa
SHA1 b502e4690bf2c88f991c543b7050839c6db8fe8d
SHA256 8ce672b0220d07da7cd3997164b53b63a48a8b977956849ee15bd4f597a618df
SHA512 b8169e775c280244defc7e052a036262f1436380bf423a6d8fec14f63971e0fc422ea846e0e2b5d4a4631d011f82b76db59d56f9802152b7931006c9cd2c9005

C:\Windows\n3SZnMg44H4k.sys

MD5 64bc1983743c584a9ad09dacf12792e5
SHA1 0f14098f523d21f11129c4df09451413ddff6d61
SHA256 057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA512 9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

memory/3380-211-0x0000000002370000-0x0000000002371000-memory.dmp

C:\Windows\7fdprvKyY3o.sys

MD5 b35f50c1fdabf0633e08120d60f58310
SHA1 e75428f11aa36e3cb3dd8ded2c1d4a96cce003a5
SHA256 2fcab54eda2766741f452476f55052f58598f9a8aa5156e45232c9c0111fa233
SHA512 17e3963353aac24f61f6b8bb13b5edb269a000c4e55311466678d99e274a29fb95c361a7f4691cd7e99d38d5660ea29ef59c7d34da1606390e9dc3e9ecc5098f

memory/3380-310-0x0000000002370000-0x0000000002371000-memory.dmp

memory/3380-313-0x0000000002620000-0x0000000002623000-memory.dmp

memory/3380-316-0x0000000002660000-0x0000000002661000-memory.dmp

memory/60-317-0x000001A93FF20000-0x000001A940042000-memory.dmp

memory/60-318-0x000001A940060000-0x000001A940061000-memory.dmp

C:\Windows\sdchange.exe

MD5 26ff03d565d4d68bf80602a8d21f46ee
SHA1 8b2e151fe31eb875aedffb6dda5d1cf761ba3631
SHA256 4113eea6d5998515b9a460c4de0be96bb00de07a36f87cd7215d29932ed02ed7
SHA512 083dbf9996fa36418cf6dcafb4915b25595c7cfc831e46241f10a78dee8555c5a2c8709747ebc8be95d9d10a7816a827011547975617d9cc06e84fd55c9398bf

memory/60-320-0x000001A940070000-0x000001A940074000-memory.dmp

memory/3380-319-0x0000000002670000-0x0000000002671000-memory.dmp

memory/3380-322-0x0000000002370000-0x0000000002371000-memory.dmp

memory/3380-323-0x000000000A3B0000-0x000000000A4D2000-memory.dmp

memory/2500-324-0x0000028D31330000-0x0000028D31331000-memory.dmp

memory/2500-325-0x0000028D329E0000-0x0000028D329E1000-memory.dmp

memory/3380-326-0x000000000A4E0000-0x000000000A4E4000-memory.dmp

memory/60-327-0x000001A93FF20000-0x000001A940042000-memory.dmp

memory/3380-328-0x000000000A3B0000-0x000000000A4D2000-memory.dmp