Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
08-12-2023 14:08
Static task
static1
General
-
Target
file.exe
-
Size
238KB
-
MD5
66b6c9a261d935b233d1f6934bffc239
-
SHA1
5b8681f9f431a96489863a16ae833b547f042780
-
SHA256
862b82e5905b93951a9f312e55b9470dd7e8f178ef481b56e06150a94ebbcb85
-
SHA512
9995d4cbec0da4012789451c9e16ac79b1869cde96f90d36dd01452c973232ee516397c4c788c5807551eb441f33cba7287cb3b46dc5855e590383e9d79152df
-
SSDEEP
3072:3a9fbArjVdpSXGaSBspv1H+oF95nNR9g8oGiWHqTCK:K9fbeVu2PBsp4o5Rg8BHqT
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
smokeloader
pub1
Extracted
lumma
http://opposesicknessopw.pw/api
Signatures
-
Detect ZGRat V1 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1744-422-0x0000000001260000-0x0000000001774000-memory.dmp family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\D734.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\D734.exe family_zgrat_v1 -
Glupteba payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2568-76-0x0000000002BD0000-0x00000000034BB000-memory.dmp family_glupteba behavioral1/memory/2568-77-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2568-80-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1960-90-0x0000000002A90000-0x000000000337B000-memory.dmp family_glupteba behavioral1/memory/1960-96-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1960-138-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/680-147-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/680-410-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/680-414-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/680-506-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Raccoon Stealer V2 payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-433-0x00000000003A0000-0x00000000003B6000-memory.dmp family_raccoon_v2 -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Processes:
9580.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\9580.exe = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 9580.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
8640.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8640.exe -
Modifies boot configuration data using bcdedit 14 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 2400 bcdedit.exe 2872 bcdedit.exe 2172 bcdedit.exe 1584 bcdedit.exe 1696 bcdedit.exe 2892 bcdedit.exe 708 bcdedit.exe 2340 bcdedit.exe 2844 bcdedit.exe 964 bcdedit.exe 2484 bcdedit.exe 2044 bcdedit.exe 2584 bcdedit.exe 2708 bcdedit.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
csrss.exedescription ioc process File created C:\Windows\system32\drivers\Winmon.sys csrss.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8640.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8640.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8640.exe -
Deletes itself 1 IoCs
Processes:
pid process 1376 -
Executes dropped EXE 21 IoCs
Processes:
8640.exe8CD6.exe9580.exe9580.exe9FCD.exe9FCD.tmpcsrss.exepatch.exeinjector.exeBC53.exeBC53.tmpDaisoLIB.exeDaisoLIB.exeD734.exeD8CA.exebcdedit.exerdehtddjwehtdddsefix.exewindefender.exewindefender.exepid process 1728 8640.exe 2712 8CD6.exe 2568 9580.exe 1960 9580.exe 2036 9FCD.exe 2628 9FCD.tmp 680 csrss.exe 1500 patch.exe 572 injector.exe 2556 BC53.exe 2592 BC53.tmp 1480 DaisoLIB.exe 984 DaisoLIB.exe 1744 D734.exe 2528 D8CA.exe 2340 bcdedit.exe 2804 rdehtdd 2576 jwehtdd 1620 dsefix.exe 2588 windefender.exe 612 windefender.exe -
Loads dropped DLL 27 IoCs
Processes:
9FCD.exe9FCD.tmp9580.exepatch.execsrss.exeBC53.exeBC53.tmpregsvr32.exeD734.exepid process 2036 9FCD.exe 2628 9FCD.tmp 2628 9FCD.tmp 2628 9FCD.tmp 2628 9FCD.tmp 1960 9580.exe 1960 9580.exe 852 1500 patch.exe 1500 patch.exe 1500 patch.exe 1500 patch.exe 1500 patch.exe 680 csrss.exe 2556 BC53.exe 2592 BC53.tmp 2592 BC53.tmp 2592 BC53.tmp 2592 BC53.tmp 2592 BC53.tmp 2592 BC53.tmp 2932 regsvr32.exe 1744 D734.exe 1500 patch.exe 1500 patch.exe 1500 patch.exe 680 csrss.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\8640.exe themida behavioral1/memory/1728-39-0x0000000000940000-0x0000000001480000-memory.dmp themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx -
Processes:
9580.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\9580.exe = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 9580.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 9580.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9580.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 9580.exe Set value (str) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
8640.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8640.exe -
Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMon csrss.exe -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
8640.exepid process 1728 8640.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bcdedit.exeD734.exedescription pid process target process PID 2340 set thread context of 660 2340 bcdedit.exe AppLaunch.exe PID 1744 set thread context of 240 1744 D734.exe RegSvcs.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
9580.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 9580.exe -
Drops file in Program Files directory 5 IoCs
Processes:
9FCD.tmpdescription ioc process File created C:\Program Files (x86)\Maildelivery\uninstall\is-NP4B7.tmp 9FCD.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-II667.tmp 9FCD.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-ANTEJ.tmp 9FCD.tmp File created C:\Program Files (x86)\Maildelivery\stuff\is-27VUN.tmp 9FCD.tmp File created C:\Program Files (x86)\Maildelivery\uninstall\unins000.dat 9FCD.tmp -
Drops file in Windows directory 5 IoCs
Processes:
makecab.execsrss.exe9580.exedescription ioc process File created C:\Windows\Logs\CBS\CbsPersist_20231208140937.cab makecab.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 9580.exe File created C:\Windows\rss\csrss.exe 9580.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 540 sc.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
8CD6.exerdehtddfile.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8CD6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8CD6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rdehtdd Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rdehtdd Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rdehtdd Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8CD6.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 452 schtasks.exe 2916 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
windefender.exe9580.exenetsh.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 9580.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-551 = "North Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-21 = "Cape Verde Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-472 = "Ekaterinburg Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-552 = "North Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-421 = "Russian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-522 = "N. Central Asia Standard Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" windefender.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 9580.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" 9580.exe -
Processes:
patch.execsrss.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2952 file.exe 2952 file.exe 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1376 -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 484 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
file.exe8CD6.exerdehtddpid process 2952 file.exe 2712 8CD6.exe 1376 1376 1376 1376 2804 rdehtdd -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
9580.execsrss.exeAppLaunch.exesc.exedescription pid process Token: SeDebugPrivilege 2568 9580.exe Token: SeImpersonatePrivilege 2568 9580.exe Token: SeShutdownPrivilege 1376 Token: SeShutdownPrivilege 1376 Token: SeSystemEnvironmentPrivilege 680 csrss.exe Token: SeShutdownPrivilege 1376 Token: SeShutdownPrivilege 1376 Token: SeShutdownPrivilege 1376 Token: SeShutdownPrivilege 1376 Token: SeShutdownPrivilege 1376 Token: SeShutdownPrivilege 1376 Token: SeDebugPrivilege 660 AppLaunch.exe Token: SeSecurityPrivilege 540 sc.exe Token: SeSecurityPrivilege 540 sc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1376 1376 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1376 1376 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9FCD.exe9580.execmd.execsrss.exeBC53.exeBC53.tmpdescription pid process target process PID 1376 wrote to memory of 1728 1376 8640.exe PID 1376 wrote to memory of 1728 1376 8640.exe PID 1376 wrote to memory of 1728 1376 8640.exe PID 1376 wrote to memory of 1728 1376 8640.exe PID 1376 wrote to memory of 2712 1376 8CD6.exe PID 1376 wrote to memory of 2712 1376 8CD6.exe PID 1376 wrote to memory of 2712 1376 8CD6.exe PID 1376 wrote to memory of 2712 1376 8CD6.exe PID 1376 wrote to memory of 2568 1376 9580.exe PID 1376 wrote to memory of 2568 1376 9580.exe PID 1376 wrote to memory of 2568 1376 9580.exe PID 1376 wrote to memory of 2568 1376 9580.exe PID 1376 wrote to memory of 2036 1376 9FCD.exe PID 1376 wrote to memory of 2036 1376 9FCD.exe PID 1376 wrote to memory of 2036 1376 9FCD.exe PID 1376 wrote to memory of 2036 1376 9FCD.exe PID 1376 wrote to memory of 2036 1376 9FCD.exe PID 1376 wrote to memory of 2036 1376 9FCD.exe PID 1376 wrote to memory of 2036 1376 9FCD.exe PID 2036 wrote to memory of 2628 2036 9FCD.exe 9FCD.tmp PID 2036 wrote to memory of 2628 2036 9FCD.exe 9FCD.tmp PID 2036 wrote to memory of 2628 2036 9FCD.exe 9FCD.tmp PID 2036 wrote to memory of 2628 2036 9FCD.exe 9FCD.tmp PID 2036 wrote to memory of 2628 2036 9FCD.exe 9FCD.tmp PID 2036 wrote to memory of 2628 2036 9FCD.exe 9FCD.tmp PID 2036 wrote to memory of 2628 2036 9FCD.exe 9FCD.tmp PID 1960 wrote to memory of 2424 1960 9580.exe cmd.exe PID 1960 wrote to memory of 2424 1960 9580.exe cmd.exe PID 1960 wrote to memory of 2424 1960 9580.exe cmd.exe PID 1960 wrote to memory of 2424 1960 9580.exe cmd.exe PID 2424 wrote to memory of 3064 2424 cmd.exe netsh.exe PID 2424 wrote to memory of 3064 2424 cmd.exe netsh.exe PID 2424 wrote to memory of 3064 2424 cmd.exe netsh.exe PID 1960 wrote to memory of 680 1960 9580.exe csrss.exe PID 1960 wrote to memory of 680 1960 9580.exe csrss.exe PID 1960 wrote to memory of 680 1960 9580.exe csrss.exe PID 1960 wrote to memory of 680 1960 9580.exe csrss.exe PID 680 wrote to memory of 572 680 csrss.exe injector.exe PID 680 wrote to memory of 572 680 csrss.exe injector.exe PID 680 wrote to memory of 572 680 csrss.exe injector.exe PID 680 wrote to memory of 572 680 csrss.exe injector.exe PID 1376 wrote to memory of 2556 1376 BC53.exe PID 1376 wrote to memory of 2556 1376 BC53.exe PID 1376 wrote to memory of 2556 1376 BC53.exe PID 1376 wrote to memory of 2556 1376 BC53.exe PID 1376 wrote to memory of 2556 1376 BC53.exe PID 1376 wrote to memory of 2556 1376 BC53.exe PID 1376 wrote to memory of 2556 1376 BC53.exe PID 2556 wrote to memory of 2592 2556 BC53.exe BC53.tmp PID 2556 wrote to memory of 2592 2556 BC53.exe BC53.tmp PID 2556 wrote to memory of 2592 2556 BC53.exe BC53.tmp PID 2556 wrote to memory of 2592 2556 BC53.exe BC53.tmp PID 2556 wrote to memory of 2592 2556 BC53.exe BC53.tmp PID 2556 wrote to memory of 2592 2556 BC53.exe BC53.tmp PID 2556 wrote to memory of 2592 2556 BC53.exe BC53.tmp PID 2592 wrote to memory of 1208 2592 BC53.tmp schtasks.exe PID 2592 wrote to memory of 1208 2592 BC53.tmp schtasks.exe PID 2592 wrote to memory of 1208 2592 BC53.tmp schtasks.exe PID 2592 wrote to memory of 1208 2592 BC53.tmp schtasks.exe PID 2592 wrote to memory of 1480 2592 BC53.tmp DaisoLIB.exe PID 2592 wrote to memory of 1480 2592 BC53.tmp DaisoLIB.exe PID 2592 wrote to memory of 1480 2592 BC53.tmp DaisoLIB.exe PID 2592 wrote to memory of 1480 2592 BC53.tmp DaisoLIB.exe PID 2592 wrote to memory of 1824 2592 BC53.tmp net.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\8640.exeC:\Users\Admin\AppData\Local\Temp\8640.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\8CD6.exeC:\Users\Admin\AppData\Local\Temp\8CD6.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9580.exeC:\Users\Admin\AppData\Local\Temp\9580.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\9580.exe"C:\Users\Admin\AppData\Local\Temp\9580.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)4⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Manipulates WinMon driver.
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 05⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn5⤵
- Modifies boot configuration data using bcdedit
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 15⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 05⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v4⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231208140937.log C:\Windows\Logs\CBS\CbsPersist_20231208140937.cab1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\9FCD.exeC:\Users\Admin\AppData\Local\Temp\9FCD.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TMMSE.tmp\9FCD.tmp"C:\Users\Admin\AppData\Local\Temp\is-TMMSE.tmp\9FCD.tmp" /SL5="$C0122,7905477,54272,C:\Users\Admin\AppData\Local\Temp\9FCD.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\is-1NREN.tmp\BC53.tmp"C:\Users\Admin\AppData\Local\Temp\is-1NREN.tmp\BC53.tmp" /SL5="$30190,7920261,54272,C:\Users\Admin\AppData\Local\Temp\BC53.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\DaisoLIB.exe"C:\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\DaisoLIB.exe" -i2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\DaisoLIB.exe"C:\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\DaisoLIB.exe" -s2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 82⤵
-
C:\Users\Admin\AppData\Local\Temp\BC53.exeC:\Users\Admin\AppData\Local\Temp\BC53.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 81⤵
-
C:\Users\Admin\AppData\Local\Temp\D734.exeC:\Users\Admin\AppData\Local\Temp\D734.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\D8CA.exeC:\Users\Admin\AppData\Local\Temp\D8CA.exe1⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DAFD.exeC:\Users\Admin\AppData\Local\Temp\DAFD.exe1⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\E76C.dll1⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\E76C.dll1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {AA013064-D301-4410-AEEC-1494D95CA61B} S-1-5-21-2058106572-1146578376-825901627-1000:LPKQNNGV\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\rdehtddC:\Users\Admin\AppData\Roaming\rdehtdd2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\jwehtddC:\Users\Admin\AppData\Roaming\jwehtdd2⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
3Disable or Modify Tools
2Modify Registry
4Virtualization/Sandbox Evasion
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD528e3bdfd9aee20b095761f761370fc01
SHA1bae4c461ba574c997f3d45b2bfe364101be5d163
SHA2569203c44021f5300ece57911485246e55694d2b90fe08c8d14b94f7e330471413
SHA5128a27a3b1e455a0d3768577ab6ee7cef858c5551d586402fe4745800f3523b8ae655afca57f9bfb640f72c42a31b2aa2af806fd7b2535826b8961445f703efe41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD54b023462f0c321d2088a5b66687065c8
SHA1cf86f01d5fd0f6ac529f3bf245fc98bfd9558a1e
SHA25603c3a48c2bccb917f61747e311b1474001c05b2984fd0969aa75a7d3cda63113
SHA512aa37912cba50ce3ea707bf65747b066e66a6c13092d18d6b9bb5366400582872e965a2cb5df80e3e3ed2feaeb19624e825865de53c68a7ad14300b7f1ca0df22
-
C:\Users\Admin\AppData\Local\Temp\8640.exeFilesize
4.6MB
MD518522f12bc42b23be611bd4d961d7bff
SHA16c37991adeb58df30b3476acddb97ac7152d2662
SHA256ad68b573ce00db5608871f4a64c1f92bf77f63be5f149d7cbb176d24d63d12fd
SHA512019df8189e2889fb500c849faee9984f2bb42ac74ffe843eb6f964febdea48a3ef8963f02d38f233a4abd8156dee543a14da786dfa5e6025e3ab34f0020dafb3
-
C:\Users\Admin\AppData\Local\Temp\8CD6.exeFilesize
238KB
MD593324054bb32be5c5a12aa31325be8dc
SHA1b1b926a7adacadf911c7ce9db4c0ffff8fa8c091
SHA256630cf18b4de45f817e9526ec0afe77ff2ac03c11967b5a87dfb8a6a122a74750
SHA512ebd89223ca0fa03949bc898369d9d2e2b88ad7823335cadb42c570bc1cfee7b54f7000e14eefaf335bae49df198407ec3d96b5fb3c80e60cc449585ed801d2d3
-
C:\Users\Admin\AppData\Local\Temp\8CD6.exeFilesize
238KB
MD593324054bb32be5c5a12aa31325be8dc
SHA1b1b926a7adacadf911c7ce9db4c0ffff8fa8c091
SHA256630cf18b4de45f817e9526ec0afe77ff2ac03c11967b5a87dfb8a6a122a74750
SHA512ebd89223ca0fa03949bc898369d9d2e2b88ad7823335cadb42c570bc1cfee7b54f7000e14eefaf335bae49df198407ec3d96b5fb3c80e60cc449585ed801d2d3
-
C:\Users\Admin\AppData\Local\Temp\9580.exeFilesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
C:\Users\Admin\AppData\Local\Temp\9580.exeFilesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
C:\Users\Admin\AppData\Local\Temp\9580.exeFilesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
C:\Users\Admin\AppData\Local\Temp\9580.exeFilesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
C:\Users\Admin\AppData\Local\Temp\9FCD.exeFilesize
7.8MB
MD555eca471619370d0106dfac3c15c6cf7
SHA1fba51745418a3d6479e2caa124963077eacab644
SHA25661ab7c49819e5ecc676b15adaa3d40d00d18fc8ec1f85ad209f29a2b1406c4f4
SHA512ff88d1e6a65d3ef56aebda022f78ff5d075c5ece6bb16c0f0d04bc1681d843728e803a8a6f2a70070c2d9de1626838ca8d3bd22c6130fe1b4c8bb70c1473a2b2
-
C:\Users\Admin\AppData\Local\Temp\9FCD.exeFilesize
7.8MB
MD555eca471619370d0106dfac3c15c6cf7
SHA1fba51745418a3d6479e2caa124963077eacab644
SHA25661ab7c49819e5ecc676b15adaa3d40d00d18fc8ec1f85ad209f29a2b1406c4f4
SHA512ff88d1e6a65d3ef56aebda022f78ff5d075c5ece6bb16c0f0d04bc1681d843728e803a8a6f2a70070c2d9de1626838ca8d3bd22c6130fe1b4c8bb70c1473a2b2
-
C:\Users\Admin\AppData\Local\Temp\BC53.exeFilesize
7.8MB
MD5b215f3726cc4ad0ee51479c703226921
SHA14ba2b845ec53115b9e9d1553377782becd749430
SHA256fc82ae779fe7fe22a71d9baca800a7318ee5bccc419b301916a24dcba9a93e70
SHA512a9667cb046c0530f216bf2116f7f93087f8ae2745f22654a9a486dfed3510496a403d3443a26d142252ef2ac9177b81115fd24127faa6092dc6173e2c369b27e
-
C:\Users\Admin\AppData\Local\Temp\BC53.exeFilesize
7.8MB
MD5b215f3726cc4ad0ee51479c703226921
SHA14ba2b845ec53115b9e9d1553377782becd749430
SHA256fc82ae779fe7fe22a71d9baca800a7318ee5bccc419b301916a24dcba9a93e70
SHA512a9667cb046c0530f216bf2116f7f93087f8ae2745f22654a9a486dfed3510496a403d3443a26d142252ef2ac9177b81115fd24127faa6092dc6173e2c369b27e
-
C:\Users\Admin\AppData\Local\Temp\CabABE9.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\D734.exeFilesize
5.1MB
MD57f4f98a26d4835578f46224112cc6a15
SHA1c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
-
C:\Users\Admin\AppData\Local\Temp\D734.exeFilesize
5.1MB
MD57f4f98a26d4835578f46224112cc6a15
SHA1c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
-
C:\Users\Admin\AppData\Local\Temp\D8CA.exeFilesize
237KB
MD522a51b329fa194d51f68705a25d7396d
SHA1aada03d8b7f1e28dbf6d72c1503981ccc5bb94da
SHA25682857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742
SHA5120d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821
-
C:\Users\Admin\AppData\Local\Temp\D8CA.exeFilesize
237KB
MD522a51b329fa194d51f68705a25d7396d
SHA1aada03d8b7f1e28dbf6d72c1503981ccc5bb94da
SHA25682857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742
SHA5120d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821
-
C:\Users\Admin\AppData\Local\Temp\DAFD.exeFilesize
382KB
MD5d8aff64273bcd3ef2208d6c4b0214d24
SHA1593273f5f0e1bc79e15a18b5ca19a51ecdf1e9b1
SHA256a9d74ae5f8e2319b1333b898747853bd0d39907eba2f4575db81156b67630283
SHA512bebac874198ac8e006e2549086436e8f0fd71e7d4de21c81434b504d8cbf8000d2ff32f0e1757236df73399b0bfab2ea22ca7a5caeb4306bcaa617f14816649b
-
C:\Users\Admin\AppData\Local\Temp\DAFD.exeFilesize
382KB
MD5d8aff64273bcd3ef2208d6c4b0214d24
SHA1593273f5f0e1bc79e15a18b5ca19a51ecdf1e9b1
SHA256a9d74ae5f8e2319b1333b898747853bd0d39907eba2f4575db81156b67630283
SHA512bebac874198ac8e006e2549086436e8f0fd71e7d4de21c81434b504d8cbf8000d2ff32f0e1757236df73399b0bfab2ea22ca7a5caeb4306bcaa617f14816649b
-
C:\Users\Admin\AppData\Local\Temp\E76C.dllFilesize
4.1MB
MD5184fc62aeb4c9d78891eb8d509c429e5
SHA14456d00e767b918a5118741985f2e1bc924b8e53
SHA2566b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052
SHA512100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b
-
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.errorFilesize
8.3MB
MD5fd2727132edd0b59fa33733daa11d9ef
SHA163e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA2563a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA5123e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e
-
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.errorFilesize
395KB
MD55da3a881ef991e8010deed799f1a5aaf
SHA1fea1acea7ed96d7c9788783781e90a2ea48c1a53
SHA256f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4
SHA51224fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09
-
C:\Users\Admin\AppData\Local\Temp\TarAEAA.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeFilesize
94KB
MD5d98e78fd57db58a11f880b45bb659767
SHA1ab70c0d3bd9103c07632eeecee9f51d198ed0e76
SHA256414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
SHA512aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
C:\Users\Admin\AppData\Local\Temp\is-1NREN.tmp\BC53.tmpFilesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
C:\Users\Admin\AppData\Local\Temp\is-1NREN.tmp\BC53.tmpFilesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
C:\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\DaisoLIB.exeFilesize
3.6MB
MD5b61d04b36b3ff147749a0ae3a8d1b20b
SHA19f39bb3fcd83aa60c764b1dd2167af8b3aa9568e
SHA256f7fa558f4e75c0caf746c12ef06d44fd0a4b199e42b58ac675c66099504e79c1
SHA5124ceec7398968394026dfa3e5a2bd7b8fb4cb0d430e02c6effdf13318565eeaed140d33579025eaa27219eccf7dbe27d54ed7bcf9898951693f4607d155bb9763
-
C:\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\DaisoLIB.exeFilesize
3.6MB
MD5b61d04b36b3ff147749a0ae3a8d1b20b
SHA19f39bb3fcd83aa60c764b1dd2167af8b3aa9568e
SHA256f7fa558f4e75c0caf746c12ef06d44fd0a4b199e42b58ac675c66099504e79c1
SHA5124ceec7398968394026dfa3e5a2bd7b8fb4cb0d430e02c6effdf13318565eeaed140d33579025eaa27219eccf7dbe27d54ed7bcf9898951693f4607d155bb9763
-
C:\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\DaisoLIB.exeFilesize
3.6MB
MD5b61d04b36b3ff147749a0ae3a8d1b20b
SHA19f39bb3fcd83aa60c764b1dd2167af8b3aa9568e
SHA256f7fa558f4e75c0caf746c12ef06d44fd0a4b199e42b58ac675c66099504e79c1
SHA5124ceec7398968394026dfa3e5a2bd7b8fb4cb0d430e02c6effdf13318565eeaed140d33579025eaa27219eccf7dbe27d54ed7bcf9898951693f4607d155bb9763
-
C:\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\stuff\is-244KP.tmpFilesize
1KB
MD5257d1bf38fa7859ffc3717ef36577c04
SHA1a9d2606cfc35e17108d7c079a355a4db54c7c2ee
SHA256dfacc2f208ebf6d6180ee6e882117c31bb58e8b6a76a26fb07ac4f40e245a0cb
SHA512e13a6f489c9c5ba840502f73acd152d366e0ccdd9d3d8e74b65ff89fdc70cd46f52e42eee0b4ba9f151323ec07c4168cf82446334564adaa8666624f7b8035f3
-
C:\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\stuff\is-C2C0K.tmpFilesize
1KB
MD5992c00beab194ce392117bb419f53051
SHA18f9114c95e2a2c9f9c65b9243d941dcb5cea40de
SHA2569e35c8e29ca055ce344e4c206e7b8ff1736158d0b47bf7b3dbc362f7ec7e722c
SHA512facdca78ae7d874300eacbe3014a9e39868c93493b9cd44aae1ab39afa4d2e0868e167bca34f8c445aa7ccc9ddb27e1b607d739af94aa4840789a3f01e7bed9d
-
C:\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
C:\Users\Admin\AppData\Local\Temp\is-TMMSE.tmp\9FCD.tmpFilesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
C:\Users\Admin\AppData\Local\Temp\osloader.exeFilesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
C:\Users\Admin\AppData\Roaming\jwehtddFilesize
238KB
MD566b6c9a261d935b233d1f6934bffc239
SHA15b8681f9f431a96489863a16ae833b547f042780
SHA256862b82e5905b93951a9f312e55b9470dd7e8f178ef481b56e06150a94ebbcb85
SHA5129995d4cbec0da4012789451c9e16ac79b1869cde96f90d36dd01452c973232ee516397c4c788c5807551eb441f33cba7287cb3b46dc5855e590383e9d79152df
-
C:\Users\Admin\AppData\Roaming\jwehtddFilesize
238KB
MD566b6c9a261d935b233d1f6934bffc239
SHA15b8681f9f431a96489863a16ae833b547f042780
SHA256862b82e5905b93951a9f312e55b9470dd7e8f178ef481b56e06150a94ebbcb85
SHA5129995d4cbec0da4012789451c9e16ac79b1869cde96f90d36dd01452c973232ee516397c4c788c5807551eb441f33cba7287cb3b46dc5855e590383e9d79152df
-
C:\Users\Admin\AppData\Roaming\rdehtddFilesize
238KB
MD593324054bb32be5c5a12aa31325be8dc
SHA1b1b926a7adacadf911c7ce9db4c0ffff8fa8c091
SHA256630cf18b4de45f817e9526ec0afe77ff2ac03c11967b5a87dfb8a6a122a74750
SHA512ebd89223ca0fa03949bc898369d9d2e2b88ad7823335cadb42c570bc1cfee7b54f7000e14eefaf335bae49df198407ec3d96b5fb3c80e60cc449585ed801d2d3
-
C:\Users\Admin\AppData\Roaming\rdehtddFilesize
238KB
MD593324054bb32be5c5a12aa31325be8dc
SHA1b1b926a7adacadf911c7ce9db4c0ffff8fa8c091
SHA256630cf18b4de45f817e9526ec0afe77ff2ac03c11967b5a87dfb8a6a122a74750
SHA512ebd89223ca0fa03949bc898369d9d2e2b88ad7823335cadb42c570bc1cfee7b54f7000e14eefaf335bae49df198407ec3d96b5fb3c80e60cc449585ed801d2d3
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
\??\c:\users\admin\appdata\local\temp\is-1nren.tmp\bc53.tmpFilesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
\??\c:\users\admin\appdata\local\temp\is-tmmse.tmp\9fcd.tmpFilesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
\Users\Admin\AppData\Local\Temp\E76C.dllFilesize
4.1MB
MD5184fc62aeb4c9d78891eb8d509c429e5
SHA14456d00e767b918a5118741985f2e1bc924b8e53
SHA2566b2a111ace1e8469a99e2696a6313352cadf138f5b431d68fdb36a7268df1052
SHA512100eb18ee1ef332862b668769fc64b37429df107873525b3ffcd5a8ccea8ad31fe57bba97cb103c2b444d62113a999a58f7743eb0b8266bb9ff8f116472d854b
-
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dllFilesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeFilesize
94KB
MD5d98e78fd57db58a11f880b45bb659767
SHA1ab70c0d3bd9103c07632eeecee9f51d198ed0e76
SHA256414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
SHA512aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
-
\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
\Users\Admin\AppData\Local\Temp\dbghelp.dllFilesize
1.5MB
MD5f0616fa8bc54ece07e3107057f74e4db
SHA1b33995c4f9a004b7d806c4bb36040ee844781fca
SHA2566e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026
SHA51215242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c
-
\Users\Admin\AppData\Local\Temp\is-1NREN.tmp\BC53.tmpFilesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\DaisoLIB.exeFilesize
3.6MB
MD5b61d04b36b3ff147749a0ae3a8d1b20b
SHA19f39bb3fcd83aa60c764b1dd2167af8b3aa9568e
SHA256f7fa558f4e75c0caf746c12ef06d44fd0a4b199e42b58ac675c66099504e79c1
SHA5124ceec7398968394026dfa3e5a2bd7b8fb4cb0d430e02c6effdf13318565eeaed140d33579025eaa27219eccf7dbe27d54ed7bcf9898951693f4607d155bb9763
-
\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\DaisoLIB\DaisoLIB.exeFilesize
3.6MB
MD5b61d04b36b3ff147749a0ae3a8d1b20b
SHA19f39bb3fcd83aa60c764b1dd2167af8b3aa9568e
SHA256f7fa558f4e75c0caf746c12ef06d44fd0a4b199e42b58ac675c66099504e79c1
SHA5124ceec7398968394026dfa3e5a2bd7b8fb4cb0d430e02c6effdf13318565eeaed140d33579025eaa27219eccf7dbe27d54ed7bcf9898951693f4607d155bb9763
-
\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\_isetup\_isdecmp.dllFilesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-G27IA.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-M8JIL.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-M8JIL.tmp\_isetup\_isdecmp.dllFilesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
\Users\Admin\AppData\Local\Temp\is-M8JIL.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-M8JIL.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-TMMSE.tmp\9FCD.tmpFilesize
694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
\Users\Admin\AppData\Local\Temp\osloader.exeFilesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
\Users\Admin\AppData\Local\Temp\osloader.exeFilesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
\Users\Admin\AppData\Local\Temp\osloader.exeFilesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
\Users\Admin\AppData\Local\Temp\symsrv.dllFilesize
163KB
MD55c399d34d8dc01741269ff1f1aca7554
SHA1e0ceed500d3cef5558f3f55d33ba9c3a709e8f55
SHA256e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
SHA5128ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d
-
\Windows\rss\csrss.exeFilesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
\Windows\rss\csrss.exeFilesize
4.1MB
MD5ee5f4c1c141d634401208931991589f5
SHA1f423fdd83d53ac3720c8b5e6020ae3773919c407
SHA2567acc5964d0b0aa71e5a774249b42c7f5b03425b0a43c37d9b9d14184d9001f53
SHA512d45eaa96e61ce7d9c14b4359c5ba3a50c6f6929acba0255329643ef26d5b4ea4221a74c499157a869261a26baa2b24ba2de11fcba96c625b67571d8db0cdf217
-
memory/240-570-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/240-547-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/240-566-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/240-528-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/240-549-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/240-551-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/240-553-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/660-445-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/660-446-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/660-444-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/660-448-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/660-450-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/660-443-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/660-442-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/660-441-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/680-145-0x0000000002660000-0x0000000002A58000-memory.dmpFilesize
4.0MB
-
memory/680-147-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/680-414-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/680-506-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/680-410-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/680-139-0x0000000002660000-0x0000000002A58000-memory.dmpFilesize
4.0MB
-
memory/984-411-0x0000000000400000-0x0000000000798000-memory.dmpFilesize
3.6MB
-
memory/984-500-0x0000000000400000-0x0000000000798000-memory.dmpFilesize
3.6MB
-
memory/984-415-0x0000000000400000-0x0000000000798000-memory.dmpFilesize
3.6MB
-
memory/1376-555-0x00000000040F0000-0x0000000004106000-memory.dmpFilesize
88KB
-
memory/1376-4-0x0000000002F30000-0x0000000002F46000-memory.dmpFilesize
88KB
-
memory/1376-94-0x0000000003C90000-0x0000000003CA6000-memory.dmpFilesize
88KB
-
memory/1480-404-0x0000000000400000-0x0000000000798000-memory.dmpFilesize
3.6MB
-
memory/1480-405-0x0000000000400000-0x0000000000798000-memory.dmpFilesize
3.6MB
-
memory/1480-401-0x0000000000400000-0x0000000000798000-memory.dmpFilesize
3.6MB
-
memory/1480-388-0x0000000000400000-0x0000000000798000-memory.dmpFilesize
3.6MB
-
memory/1500-160-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1500-169-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1660-489-0x0000000000060000-0x000000000006C000-memory.dmpFilesize
48KB
-
memory/1728-31-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-117-0x0000000000940000-0x0000000001480000-memory.dmpFilesize
11.2MB
-
memory/1728-36-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-38-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-37-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-40-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-39-0x0000000000940000-0x0000000001480000-memory.dmpFilesize
11.2MB
-
memory/1728-41-0x0000000077A00000-0x0000000077A02000-memory.dmpFilesize
8KB
-
memory/1728-42-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/1728-43-0x0000000007B80000-0x0000000007BC0000-memory.dmpFilesize
256KB
-
memory/1728-33-0x0000000075750000-0x0000000075797000-memory.dmpFilesize
284KB
-
memory/1728-34-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-141-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-18-0x0000000000940000-0x0000000001480000-memory.dmpFilesize
11.2MB
-
memory/1728-19-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-20-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-22-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-32-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-24-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-35-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-148-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/1728-29-0x0000000075750000-0x0000000075797000-memory.dmpFilesize
284KB
-
memory/1728-30-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-28-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-27-0x0000000075750000-0x0000000075797000-memory.dmpFilesize
284KB
-
memory/1728-128-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-142-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-154-0x0000000007B80000-0x0000000007BC0000-memory.dmpFilesize
256KB
-
memory/1728-144-0x00000000757A0000-0x00000000758B0000-memory.dmpFilesize
1.1MB
-
memory/1728-143-0x0000000075750000-0x0000000075797000-memory.dmpFilesize
284KB
-
memory/1744-424-0x0000000001210000-0x0000000001250000-memory.dmpFilesize
256KB
-
memory/1744-423-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/1744-422-0x0000000001260000-0x0000000001774000-memory.dmpFilesize
5.1MB
-
memory/1960-140-0x0000000002690000-0x0000000002A88000-memory.dmpFilesize
4.0MB
-
memory/1960-138-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1960-86-0x0000000002690000-0x0000000002A88000-memory.dmpFilesize
4.0MB
-
memory/1960-96-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1960-90-0x0000000002A90000-0x000000000337B000-memory.dmpFilesize
8.9MB
-
memory/1960-81-0x0000000002690000-0x0000000002A88000-memory.dmpFilesize
4.0MB
-
memory/2036-88-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2036-393-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2036-92-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2528-432-0x0000000000230000-0x0000000000330000-memory.dmpFilesize
1024KB
-
memory/2528-433-0x00000000003A0000-0x00000000003B6000-memory.dmpFilesize
88KB
-
memory/2556-235-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2568-77-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2568-76-0x0000000002BD0000-0x00000000034BB000-memory.dmpFilesize
8.9MB
-
memory/2568-80-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2568-82-0x00000000027D0000-0x0000000002BC8000-memory.dmpFilesize
4.0MB
-
memory/2568-74-0x00000000027D0000-0x0000000002BC8000-memory.dmpFilesize
4.0MB
-
memory/2568-75-0x00000000027D0000-0x0000000002BC8000-memory.dmpFilesize
4.0MB
-
memory/2576-508-0x0000000000400000-0x000000000085E000-memory.dmpFilesize
4.4MB
-
memory/2592-463-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2592-257-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2592-387-0x0000000003250000-0x00000000035E8000-memory.dmpFilesize
3.6MB
-
memory/2592-408-0x0000000003250000-0x00000000035E8000-memory.dmpFilesize
3.6MB
-
memory/2628-129-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2628-413-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2712-51-0x00000000002D0000-0x00000000003D0000-memory.dmpFilesize
1024KB
-
memory/2712-95-0x0000000000400000-0x000000000085E000-memory.dmpFilesize
4.4MB
-
memory/2712-53-0x0000000000400000-0x000000000085E000-memory.dmpFilesize
4.4MB
-
memory/2712-52-0x00000000001B0000-0x00000000001BB000-memory.dmpFilesize
44KB
-
memory/2756-472-0x0000000000080000-0x00000000000EB000-memory.dmpFilesize
428KB
-
memory/2932-536-0x0000000002790000-0x00000000028B7000-memory.dmpFilesize
1.2MB
-
memory/2932-468-0x0000000010000000-0x0000000010418000-memory.dmpFilesize
4.1MB
-
memory/2932-533-0x0000000002790000-0x00000000028B7000-memory.dmpFilesize
1.2MB
-
memory/2932-532-0x0000000001F00000-0x0000000002043000-memory.dmpFilesize
1.3MB
-
memory/2952-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/2952-5-0x0000000000400000-0x000000000085E000-memory.dmpFilesize
4.4MB
-
memory/2952-3-0x0000000000400000-0x000000000085E000-memory.dmpFilesize
4.4MB
-
memory/2952-1-0x00000000009E0000-0x0000000000AE0000-memory.dmpFilesize
1024KB