Malware Analysis Report

2024-11-16 13:18

Sample ID 240519-lafb3sbg78
Target 2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3
SHA256 2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3

Threat Level: Known bad

The file 2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Modifies firewall policy service

Sality

Windows security bypass

UAC bypass

Loads dropped DLL

Executes dropped EXE

Windows security modification

UPX packed file

Checks computer location settings

Deletes itself

Enumerates connected drives

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

System policy modification

Runs net.exe

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-19 09:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 09:19

Reported

2024-05-19 09:22

Platform

win7-20231129-en

Max time kernel

149s

Max time network

120s

Command Line

C:\Windows\Explorer.EXE

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Portable Devices\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Journal\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\Visualizations\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jre7\lib\ext\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Windows Mail\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\en_GB\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Help\en_US\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\fr-FR\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\en-US\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\3082\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\_desktop.ini C:\Windows\Logo1_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\_desktop.ini C:\Windows\Logo1_.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
File created C:\Windows\vDll.dll C:\Windows\Logo1_.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A
N/A N/A C:\Windows\Logo1_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2392 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\Logo1_.exe
PID 2392 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\Logo1_.exe
PID 2392 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\Logo1_.exe
PID 2392 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\Logo1_.exe
PID 2932 wrote to memory of 1208 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2932 wrote to memory of 1208 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2932 wrote to memory of 1208 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2932 wrote to memory of 1208 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 2708 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe
PID 2708 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe
PID 2708 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe
PID 2708 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe
PID 1208 wrote to memory of 1184 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1208 wrote to memory of 1184 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1208 wrote to memory of 1184 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1208 wrote to memory of 1184 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2648 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 1260 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 2932 wrote to memory of 1260 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe

"C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$$aF3D.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe

"C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\$$aFF8.bat

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

Network

N/A

Files

memory/2392-0-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$aF3D.bat

MD5 48fda2f297529a9b1a1f7a35ead52bd8
SHA1 78904ed572eb88846981c8e3b0e553b6c02ab9b7
SHA256 cb287464e2c42257e4e614c7f2d4d4248959f23ab01d4f4dc149b39b3f9c1687
SHA512 219f8804d78e351295993026566a66bc970cba8516b07b78731ec9af141022b11129eb065a4be7a69e12bc24094d2556ab240b82e9136a699f9d23ba3094ce31

memory/2932-18-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Windows\Logo1_.exe

MD5 501e8b69f0c69752427230a1a009466e
SHA1 96d9e84f26cda2da08e2aa64d3a0a4e01bfa91b1
SHA256 48c1b2a71fe3057e59ca81108b97cff0189251c8d98739462bf65e307a7352dd
SHA512 1c11f011297000e4a103a2f2732bc47b5f6f4fef9ce746ee519fa7b57a08703bf73ce148b9caa5b20dc104323dda304553b384a2520bda9c6b5f3fce79be7656

memory/2392-16-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe.exe

MD5 282a4610ed8780d8b59c66032c8512dc
SHA1 a28331f6cd9d45f845d057a15fa4706722d18825
SHA256 e9231a3bf147f0753637c95651ae2a3d1f009d1bae2a2d61d52b1f572181ac8a
SHA512 3d97358cfd38c43d348cdc44e65f2c96d4060db6ca927e94c445123bd1684263c23c68644a18240f2565467651177f52bb3272b509187436b2f7a53b703537d5

memory/2648-31-0x0000000000400000-0x0000000000446000-memory.dmp

memory/2708-30-0x0000000000350000-0x0000000000396000-memory.dmp

memory/2708-29-0x0000000000350000-0x0000000000396000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$aFF8.bat

MD5 cee54f60e0f4ce9caf74fe0ba3eeabb4
SHA1 279b2d3b2c02e15b758d86cf931fe57b4e30ac5e
SHA256 22ae82a6a5ad3d8ce11edf325d104a65c073ba65895cf3f29389eda0a102de4e
SHA512 fa046f6f7a4621320a9454c7d680ec73bfb039ededcd2b932b44fa4da1e136d6bea85338cc82ef4a4a912dabb463319099b64ca0dd98a28fc4d086f87cba6de5

C:\Windows\rundl132.exe

MD5 28c25a455fac21e801a6abc7f4a20a70
SHA1 aff3d1e87516b95f4a0f679da579801f62f98cb5
SHA256 be93947f31fc8bb145e97a0d6190a116dca8734e97f8464067200d52f77e8e07
SHA512 9b681f81ae5a60249b8c3a3a5d586291a2b7678428e8db02366ea4962e6db14bf9487504322cc82c245ae8ab7dccb090bed88b1c947734290b5abe9923cee989

memory/2648-43-0x00000000005D0000-0x000000000165E000-memory.dmp

memory/2648-45-0x00000000005D0000-0x000000000165E000-memory.dmp

memory/2648-46-0x00000000005D0000-0x000000000165E000-memory.dmp

memory/2648-47-0x00000000005D0000-0x000000000165E000-memory.dmp

memory/2648-50-0x00000000005D0000-0x000000000165E000-memory.dmp

memory/2648-48-0x00000000005D0000-0x000000000165E000-memory.dmp

memory/2648-51-0x00000000005D0000-0x000000000165E000-memory.dmp

memory/2648-49-0x00000000005D0000-0x000000000165E000-memory.dmp

memory/2648-52-0x00000000005D0000-0x000000000165E000-memory.dmp

memory/2648-53-0x00000000005D0000-0x000000000165E000-memory.dmp

memory/2648-61-0x0000000000400000-0x0000000000446000-memory.dmp

memory/1260-64-0x00000000025C0000-0x00000000025C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe.exe

MD5 7bb1fe0bd3140c6d19c11f4799fe9261
SHA1 1b1cb210fd6bd71dacf9f4adea0258122ddb5d2b
SHA256 f8a2d545279f286ad1ef55bc47926ba49f7fc104a4f4b9c616f4f8fc4e2dfffa
SHA512 c9fec614ece172bf4a686ec1b2e8c08aba134f1793055eb2b22ae968c6a1c24c8b7346b677618457bd3feb31bd9c98949f5efc315cd80649640f6dcbaa3adc26

memory/2932-105-0x0000000000400000-0x0000000000434000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\_desktop.ini

MD5 626b7ac8db42922bd5ad061459a997cd
SHA1 1d94c0679bc448cde1fc2da8cea39b910af74f3b
SHA256 ec459940188be916789d5d79bd7826fecb6ad8f47d606e862d95946998d36208
SHA512 cff25aa56e8d7d33dddf326fe1fdc1fc11e4269e0b03caa2f8baa637a549b1e0878ea933333cc82c03fb3930d0ae1b8735bfdbf1337e696b5bd062b693847f20

memory/2932-112-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2932-118-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2932-164-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2932-171-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2932-1662-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2932-1923-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 96e1b35794cab7c89ed11aef9fd21231
SHA1 f117566e261850b2a7439a644d229ae68917da20
SHA256 b3a73fa9b408ee517b0bfe8d54f7ddfa25158dc2a9aa0944b08b11fbcf8b57f3
SHA512 6962ac273cce263805f787f1a08584125091c906e9a753023cdc54e20ad3f0d2e63678d6d167e5febbd5a2776360cb1266200fac701bb755a3ee97938c558a16

memory/2932-3202-0x0000000000400000-0x0000000000434000-memory.dmp

memory/2932-3383-0x0000000000400000-0x0000000000434000-memory.dmp

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

MD5 4cfdb20b04aa239d6f9e83084d5d0a77
SHA1 f22863e04cc1fd4435f785993ede165bd8245ac6
SHA256 30ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA512 35b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 09:19

Reported

2024-05-19 09:22

Platform

win10v2004-20240508-en

Max time kernel

27s

Max time network

149s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\Logo1_.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Logo1_.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\Logo1_.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\Logo1_.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\cmd.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Logo1_.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\R: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\E: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\T: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\N: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\M: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\K: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\H: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\O: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\G: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Z: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\X: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\W: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\U: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Q: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\J: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\I: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\Y: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\V: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\S: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\P: C:\Windows\Logo1_.exe N/A
File opened (read-only) \??\L: C:\Windows\Logo1_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
File created C:\Windows\vDll.dll C:\Windows\Logo1_.exe N/A
File created C:\Windows\rundl132.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
File created C:\Windows\Logo1_.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
File opened for modification C:\Windows\rundl132.exe C:\Windows\Logo1_.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4684 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\Logo1_.exe
PID 4684 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\Logo1_.exe
PID 4684 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\Logo1_.exe
PID 1796 wrote to memory of 1560 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1796 wrote to memory of 1560 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1796 wrote to memory of 1560 N/A C:\Windows\Logo1_.exe C:\Windows\SysWOW64\net.exe
PID 1560 wrote to memory of 3712 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1560 wrote to memory of 3712 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1560 wrote to memory of 3712 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3224 wrote to memory of 4144 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe
PID 3224 wrote to memory of 4144 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe
PID 3224 wrote to memory of 4144 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe
PID 4144 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\system32\fontdrvhost.exe
PID 4144 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\system32\fontdrvhost.exe
PID 4144 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\system32\dwm.exe
PID 4144 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\system32\sihost.exe
PID 4144 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\system32\svchost.exe
PID 4144 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\system32\taskhostw.exe
PID 4144 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\Explorer.EXE
PID 4144 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\system32\svchost.exe
PID 4144 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\system32\DllHost.exe
PID 4144 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4144 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\System32\RuntimeBroker.exe
PID 4144 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4144 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\System32\RuntimeBroker.exe
PID 4144 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\System32\RuntimeBroker.exe
PID 4144 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4144 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4144 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4144 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 4144 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 4144 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\Logo1_.exe
PID 4144 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\Logo1_.exe
PID 4144 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\System32\Conhost.exe
PID 4144 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 4144 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 4144 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 4144 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 4144 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe C:\Windows\SysWOW64\cmd.exe
PID 3224 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\fontdrvhost.exe
PID 3224 wrote to memory of 804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\fontdrvhost.exe
PID 3224 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\dwm.exe
PID 3224 wrote to memory of 2516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\sihost.exe
PID 3224 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 3224 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\taskhostw.exe
PID 3224 wrote to memory of 3460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\Explorer.EXE
PID 3224 wrote to memory of 3608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 3224 wrote to memory of 3796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\DllHost.exe
PID 3224 wrote to memory of 3892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3224 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 3224 wrote to memory of 4080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3224 wrote to memory of 3480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 3224 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 3224 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3224 wrote to memory of 3912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3224 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3224 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\Conhost.exe
PID 3224 wrote to memory of 396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\Conhost.exe
PID 1796 wrote to memory of 3460 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 1796 wrote to memory of 3460 N/A C:\Windows\Logo1_.exe C:\Windows\Explorer.EXE
PID 1796 wrote to memory of 796 N/A C:\Windows\Logo1_.exe C:\Windows\system32\fontdrvhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\cmd.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Logo1_.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe

"C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56BB.bat

C:\Windows\Logo1_.exe

C:\Windows\Logo1_.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\net.exe

net stop "Kingsoft AntiVirus Service"

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"

C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe

"C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58FD.bat

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\dwm.exe

"dwm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

memory/4684-0-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4684-8-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Windows\Logo1_.exe

MD5 501e8b69f0c69752427230a1a009466e
SHA1 96d9e84f26cda2da08e2aa64d3a0a4e01bfa91b1
SHA256 48c1b2a71fe3057e59ca81108b97cff0189251c8d98739462bf65e307a7352dd
SHA512 1c11f011297000e4a103a2f2732bc47b5f6f4fef9ce746ee519fa7b57a08703bf73ce148b9caa5b20dc104323dda304553b384a2520bda9c6b5f3fce79be7656

memory/1796-10-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$$a56BB.bat

MD5 6c8be8ccaaee9516294618eecdabe835
SHA1 8bf2521807854e940bb0f250dca978aa199b8bc1
SHA256 cec7aeebdcadbe3940d7f30f0b1fba87ec4fc8966b8acbfb6c6c0f5daa1a5bec
SHA512 fbd0afd6cd3bb1b906f0f4a11be41fd1ce0209381c69e382562c434f55aad3d248349ccdcd4df884dbcf389fb27791054593f41d696f278192c60b973fda877e

C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe.exe

MD5 282a4610ed8780d8b59c66032c8512dc
SHA1 a28331f6cd9d45f845d057a15fa4706722d18825
SHA256 e9231a3bf147f0753637c95651ae2a3d1f009d1bae2a2d61d52b1f572181ac8a
SHA512 3d97358cfd38c43d348cdc44e65f2c96d4060db6ca927e94c445123bd1684263c23c68644a18240f2565467651177f52bb3272b509187436b2f7a53b703537d5

memory/4144-20-0x0000000000400000-0x0000000000446000-memory.dmp

memory/4144-19-0x0000000000860000-0x00000000018EE000-memory.dmp

memory/4144-22-0x0000000000860000-0x00000000018EE000-memory.dmp

C:\Windows\rundl132.exe

MD5 28c25a455fac21e801a6abc7f4a20a70
SHA1 aff3d1e87516b95f4a0f679da579801f62f98cb5
SHA256 be93947f31fc8bb145e97a0d6190a116dca8734e97f8464067200d52f77e8e07
SHA512 9b681f81ae5a60249b8c3a3a5d586291a2b7678428e8db02366ea4962e6db14bf9487504322cc82c245ae8ab7dccb090bed88b1c947734290b5abe9923cee989

memory/4144-23-0x0000000000860000-0x00000000018EE000-memory.dmp

memory/1420-38-0x00000000007B0000-0x00000000007B1000-memory.dmp

memory/4144-24-0x0000000000860000-0x00000000018EE000-memory.dmp

memory/1796-39-0x0000000000550000-0x0000000000552000-memory.dmp

memory/4144-36-0x0000000001A70000-0x0000000001A71000-memory.dmp

memory/1796-34-0x0000000000560000-0x0000000000561000-memory.dmp

memory/1796-33-0x0000000000550000-0x0000000000552000-memory.dmp

memory/3224-31-0x0000000001A70000-0x0000000001A71000-memory.dmp

memory/3224-30-0x00000000012B0000-0x00000000012B2000-memory.dmp

memory/4144-40-0x0000000000860000-0x00000000018EE000-memory.dmp

memory/4144-47-0x0000000000400000-0x0000000000446000-memory.dmp

memory/3224-48-0x00000000012B0000-0x00000000012B2000-memory.dmp

memory/3224-50-0x00000000012B0000-0x00000000012B2000-memory.dmp

memory/3224-49-0x0000000001D20000-0x0000000002DAE000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 7f1400d633e49d8fa819822bfca2da51
SHA1 6b0715284d6cf9d128fdae7439c1460858138e19
SHA256 ae86bafa5294d4a8b0af7a8233ce1cf1d7f5ba12647cd3482fc76d38ba7a0e08
SHA512 eb9c656c7ebc7b133e1cad7ab53c3434682025a0d01b6b07ca862895eea32d4215fa844dd6ec899efedb03097f1a815e39c591d5c666e23b6960eb2735f1bbb7

memory/3224-52-0x0000000001D20000-0x0000000002DAE000-memory.dmp

memory/3224-53-0x0000000001D20000-0x0000000002DAE000-memory.dmp

memory/1420-55-0x0000000000760000-0x0000000000762000-memory.dmp

memory/1420-56-0x0000000000760000-0x0000000000762000-memory.dmp

memory/3224-54-0x0000000001D20000-0x0000000002DAE000-memory.dmp

memory/3224-57-0x0000000001D20000-0x0000000002DAE000-memory.dmp

memory/3224-59-0x0000000001D20000-0x0000000002DAE000-memory.dmp

memory/3224-58-0x0000000001D20000-0x0000000002DAE000-memory.dmp

memory/3224-60-0x0000000001D20000-0x0000000002DAE000-memory.dmp

memory/3224-61-0x0000000001D20000-0x0000000002DAE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2f8390fbf756e197c094c7b30b01d0335b5682409bd46c7fdd30cf8361aa5de3.exe.exe

MD5 7bb1fe0bd3140c6d19c11f4799fe9261
SHA1 1b1cb210fd6bd71dacf9f4adea0258122ddb5d2b
SHA256 f8a2d545279f286ad1ef55bc47926ba49f7fc104a4f4b9c616f4f8fc4e2dfffa
SHA512 c9fec614ece172bf4a686ec1b2e8c08aba134f1793055eb2b22ae968c6a1c24c8b7346b677618457bd3feb31bd9c98949f5efc315cd80649640f6dcbaa3adc26

C:\Users\Admin\AppData\Local\Temp\$$a58FD.bat

MD5 a5fa7ec8c96409b607e5c4ae2a20f84e
SHA1 109e1a80ab54c3d4c383238280d99cf6839e5375
SHA256 9f5a72c73433a7e839e744d4ac8eb461e25591fb957f2e475a0d44b98f857d9f
SHA512 8cd03d64dc837e4834c0dd8f0f81de01d86f768ea4f6e941d427defbe0eca46d46c6ddf253a1484ac63d2fc09b3442c56fcb5837a7cfeae15bc2e54cc2f7ca78

memory/3224-64-0x0000000001D20000-0x0000000002DAE000-memory.dmp

memory/1796-83-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-82-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-84-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-80-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-81-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-78-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-79-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-77-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-76-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-86-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-85-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-87-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-88-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-89-0x00000000033D0000-0x000000000445E000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\_desktop.ini

MD5 626b7ac8db42922bd5ad061459a997cd
SHA1 1d94c0679bc448cde1fc2da8cea39b910af74f3b
SHA256 ec459940188be916789d5d79bd7826fecb6ad8f47d606e862d95946998d36208
SHA512 cff25aa56e8d7d33dddf326fe1fdc1fc11e4269e0b03caa2f8baa637a549b1e0878ea933333cc82c03fb3930d0ae1b8735bfdbf1337e696b5bd062b693847f20

memory/1796-97-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-98-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-100-0x00000000033D0000-0x000000000445E000-memory.dmp

memory/1796-101-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1796-153-0x0000000000550000-0x0000000000552000-memory.dmp

C:\gyion.pif

MD5 a4492b766378c721f9192298a559f7c7
SHA1 df9b59d7d06ea751a3be8018b7c5380e7ad04032
SHA256 06cca4ad01ccc6a754e555a8ed54d32437aabb83e317eb72f9035d6540901a0f
SHA512 30f120d129df038ad3698c785878812dd0c8b2d23fd2c49211e831c511ab951589b530bf1312ffbf0466bb8512541f609fc38a36298a31966c2e9e773b9a3a99

memory/1420-163-0x0000000000760000-0x0000000000762000-memory.dmp

C:\Program Files\OpenExport.exe

MD5 e8d16d8c4111a42ce2116b008a76b088
SHA1 499c50911d8dd948b3e6c70521adb64002204656
SHA256 01153f1149af4c759dfbdb0df484217a1a0a197e6e07b0370697f93ed4e18fd0
SHA512 af91c82d9ff87db081c9b0b725e791734514a42331253645616cecb904b35de9e377b00e2ce2c14305aea9db663ea99c942f299eb10a89539e1fb324cdba2b5d

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 96e1b35794cab7c89ed11aef9fd21231
SHA1 f117566e261850b2a7439a644d229ae68917da20
SHA256 b3a73fa9b408ee517b0bfe8d54f7ddfa25158dc2a9aa0944b08b11fbcf8b57f3
SHA512 6962ac273cce263805f787f1a08584125091c906e9a753023cdc54e20ad3f0d2e63678d6d167e5febbd5a2776360cb1266200fac701bb755a3ee97938c558a16

memory/1796-4946-0x0000000000400000-0x0000000000434000-memory.dmp