Malware Analysis Report

2024-09-11 12:20

Sample ID 240615-ytal6awhqp
Target 2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558
SHA256 2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558
Tags
sality backdoor evasion persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558

Threat Level: Known bad

The file 2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion persistence trojan upx

Sality

Modifies visiblity of hidden/system files in Explorer

UAC bypass

Modifies firewall policy service

Windows security bypass

Modifies visibility of file extensions in Explorer

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

UPX dump on OEP (original entry point)

Drops startup file

Windows security modification

Deletes itself

Loads dropped DLL

Executes dropped EXE

UPX packed file

Adds Run key to start application

Enumerates connected drives

Checks whether UAC is enabled

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

System policy modification

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 20:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 20:04

Reported

2024-06-15 20:06

Platform

win10v2004-20240611-en

Max time kernel

30s

Max time network

121s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\????.lnk C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\????.lnk C:\Windows\SysWOW64\ppsap.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PPS Accelerator = "C:\\Windows\\system32\\ppsap.exe" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PPS Accelerator = "C:\\Windows\\system32\\ppsap.exe" C:\Windows\SysWOW64\ppsap.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
File opened (read-only) \??\E: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened (read-only) \??\G: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened (read-only) \??\H: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened (read-only) \??\I: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened (read-only) \??\J: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ppsap.exe C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
File opened for modification C:\Windows\SysWOW64\ppsap.exe C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{71C3F084-2B52-11EF-9D11-FE349C7D5183} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4356 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\fontdrvhost.exe
PID 4356 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\fontdrvhost.exe
PID 4356 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\dwm.exe
PID 4356 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\sihost.exe
PID 4356 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\svchost.exe
PID 4356 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\taskhostw.exe
PID 4356 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\Explorer.EXE
PID 4356 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\svchost.exe
PID 4356 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\DllHost.exe
PID 4356 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4356 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\System32\RuntimeBroker.exe
PID 4356 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4356 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\System32\RuntimeBroker.exe
PID 4356 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4356 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\System32\RuntimeBroker.exe
PID 4356 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4356 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4356 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\SysWOW64\ppsap.exe
PID 4356 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\SysWOW64\ppsap.exe
PID 4356 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\SysWOW64\ppsap.exe
PID 724 wrote to memory of 856 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 724 wrote to memory of 856 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 856 wrote to memory of 512 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 856 wrote to memory of 512 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 856 wrote to memory of 512 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 724 wrote to memory of 1952 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 724 wrote to memory of 1952 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 724 wrote to memory of 1952 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 1952 wrote to memory of 788 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\fontdrvhost.exe
PID 1952 wrote to memory of 796 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\fontdrvhost.exe
PID 1952 wrote to memory of 380 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\dwm.exe
PID 1952 wrote to memory of 2652 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\sihost.exe
PID 1952 wrote to memory of 2668 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\svchost.exe
PID 1952 wrote to memory of 2748 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\taskhostw.exe
PID 1952 wrote to memory of 3452 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\Explorer.EXE
PID 1952 wrote to memory of 3560 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\svchost.exe
PID 1952 wrote to memory of 3768 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 1952 wrote to memory of 3860 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1952 wrote to memory of 3924 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\System32\RuntimeBroker.exe
PID 1952 wrote to memory of 4020 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1952 wrote to memory of 3472 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\System32\RuntimeBroker.exe
PID 1952 wrote to memory of 2476 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1952 wrote to memory of 432 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\System32\RuntimeBroker.exe
PID 1952 wrote to memory of 3044 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1952 wrote to memory of 2508 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1952 wrote to memory of 724 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 1952 wrote to memory of 724 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 1952 wrote to memory of 856 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 1952 wrote to memory of 548 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\BackgroundTaskHost.exe
PID 1952 wrote to memory of 512 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1952 wrote to memory of 512 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 724 wrote to memory of 624 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 724 wrote to memory of 624 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 724 wrote to memory of 624 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 624 wrote to memory of 788 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\fontdrvhost.exe
PID 624 wrote to memory of 796 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\fontdrvhost.exe
PID 624 wrote to memory of 380 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\dwm.exe
PID 624 wrote to memory of 2652 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\sihost.exe
PID 624 wrote to memory of 2668 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\svchost.exe
PID 624 wrote to memory of 2748 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\taskhostw.exe
PID 624 wrote to memory of 3452 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\Explorer.EXE
PID 624 wrote to memory of 3560 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\svchost.exe
PID 624 wrote to memory of 3768 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 624 wrote to memory of 3860 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe

"C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe"

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://shop58477515.taobao.com/

C:\Windows\system32\BackgroundTaskHost.exe

"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:17410 /prefetch:2

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 shop58477515.taobao.com udp
CN 203.119.169.39:80 shop58477515.taobao.com tcp
CN 203.119.169.39:80 shop58477515.taobao.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.184:443 www.bing.com tcp
CN 203.119.169.39:80 shop58477515.taobao.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 184.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 shop58477515.taobao.com udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 52.111.227.14:443 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

memory/4356-0-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4356-1-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-10-0x0000000002200000-0x0000000002202000-memory.dmp

memory/4356-13-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-7-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-16-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-17-0x00000000029A0000-0x0000000003A2E000-memory.dmp

C:\Windows\SysWOW64\ppsap.exe

MD5 3a263e834baaf70dc488d28832ec4d42
SHA1 8d33461d29c80edb9807974845fbd40729184376
SHA256 2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558
SHA512 4c32a1ebe1622928c2ab7779c1aca8eaef50bb4a3627e86c3a6bf92471cf101181d6eb01381199fedc15378dad641a8805cac35dba84f7c7dca435bcb794837b

memory/724-23-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4356-12-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-14-0x0000000002200000-0x0000000002202000-memory.dmp

memory/4356-6-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-15-0x0000000002200000-0x0000000002202000-memory.dmp

memory/4356-4-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-11-0x0000000004A20000-0x0000000004A21000-memory.dmp

memory/4356-5-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-24-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-25-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-28-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-29-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-30-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-34-0x00000000029A0000-0x0000000003A2E000-memory.dmp

memory/4356-39-0x0000000002200000-0x0000000002202000-memory.dmp

memory/4356-47-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1952-49-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1952-58-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/1952-55-0x0000000002A90000-0x0000000003B1E000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 b3cafb5e376366ff5138e3152246cee1
SHA1 8ddec39d6b1aa2ef4a5e5a66ed6060719b5344e7
SHA256 a4ae75782720251b2d5a0270d59520249c78c4c2b41f0e8d8bb3341fa7b95e7b
SHA512 babbc39ae8737961da21fab5d444b84d9059cb182d4cf8f666876fc5ebd2cd12d0fc9cbc14c969fa0cd8fe5dfa99492350c07a83a26586f8cbc89feee654bc4c

memory/1952-57-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/1952-64-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/1952-66-0x0000000001F60000-0x0000000001F62000-memory.dmp

memory/1952-68-0x0000000001F60000-0x0000000001F62000-memory.dmp

memory/724-67-0x0000000003240000-0x0000000003242000-memory.dmp

memory/724-65-0x0000000003240000-0x0000000003242000-memory.dmp

memory/1952-59-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/1952-63-0x0000000001F70000-0x0000000001F71000-memory.dmp

memory/724-61-0x0000000003520000-0x0000000003521000-memory.dmp

memory/1952-56-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/1952-54-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/1952-53-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/1952-50-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/1952-71-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/1952-86-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1952-81-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/1952-72-0x0000000002A90000-0x0000000003B1E000-memory.dmp

memory/624-88-0x0000000002A10000-0x0000000003A9E000-memory.dmp

memory/624-99-0x0000000000400000-0x000000000041E000-memory.dmp

memory/624-114-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1912-116-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1912-142-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3708-163-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3384-165-0x0000000000400000-0x000000000041E000-memory.dmp

memory/720-169-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1560-173-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3328-175-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3328-178-0x0000000000400000-0x000000000041E000-memory.dmp

memory/780-185-0x0000000000400000-0x000000000041E000-memory.dmp

memory/780-188-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4708-190-0x0000000000400000-0x000000000041E000-memory.dmp

memory/724-193-0x0000000003240000-0x0000000003242000-memory.dmp

memory/2304-192-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2304-196-0x0000000000400000-0x000000000041E000-memory.dmp

memory/5068-200-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3000-202-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3000-205-0x0000000000400000-0x000000000041E000-memory.dmp

memory/924-207-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4036-209-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4036-212-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4008-214-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4008-217-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4920-221-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4564-223-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4564-226-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3624-228-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3624-231-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1812-235-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3692-242-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3692-243-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3968-249-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3968-252-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4612-254-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4612-257-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1844-259-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3604-261-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3604-264-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3960-266-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3960-269-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3616-271-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3616-274-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4840-276-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4840-279-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4280-281-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4280-284-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1868-288-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4988-290-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4988-293-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3464-297-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1840-299-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1840-302-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3440-304-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3440-307-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4084-309-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4084-312-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4536-316-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4536-319-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4500-321-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4500-324-0x0000000000400000-0x000000000041E000-memory.dmp

memory/748-326-0x0000000000400000-0x000000000041E000-memory.dmp

memory/748-329-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4168-331-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4168-334-0x0000000000400000-0x000000000041E000-memory.dmp

C:\jgnpx.exe

MD5 f3c341a332c8e074afe236c71d31f2f2
SHA1 e61397d353741376871c0e6deda44438ed9c2201
SHA256 292194e5f9403f3e8f7e32c8914131348f2232c5bff0ee07c4b01a44194ce339
SHA512 c68497c7a9641a5879234e2830d10abb5bac532578ca70da806565c8cdef6aa76c8882de2be2e29b20947bc83825a8730288e4ec25f5f605b3b38a97485f869d

memory/1752-344-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1800-346-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1800-349-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4596-351-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4596-354-0x0000000000400000-0x000000000041E000-memory.dmp

memory/424-358-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3352-360-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3352-363-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2508-365-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2508-368-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1416-370-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1416-373-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4756-375-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4756-378-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1532-380-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1532-383-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4508-385-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4508-388-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3096-390-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3096-393-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3320-395-0x0000000000400000-0x000000000041E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 20:04

Reported

2024-06-15 20:06

Platform

win7-20240508-en

Max time kernel

15s

Max time network

51s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\????.lnk C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\????.lnk C:\Windows\SysWOW64\ppsap.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ppsap.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PPS Accelerator = "C:\\Windows\\system32\\ppsap.exe" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PPS Accelerator = "C:\\Windows\\system32\\ppsap.exe" C:\Windows\SysWOW64\ppsap.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\ppsap.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\ppsap.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ppsap.exe C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
File opened for modification C:\Windows\SysWOW64\ppsap.exe C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6DDC56A1-2B52-11EF-A9A6-4658C477BD5D} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ppsap.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A
N/A N/A C:\Windows\SysWOW64\ppsap.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1724 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\taskhost.exe
PID 1724 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\Dwm.exe
PID 1724 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\Explorer.EXE
PID 1724 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\system32\DllHost.exe
PID 1724 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\SysWOW64\ppsap.exe
PID 1724 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\SysWOW64\ppsap.exe
PID 1724 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\SysWOW64\ppsap.exe
PID 1724 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2840 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2636 wrote to memory of 2840 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2636 wrote to memory of 2840 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2636 wrote to memory of 2840 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2840 wrote to memory of 2516 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2840 wrote to memory of 2516 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2840 wrote to memory of 2516 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2840 wrote to memory of 2516 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2636 wrote to memory of 3024 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 3024 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 3024 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 3024 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2404 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2404 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2404 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2404 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2404 wrote to memory of 1116 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\taskhost.exe
PID 2404 wrote to memory of 1172 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\Dwm.exe
PID 2404 wrote to memory of 1208 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1756 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 2404 wrote to memory of 2636 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2404 wrote to memory of 2636 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2404 wrote to memory of 2840 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2404 wrote to memory of 2516 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2404 wrote to memory of 2516 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2636 wrote to memory of 1116 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\taskhost.exe
PID 2636 wrote to memory of 1172 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\Dwm.exe
PID 2636 wrote to memory of 1208 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\Explorer.EXE
PID 2636 wrote to memory of 1756 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\system32\DllHost.exe
PID 2636 wrote to memory of 2840 N/A C:\Windows\SysWOW64\ppsap.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2636 wrote to memory of 564 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 564 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 564 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 564 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2276 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2276 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2276 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2276 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 1352 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 1352 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 1352 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 1352 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 620 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 620 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 620 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 620 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 3040 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 3040 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 3040 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 3040 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2920 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2920 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2920 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 2920 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 1732 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe
PID 2636 wrote to memory of 1732 N/A C:\Windows\SysWOW64\ppsap.exe C:\Windows\SysWOW64\ppsap.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\ppsap.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe

"C:\Users\Admin\AppData\Local\Temp\2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558.exe"

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://shop58477515.taobao.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

C:\Windows\SysWOW64\ppsap.exe

C:\Windows\system32\ppsap.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 shop58477515.taobao.com udp
US 8.8.8.8:53 shop58477515.taobao.com udp
US 8.8.8.8:53 shop58477515.taobao.com udp

Files

memory/1724-0-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1724-3-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/1724-1-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/1724-6-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/1724-27-0x0000000000880000-0x0000000000881000-memory.dmp

memory/1724-5-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/1724-10-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/1116-13-0x0000000002070000-0x0000000002072000-memory.dmp

memory/1724-23-0x0000000000880000-0x0000000000881000-memory.dmp

memory/1724-20-0x0000000000870000-0x0000000000872000-memory.dmp

memory/1724-29-0x0000000000870000-0x0000000000872000-memory.dmp

memory/1724-28-0x0000000000870000-0x0000000000872000-memory.dmp

memory/1724-8-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/1724-4-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/1724-12-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/1724-7-0x0000000002540000-0x00000000035CE000-memory.dmp

\Windows\SysWOW64\ppsap.exe

MD5 3a263e834baaf70dc488d28832ec4d42
SHA1 8d33461d29c80edb9807974845fbd40729184376
SHA256 2d61cefcf656abc129b86c969dc40d7760f102176f4d6b04538b6cc4f7887558
SHA512 4c32a1ebe1622928c2ab7779c1aca8eaef50bb4a3627e86c3a6bf92471cf101181d6eb01381199fedc15378dad641a8805cac35dba84f7c7dca435bcb794837b

memory/2636-37-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1724-36-0x0000000003F00000-0x0000000003F1E000-memory.dmp

memory/1724-52-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/1724-51-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3024-58-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-57-0x0000000001E70000-0x0000000001E8E000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 9ce3730693fe3d03b3dc3b7c64be074b
SHA1 8483b707a5a3b00fef6ddd97aa8d80ecf1e78a81
SHA256 a5f2e2085da0d04daae51f4a30f3354d6dd38272353c8f50b6e2d6b7f9049c25
SHA512 a92d803b4d9c683c2d23cfe85a24957af20689770c6e34952d7ca778b89c2e880b0dc744260ce46cf400a808687035269f33e7ccce0719e5570534cbe1b64d11

memory/3024-61-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/3024-63-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/3024-65-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/3024-67-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/3024-68-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/3024-66-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/3024-64-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/3024-62-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/3024-59-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/3024-71-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/3024-81-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-85-0x0000000001E70000-0x0000000001E8E000-memory.dmp

memory/2404-88-0x00000000025F0000-0x000000000367E000-memory.dmp

memory/2404-86-0x00000000025F0000-0x000000000367E000-memory.dmp

memory/2404-92-0x00000000025F0000-0x000000000367E000-memory.dmp

memory/2404-90-0x00000000025F0000-0x000000000367E000-memory.dmp

memory/2404-134-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2404-95-0x00000000025F0000-0x000000000367E000-memory.dmp

memory/2404-89-0x00000000025F0000-0x000000000367E000-memory.dmp

memory/2404-94-0x00000000025F0000-0x000000000367E000-memory.dmp

memory/2404-91-0x00000000025F0000-0x000000000367E000-memory.dmp

memory/2404-93-0x00000000025F0000-0x000000000367E000-memory.dmp

memory/2404-87-0x00000000025F0000-0x000000000367E000-memory.dmp

memory/2636-157-0x0000000004040000-0x000000000405E000-memory.dmp

memory/564-159-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-155-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-164-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2276-167-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1352-173-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1352-176-0x0000000000400000-0x000000000041E000-memory.dmp

memory/620-182-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-181-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-187-0x0000000004040000-0x000000000405E000-memory.dmp

memory/3040-188-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2920-195-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-193-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-192-0x0000000004040000-0x000000000405E000-memory.dmp

memory/1732-205-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1732-202-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-201-0x0000000004040000-0x000000000405E000-memory.dmp

memory/296-211-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2868-218-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2868-221-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-217-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2700-236-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-234-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2736-243-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-242-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2736-246-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2140-252-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1724-259-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1724-258-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-266-0x0000000004040000-0x000000000405E000-memory.dmp

memory/1920-267-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1976-276-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1976-279-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-275-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-274-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2488-285-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1516-291-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1516-294-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1200-301-0x0000000000400000-0x000000000041E000-memory.dmp

memory/532-314-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-313-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-312-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-322-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-321-0x0000000004040000-0x000000000405E000-memory.dmp

memory/552-328-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-332-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-331-0x0000000004040000-0x000000000405E000-memory.dmp

memory/1164-333-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-336-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2372-339-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-342-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2308-344-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2308-343-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2172-349-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-348-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-347-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-352-0x0000000004040000-0x000000000405E000-memory.dmp

memory/1872-353-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-351-0x0000000004040000-0x000000000405E000-memory.dmp

memory/1872-356-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-359-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-358-0x0000000004040000-0x000000000405E000-memory.dmp

memory/1940-360-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1140-362-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1140-365-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-375-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-374-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2200-376-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-377-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-378-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2924-379-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2924-382-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-384-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-383-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2248-385-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-387-0x0000000004040000-0x000000000405E000-memory.dmp

memory/1764-388-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-386-0x0000000004040000-0x000000000405E000-memory.dmp

memory/1764-391-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2000-394-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-393-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2636-392-0x0000000004040000-0x000000000405E000-memory.dmp

memory/2000-397-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2636-398-0x0000000004040000-0x000000000405E000-memory.dmp

C:\ihmhjx.pif

MD5 64ec89689f183cda300cc740bc36e290
SHA1 cef2fc04aeb6a8919271689fd8b102caadb6362b
SHA256 e9bc5a3c0edfe2bf653b487120d6717052ebf3851729020a755d6821be821d6d
SHA512 6f0a9e4714fad9a52494c1b890b5dd2dea5b6210392a8c67fd268889450c8a7e4f6040c97ac96a490127e7666e4e742d785d270558267c8aad9005864fcf9f75