Malware Analysis Report

2024-11-16 13:12

Sample ID 240625-c4pm6swfme
Target d010d63e510da857c0cc59c50a20d922a3177e5c268b9c01742d91fe464a9a31
SHA256 d010d63e510da857c0cc59c50a20d922a3177e5c268b9c01742d91fe464a9a31
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d010d63e510da857c0cc59c50a20d922a3177e5c268b9c01742d91fe464a9a31

Threat Level: Known bad

The file d010d63e510da857c0cc59c50a20d922a3177e5c268b9c01742d91fe464a9a31 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

Sality

Modifies firewall policy service

Windows security bypass

UAC bypass

UPX dump on OEP (original entry point)

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

Loads dropped DLL

Executes dropped EXE

UPX packed file

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 02:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 02:38

Reported

2024-06-25 02:40

Platform

win7-20240508-en

Max time kernel

118s

Max time network

119s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\f76273f C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
File created C:\Windows\f767752 C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2020 wrote to memory of 1464 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2020 wrote to memory of 1464 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2020 wrote to memory of 1464 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2020 wrote to memory of 1464 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2020 wrote to memory of 1464 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2020 wrote to memory of 1464 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2020 wrote to memory of 1464 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1464 wrote to memory of 2472 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7626d2.exe
PID 1464 wrote to memory of 2472 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7626d2.exe
PID 1464 wrote to memory of 2472 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7626d2.exe
PID 1464 wrote to memory of 2472 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7626d2.exe
PID 2472 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Windows\system32\taskhost.exe
PID 2472 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Windows\system32\Dwm.exe
PID 2472 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Windows\Explorer.EXE
PID 2472 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Windows\system32\DllHost.exe
PID 2472 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Windows\system32\rundll32.exe
PID 2472 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Windows\SysWOW64\rundll32.exe
PID 2472 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Windows\SysWOW64\rundll32.exe
PID 1464 wrote to memory of 2040 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f762896.exe
PID 1464 wrote to memory of 2040 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f762896.exe
PID 1464 wrote to memory of 2040 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f762896.exe
PID 1464 wrote to memory of 2040 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f762896.exe
PID 1464 wrote to memory of 2984 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76425d.exe
PID 1464 wrote to memory of 2984 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76425d.exe
PID 1464 wrote to memory of 2984 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76425d.exe
PID 1464 wrote to memory of 2984 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76425d.exe
PID 2472 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Windows\system32\taskhost.exe
PID 2472 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Windows\system32\Dwm.exe
PID 2472 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Windows\Explorer.EXE
PID 2472 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Users\Admin\AppData\Local\Temp\f762896.exe
PID 2472 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Users\Admin\AppData\Local\Temp\f762896.exe
PID 2472 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Users\Admin\AppData\Local\Temp\f76425d.exe
PID 2472 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\f7626d2.exe C:\Users\Admin\AppData\Local\Temp\f76425d.exe
PID 2984 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe C:\Windows\system32\taskhost.exe
PID 2984 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe C:\Windows\system32\Dwm.exe
PID 2984 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\f76425d.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f7626d2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76425d.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d010d63e510da857c0cc59c50a20d922a3177e5c268b9c01742d91fe464a9a31.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d010d63e510da857c0cc59c50a20d922a3177e5c268b9c01742d91fe464a9a31.dll,#1

C:\Users\Admin\AppData\Local\Temp\f7626d2.exe

C:\Users\Admin\AppData\Local\Temp\f7626d2.exe

C:\Users\Admin\AppData\Local\Temp\f762896.exe

C:\Users\Admin\AppData\Local\Temp\f762896.exe

C:\Users\Admin\AppData\Local\Temp\f76425d.exe

C:\Users\Admin\AppData\Local\Temp\f76425d.exe

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\f7626d2.exe

MD5 f1abe15f751785b8173dbe30c08f6657
SHA1 0d2f61d1dc48e2da579156c6ab914f87d4ad34a1
SHA256 f51974d1d958ca45e7ca08a539b5f85c609cea6078645251af82ac6850d62c74
SHA512 60bcc34328d4cf1f93332577ddcf09c200a8c3dc7f17ec0bf92cbfe7423f5c1b9d2e52aa2ebb032160e5dee94eba846bc5d086d55076c01e68ac0859a381c4e1

memory/1464-9-0x00000000001B0000-0x00000000001C2000-memory.dmp

memory/1464-8-0x00000000001B0000-0x00000000001C2000-memory.dmp

memory/2472-11-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1464-4-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2472-16-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-18-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-17-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-22-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-14-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-49-0x0000000003BD0000-0x0000000003BD2000-memory.dmp

memory/1464-56-0x00000000001F0000-0x00000000001F2000-memory.dmp

memory/2472-21-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-20-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-47-0x0000000003C20000-0x0000000003C21000-memory.dmp

memory/1464-46-0x0000000000200000-0x0000000000201000-memory.dmp

memory/2472-19-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/1464-37-0x0000000000200000-0x0000000000201000-memory.dmp

memory/1464-36-0x00000000001F0000-0x00000000001F2000-memory.dmp

memory/1128-29-0x00000000020F0000-0x00000000020F2000-memory.dmp

memory/2472-15-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-23-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-58-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2040-63-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1464-62-0x00000000001F0000-0x00000000001F2000-memory.dmp

memory/1464-61-0x00000000002F0000-0x0000000000302000-memory.dmp

memory/2472-60-0x0000000003BD0000-0x0000000003BD2000-memory.dmp

memory/2472-59-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-64-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-66-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-65-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-68-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-69-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/1464-81-0x0000000000310000-0x0000000000322000-memory.dmp

memory/1464-80-0x00000000001B0000-0x00000000001B2000-memory.dmp

memory/2984-84-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2472-83-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-87-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-90-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2984-106-0x00000000001B0000-0x00000000001B2000-memory.dmp

memory/2984-105-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2040-99-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2984-108-0x00000000001B0000-0x00000000001B2000-memory.dmp

memory/2040-109-0x00000000001B0000-0x00000000001B2000-memory.dmp

memory/2472-110-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-124-0x0000000003BD0000-0x0000000003BD2000-memory.dmp

memory/2472-153-0x00000000006E0000-0x000000000179A000-memory.dmp

memory/2472-154-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 24b7456934c78d19643b0f09eec42df3
SHA1 fbc32643443278f908db4a8398ecb448433ba78b
SHA256 be21daf0574943460034792a77fc69cf1dee6b34f4dbcd722388c51735fe8066
SHA512 6fa7f738bf064898701aee4437adc6c41e5ad17be0ace6bbce224dbd98f9303694f13bd54ed823d4be1e79da4168a98afaa080117273cc4ff7d93b47223894c6

memory/2984-166-0x0000000000920000-0x00000000019DA000-memory.dmp

memory/2040-181-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2984-209-0x0000000000920000-0x00000000019DA000-memory.dmp

memory/2984-208-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 02:38

Reported

2024-06-25 02:40

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

107s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e573d28 C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
File created C:\Windows\e57b083 C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 4868 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2060 wrote to memory of 4868 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2060 wrote to memory of 4868 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4868 wrote to memory of 3652 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e573cab.exe
PID 4868 wrote to memory of 3652 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e573cab.exe
PID 4868 wrote to memory of 3652 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e573cab.exe
PID 3652 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\fontdrvhost.exe
PID 3652 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\fontdrvhost.exe
PID 3652 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\dwm.exe
PID 3652 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\svchost.exe
PID 3652 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\sihost.exe
PID 3652 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\taskhostw.exe
PID 3652 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\Explorer.EXE
PID 3652 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\svchost.exe
PID 3652 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\DllHost.exe
PID 3652 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3652 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\System32\RuntimeBroker.exe
PID 3652 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3652 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\System32\RuntimeBroker.exe
PID 3652 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3652 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\System32\RuntimeBroker.exe
PID 3652 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3652 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3652 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\rundll32.exe
PID 3652 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\SysWOW64\rundll32.exe
PID 3652 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\SysWOW64\rundll32.exe
PID 4868 wrote to memory of 2832 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e573dc4.exe
PID 4868 wrote to memory of 2832 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e573dc4.exe
PID 4868 wrote to memory of 2832 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e573dc4.exe
PID 4868 wrote to memory of 4736 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5761f6.exe
PID 4868 wrote to memory of 4736 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5761f6.exe
PID 4868 wrote to memory of 4736 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5761f6.exe
PID 4868 wrote to memory of 4956 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e576206.exe
PID 4868 wrote to memory of 4956 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e576206.exe
PID 4868 wrote to memory of 4956 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e576206.exe
PID 3652 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\fontdrvhost.exe
PID 3652 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\fontdrvhost.exe
PID 3652 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\dwm.exe
PID 3652 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\svchost.exe
PID 3652 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\sihost.exe
PID 3652 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\taskhostw.exe
PID 3652 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\Explorer.EXE
PID 3652 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\svchost.exe
PID 3652 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\DllHost.exe
PID 3652 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3652 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\System32\RuntimeBroker.exe
PID 3652 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3652 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\System32\RuntimeBroker.exe
PID 3652 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3652 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\System32\RuntimeBroker.exe
PID 3652 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3652 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3652 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Users\Admin\AppData\Local\Temp\e573dc4.exe
PID 3652 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Users\Admin\AppData\Local\Temp\e573dc4.exe
PID 3652 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\System32\RuntimeBroker.exe
PID 3652 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Windows\System32\RuntimeBroker.exe
PID 3652 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Users\Admin\AppData\Local\Temp\e5761f6.exe
PID 3652 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Users\Admin\AppData\Local\Temp\e5761f6.exe
PID 3652 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Users\Admin\AppData\Local\Temp\e576206.exe
PID 3652 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\e573cab.exe C:\Users\Admin\AppData\Local\Temp\e576206.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e573cab.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e576206.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d010d63e510da857c0cc59c50a20d922a3177e5c268b9c01742d91fe464a9a31.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\d010d63e510da857c0cc59c50a20d922a3177e5c268b9c01742d91fe464a9a31.dll,#1

C:\Users\Admin\AppData\Local\Temp\e573cab.exe

C:\Users\Admin\AppData\Local\Temp\e573cab.exe

C:\Users\Admin\AppData\Local\Temp\e573dc4.exe

C:\Users\Admin\AppData\Local\Temp\e573dc4.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\e5761f6.exe

C:\Users\Admin\AppData\Local\Temp\e5761f6.exe

C:\Users\Admin\AppData\Local\Temp\e576206.exe

C:\Users\Admin\AppData\Local\Temp\e576206.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\e573cab.exe

MD5 f1abe15f751785b8173dbe30c08f6657
SHA1 0d2f61d1dc48e2da579156c6ab914f87d4ad34a1
SHA256 f51974d1d958ca45e7ca08a539b5f85c609cea6078645251af82ac6850d62c74
SHA512 60bcc34328d4cf1f93332577ddcf09c200a8c3dc7f17ec0bf92cbfe7423f5c1b9d2e52aa2ebb032160e5dee94eba846bc5d086d55076c01e68ac0859a381c4e1

memory/3652-5-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4868-4-0x0000000010000000-0x0000000010020000-memory.dmp

memory/3652-6-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-10-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-11-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/2832-33-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3652-19-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-27-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-34-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-32-0x00000000005F0000-0x00000000005F2000-memory.dmp

memory/4868-31-0x0000000001100000-0x0000000001102000-memory.dmp

memory/3652-18-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-23-0x0000000001B00000-0x0000000001B01000-memory.dmp

memory/3652-28-0x00000000005F0000-0x00000000005F2000-memory.dmp

memory/4868-20-0x0000000001100000-0x0000000001102000-memory.dmp

memory/3652-17-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-9-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-8-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/4868-24-0x0000000001100000-0x0000000001102000-memory.dmp

memory/4868-21-0x0000000003F80000-0x0000000003F81000-memory.dmp

memory/3652-36-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-35-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-37-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-39-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-38-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/4956-53-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4736-47-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3652-54-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/2832-57-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4736-59-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/4736-62-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4956-61-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/2832-56-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/2832-64-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4956-66-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4736-65-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/3652-67-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-69-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-70-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-71-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-73-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-74-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-77-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-80-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-82-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-91-0x00000000005F0000-0x00000000005F2000-memory.dmp

memory/3652-86-0x0000000000800000-0x00000000018BA000-memory.dmp

memory/3652-102-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2832-106-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4736-110-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 30b946017548221cdeca55174b48a0a2
SHA1 ba504d0da959fddafad32bd0caa81aabc5f256c0
SHA256 5963f32feb355ef03720969df9b8fc016db9be12f73a7b81102d3788a5e84378
SHA512 f17e27b84cb163d6d6ddf315ae0b530001ee6a94bd4690f5412ae405b87174925d7b1da7b154d13f63e10e1e21bd0fbbfef503a9bf43f0b1b0adb38615dd016b

memory/4956-134-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4956-135-0x0000000000B40000-0x0000000001BFA000-memory.dmp