Malware Analysis Report

2025-08-11 06:58

Sample ID 241107-d41wwatnax
Target 3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728aN
SHA256 3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728a
Tags
sality backdoor discovery evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728a

Threat Level: Known bad

The file 3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728aN was found to be: Known bad.

Malicious Activity Summary

sality backdoor discovery evasion trojan upx

Windows security bypass

UAC bypass

Sality family

Modifies firewall policy service

Sality

Executes dropped EXE

Windows security modification

Loads dropped DLL

Enumerates connected drives

Checks whether UAC is enabled

UPX packed file

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 03:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 03:34

Reported

2024-11-07 03:37

Platform

win7-20240903-en

Max time kernel

120s

Max time network

120s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A

Sality

backdoor sality

Sality family

sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\f76dc3b C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
File created C:\Windows\f772c2f C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2616 wrote to memory of 1960 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2616 wrote to memory of 1960 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2616 wrote to memory of 1960 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2616 wrote to memory of 1960 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2616 wrote to memory of 1960 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2616 wrote to memory of 1960 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2616 wrote to memory of 1960 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 2012 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76dbce.exe
PID 1960 wrote to memory of 2012 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76dbce.exe
PID 1960 wrote to memory of 2012 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76dbce.exe
PID 1960 wrote to memory of 2012 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76dbce.exe
PID 2012 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\system32\taskhost.exe
PID 2012 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\system32\Dwm.exe
PID 2012 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\Explorer.EXE
PID 2012 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\system32\DllHost.exe
PID 2012 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\system32\rundll32.exe
PID 2012 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\SysWOW64\rundll32.exe
PID 2012 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\SysWOW64\rundll32.exe
PID 1960 wrote to memory of 2552 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76dd93.exe
PID 1960 wrote to memory of 2552 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76dd93.exe
PID 1960 wrote to memory of 2552 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76dd93.exe
PID 1960 wrote to memory of 2552 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76dd93.exe
PID 1960 wrote to memory of 1944 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe
PID 1960 wrote to memory of 1944 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe
PID 1960 wrote to memory of 1944 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe
PID 1960 wrote to memory of 1944 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe
PID 2012 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\system32\taskhost.exe
PID 2012 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\system32\Dwm.exe
PID 2012 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\Explorer.EXE
PID 2012 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Windows\system32\DllHost.exe
PID 2012 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Users\Admin\AppData\Local\Temp\f76dd93.exe
PID 2012 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Users\Admin\AppData\Local\Temp\f76dd93.exe
PID 2012 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe
PID 2012 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\f76dbce.exe C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe
PID 1944 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe C:\Windows\system32\taskhost.exe
PID 1944 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe C:\Windows\system32\Dwm.exe
PID 1944 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe C:\Windows\Explorer.EXE
PID 1944 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe C:\Windows\system32\DllHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76dbce.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728aN.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728aN.dll,#1

C:\Users\Admin\AppData\Local\Temp\f76dbce.exe

C:\Users\Admin\AppData\Local\Temp\f76dbce.exe

C:\Users\Admin\AppData\Local\Temp\f76dd93.exe

C:\Users\Admin\AppData\Local\Temp\f76dd93.exe

C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe

C:\Users\Admin\AppData\Local\Temp\f76f7c7.exe

Network

N/A

Files

memory/1960-2-0x0000000010000000-0x0000000010020000-memory.dmp

memory/1960-4-0x0000000010000000-0x0000000010020000-memory.dmp

memory/1960-1-0x0000000010000000-0x0000000010020000-memory.dmp

memory/1960-0-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2012-14-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1960-13-0x00000000001B0000-0x00000000001C2000-memory.dmp

memory/1960-12-0x00000000001B0000-0x00000000001C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f76dbce.exe

MD5 1533ebac136efa69caa3cc580643f172
SHA1 a031ed4833fa6f7a9442df63688c4c932fbbef4c
SHA256 b6bef51c4b617dfc72802416539bfa58f25a8650fd665f0932d11f77ab88463f
SHA512 e4b8521396b6d466480dbf255daa9bc0749c7acb48f9c67838fb4b2e4c4a3070d15daebbdf9538f7e4e1659e3de904d0612205214a9b5a22285beb4a73d9e8de

memory/2012-18-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-21-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-23-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-22-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-19-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-17-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-54-0x0000000000380000-0x0000000000382000-memory.dmp

memory/1960-64-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/2552-66-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1960-63-0x0000000000210000-0x0000000000222000-memory.dmp

memory/2012-62-0x0000000000380000-0x0000000000382000-memory.dmp

memory/1960-61-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/2012-25-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/1960-52-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/2012-51-0x0000000000390000-0x0000000000391000-memory.dmp

memory/2012-50-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-24-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-20-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/1960-41-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/1960-40-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/1100-31-0x0000000000350000-0x0000000000352000-memory.dmp

memory/2012-67-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-69-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-70-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-68-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-71-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-73-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-74-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/1960-86-0x00000000001B0000-0x00000000001B2000-memory.dmp

memory/2012-88-0x0000000000380000-0x0000000000382000-memory.dmp

memory/1944-87-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1960-82-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/2012-89-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-90-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-92-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2012-94-0x0000000000630000-0x00000000016EA000-memory.dmp

memory/2552-104-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2552-105-0x0000000000220000-0x0000000000222000-memory.dmp

memory/1944-109-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/1944-112-0x0000000000360000-0x0000000000362000-memory.dmp

memory/2552-111-0x0000000000220000-0x0000000000222000-memory.dmp

memory/1944-110-0x0000000000360000-0x0000000000362000-memory.dmp

memory/2552-133-0x0000000000220000-0x0000000000222000-memory.dmp

memory/2012-156-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2012-157-0x0000000000630000-0x00000000016EA000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 9fd6f8cae4f01d8a3cb1c329adb1c9e1
SHA1 aa6329430ede3d78d0330fcb666993bc309ea3da
SHA256 7bdc33295e8fd86fe67cc80008d5c54cf854d6e510a8ba7f1fbe315d8d0d1e36
SHA512 207006078ae0182b746da6a1b428553a721f1341d2b86257be7bd8618b24cf2ca13de1524e25b12a5c45422eea8b6a03d696b02c9eb973559dd1d7021e860407

memory/1944-171-0x0000000000920000-0x00000000019DA000-memory.dmp

memory/2552-188-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1944-214-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1944-213-0x0000000000920000-0x00000000019DA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 03:34

Reported

2024-11-07 03:37

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

141s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A

Sality

backdoor sality

Sality family

sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e5777d0 C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
File created C:\Windows\e57c8af C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e577908.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e5792ab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4544 wrote to memory of 4796 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4544 wrote to memory of 4796 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4544 wrote to memory of 4796 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4796 wrote to memory of 864 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e577762.exe
PID 4796 wrote to memory of 864 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e577762.exe
PID 4796 wrote to memory of 864 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e577762.exe
PID 864 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\fontdrvhost.exe
PID 864 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\fontdrvhost.exe
PID 864 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\dwm.exe
PID 864 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\sihost.exe
PID 864 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\svchost.exe
PID 864 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\taskhostw.exe
PID 864 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\svchost.exe
PID 864 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\DllHost.exe
PID 864 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 864 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\System32\RuntimeBroker.exe
PID 864 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 864 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\System32\RuntimeBroker.exe
PID 864 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 864 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\System32\RuntimeBroker.exe
PID 864 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\backgroundTaskHost.exe
PID 864 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\rundll32.exe
PID 864 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\SysWOW64\rundll32.exe
PID 864 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\SysWOW64\rundll32.exe
PID 4796 wrote to memory of 1540 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e577908.exe
PID 4796 wrote to memory of 1540 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e577908.exe
PID 4796 wrote to memory of 1540 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e577908.exe
PID 4796 wrote to memory of 1276 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5792ab.exe
PID 4796 wrote to memory of 1276 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5792ab.exe
PID 4796 wrote to memory of 1276 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5792ab.exe
PID 4796 wrote to memory of 4536 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5792da.exe
PID 4796 wrote to memory of 4536 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5792da.exe
PID 4796 wrote to memory of 4536 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5792da.exe
PID 864 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\fontdrvhost.exe
PID 864 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\fontdrvhost.exe
PID 864 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\dwm.exe
PID 864 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\sihost.exe
PID 864 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\svchost.exe
PID 864 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\taskhostw.exe
PID 864 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\Explorer.EXE
PID 864 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\svchost.exe
PID 864 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\system32\DllHost.exe
PID 864 wrote to memory of 3940 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 864 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\System32\RuntimeBroker.exe
PID 864 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 864 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\System32\RuntimeBroker.exe
PID 864 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 864 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\System32\RuntimeBroker.exe
PID 864 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Users\Admin\AppData\Local\Temp\e577908.exe
PID 864 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Users\Admin\AppData\Local\Temp\e577908.exe
PID 864 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\System32\RuntimeBroker.exe
PID 864 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Windows\System32\RuntimeBroker.exe
PID 864 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Users\Admin\AppData\Local\Temp\e5792ab.exe
PID 864 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Users\Admin\AppData\Local\Temp\e5792ab.exe
PID 864 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Users\Admin\AppData\Local\Temp\e5792da.exe
PID 864 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\e577762.exe C:\Users\Admin\AppData\Local\Temp\e5792da.exe
PID 4536 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\e5792da.exe C:\Windows\system32\fontdrvhost.exe
PID 4536 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\e5792da.exe C:\Windows\system32\fontdrvhost.exe
PID 4536 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\e5792da.exe C:\Windows\system32\dwm.exe
PID 4536 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\e5792da.exe C:\Windows\system32\sihost.exe
PID 4536 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\e5792da.exe C:\Windows\system32\svchost.exe
PID 4536 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\e5792da.exe C:\Windows\system32\taskhostw.exe
PID 4536 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e5792da.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e577762.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e5792da.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728aN.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ad879c2b2800ab4bbea43589d2673efbde2f870b2273509eab9eaf040c9728aN.dll,#1

C:\Users\Admin\AppData\Local\Temp\e577762.exe

C:\Users\Admin\AppData\Local\Temp\e577762.exe

C:\Users\Admin\AppData\Local\Temp\e577908.exe

C:\Users\Admin\AppData\Local\Temp\e577908.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\e5792ab.exe

C:\Users\Admin\AppData\Local\Temp\e5792ab.exe

C:\Users\Admin\AppData\Local\Temp\e5792da.exe

C:\Users\Admin\AppData\Local\Temp\e5792da.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 98.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

memory/4796-0-0x0000000010000000-0x0000000010020000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e577762.exe

MD5 1533ebac136efa69caa3cc580643f172
SHA1 a031ed4833fa6f7a9442df63688c4c932fbbef4c
SHA256 b6bef51c4b617dfc72802416539bfa58f25a8650fd665f0932d11f77ab88463f
SHA512 e4b8521396b6d466480dbf255daa9bc0749c7acb48f9c67838fb4b2e4c4a3070d15daebbdf9538f7e4e1659e3de904d0612205214a9b5a22285beb4a73d9e8de

memory/864-4-0x0000000000400000-0x0000000000412000-memory.dmp

memory/864-6-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-10-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-17-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-18-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-34-0x0000000000630000-0x0000000000632000-memory.dmp

memory/4796-33-0x0000000003780000-0x0000000003782000-memory.dmp

memory/1540-32-0x0000000000400000-0x0000000000412000-memory.dmp

memory/864-29-0x0000000000630000-0x0000000000632000-memory.dmp

memory/864-27-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-11-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4796-24-0x0000000003780000-0x0000000003782000-memory.dmp

memory/864-23-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-22-0x0000000000640000-0x0000000000641000-memory.dmp

memory/4796-20-0x0000000003810000-0x0000000003811000-memory.dmp

memory/4796-19-0x0000000003780000-0x0000000003782000-memory.dmp

memory/864-8-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-9-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-28-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-35-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-36-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-37-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-38-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-39-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-40-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-42-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-43-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-55-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-57-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-58-0x0000000000630000-0x0000000000632000-memory.dmp

memory/864-60-0x0000000000860000-0x000000000191A000-memory.dmp

memory/4536-72-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/1276-71-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4536-70-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/1540-68-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/1276-69-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/4536-67-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/1276-65-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/1540-63-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/1540-62-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/864-74-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-75-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-78-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-79-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-82-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-83-0x0000000000860000-0x000000000191A000-memory.dmp

memory/1540-86-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/864-87-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-90-0x0000000000860000-0x000000000191A000-memory.dmp

memory/1276-91-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/864-97-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-106-0x0000000000630000-0x0000000000632000-memory.dmp

memory/864-101-0x0000000000860000-0x000000000191A000-memory.dmp

memory/864-117-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1540-121-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4536-123-0x0000000000B40000-0x0000000001BFA000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 6a0ce950db94d75eaa33e777f2ba8032
SHA1 346a9f3a4249ed25d9fcf8c735d53bdc0f128b27
SHA256 27a034fef1b148903873144aea9a79c9342578bdf2d3c9c74b658b8a77d4528b
SHA512 f0dd1ea77a567b9e85d1649cdcd34b4bd734757529a8362ec881b426f95e9cfad6b4cea9d9ff7fd2f0b58827a6d7c6a00db6e73739921e41dbfc2cf74c0d0ed5

memory/1276-149-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4536-166-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4536-167-0x0000000000B40000-0x0000000001BFA000-memory.dmp