Malware Analysis Report

2025-08-06 01:12

Sample ID 241107-ja4cssydkn
Target 1e16eeca50e75e7f20df367db63348d3393bb9dbeab055004cedff76414abb4cN
SHA256 1e16eeca50e75e7f20df367db63348d3393bb9dbeab055004cedff76414abb4c
Tags
sality backdoor discovery evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1e16eeca50e75e7f20df367db63348d3393bb9dbeab055004cedff76414abb4c

Threat Level: Known bad

The file 1e16eeca50e75e7f20df367db63348d3393bb9dbeab055004cedff76414abb4cN was found to be: Known bad.

Malicious Activity Summary

sality backdoor discovery evasion trojan upx

Sality family

Sality

Windows security bypass

UAC bypass

Modifies firewall policy service

Executes dropped EXE

Windows security modification

Loads dropped DLL

Enumerates connected drives

Checks whether UAC is enabled

UPX packed file

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 07:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 07:28

Reported

2024-11-07 07:31

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A

Sality

backdoor sality

Sality family

sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e57b5e2 C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
File created C:\Windows\e5811ed C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e57ea9e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e57b8e0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4028 wrote to memory of 1392 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4028 wrote to memory of 1392 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4028 wrote to memory of 1392 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1392 wrote to memory of 3780 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b575.exe
PID 1392 wrote to memory of 3780 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b575.exe
PID 1392 wrote to memory of 3780 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b575.exe
PID 3780 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\fontdrvhost.exe
PID 3780 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\fontdrvhost.exe
PID 3780 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\dwm.exe
PID 3780 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\sihost.exe
PID 3780 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\svchost.exe
PID 3780 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\taskhostw.exe
PID 3780 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\Explorer.EXE
PID 3780 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\svchost.exe
PID 3780 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\DllHost.exe
PID 3780 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3780 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\System32\RuntimeBroker.exe
PID 3780 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3780 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\System32\RuntimeBroker.exe
PID 3780 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3780 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\System32\RuntimeBroker.exe
PID 3780 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3780 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\rundll32.exe
PID 3780 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\SysWOW64\rundll32.exe
PID 3780 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\SysWOW64\rundll32.exe
PID 1392 wrote to memory of 2260 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b8e0.exe
PID 1392 wrote to memory of 2260 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b8e0.exe
PID 1392 wrote to memory of 2260 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57b8e0.exe
PID 3780 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\fontdrvhost.exe
PID 3780 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\fontdrvhost.exe
PID 3780 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\dwm.exe
PID 3780 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\sihost.exe
PID 3780 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\svchost.exe
PID 3780 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\taskhostw.exe
PID 3780 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\Explorer.EXE
PID 3780 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\svchost.exe
PID 3780 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\DllHost.exe
PID 3780 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3780 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\System32\RuntimeBroker.exe
PID 3780 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3780 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\System32\RuntimeBroker.exe
PID 3780 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3780 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\System32\RuntimeBroker.exe
PID 3780 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3780 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Windows\system32\rundll32.exe
PID 3780 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Users\Admin\AppData\Local\Temp\e57b8e0.exe
PID 3780 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e57b575.exe C:\Users\Admin\AppData\Local\Temp\e57b8e0.exe
PID 1392 wrote to memory of 3428 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe
PID 1392 wrote to memory of 3428 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe
PID 1392 wrote to memory of 3428 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe
PID 1392 wrote to memory of 5000 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57ea9e.exe
PID 1392 wrote to memory of 5000 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57ea9e.exe
PID 1392 wrote to memory of 5000 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\e57ea9e.exe
PID 3428 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\system32\fontdrvhost.exe
PID 3428 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\system32\fontdrvhost.exe
PID 3428 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\system32\dwm.exe
PID 3428 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\system32\sihost.exe
PID 3428 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\system32\svchost.exe
PID 3428 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\system32\taskhostw.exe
PID 3428 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\Explorer.EXE
PID 3428 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\system32\svchost.exe
PID 3428 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\system32\DllHost.exe
PID 3428 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3428 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe C:\Windows\System32\RuntimeBroker.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e57b575.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e16eeca50e75e7f20df367db63348d3393bb9dbeab055004cedff76414abb4cN.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e16eeca50e75e7f20df367db63348d3393bb9dbeab055004cedff76414abb4cN.dll,#1

C:\Users\Admin\AppData\Local\Temp\e57b575.exe

C:\Users\Admin\AppData\Local\Temp\e57b575.exe

C:\Users\Admin\AppData\Local\Temp\e57b8e0.exe

C:\Users\Admin\AppData\Local\Temp\e57b8e0.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe

C:\Users\Admin\AppData\Local\Temp\e57ea7f.exe

C:\Users\Admin\AppData\Local\Temp\e57ea9e.exe

C:\Users\Admin\AppData\Local\Temp\e57ea9e.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/1392-1-0x0000000010000000-0x0000000010020000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e57b575.exe

MD5 66d41e0f149e01e24d869376f09b051f
SHA1 100d1e937afc4a2570b335c70e8cd366cd48944c
SHA256 f650e3e07bf97f9f79f4f11cf8342a5aa4ca87f6a6b3a525effeeaceafcbba14
SHA512 298a6d567894430005d9541ea36e4d25f3823d79247e08a16e7bc8eb8bd3c74b884c14c0a5bbb8a8b33b72dd999085bcbc44f21a6e2f68c84ec041b7480f1103

memory/3780-4-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3780-10-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-14-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-13-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-16-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-15-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-12-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-11-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-9-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-8-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-6-0x0000000000850000-0x000000000190A000-memory.dmp

memory/1392-23-0x00000000005F0000-0x00000000005F2000-memory.dmp

memory/2260-35-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3780-34-0x0000000000730000-0x0000000000732000-memory.dmp

memory/3780-31-0x0000000000730000-0x0000000000732000-memory.dmp

memory/1392-29-0x00000000005F0000-0x00000000005F2000-memory.dmp

memory/3780-28-0x0000000000740000-0x0000000000741000-memory.dmp

memory/1392-26-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

memory/1392-24-0x00000000005F0000-0x00000000005F2000-memory.dmp

memory/3780-17-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-36-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-37-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-38-0x0000000000850000-0x000000000190A000-memory.dmp

memory/2260-40-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/2260-41-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/2260-42-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/3780-43-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-44-0x0000000000850000-0x000000000190A000-memory.dmp

memory/1392-54-0x00000000005F0000-0x00000000005F2000-memory.dmp

memory/5000-59-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3428-58-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3780-57-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-61-0x0000000000730000-0x0000000000732000-memory.dmp

memory/3780-62-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-63-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-65-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-67-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-68-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-71-0x0000000000850000-0x000000000190A000-memory.dmp

memory/3780-72-0x0000000000850000-0x000000000190A000-memory.dmp

memory/2260-94-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3780-95-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3428-101-0x0000000000830000-0x00000000018EA000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 d5bbe2c893e110ae46c2d3e38b4554a5
SHA1 883c22048e2e0cb48d202bdd205862cbed93a807
SHA256 1af7f7e2eb00303ac80236787d25944a2ff1cf9fecbedb18fcb1c56009508703
SHA512 d96a248e3d4f61d680dd373cd02243e8cb068e26591efdba2b46c0d28c438d1d4a6bd78377d44a4402a1abcf7977d9b3b1dbc1b13bc8f67ab9a9d4581dd1e048

memory/3428-100-0x0000000000830000-0x00000000018EA000-memory.dmp

memory/3428-99-0x0000000000830000-0x00000000018EA000-memory.dmp

memory/3428-116-0x0000000000830000-0x00000000018EA000-memory.dmp

memory/5000-151-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3428-152-0x0000000000830000-0x00000000018EA000-memory.dmp

memory/3428-147-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 07:28

Reported

2024-11-07 07:31

Platform

win7-20241023-en

Max time kernel

118s

Max time network

119s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A

Sality

backdoor sality

Sality family

sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\f776a86 C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
File created C:\Windows\f7719d7 C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2272 wrote to memory of 2152 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2272 wrote to memory of 2152 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2272 wrote to memory of 2152 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2272 wrote to memory of 2152 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2272 wrote to memory of 2152 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2272 wrote to memory of 2152 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2272 wrote to memory of 2152 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2152 wrote to memory of 2492 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771989.exe
PID 2152 wrote to memory of 2492 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771989.exe
PID 2152 wrote to memory of 2492 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771989.exe
PID 2152 wrote to memory of 2492 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771989.exe
PID 2492 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\system32\taskhost.exe
PID 2492 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\system32\Dwm.exe
PID 2492 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\Explorer.EXE
PID 2492 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\system32\DllHost.exe
PID 2492 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\system32\rundll32.exe
PID 2492 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\SysWOW64\rundll32.exe
PID 2492 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\SysWOW64\rundll32.exe
PID 2152 wrote to memory of 2800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771b2e.exe
PID 2152 wrote to memory of 2800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771b2e.exe
PID 2152 wrote to memory of 2800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771b2e.exe
PID 2152 wrote to memory of 2800 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f771b2e.exe
PID 2152 wrote to memory of 2676 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7737f2.exe
PID 2152 wrote to memory of 2676 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7737f2.exe
PID 2152 wrote to memory of 2676 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7737f2.exe
PID 2152 wrote to memory of 2676 N/A C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7737f2.exe
PID 2492 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\system32\taskhost.exe
PID 2492 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\system32\Dwm.exe
PID 2492 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\Explorer.EXE
PID 2492 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Windows\system32\DllHost.exe
PID 2492 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Users\Admin\AppData\Local\Temp\f771b2e.exe
PID 2492 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Users\Admin\AppData\Local\Temp\f771b2e.exe
PID 2492 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Users\Admin\AppData\Local\Temp\f7737f2.exe
PID 2492 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\f771989.exe C:\Users\Admin\AppData\Local\Temp\f7737f2.exe
PID 2676 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe C:\Windows\system32\taskhost.exe
PID 2676 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe C:\Windows\system32\Dwm.exe
PID 2676 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe C:\Windows\Explorer.EXE
PID 2676 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\f7737f2.exe C:\Windows\system32\DllHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f771989.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f7737f2.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e16eeca50e75e7f20df367db63348d3393bb9dbeab055004cedff76414abb4cN.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e16eeca50e75e7f20df367db63348d3393bb9dbeab055004cedff76414abb4cN.dll,#1

C:\Users\Admin\AppData\Local\Temp\f771989.exe

C:\Users\Admin\AppData\Local\Temp\f771989.exe

C:\Users\Admin\AppData\Local\Temp\f771b2e.exe

C:\Users\Admin\AppData\Local\Temp\f771b2e.exe

C:\Users\Admin\AppData\Local\Temp\f7737f2.exe

C:\Users\Admin\AppData\Local\Temp\f7737f2.exe

Network

N/A

Files

memory/2152-3-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2152-2-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2152-1-0x0000000010000000-0x0000000010020000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f771989.exe

MD5 66d41e0f149e01e24d869376f09b051f
SHA1 100d1e937afc4a2570b335c70e8cd366cd48944c
SHA256 f650e3e07bf97f9f79f4f11cf8342a5aa4ca87f6a6b3a525effeeaceafcbba14
SHA512 298a6d567894430005d9541ea36e4d25f3823d79247e08a16e7bc8eb8bd3c74b884c14c0a5bbb8a8b33b72dd999085bcbc44f21a6e2f68c84ec041b7480f1103

memory/2152-0-0x0000000010000000-0x0000000010020000-memory.dmp

memory/2492-14-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2152-13-0x0000000000140000-0x0000000000152000-memory.dmp

memory/2152-12-0x0000000000140000-0x0000000000152000-memory.dmp

memory/2492-15-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-20-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-17-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-18-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-25-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2152-60-0x0000000000170000-0x0000000000172000-memory.dmp

memory/2492-61-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2492-53-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2492-51-0x00000000005A0000-0x00000000005A1000-memory.dmp

memory/2152-50-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2152-41-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2152-40-0x0000000000170000-0x0000000000172000-memory.dmp

memory/1112-32-0x0000000000410000-0x0000000000412000-memory.dmp

memory/2492-23-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-22-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-21-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-19-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-26-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-63-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2800-67-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2492-64-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2152-66-0x0000000000170000-0x0000000000172000-memory.dmp

memory/2152-65-0x00000000001D0000-0x00000000001E2000-memory.dmp

memory/2492-68-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-69-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-70-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-72-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-73-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-74-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-75-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2152-87-0x0000000000140000-0x0000000000142000-memory.dmp

memory/2676-88-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2492-90-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-92-0x00000000006C0000-0x000000000177A000-memory.dmp

memory/2492-93-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2676-111-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2800-105-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/2800-115-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2676-114-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2800-143-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2492-162-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2492-163-0x00000000006C0000-0x000000000177A000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 1d6e67ae2146e1088c801771a9987c97
SHA1 6feda515666c67734c77849649293c757dddfb04
SHA256 ec85933d9aa065753930437b53d9671e3971c1147495ea645ccd867f3caaa327
SHA512 ce2ed46d7327a09dbe8de16aa4f4cd003b482e8fb938a1f6e5cf5403d0b1ce13768577531978718efdddda39c774257852451b1b5ed169644ccb8092ed2e9a6f

memory/2676-180-0x0000000000A10000-0x0000000001ACA000-memory.dmp

memory/2676-219-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2676-218-0x0000000000A10000-0x0000000001ACA000-memory.dmp