8c55d27587b1af39a7a25bae346238cae6603755e40b738171b217d5cb6a7f9b
Kernel driver rootkit indicators
Driver-backed termination of another processNative driver combines kernel module inspection with process termination
SHA-2568c55d27587b1af39a7a25bae346238cae6603755e40b738171b217d5cb6a7f9b
Evidence
⋯5 more rows
0x207e42848897c242041b9180000004c8d45e0(H.|$ A.....L.E.
0x207f4ba24202200488bceff1556fe030085c0.$ ".H....V.....
0x20804740c837d000075060fb74504eb078bc7t..}..u...E.....
⋯11 more rows
⋯5 more rows
0x5fbf000000000000000000000000000000000................
0x5fc008cd12a0000000000a6d12a0000000000..*.......*.....
0x5fc1076d12a000000000064d12a0000000000v.*.....d.*.....
0x5fc204ed12a000000000038d12a0000000000N.*.....8.*.....
0x5fc3026d12a0000000000ccd02a0000000000&.*.......*.....
0x5fc40dcd02a0000000000f4d02a0000000000..*.......*.....
0x5fc5004d12a000000000016d12a0000000000..*.......*.....
0x5fc6000000000000000007cd22a0000000000........|.*.....
0x5fc7068d22a000000000050d22a0000000000h.*.....P.*.....
0x5fc8038d22a000000000090d22a00000000008.*.......*.....
0x5fc900000000000000000aad02a0000000000..........*.....
0x5fca0000000000000000092d02a0000000000..........*.....
0x5fcb086d02a000000000076d02a0000000000..*.....v.*.....
0x5fcc060d02a00000000004ed02a0000000000`.*.....N.*.....
0x5fcd00000000000000000e8cb2a0000000000..........*.....
0x5fce0f8cb2a00000000000acc2a0000000000..*.......*.....
0x5fcf016cc2a00000000002acc2a0000000000..*.....*.*.....
0x5fd0048cc2a000000000060cc2a0000000000H.*.....`.*.....
0x5fd106ccc2a000000000084cc2a0000000000l.*.......*.....
0x5fd209ecc2a0000000000bcd82a0000000000..*.......*.....
0x5fd30c4cb2a00000000008ad82a0000000000..*.......*.....
0x5fd406ed82a0000000000f2d82a0000000000n.*.......*.....
0x5fd500cd92a000000000028d92a0000000000..*.....(.*.....
0x5fd6044d92a000000000058d92a0000000000D.*.....X.*.....
0x5fd706ad92a000000000084d92a0000000000j.*.......*.....
0x5fd809ad92a0000000000b4d92a0000000000..*.......*.....
0x5fd90accb2a00000000009ccb2a0000000000..*.......*.....
0x5fda086cb2a000000000078cb2a0000000000..*.....x.*.....
0x5fdb06acb2a00000000005ccb2a0000000000j.*.....\.*.....
0x5fdc04ccb2a00000000002ecb2a0000000000L.*.......*.....
0x5fdd05ad82a000000000018cb2a0000000000Z.*.......*.....
0x5fde008cb2a0000000000f8ca2a0000000000..*.......*.....
0x5fdf0e8ca2a0000000000d8ca2a0000000000..*.......*.....
0x5fe00c6ca2a0000000000beca2a0000000000..*.......*.....
0x5fe10a8ca2a000000000092ca2a0000000000..*.......*.....
0x5fe20d8d82a000000000086ca2a0000000000..*.......*.....
0x5fe3074ca2a000000000062ca2a0000000000t.*.....b.*.....
0x5fe40d4cb2a000000000054ca2a0000000000..*.....T.*.....
0x5fe5046ca2a000000000034ca2a0000000000F.*.....4.*.....
0x5fe602cd82a0000000000a8d82a0000000000,.*.......*.....
0x5fe7040d82a00000000000000000000000000@.*.............
0x60f9808090a0b0c0d0e0f0001020306070c0d................
0x60fa80e0f0a0b0c0d0e0f020306070c0d0e0f................
0x60fb808090a0b0c0d0e0f000106070c0d0e0f................
0x60fc808090a0b0c0d0e0f06070c0d0e0f0607................
0x60fd808090a0b0c0d0e0f0001020304050c0d................
0x60fe80e0f0a0b0c0d0e0f020304050c0d0e0f................
0x60ff808090a0b0c0d0e0f000104050c0d0e0f................
0x6100808090a0b0c0d0e0f04050c0d0e0f0607................
0x6101808090a0b0c0d0e0f000102030c0d0e0f................
0x6102808090a0b0c0d0e0f02030c0d0e0f0607................
0x6103808090a0b0c0d0e0f00010c0d0e0f0607................
0x6104808090a0b0c0d0e0f0c0d0e0f04050607................
0x6105808090a0b0c0d0e0f0001020304050607................
0x6106808090a0b0e0f0e0f0203040506070809................
0x610780a0b0e0f0c0d0e0f0001040506070809................
0x610880a0b0e0f0c0d0e0f0405060708090a0b................
0x610980e0f0a0b0c0d0e0f0001020306070809................
0x610a80a0b0e0f0c0d0e0f0203060708090a0b................
0x610b80e0f0a0b0c0d0e0f0001060708090a0b................
0x610c80e0f0a0b0c0d0e0f060708090a0b0e0f................
0x610d808090a0b0c0d0e0f0001020304050809................
0x610e80a0b0e0f0c0d0e0f0203040508090a0b................
0x610f80e0f0a0b0c0d0e0f0001040508090a0b................
0x611080e0f0a0b0c0d0e0f040508090a0b0e0f................
0x6111808090a0b0c0d0e0f0001020308090a0b................
0x611280e0f0a0b0c0d0e0f020308090a0b0e0f................
0x6113808090a0b0c0d0e0f000108090a0b0e0f................
0x6114808090a0b0c0d0e0f08090a0b0e0f0607................
0x6115808090a0b0c0d0e0f0001020304050607................
0x611680a0b0e0f0c0d0e0f0203040506070a0b................
0x611780e0f0a0b0c0d0e0f0001040506070a0b................
0x611880e0f0a0b0c0d0e0f040506070a0b0e0f................
0x6119808090a0b0c0d0e0f0001020306070a0b................
0x611a80e0f0a0b0c0d0e0f020306070a0b0e0f................
0x611b808090a0b0c0d0e0f000106070a0b0e0f................
0x611c808090a0b0c0d0e0f06070a0b0e0f0607................
0x611d808090a0b0c0d0e0f0001020304050a0b................
0x611e80e0f0a0b0c0d0e0f020304050a0b0e0f................
0x611f808090a0b0c0d0e0f000104050a0b0e0f................
0x6120808090a0b0c0d0e0f04050a0b0e0f0607................
0x6121808090a0b0c0d0e0f000102030a0b0e0f................
0x6122808090a0b0c0d0e0f02030a0b0e0f0607................
0x6123808090a0b0c0d0e0f00010a0b0e0f0607................
0x6124808090a0b0c0d0e0f0a0b0e0f04050607................
0x6125808090a0b0c0d0e0f0001020304050607................
0x6126808090e0f0c0d0e0f0203040506070809................
0x612780e0f0a0b0c0d0e0f0001040506070809................
0x612880e0f0a0b0c0d0e0f0405060708090e0f................
⋯3 more rows
0x309f6b00570000005c00530079007300740065.W...\.S.y.s.t.e
0x309f7b006d0052006f006f0074005c00530079.m.R.o.o.t.\.S.y
0x309f8b007300740065006d00330032005c0064.s.t.e.m.3.2.\.d
0x309f9b007200690076006500720073005c006e.r.i.v.e.r.s.\.n
0x309fab007400660073002e0073007900730000.t.f.s...s.y.s..
0x309fbb00cccccccc5c00530079007300740065.....\.S.y.s.t.e
0x309fcb006d0052006f006f0074005c00530079.m.R.o.o.t.\.S.y
0x309fdb007300740065006d00330032005c0064.s.t.e.m.3.2.\.d
0x309feb007200690076006500720073005c0072.r.i.v.e.r.s.\.r
0x309ffb006500660073002e0073007900730000.e.f.s...s.y.s..
0x30a00b00cccccccc5c00530079007300740065.....\.S.y.s.t.e
0x30a01b006d0052006f006f0074005c00530079.m.R.o.o.t.\.S.y
0x30a02b007300740065006d00330032005c0064.s.t.e.m.3.2.\.d
0x30a03b007200690076006500720073005c0072.r.i.v.e.r.s.\.r
0x30a04b00650066007300760031002e00730079.e.f.s.v.1...s.y
0x30a05b00730000005c00530079007300740065.s...\.S.y.s.t.e
0x30a06b006d0052006f006f0074005c00530079.m.R.o.o.t.\.S.y
0x30a07b007300740065006d00330032005c0064.s.t.e.m.3.2.\.d
0x30a08b007200690076006500720073005c0066.r.i.v.e.r.s.\.f
0x30a09b006100730074006600610074002e0073.a.s.t.f.a.t...s
0x30a0ab00790073000000cccccccccccccccccc.y.s............
0x30a0bbcccccccccc5c00530079007300740065.....\.S.y.s.t.e
0x30a0cb006d0052006f006f0074005c00530079.m.R.o.o.t.\.S.y
0x30a0db007300740065006d00330032005c0064.s.t.e.m.3.2.\.d
0x30a0eb007200690076006500720073005c006d.r.i.v.e.r.s.\.m
0x30a0fb007300660073002e0073007900730000.s.f.s...s.y.s..
0x30a10b00cccccccc5c00530079007300740065.....\.S.y.s.t.e
0x30a11b006d0052006f006f0074005c00530079.m.R.o.o.t.\.S.y
0x30a12b007300740065006d00330032005c0064.s.t.e.m.3.2.\.d
0x30a13b007200690076006500720073005c006e.r.i.v.e.r.s.\.n
0x30a14b007000660073002e0073007900730000.p.f.s...s.y.s..
0x30a15b00cccccccc5c00530079007300740065.....\.S.y.s.t.e
0x30a16b006d0052006f006f0074005c00530079.m.R.o.o.t.\.S.y
0x30a17b007300740065006d00330032005c0064.s.t.e.m.3.2.\.d
0x30a18b007200690076006500720073005c0063.r.i.v.e.r.s.\.c
0x30a19b006400660073002e0073007900730000.d.f.s...s.y.s..
0x30a1ab00cccccccc5c00530079007300740065.....\.S.y.s.t.e
0x30a1bb006d0052006f006f0074005c00530079.m.R.o.o.t.\.S.y
0x30a1cb007300740065006d00330032005c0064.s.t.e.m.3.2.\.d
0x30a1db007200690076006500720073005c0075.r.i.v.e.r.s.\.u
⋯5 more rows
⋯3 more rows
0x3224fe726563746f72794f626a65637400e707rectoryObject...
0x32250e50734c6f616465644d6f64756c654c69PsLoadedModuleLi
0x32251e737400006800436d556e526567697374st..h.CmUnRegist
0x32252e657243616c6c6261636b000015085073erCallback....Ps
⋯7 more rows