Malware Analysis Report

2024-11-30 19:44

Sample ID 220128-z4gc5adgdr
Target 47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b
SHA256 47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b
Tags
rms evasion rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b

Threat Level: Known bad

The file 47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b was found to be: Known bad.

Malicious Activity Summary

rms evasion rat trojan upx

RMS

Executes dropped EXE

UPX packed file

Sets file to hidden

Checks computer location settings

Loads dropped DLL

Drops file in Windows directory

Enumerates physical storage devices

Modifies data under HKEY_USERS

Suspicious use of SetWindowsHookEx

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-28 21:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-28 21:16

Reported

2022-01-28 23:00

Platform

win7-en-20211208

Max time kernel

152s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe"

Signatures

RMS

trojan rat rms

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System64\sysdisk.exe N/A
N/A N/A C:\Windows\System64\sysdisk.exe N/A

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\International\Geo\Nation C:\Windows\System64\sysdisk.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\System64\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe N/A
File created C:\Windows\System64\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe N/A
File created C:\Windows\System64\sysdisk.exe C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System64\sysdisk.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System64\sysdisk.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\System64\sysdisk.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\System64\sysdisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1220 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\System64\sysdisk.exe
PID 1220 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\System64\sysdisk.exe
PID 1220 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\System64\sysdisk.exe
PID 1220 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\System64\sysdisk.exe
PID 1220 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 1220 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 1220 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 1220 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 1220 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 1220 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 1220 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 1220 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 1484 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1484 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1484 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1484 wrote to memory of 1016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1400 wrote to memory of 1460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1400 wrote to memory of 1460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1400 wrote to memory of 1460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1400 wrote to memory of 1460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe

"C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe"

C:\Windows\System64\sysdisk.exe

"C:\Windows\System64\sysdisk.exe"

C:\Windows\System64\sysdisk.exe

C:\Windows\System64\sysdisk.exe -second

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /K attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\libeay32.dll

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /K attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\ssleay32.dll

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\ssleay32.dll

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\libeay32.dll

Network

Country Destination Domain Proto
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/1220-54-0x0000000076C61000-0x0000000076C63000-memory.dmp

memory/1220-55-0x0000000000230000-0x0000000000231000-memory.dmp

\Windows\System64\sysdisk.exe

MD5 f086776a5782d7f6044662cad34054bf
SHA1 472c1cbbc931baefbd360bef3193edebeaee9f01
SHA256 0b628d5764034af71e7929e0f18628b74e8f075f9a7dcc87331ee3d44e419c18
SHA512 06073178a4f7ddd7850c08dae65745f8dfca3bb645d6792bf2473cedc87032366fb28c004cabaeab8fba6b91316afd8510feaff1270885ee78fe4b7e5c77bbf5

C:\Windows\System64\sysdisk.exe

MD5 f086776a5782d7f6044662cad34054bf
SHA1 472c1cbbc931baefbd360bef3193edebeaee9f01
SHA256 0b628d5764034af71e7929e0f18628b74e8f075f9a7dcc87331ee3d44e419c18
SHA512 06073178a4f7ddd7850c08dae65745f8dfca3bb645d6792bf2473cedc87032366fb28c004cabaeab8fba6b91316afd8510feaff1270885ee78fe4b7e5c77bbf5

C:\Windows\System64\sysdisk.exe

MD5 f086776a5782d7f6044662cad34054bf
SHA1 472c1cbbc931baefbd360bef3193edebeaee9f01
SHA256 0b628d5764034af71e7929e0f18628b74e8f075f9a7dcc87331ee3d44e419c18
SHA512 06073178a4f7ddd7850c08dae65745f8dfca3bb645d6792bf2473cedc87032366fb28c004cabaeab8fba6b91316afd8510feaff1270885ee78fe4b7e5c77bbf5

C:\Windows\System64\sysdisk.exe

MD5 f086776a5782d7f6044662cad34054bf
SHA1 472c1cbbc931baefbd360bef3193edebeaee9f01
SHA256 0b628d5764034af71e7929e0f18628b74e8f075f9a7dcc87331ee3d44e419c18
SHA512 06073178a4f7ddd7850c08dae65745f8dfca3bb645d6792bf2473cedc87032366fb28c004cabaeab8fba6b91316afd8510feaff1270885ee78fe4b7e5c77bbf5

memory/976-63-0x00000000002F0000-0x00000000002F1000-memory.dmp

C:\Windows\System64\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Windows\System64\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

\Users\Admin\AppData\Local\Temp\libeay32.dll

MD5 c39b8d8bd482b717ebdd17dcae374c9b
SHA1 abe57f749650fdebbaa6792e3676294c20db6abe
SHA256 0e8006f941ad484931369e96d4319e526e62c3e802b8917d2693074e2e0451af
SHA512 2c9f749541b1fa7d9ff2e4f4182ec81824c71c7306e95cf84f93a5b21dbd0fba40f3e0bb10782742f3b84aaee928bac65f75d3226ecb44e41c27fc6219679667

\Users\Admin\AppData\Local\Temp\ssleay32.dll

MD5 89172a85c3b07bff7541720d42d31bc6
SHA1 4685df166f9a64d02c86d7966d4d3a7fa18b3106
SHA256 9594efa47fa162756ad19c7fb7e7c7c09d97f505daf6280f6d9a130f76264350
SHA512 1e9f56f89f5f57be88b95836626ffafe54e58a41cb7c1851bb1933ca056e2c8aaf08aa6e7509e0b22f358c727c554c2a7a7cbe7da3d13dd0c42f9084413b468c

C:\Users\Admin\AppData\Local\Temp\libeay32.dll

MD5 c39b8d8bd482b717ebdd17dcae374c9b
SHA1 abe57f749650fdebbaa6792e3676294c20db6abe
SHA256 0e8006f941ad484931369e96d4319e526e62c3e802b8917d2693074e2e0451af
SHA512 2c9f749541b1fa7d9ff2e4f4182ec81824c71c7306e95cf84f93a5b21dbd0fba40f3e0bb10782742f3b84aaee928bac65f75d3226ecb44e41c27fc6219679667

C:\Users\Admin\AppData\Local\Temp\ssleay32.dll

MD5 89172a85c3b07bff7541720d42d31bc6
SHA1 4685df166f9a64d02c86d7966d4d3a7fa18b3106
SHA256 9594efa47fa162756ad19c7fb7e7c7c09d97f505daf6280f6d9a130f76264350
SHA512 1e9f56f89f5f57be88b95836626ffafe54e58a41cb7c1851bb1933ca056e2c8aaf08aa6e7509e0b22f358c727c554c2a7a7cbe7da3d13dd0c42f9084413b468c

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-28 21:16

Reported

2022-01-28 23:01

Platform

win10-en-20211208

Max time kernel

204s

Max time network

235s

Command Line

"C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe"

Signatures

RMS

trojan rat rms

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System64\sysdisk.exe N/A
N/A N/A C:\Windows\System64\sysdisk.exe N/A

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\International\Geo\Nation C:\Windows\System64\sysdisk.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\System64\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe N/A
File created C:\Windows\System64\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe N/A
File created C:\Windows\System64\sysdisk.exe C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\System64\sysdisk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@C:\Windows\SysWOW64\FirewallControlPanel.dll,-12122 = "Windows Firewall" C:\Windows\System64\sysdisk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System64\sysdisk.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System64\sysdisk.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\System64\sysdisk.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\System64\sysdisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2744 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\System64\sysdisk.exe
PID 2744 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\System64\sysdisk.exe
PID 2744 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\System64\sysdisk.exe
PID 2744 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 1228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2600 wrote to memory of 1228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2600 wrote to memory of 1228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1428 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1428 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1428 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe

"C:\Users\Admin\AppData\Local\Temp\47ac7b3483b7ddf28130b9d5b9e254905a6ceff2d6b82823e7ea815945e6943b.exe"

C:\Windows\System64\sysdisk.exe

"C:\Windows\System64\sysdisk.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /K attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\libeay32.dll

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /K attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\ssleay32.dll

C:\Windows\System64\sysdisk.exe

C:\Windows\System64\sysdisk.exe -second

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\libeay32.dll

C:\Windows\SysWOW64\attrib.exe

attrib +r +a +s +h C:\Users\Admin\AppData\Local\Temp\ssleay32.dll

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/2744-115-0x0000000000EF0000-0x000000000103A000-memory.dmp

C:\Windows\System64\sysdisk.exe

MD5 f086776a5782d7f6044662cad34054bf
SHA1 472c1cbbc931baefbd360bef3193edebeaee9f01
SHA256 0b628d5764034af71e7929e0f18628b74e8f075f9a7dcc87331ee3d44e419c18
SHA512 06073178a4f7ddd7850c08dae65745f8dfca3bb645d6792bf2473cedc87032366fb28c004cabaeab8fba6b91316afd8510feaff1270885ee78fe4b7e5c77bbf5

C:\Windows\System64\sysdisk.exe

MD5 f086776a5782d7f6044662cad34054bf
SHA1 472c1cbbc931baefbd360bef3193edebeaee9f01
SHA256 0b628d5764034af71e7929e0f18628b74e8f075f9a7dcc87331ee3d44e419c18
SHA512 06073178a4f7ddd7850c08dae65745f8dfca3bb645d6792bf2473cedc87032366fb28c004cabaeab8fba6b91316afd8510feaff1270885ee78fe4b7e5c77bbf5

memory/788-118-0x0000000002DC0000-0x0000000002F20000-memory.dmp

C:\Windows\System64\sysdisk.exe

MD5 f086776a5782d7f6044662cad34054bf
SHA1 472c1cbbc931baefbd360bef3193edebeaee9f01
SHA256 0b628d5764034af71e7929e0f18628b74e8f075f9a7dcc87331ee3d44e419c18
SHA512 06073178a4f7ddd7850c08dae65745f8dfca3bb645d6792bf2473cedc87032366fb28c004cabaeab8fba6b91316afd8510feaff1270885ee78fe4b7e5c77bbf5

memory/1060-120-0x0000000001310000-0x0000000001311000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ssleay32.dll

MD5 89172a85c3b07bff7541720d42d31bc6
SHA1 4685df166f9a64d02c86d7966d4d3a7fa18b3106
SHA256 9594efa47fa162756ad19c7fb7e7c7c09d97f505daf6280f6d9a130f76264350
SHA512 1e9f56f89f5f57be88b95836626ffafe54e58a41cb7c1851bb1933ca056e2c8aaf08aa6e7509e0b22f358c727c554c2a7a7cbe7da3d13dd0c42f9084413b468c

C:\Users\Admin\AppData\Local\Temp\libeay32.dll

MD5 c39b8d8bd482b717ebdd17dcae374c9b
SHA1 abe57f749650fdebbaa6792e3676294c20db6abe
SHA256 0e8006f941ad484931369e96d4319e526e62c3e802b8917d2693074e2e0451af
SHA512 2c9f749541b1fa7d9ff2e4f4182ec81824c71c7306e95cf84f93a5b21dbd0fba40f3e0bb10782742f3b84aaee928bac65f75d3226ecb44e41c27fc6219679667

\Users\Admin\AppData\Local\Temp\libeay32.dll

MD5 c39b8d8bd482b717ebdd17dcae374c9b
SHA1 abe57f749650fdebbaa6792e3676294c20db6abe
SHA256 0e8006f941ad484931369e96d4319e526e62c3e802b8917d2693074e2e0451af
SHA512 2c9f749541b1fa7d9ff2e4f4182ec81824c71c7306e95cf84f93a5b21dbd0fba40f3e0bb10782742f3b84aaee928bac65f75d3226ecb44e41c27fc6219679667

\Users\Admin\AppData\Local\Temp\ssleay32.dll

MD5 89172a85c3b07bff7541720d42d31bc6
SHA1 4685df166f9a64d02c86d7966d4d3a7fa18b3106
SHA256 9594efa47fa162756ad19c7fb7e7c7c09d97f505daf6280f6d9a130f76264350
SHA512 1e9f56f89f5f57be88b95836626ffafe54e58a41cb7c1851bb1933ca056e2c8aaf08aa6e7509e0b22f358c727c554c2a7a7cbe7da3d13dd0c42f9084413b468c

C:\Windows\System64\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Windows\System64\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7