Analysis

  • max time kernel
    151s
  • max time network
    174s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 07:36

General

  • Target

    c44cab677372525ad23d447b5511976f98c0859531a5b75b3555c0665ffef38d.exe

  • Size

    2.2MB

  • MD5

    885090d2bc9024a7b4b43adb3e988e61

  • SHA1

    4cbcf18a343a60f53bd59e081a6cd0fbf809b1e0

  • SHA256

    c44cab677372525ad23d447b5511976f98c0859531a5b75b3555c0665ffef38d

  • SHA512

    a89990c7f35221e3a749c70521e2abd03dcfb9238c65f83f96774026c3aef5eb0342e1cc8f7aaa078112fdb139cd858a0a372342a414ccd11e8a43fe92defe8a

  • SSDEEP

    49152:21dHhwSGDIaP7oP4GcakEPoSFZymFHgD0OhRo5jT:6HhPEIapmxPoSFZle0BT

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 38 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1224
      • C:\Users\Admin\AppData\Local\Temp\c44cab677372525ad23d447b5511976f98c0859531a5b75b3555c0665ffef38d.exe
        "C:\Users\Admin\AppData\Local\Temp\c44cab677372525ad23d447b5511976f98c0859531a5b75b3555c0665ffef38d.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhsf.exe
          "C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhsf.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1220
        • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\ztsf.exe
          "C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\ztsf.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:280
        • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhplaysf.exe
          "C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhplaysf.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:268
          • C:\Windows\rxjhplaysf.exe
            C:\Windows\rxjhplaysf.exe
            4⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:976
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\PROGRA~1\B7A6~1\RXJHPL~1.EXE > nul
            4⤵
              PID:1612
          • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\fhwg.exe
            "C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\fhwg.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1380
          • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\zxwg.exe
            "C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\zxwg.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:588
          • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\¾«Æ·ÈÈѪ½­ºþ.exe
            "C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\¾«Æ·ÈÈѪ½­ºþ.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1060

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\fhwg.exe

        Filesize

        15KB

        MD5

        d1cf44d0b1e1f4c35a962ce84c576de5

        SHA1

        3e4f1ea73dc961acc7c1293bc1870914f3c886d5

        SHA256

        e7770d771949b32a2b355659acf486d2a8480f694ef3995235e29f25131af2cf

        SHA512

        2a747d86b2594b227749dd92b72cdf947c3e0eba311e01e668bae384597c908dd692557c379a368e913a08b6cd0ebaf646f1aa2d8b98d74950c1bbbfe04dd64a

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\fhwg.exe

        Filesize

        15KB

        MD5

        d1cf44d0b1e1f4c35a962ce84c576de5

        SHA1

        3e4f1ea73dc961acc7c1293bc1870914f3c886d5

        SHA256

        e7770d771949b32a2b355659acf486d2a8480f694ef3995235e29f25131af2cf

        SHA512

        2a747d86b2594b227749dd92b72cdf947c3e0eba311e01e668bae384597c908dd692557c379a368e913a08b6cd0ebaf646f1aa2d8b98d74950c1bbbfe04dd64a

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhplaysf.exe

        Filesize

        7KB

        MD5

        3b1b28357290f63a55b8fbdb67e4c841

        SHA1

        a2a68a27eb4a2787fd41f25e76380ee1777412dc

        SHA256

        c98496916611983b7f74df61bd900ec1bb39382c275ac83a8f366b813e484df3

        SHA512

        cad12c6ca044e59cacab8716b60113306b582fdac98be5432bae4a5bf93b680df613abf2706f04ac5730c497052df750c4ff099390c6091f54b65a30d0c8a1bb

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhplaysf.exe

        Filesize

        7KB

        MD5

        3b1b28357290f63a55b8fbdb67e4c841

        SHA1

        a2a68a27eb4a2787fd41f25e76380ee1777412dc

        SHA256

        c98496916611983b7f74df61bd900ec1bb39382c275ac83a8f366b813e484df3

        SHA512

        cad12c6ca044e59cacab8716b60113306b582fdac98be5432bae4a5bf93b680df613abf2706f04ac5730c497052df750c4ff099390c6091f54b65a30d0c8a1bb

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhsf.exe

        Filesize

        18KB

        MD5

        fe7bc3f8e64e5cb241e23649da518ebe

        SHA1

        49986a8671c0b8eade865fb60f809aab2f69941f

        SHA256

        a3bb280d7043f823631d142fc0b7cb87d9c8b9313842ed7289f7177c6ce32b3a

        SHA512

        2a673de516ef25b3861bc0068556a7b85ca57e600829042c94b2517f228b7f5b747b759ff5a5241988e61d58042204e6b597b4da03a26ff4be0e8c393e3610a2

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhsf.exe

        Filesize

        18KB

        MD5

        fe7bc3f8e64e5cb241e23649da518ebe

        SHA1

        49986a8671c0b8eade865fb60f809aab2f69941f

        SHA256

        a3bb280d7043f823631d142fc0b7cb87d9c8b9313842ed7289f7177c6ce32b3a

        SHA512

        2a673de516ef25b3861bc0068556a7b85ca57e600829042c94b2517f228b7f5b747b759ff5a5241988e61d58042204e6b597b4da03a26ff4be0e8c393e3610a2

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\ztsf.exe

        Filesize

        19KB

        MD5

        06dcc65609bb6babbdc5879d5afe6afa

        SHA1

        1c27daf6bef48066cf6ba60ad7f149e4b490cb6f

        SHA256

        4af8a59a31b53bc4efb260a76cb658c17ab09c2acf641ebd24600a4031f3c822

        SHA512

        1fa3a47f44b051816bd8315eda2d17b39027439f95f1487a5dacf4141d377a0d11a5833c394c144b2533439de717451bd473aef1c190e3aeca6783a713961d83

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\ztsf.exe

        Filesize

        19KB

        MD5

        06dcc65609bb6babbdc5879d5afe6afa

        SHA1

        1c27daf6bef48066cf6ba60ad7f149e4b490cb6f

        SHA256

        4af8a59a31b53bc4efb260a76cb658c17ab09c2acf641ebd24600a4031f3c822

        SHA512

        1fa3a47f44b051816bd8315eda2d17b39027439f95f1487a5dacf4141d377a0d11a5833c394c144b2533439de717451bd473aef1c190e3aeca6783a713961d83

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\zxwg.exe

        Filesize

        19KB

        MD5

        846c04dfd20856697f88a62dd7420b5a

        SHA1

        3a3cd9bf1162e608e347fb7526d971b5e0d660ee

        SHA256

        8c91a37a5652225ffae37d055dbc92652ee4f48407a684ba5c9f4b7c9d38829e

        SHA512

        f91a582b433e65ef61293428e55cb0fa592b855a586d2dfd446e08905dd522563d54715d9865729b379ccabebb5d4a89ede3e28af23e95db9c458b1b605515e8

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\zxwg.exe

        Filesize

        19KB

        MD5

        846c04dfd20856697f88a62dd7420b5a

        SHA1

        3a3cd9bf1162e608e347fb7526d971b5e0d660ee

        SHA256

        8c91a37a5652225ffae37d055dbc92652ee4f48407a684ba5c9f4b7c9d38829e

        SHA512

        f91a582b433e65ef61293428e55cb0fa592b855a586d2dfd446e08905dd522563d54715d9865729b379ccabebb5d4a89ede3e28af23e95db9c458b1b605515e8

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\¾«Æ·ÈÈѪ½­ºþ.exe

        Filesize

        1.3MB

        MD5

        8424b9f2df4067a27c7d0fc2fd056858

        SHA1

        c724d98e77d20a0b4cb089261309350b24710c0d

        SHA256

        354fa1c76fe183bb24fc0b7c65a482a17496a4741f91286a94af3504f510c6d3

        SHA512

        442619bef60516b19349ea9bd9c2c03dd60bf28bf3e0f3301b056b462c983727208b4fa16ae084a4a65cf9a069b6a9ae9d2914282fb564ddb98528d79ef3a516

      • C:\Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\¾«Æ·ÈÈѪ½­ºþ.exe

        Filesize

        1.3MB

        MD5

        8424b9f2df4067a27c7d0fc2fd056858

        SHA1

        c724d98e77d20a0b4cb089261309350b24710c0d

        SHA256

        354fa1c76fe183bb24fc0b7c65a482a17496a4741f91286a94af3504f510c6d3

        SHA512

        442619bef60516b19349ea9bd9c2c03dd60bf28bf3e0f3301b056b462c983727208b4fa16ae084a4a65cf9a069b6a9ae9d2914282fb564ddb98528d79ef3a516

      • C:\Windows\SysWOW64\huifitc.dll

        Filesize

        36KB

        MD5

        8ba647fb5ed75c8d08111397cc908784

        SHA1

        ee1c0eae2369d646941e616f611d95c11fea776b

        SHA256

        b318c6b068de8bb96afba6e55c9f4b1a36e0efacd00ac4096e97d83cc731e766

        SHA512

        6da2e0a5d0b2748c8f5eeaa6ed50d8464618cb87a2fb5cc9e4ff45940d036e421bab74c42314dc5411a9ce90d70ad8a2fe388c6fe319267342c8b5cd3d4ce18a

      • C:\Windows\rxjhplaysf.exe

        Filesize

        7KB

        MD5

        3b1b28357290f63a55b8fbdb67e4c841

        SHA1

        a2a68a27eb4a2787fd41f25e76380ee1777412dc

        SHA256

        c98496916611983b7f74df61bd900ec1bb39382c275ac83a8f366b813e484df3

        SHA512

        cad12c6ca044e59cacab8716b60113306b582fdac98be5432bae4a5bf93b680df613abf2706f04ac5730c497052df750c4ff099390c6091f54b65a30d0c8a1bb

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\fhwg.exe

        Filesize

        15KB

        MD5

        d1cf44d0b1e1f4c35a962ce84c576de5

        SHA1

        3e4f1ea73dc961acc7c1293bc1870914f3c886d5

        SHA256

        e7770d771949b32a2b355659acf486d2a8480f694ef3995235e29f25131af2cf

        SHA512

        2a747d86b2594b227749dd92b72cdf947c3e0eba311e01e668bae384597c908dd692557c379a368e913a08b6cd0ebaf646f1aa2d8b98d74950c1bbbfe04dd64a

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\fhwg.exe

        Filesize

        15KB

        MD5

        d1cf44d0b1e1f4c35a962ce84c576de5

        SHA1

        3e4f1ea73dc961acc7c1293bc1870914f3c886d5

        SHA256

        e7770d771949b32a2b355659acf486d2a8480f694ef3995235e29f25131af2cf

        SHA512

        2a747d86b2594b227749dd92b72cdf947c3e0eba311e01e668bae384597c908dd692557c379a368e913a08b6cd0ebaf646f1aa2d8b98d74950c1bbbfe04dd64a

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\fhwg.exe

        Filesize

        15KB

        MD5

        d1cf44d0b1e1f4c35a962ce84c576de5

        SHA1

        3e4f1ea73dc961acc7c1293bc1870914f3c886d5

        SHA256

        e7770d771949b32a2b355659acf486d2a8480f694ef3995235e29f25131af2cf

        SHA512

        2a747d86b2594b227749dd92b72cdf947c3e0eba311e01e668bae384597c908dd692557c379a368e913a08b6cd0ebaf646f1aa2d8b98d74950c1bbbfe04dd64a

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\fhwg.exe

        Filesize

        15KB

        MD5

        d1cf44d0b1e1f4c35a962ce84c576de5

        SHA1

        3e4f1ea73dc961acc7c1293bc1870914f3c886d5

        SHA256

        e7770d771949b32a2b355659acf486d2a8480f694ef3995235e29f25131af2cf

        SHA512

        2a747d86b2594b227749dd92b72cdf947c3e0eba311e01e668bae384597c908dd692557c379a368e913a08b6cd0ebaf646f1aa2d8b98d74950c1bbbfe04dd64a

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\fhwg.exe

        Filesize

        15KB

        MD5

        d1cf44d0b1e1f4c35a962ce84c576de5

        SHA1

        3e4f1ea73dc961acc7c1293bc1870914f3c886d5

        SHA256

        e7770d771949b32a2b355659acf486d2a8480f694ef3995235e29f25131af2cf

        SHA512

        2a747d86b2594b227749dd92b72cdf947c3e0eba311e01e668bae384597c908dd692557c379a368e913a08b6cd0ebaf646f1aa2d8b98d74950c1bbbfe04dd64a

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhplaysf.exe

        Filesize

        7KB

        MD5

        3b1b28357290f63a55b8fbdb67e4c841

        SHA1

        a2a68a27eb4a2787fd41f25e76380ee1777412dc

        SHA256

        c98496916611983b7f74df61bd900ec1bb39382c275ac83a8f366b813e484df3

        SHA512

        cad12c6ca044e59cacab8716b60113306b582fdac98be5432bae4a5bf93b680df613abf2706f04ac5730c497052df750c4ff099390c6091f54b65a30d0c8a1bb

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhplaysf.exe

        Filesize

        7KB

        MD5

        3b1b28357290f63a55b8fbdb67e4c841

        SHA1

        a2a68a27eb4a2787fd41f25e76380ee1777412dc

        SHA256

        c98496916611983b7f74df61bd900ec1bb39382c275ac83a8f366b813e484df3

        SHA512

        cad12c6ca044e59cacab8716b60113306b582fdac98be5432bae4a5bf93b680df613abf2706f04ac5730c497052df750c4ff099390c6091f54b65a30d0c8a1bb

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhplaysf.exe

        Filesize

        7KB

        MD5

        3b1b28357290f63a55b8fbdb67e4c841

        SHA1

        a2a68a27eb4a2787fd41f25e76380ee1777412dc

        SHA256

        c98496916611983b7f74df61bd900ec1bb39382c275ac83a8f366b813e484df3

        SHA512

        cad12c6ca044e59cacab8716b60113306b582fdac98be5432bae4a5bf93b680df613abf2706f04ac5730c497052df750c4ff099390c6091f54b65a30d0c8a1bb

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhplaysf.exe

        Filesize

        7KB

        MD5

        3b1b28357290f63a55b8fbdb67e4c841

        SHA1

        a2a68a27eb4a2787fd41f25e76380ee1777412dc

        SHA256

        c98496916611983b7f74df61bd900ec1bb39382c275ac83a8f366b813e484df3

        SHA512

        cad12c6ca044e59cacab8716b60113306b582fdac98be5432bae4a5bf93b680df613abf2706f04ac5730c497052df750c4ff099390c6091f54b65a30d0c8a1bb

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhplaysf.exe

        Filesize

        7KB

        MD5

        3b1b28357290f63a55b8fbdb67e4c841

        SHA1

        a2a68a27eb4a2787fd41f25e76380ee1777412dc

        SHA256

        c98496916611983b7f74df61bd900ec1bb39382c275ac83a8f366b813e484df3

        SHA512

        cad12c6ca044e59cacab8716b60113306b582fdac98be5432bae4a5bf93b680df613abf2706f04ac5730c497052df750c4ff099390c6091f54b65a30d0c8a1bb

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhsf.exe

        Filesize

        18KB

        MD5

        fe7bc3f8e64e5cb241e23649da518ebe

        SHA1

        49986a8671c0b8eade865fb60f809aab2f69941f

        SHA256

        a3bb280d7043f823631d142fc0b7cb87d9c8b9313842ed7289f7177c6ce32b3a

        SHA512

        2a673de516ef25b3861bc0068556a7b85ca57e600829042c94b2517f228b7f5b747b759ff5a5241988e61d58042204e6b597b4da03a26ff4be0e8c393e3610a2

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhsf.exe

        Filesize

        18KB

        MD5

        fe7bc3f8e64e5cb241e23649da518ebe

        SHA1

        49986a8671c0b8eade865fb60f809aab2f69941f

        SHA256

        a3bb280d7043f823631d142fc0b7cb87d9c8b9313842ed7289f7177c6ce32b3a

        SHA512

        2a673de516ef25b3861bc0068556a7b85ca57e600829042c94b2517f228b7f5b747b759ff5a5241988e61d58042204e6b597b4da03a26ff4be0e8c393e3610a2

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhsf.exe

        Filesize

        18KB

        MD5

        fe7bc3f8e64e5cb241e23649da518ebe

        SHA1

        49986a8671c0b8eade865fb60f809aab2f69941f

        SHA256

        a3bb280d7043f823631d142fc0b7cb87d9c8b9313842ed7289f7177c6ce32b3a

        SHA512

        2a673de516ef25b3861bc0068556a7b85ca57e600829042c94b2517f228b7f5b747b759ff5a5241988e61d58042204e6b597b4da03a26ff4be0e8c393e3610a2

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhsf.exe

        Filesize

        18KB

        MD5

        fe7bc3f8e64e5cb241e23649da518ebe

        SHA1

        49986a8671c0b8eade865fb60f809aab2f69941f

        SHA256

        a3bb280d7043f823631d142fc0b7cb87d9c8b9313842ed7289f7177c6ce32b3a

        SHA512

        2a673de516ef25b3861bc0068556a7b85ca57e600829042c94b2517f228b7f5b747b759ff5a5241988e61d58042204e6b597b4da03a26ff4be0e8c393e3610a2

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\rxjhsf.exe

        Filesize

        18KB

        MD5

        fe7bc3f8e64e5cb241e23649da518ebe

        SHA1

        49986a8671c0b8eade865fb60f809aab2f69941f

        SHA256

        a3bb280d7043f823631d142fc0b7cb87d9c8b9313842ed7289f7177c6ce32b3a

        SHA512

        2a673de516ef25b3861bc0068556a7b85ca57e600829042c94b2517f228b7f5b747b759ff5a5241988e61d58042204e6b597b4da03a26ff4be0e8c393e3610a2

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\ztsf.exe

        Filesize

        19KB

        MD5

        06dcc65609bb6babbdc5879d5afe6afa

        SHA1

        1c27daf6bef48066cf6ba60ad7f149e4b490cb6f

        SHA256

        4af8a59a31b53bc4efb260a76cb658c17ab09c2acf641ebd24600a4031f3c822

        SHA512

        1fa3a47f44b051816bd8315eda2d17b39027439f95f1487a5dacf4141d377a0d11a5833c394c144b2533439de717451bd473aef1c190e3aeca6783a713961d83

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\ztsf.exe

        Filesize

        19KB

        MD5

        06dcc65609bb6babbdc5879d5afe6afa

        SHA1

        1c27daf6bef48066cf6ba60ad7f149e4b490cb6f

        SHA256

        4af8a59a31b53bc4efb260a76cb658c17ab09c2acf641ebd24600a4031f3c822

        SHA512

        1fa3a47f44b051816bd8315eda2d17b39027439f95f1487a5dacf4141d377a0d11a5833c394c144b2533439de717451bd473aef1c190e3aeca6783a713961d83

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\ztsf.exe

        Filesize

        19KB

        MD5

        06dcc65609bb6babbdc5879d5afe6afa

        SHA1

        1c27daf6bef48066cf6ba60ad7f149e4b490cb6f

        SHA256

        4af8a59a31b53bc4efb260a76cb658c17ab09c2acf641ebd24600a4031f3c822

        SHA512

        1fa3a47f44b051816bd8315eda2d17b39027439f95f1487a5dacf4141d377a0d11a5833c394c144b2533439de717451bd473aef1c190e3aeca6783a713961d83

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\ztsf.exe

        Filesize

        19KB

        MD5

        06dcc65609bb6babbdc5879d5afe6afa

        SHA1

        1c27daf6bef48066cf6ba60ad7f149e4b490cb6f

        SHA256

        4af8a59a31b53bc4efb260a76cb658c17ab09c2acf641ebd24600a4031f3c822

        SHA512

        1fa3a47f44b051816bd8315eda2d17b39027439f95f1487a5dacf4141d377a0d11a5833c394c144b2533439de717451bd473aef1c190e3aeca6783a713961d83

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\ztsf.exe

        Filesize

        19KB

        MD5

        06dcc65609bb6babbdc5879d5afe6afa

        SHA1

        1c27daf6bef48066cf6ba60ad7f149e4b490cb6f

        SHA256

        4af8a59a31b53bc4efb260a76cb658c17ab09c2acf641ebd24600a4031f3c822

        SHA512

        1fa3a47f44b051816bd8315eda2d17b39027439f95f1487a5dacf4141d377a0d11a5833c394c144b2533439de717451bd473aef1c190e3aeca6783a713961d83

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\zxwg.exe

        Filesize

        19KB

        MD5

        846c04dfd20856697f88a62dd7420b5a

        SHA1

        3a3cd9bf1162e608e347fb7526d971b5e0d660ee

        SHA256

        8c91a37a5652225ffae37d055dbc92652ee4f48407a684ba5c9f4b7c9d38829e

        SHA512

        f91a582b433e65ef61293428e55cb0fa592b855a586d2dfd446e08905dd522563d54715d9865729b379ccabebb5d4a89ede3e28af23e95db9c458b1b605515e8

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\zxwg.exe

        Filesize

        19KB

        MD5

        846c04dfd20856697f88a62dd7420b5a

        SHA1

        3a3cd9bf1162e608e347fb7526d971b5e0d660ee

        SHA256

        8c91a37a5652225ffae37d055dbc92652ee4f48407a684ba5c9f4b7c9d38829e

        SHA512

        f91a582b433e65ef61293428e55cb0fa592b855a586d2dfd446e08905dd522563d54715d9865729b379ccabebb5d4a89ede3e28af23e95db9c458b1b605515e8

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\zxwg.exe

        Filesize

        19KB

        MD5

        846c04dfd20856697f88a62dd7420b5a

        SHA1

        3a3cd9bf1162e608e347fb7526d971b5e0d660ee

        SHA256

        8c91a37a5652225ffae37d055dbc92652ee4f48407a684ba5c9f4b7c9d38829e

        SHA512

        f91a582b433e65ef61293428e55cb0fa592b855a586d2dfd446e08905dd522563d54715d9865729b379ccabebb5d4a89ede3e28af23e95db9c458b1b605515e8

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\zxwg.exe

        Filesize

        19KB

        MD5

        846c04dfd20856697f88a62dd7420b5a

        SHA1

        3a3cd9bf1162e608e347fb7526d971b5e0d660ee

        SHA256

        8c91a37a5652225ffae37d055dbc92652ee4f48407a684ba5c9f4b7c9d38829e

        SHA512

        f91a582b433e65ef61293428e55cb0fa592b855a586d2dfd446e08905dd522563d54715d9865729b379ccabebb5d4a89ede3e28af23e95db9c458b1b605515e8

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\zxwg.exe

        Filesize

        19KB

        MD5

        846c04dfd20856697f88a62dd7420b5a

        SHA1

        3a3cd9bf1162e608e347fb7526d971b5e0d660ee

        SHA256

        8c91a37a5652225ffae37d055dbc92652ee4f48407a684ba5c9f4b7c9d38829e

        SHA512

        f91a582b433e65ef61293428e55cb0fa592b855a586d2dfd446e08905dd522563d54715d9865729b379ccabebb5d4a89ede3e28af23e95db9c458b1b605515e8

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\¾«Æ·ÈÈѪ½­ºþ.exe

        Filesize

        1.3MB

        MD5

        8424b9f2df4067a27c7d0fc2fd056858

        SHA1

        c724d98e77d20a0b4cb089261309350b24710c0d

        SHA256

        354fa1c76fe183bb24fc0b7c65a482a17496a4741f91286a94af3504f510c6d3

        SHA512

        442619bef60516b19349ea9bd9c2c03dd60bf28bf3e0f3301b056b462c983727208b4fa16ae084a4a65cf9a069b6a9ae9d2914282fb564ddb98528d79ef3a516

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\¾«Æ·ÈÈѪ½­ºþ.exe

        Filesize

        1.3MB

        MD5

        8424b9f2df4067a27c7d0fc2fd056858

        SHA1

        c724d98e77d20a0b4cb089261309350b24710c0d

        SHA256

        354fa1c76fe183bb24fc0b7c65a482a17496a4741f91286a94af3504f510c6d3

        SHA512

        442619bef60516b19349ea9bd9c2c03dd60bf28bf3e0f3301b056b462c983727208b4fa16ae084a4a65cf9a069b6a9ae9d2914282fb564ddb98528d79ef3a516

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\¾«Æ·ÈÈѪ½­ºþ.exe

        Filesize

        1.3MB

        MD5

        8424b9f2df4067a27c7d0fc2fd056858

        SHA1

        c724d98e77d20a0b4cb089261309350b24710c0d

        SHA256

        354fa1c76fe183bb24fc0b7c65a482a17496a4741f91286a94af3504f510c6d3

        SHA512

        442619bef60516b19349ea9bd9c2c03dd60bf28bf3e0f3301b056b462c983727208b4fa16ae084a4a65cf9a069b6a9ae9d2914282fb564ddb98528d79ef3a516

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\¾«Æ·ÈÈѪ½­ºþ.exe

        Filesize

        1.3MB

        MD5

        8424b9f2df4067a27c7d0fc2fd056858

        SHA1

        c724d98e77d20a0b4cb089261309350b24710c0d

        SHA256

        354fa1c76fe183bb24fc0b7c65a482a17496a4741f91286a94af3504f510c6d3

        SHA512

        442619bef60516b19349ea9bd9c2c03dd60bf28bf3e0f3301b056b462c983727208b4fa16ae084a4a65cf9a069b6a9ae9d2914282fb564ddb98528d79ef3a516

      • \Program Files\ÈÈѪ½­ºþ˽·þµÇ½Æ÷\¾«Æ·ÈÈѪ½­ºþ.exe

        Filesize

        1.3MB

        MD5

        8424b9f2df4067a27c7d0fc2fd056858

        SHA1

        c724d98e77d20a0b4cb089261309350b24710c0d

        SHA256

        354fa1c76fe183bb24fc0b7c65a482a17496a4741f91286a94af3504f510c6d3

        SHA512

        442619bef60516b19349ea9bd9c2c03dd60bf28bf3e0f3301b056b462c983727208b4fa16ae084a4a65cf9a069b6a9ae9d2914282fb564ddb98528d79ef3a516

      • \Users\Admin\AppData\Local\Temp\E_4\HtmlView.fne

        Filesize

        224KB

        MD5

        9ec9ca1721c38e986d14b8037fdb7200

        SHA1

        f8db76cc1e127a1d209888c54e6bfa30ab5deaeb

        SHA256

        9f7b88193fcb2b4cc6d1678eceaff8680a834285de461b7ad8b1ea523c0397b7

        SHA512

        d663e85fd9bddb379b0a5b249d427e1bef260acb064d74c0b97ad3634ab6fc8448c5c78e92cd7e24e633d7009abc4a170bb44b40f53436682e7a3f4d52edb7fe

      • \Users\Admin\AppData\Local\Temp\E_4\iext.fnr

        Filesize

        212KB

        MD5

        8fc38a56bab9cfe08b48eb6ee3fa997c

        SHA1

        88b2758f71aa83bca2bc3b1dc791a56372fd9d57

        SHA256

        10d85bdc14fa7c06f555858d920d0e0b9becf8fde7cc9df315bd130add2dad86

        SHA512

        319ab901c294577196f69f9890859280bcc744d69731fe2b909d9178eef798dc4d2bba74b6d2e5f397226dc7b7e691bdaf7e7e200a4ee4a9319b497b3166b320

      • \Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

        Filesize

        1.1MB

        MD5

        c041498e60183fe841392ec977c68c19

        SHA1

        ff6bc69d14c6cb121d12ee9656cd0c4d2d702a6e

        SHA256

        69449597575314e59e8dde419f582e93ee04ec45414b4558b02ada148072a982

        SHA512

        75066d211c5721a3176a8e52464171d036695993442ba817a0271c033f39bb4c480ac836042611d3c0f25554290f26c000027838f50ff71ce6fde8e7438968c5

      • \Windows\SysWOW64\huifitc.dll

        Filesize

        36KB

        MD5

        8ba647fb5ed75c8d08111397cc908784

        SHA1

        ee1c0eae2369d646941e616f611d95c11fea776b

        SHA256

        b318c6b068de8bb96afba6e55c9f4b1a36e0efacd00ac4096e97d83cc731e766

        SHA512

        6da2e0a5d0b2748c8f5eeaa6ed50d8464618cb87a2fb5cc9e4ff45940d036e421bab74c42314dc5411a9ce90d70ad8a2fe388c6fe319267342c8b5cd3d4ce18a

      • \Windows\SysWOW64\huifitc.dll

        Filesize

        36KB

        MD5

        8ba647fb5ed75c8d08111397cc908784

        SHA1

        ee1c0eae2369d646941e616f611d95c11fea776b

        SHA256

        b318c6b068de8bb96afba6e55c9f4b1a36e0efacd00ac4096e97d83cc731e766

        SHA512

        6da2e0a5d0b2748c8f5eeaa6ed50d8464618cb87a2fb5cc9e4ff45940d036e421bab74c42314dc5411a9ce90d70ad8a2fe388c6fe319267342c8b5cd3d4ce18a

      • \Windows\SysWOW64\jfrwdh.dll

        Filesize

        217KB

        MD5

        d62f1f32d3d868dcfecfb268c4a0790d

        SHA1

        3cf598ed6a7005633fb9386684b8f66aa4a19998

        SHA256

        3c268897b539df8844f3f5ad87edf62f9a8dcba695747f24a54f43642457fac5

        SHA512

        1448bc2721c3b1b504207ce617dd0afdbc9c84e8ffdb5bf3ae58e9d6465f1f028c0d6abac2e687af5894a3b6f5344b51e73f3ccbe8786f9a20d543e555ba57ec

      • \Windows\SysWOW64\zgfdet.dll

        Filesize

        227KB

        MD5

        db867826d3def57264a830d9192ff2d3

        SHA1

        d671720823db9c9b50110105f1d55e0fca5bfd9b

        SHA256

        df4987d151b8ac7aec74c5cefa9fd44c8b655913c50776a2c063958f5223e26b

        SHA512

        d53d2c940f6bd6f805e304fcf95196c9ce54d202dd944402c1440bd7f7e5207b3146153f35c96e3b0eed7a97be1ae74181855fb86c26fba5a398de0cd57739d3

      • \Windows\SysWOW64\zgxfdx.dll

        Filesize

        220KB

        MD5

        752d53bc9e32a2fe81054522db69dd19

        SHA1

        982e45fae0154518ab3510eb9c5b8f8c3ae2632d

        SHA256

        4ea52ab43f7bfd966df4af5bc3317302a48022953904053cf9f9aac6e7bd22d0

        SHA512

        211a3b133d76c701b8b9d183b217d2a820328ddab576cf01b3b0aaba45e2d1aa5dfbc033c3757011d0436ddd224835b10b4b4d0bcf36a4979cbda75fae17f21a

      • memory/280-76-0x0000000000240000-0x000000000024D000-memory.dmp

        Filesize

        52KB

      • memory/588-115-0x0000000000280000-0x000000000028D000-memory.dmp

        Filesize

        52KB

      • memory/1060-136-0x0000000000400000-0x00000000004A7000-memory.dmp

        Filesize

        668KB

      • memory/1060-126-0x0000000000400000-0x00000000004A7000-memory.dmp

        Filesize

        668KB

      • memory/1060-129-0x0000000000390000-0x00000000003CB000-memory.dmp

        Filesize

        236KB

      • memory/1220-65-0x0000000000240000-0x000000000024D000-memory.dmp

        Filesize

        52KB

      • memory/1224-102-0x0000000002670000-0x0000000002671000-memory.dmp

        Filesize

        4KB

      • memory/1224-103-0x00000000029E0000-0x00000000029E1000-memory.dmp

        Filesize

        4KB

      • memory/1224-89-0x00000000021E0000-0x00000000021E4000-memory.dmp

        Filesize

        16KB

      • memory/1956-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

        Filesize

        8KB

      • memory/1956-121-0x0000000002FA0000-0x0000000003047000-memory.dmp

        Filesize

        668KB