Malware Analysis Report

2024-11-30 23:28

Sample ID 230815-pjzzmaaf78
Target 26X.rar
SHA256 d8fee2bf8afc2a4142b71d0410294967c95ea76f8cee3989082b6a8c43d30d3e
Tags
systembc trojan cobaltstrike 100000 backdoor 391144938 gh0strat aspackv2 evasion persistence rat upx pyinstaller
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d8fee2bf8afc2a4142b71d0410294967c95ea76f8cee3989082b6a8c43d30d3e

Threat Level: Known bad

The file 26X.rar was found to be: Known bad.

Malicious Activity Summary

systembc trojan cobaltstrike 100000 backdoor 391144938 gh0strat aspackv2 evasion persistence rat upx pyinstaller

Cobaltstrike

Gh0strat

Gh0st RAT payload

SystemBC

UAC bypass

Suspicious use of NtCreateUserProcessOtherParentProcess

ASPack v2.12-2.42

Executes dropped EXE

Loads dropped DLL

UPX packed file

Enumerates connected drives

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Program crash

Unsigned PE

Detects Pyinstaller

Enumerates physical storage devices

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

System policy modification

Modifies registry class

Modifies system certificate store

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Modifies Control Panel

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-08-15 12:22

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral4

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

151s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\11.exe"

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1608 created 1036 N/A C:\Users\Admin\AppData\Local\Temp\26X\11.exe C:\Windows\Explorer.EXE

SystemBC

trojan systembc

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfreader.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfreader.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4040 set thread context of 5064 N/A C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfreader.exe C:\Windows\SysWOW64\cmd.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\11.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\11.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfreader.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfreader.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfreader.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\11.exe

"C:\Users\Admin\AppData\Local\Temp\26X\11.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfreader.exe

"C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfreader.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\SysWOW64\cmd.exe"

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 mayo.edu udp
US 129.176.1.88:443 mayo.edu tcp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 254.130.241.8.in-addr.arpa udp
US 8.8.8.8:53 88.1.176.129.in-addr.arpa udp
US 8.8.8.8:53 www.mayo.edu udp
US 52.162.245.23:443 www.mayo.edu tcp
US 8.8.8.8:53 23.245.162.52.in-addr.arpa udp
US 8.8.8.8:53 i.imgur.com udp
NL 199.232.148.193:443 i.imgur.com tcp
US 8.8.8.8:53 193.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 48.101.122.92.in-addr.arpa udp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp

Files

memory/1608-134-0x00007FF808E10000-0x00007FF80913D000-memory.dmp

C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfreader.exe

MD5 b43b96e4483dce09976dc250f87ecf1a
SHA1 4290076db1e87a46b73e8391186025f1f5b492bb
SHA256 5eaf95ad5163607ea220e439f13e58ae1bd9b408d94e06d5d721e8daca911c12
SHA512 383b723d2d547f775a661bf6990e834b0233849822c7cbc3f0aaf0f276b1c05b0f7bde754dae3da133f7a8aae669b31547889495e5370a6617c09a2a3b61c438

memory/1608-140-0x0000000000400000-0x00000000007F2000-memory.dmp

memory/4040-141-0x00000000012F0000-0x00000000012F1000-memory.dmp

C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfium.dll

MD5 5253296effaf275e7239e52a6e3c76be
SHA1 3a07d2f3e83359d8998c7e11ee6e256e2cabdd7b
SHA256 bc7defe6891b955f977ae0d28036cea440e849209deeb9b58a693a11d359ee17
SHA512 669d549eba49e3d9fbaa1cf9775f5b4dc89784f336d14382389c1efb5a64b362bfea7a3e661bbdb816f5517acd66ebc0e8d3c9020f86b5a5dfc0774aa61a99f9

C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfium.dll

MD5 5253296effaf275e7239e52a6e3c76be
SHA1 3a07d2f3e83359d8998c7e11ee6e256e2cabdd7b
SHA256 bc7defe6891b955f977ae0d28036cea440e849209deeb9b58a693a11d359ee17
SHA512 669d549eba49e3d9fbaa1cf9775f5b4dc89784f336d14382389c1efb5a64b362bfea7a3e661bbdb816f5517acd66ebc0e8d3c9020f86b5a5dfc0774aa61a99f9

C:\Users\Admin\AppData\Roaming\KBDINDEV\ail.html

MD5 5bb10ce2d154345099373f632594b49a
SHA1 bdb91eb50e5dd610d00a8a9c8aa69c91ed063015
SHA256 b7dba474ec7726fcbf7ee3acb24a8ee08e808b57e44bfb5d5a91d74f475cba1c
SHA512 cb5729643ceb6d51c66f555bcd6fbaefcfa74b3309bafd22daf5c7dbbb4bf1df49d5539001fe21b5c29421ed9d3b1b7dbd375fb3de710e375839cbf878d7ebef

memory/4040-145-0x0000000074240000-0x0000000075494000-memory.dmp

memory/4040-146-0x0000000000400000-0x0000000000C88000-memory.dmp

memory/4040-147-0x00000000012F0000-0x00000000012F1000-memory.dmp

memory/5064-150-0x0000000074240000-0x0000000075494000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\297943f9

MD5 3a4c85148a866a92caa6d0a39564676b
SHA1 cf157e38f9487378543bbe1682bcf1e5dd47c3d4
SHA256 d8491b558e3e995fe2ca1af6d3082974f8cf30478f7ccd458d719acdbb4a1e15
SHA512 ef8b2d461365cf520f067fac0733ca2b42669791b303ae975680fec24a22cdca418c4320c77c6e2385e9fd4b8be67bb44d739a92dc247a3c25420b37b509d89c

memory/5064-152-0x00007FF819190000-0x00007FF819385000-memory.dmp

C:\Users\Admin\AppData\Roaming\KBDINDEV\pdfreader.exe

MD5 b43b96e4483dce09976dc250f87ecf1a
SHA1 4290076db1e87a46b73e8391186025f1f5b492bb
SHA256 5eaf95ad5163607ea220e439f13e58ae1bd9b408d94e06d5d721e8daca911c12
SHA512 383b723d2d547f775a661bf6990e834b0233849822c7cbc3f0aaf0f276b1c05b0f7bde754dae3da133f7a8aae669b31547889495e5370a6617c09a2a3b61c438

memory/5064-155-0x0000000074240000-0x0000000075494000-memory.dmp

memory/5064-156-0x0000000074240000-0x0000000075494000-memory.dmp

memory/5064-158-0x0000000074240000-0x0000000075494000-memory.dmp

memory/4560-159-0x0000000000350000-0x0000000000358000-memory.dmp

memory/4560-160-0x00007FF819190000-0x00007FF819385000-memory.dmp

memory/4560-161-0x0000000000350000-0x0000000000358000-memory.dmp

memory/4560-162-0x0000000000860000-0x0000000000C93000-memory.dmp

memory/4560-164-0x0000000000350000-0x0000000000358000-memory.dmp

memory/4560-165-0x0000000000350000-0x0000000000358000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

120s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\20.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\20.exe

"C:\Users\Admin\AppData\Local\Temp\26X\20.exe"

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\6.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\6.exe

"C:\Users\Admin\AppData\Local\Temp\26X\6.exe"

Network

Country Destination Domain Proto
US 173.82.255.121:80 tcp
N/A 127.0.0.1:12306 tcp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

141s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\13.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\13.exe

"C:\Users\Admin\AppData\Local\Temp\26X\13.exe"

Network

N/A

Files

memory/2116-54-0x000000013FA60000-0x0000000140036000-memory.dmp

Analysis: behavioral29

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

118s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\5.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3000 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe C:\Users\Admin\AppData\Local\Temp\26X\5.exe
PID 3000 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe C:\Users\Admin\AppData\Local\Temp\26X\5.exe
PID 3000 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\26X\5.exe C:\Users\Admin\AppData\Local\Temp\26X\5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\26X\5.exe

"C:\Users\Admin\AppData\Local\Temp\26X\5.exe"

C:\Users\Admin\AppData\Local\Temp\26X\5.exe

"C:\Users\Admin\AppData\Local\Temp\26X\5.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 yiyasasa.top udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI30002\ucrtbase.dll

MD5 3c72fc810602812d8c03c8709519f115
SHA1 8956f79d95fe1eab1a06c4ad75588a49c2029994
SHA256 da572f7c674178ba7b91f7d47643fed07f7e71dbb4aeb46e1671ce08d1b31d73
SHA512 633f71aa2985e30870a3408dfb5b135b75c65ac89df24dc21b4f1057a6c8a489309ebdb263b3c46b054817dd81cde33ba47aa4677ee7f52237a5e0b821417901

\Users\Admin\AppData\Local\Temp\_MEI30002\ucrtbase.dll

MD5 3c72fc810602812d8c03c8709519f115
SHA1 8956f79d95fe1eab1a06c4ad75588a49c2029994
SHA256 da572f7c674178ba7b91f7d47643fed07f7e71dbb4aeb46e1671ce08d1b31d73
SHA512 633f71aa2985e30870a3408dfb5b135b75c65ac89df24dc21b4f1057a6c8a489309ebdb263b3c46b054817dd81cde33ba47aa4677ee7f52237a5e0b821417901

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-core-localization-l1-2-0.dll

MD5 b402ed77d6f31d825bda175dbc0c4f92
SHA1 1f2a4b8753b3aae225feac5487cc0011b73c0eb7
SHA256 6ed17fb3ca5156b39fbc1ef7d1eefa95e739857607de4cd8d41cecfcd1350705
SHA512 ec04013139f3fd9dbf22b92121d82b2eb97e136f8619790cde2d0b660280e838962f9006d3e4c3a359627b017f2b6ade7edff3bbc26e559c3de37540585602d9

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-core-localization-l1-2-0.dll

MD5 b402ed77d6f31d825bda175dbc0c4f92
SHA1 1f2a4b8753b3aae225feac5487cc0011b73c0eb7
SHA256 6ed17fb3ca5156b39fbc1ef7d1eefa95e739857607de4cd8d41cecfcd1350705
SHA512 ec04013139f3fd9dbf22b92121d82b2eb97e136f8619790cde2d0b660280e838962f9006d3e4c3a359627b017f2b6ade7edff3bbc26e559c3de37540585602d9

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-core-processthreads-l1-1-1.dll

MD5 3d872be898581f00d0310d7ab9abaf2b
SHA1 420e0ab98bb748723130de414f0ffed117ef3f7e
SHA256 4de821884cbef4182b29d8c33cfe13e43e130ad58ee1281679e8d40a2edcb8ea
SHA512 35cfb9888a5f4299403a0d9c57f0ba79e3625431a9acc5e04ae2ae101b3dc521a0dcff5d4a1bf508b25dbf05dd432f6987d860ff494d15538ed95673a8b7376b

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-core-file-l1-2-0.dll

MD5 9d8413744097196f92327f632a85acee
SHA1 dfc07f5e5a0634dd1f15fdc9ff9731748fbff919
SHA256 6878d8168d5cc159efe58f14e5ba10310d99b53ab8495521e54c966994dac50b
SHA512 a8f6e9ee1c5d65f68b8b20d406d3e666c186e15cb3b92575257b5637fe7dd5ac7d75e9ad51c839ba4490512f68f6b48822fc9edd316dd7625d3627d3b975fb2a

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-core-file-l1-2-0.dll

MD5 9d8413744097196f92327f632a85acee
SHA1 dfc07f5e5a0634dd1f15fdc9ff9731748fbff919
SHA256 6878d8168d5cc159efe58f14e5ba10310d99b53ab8495521e54c966994dac50b
SHA512 a8f6e9ee1c5d65f68b8b20d406d3e666c186e15cb3b92575257b5637fe7dd5ac7d75e9ad51c839ba4490512f68f6b48822fc9edd316dd7625d3627d3b975fb2a

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-core-timezone-l1-1-0.dll

MD5 6c180c8de3ecf27de7a5812ff055737e
SHA1 3aad20b71bb374bb2c5f7431a1b75b60956a01fd
SHA256 630466fd77ac7009c947a8370a0d0c20652169824c54ddcb8c05e8df45e23197
SHA512 e4aa79eb2b6b3be9b545e8cb8b43cd6052036dc5cce7077be40441b9942931b30d76c475d550a178d4e94c9c366cabc852f500e482b7fdcd361fc2a08e41c00e

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-core-file-l2-1-0.dll

MD5 361c6bcfcea263749419b0fbed7a0ce8
SHA1 03db13108ce9d5fc01cecf3199619ffbccbd855a
SHA256 b74aefd6fa638be3f415165c8109121a2093597421101abc312ee7ffa1130278
SHA512 aa8b585000cc65f9841b938e4523d91d8f6db650e0b4bb11efd740c27309bf81cdb77f05d0beda2489bf26f4fbc6d02c93ce3b64946502e2c044eea89696cc76

C:\Users\Admin\AppData\Local\Temp\_MEI30002\python38.dll

MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-core-file-l2-1-0.dll

MD5 361c6bcfcea263749419b0fbed7a0ce8
SHA1 03db13108ce9d5fc01cecf3199619ffbccbd855a
SHA256 b74aefd6fa638be3f415165c8109121a2093597421101abc312ee7ffa1130278
SHA512 aa8b585000cc65f9841b938e4523d91d8f6db650e0b4bb11efd740c27309bf81cdb77f05d0beda2489bf26f4fbc6d02c93ce3b64946502e2c044eea89696cc76

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-core-timezone-l1-1-0.dll

MD5 6c180c8de3ecf27de7a5812ff055737e
SHA1 3aad20b71bb374bb2c5f7431a1b75b60956a01fd
SHA256 630466fd77ac7009c947a8370a0d0c20652169824c54ddcb8c05e8df45e23197
SHA512 e4aa79eb2b6b3be9b545e8cb8b43cd6052036dc5cce7077be40441b9942931b30d76c475d550a178d4e94c9c366cabc852f500e482b7fdcd361fc2a08e41c00e

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-core-processthreads-l1-1-1.dll

MD5 3d872be898581f00d0310d7ab9abaf2b
SHA1 420e0ab98bb748723130de414f0ffed117ef3f7e
SHA256 4de821884cbef4182b29d8c33cfe13e43e130ad58ee1281679e8d40a2edcb8ea
SHA512 35cfb9888a5f4299403a0d9c57f0ba79e3625431a9acc5e04ae2ae101b3dc521a0dcff5d4a1bf508b25dbf05dd432f6987d860ff494d15538ed95673a8b7376b

\Users\Admin\AppData\Local\Temp\_MEI30002\python38.dll

MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

C:\Users\Admin\AppData\Local\Temp\_MEI30002\VCRUNTIME140.dll

MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

\Users\Admin\AppData\Local\Temp\_MEI30002\VCRUNTIME140.dll

MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-runtime-l1-1-0.dll

MD5 55b80c522731ecb92914bf9cded028c2
SHA1 424c61bc659caf04281959ede1b1f03b703934ed
SHA256 4c787ff8d40bb803e75fe6218fec36a672cfa6cfc7f6e80e68a7eb0b77a10e5a
SHA512 3779b530c7dba624369cb0f5d15154d89547adc3c4c7cc0571f1e8326588165098b9b5768d0052ecf1ea4f2dc84ae7dcf4712e3bc9ebdadb5fca4b0f4de43812

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-runtime-l1-1-0.dll

MD5 55b80c522731ecb92914bf9cded028c2
SHA1 424c61bc659caf04281959ede1b1f03b703934ed
SHA256 4c787ff8d40bb803e75fe6218fec36a672cfa6cfc7f6e80e68a7eb0b77a10e5a
SHA512 3779b530c7dba624369cb0f5d15154d89547adc3c4c7cc0571f1e8326588165098b9b5768d0052ecf1ea4f2dc84ae7dcf4712e3bc9ebdadb5fca4b0f4de43812

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-heap-l1-1-0.dll

MD5 01370c79ebabd534e7b58d35072d2866
SHA1 8cd0cd21ff838a2a314246def4bd858bab184a5d
SHA256 742bb9bf4c232f84ad8008af4af8eda7a1ec3eb76f05d9d7ebb95f6a5cabd2d8
SHA512 b07d9634ac804b476d61b6a0fc87894947e88744cc3eecf7d68ede3714acd938fae14452e43f9110919b8f8f9f5d4222e9de2ca97a915dd07b3231d674729761

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-heap-l1-1-0.dll

MD5 01370c79ebabd534e7b58d35072d2866
SHA1 8cd0cd21ff838a2a314246def4bd858bab184a5d
SHA256 742bb9bf4c232f84ad8008af4af8eda7a1ec3eb76f05d9d7ebb95f6a5cabd2d8
SHA512 b07d9634ac804b476d61b6a0fc87894947e88744cc3eecf7d68ede3714acd938fae14452e43f9110919b8f8f9f5d4222e9de2ca97a915dd07b3231d674729761

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-string-l1-1-0.dll

MD5 7a2799f4bc45505e7104e06dc8e254f8
SHA1 323bc35e0101b351a4abde1fce698520832518a8
SHA256 92f72f495a6897f7d7cf2c2064b2b65f6b4fbd4f30911a534a5cd0de73395ebe
SHA512 2627da183779f17fcc9709a6da2e2916a296f61124adb9bf563c80d723ada9b769806cab8fbc4ed916f54fd4cde18f25e7ad53ed6c75e7e61fdef37c2f1ec9b2

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-string-l1-1-0.dll

MD5 7a2799f4bc45505e7104e06dc8e254f8
SHA1 323bc35e0101b351a4abde1fce698520832518a8
SHA256 92f72f495a6897f7d7cf2c2064b2b65f6b4fbd4f30911a534a5cd0de73395ebe
SHA512 2627da183779f17fcc9709a6da2e2916a296f61124adb9bf563c80d723ada9b769806cab8fbc4ed916f54fd4cde18f25e7ad53ed6c75e7e61fdef37c2f1ec9b2

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-stdio-l1-1-0.dll

MD5 4614d03a94d46c0e9d1c5d96a3fe1d78
SHA1 cacb73ca3c7e31a4b8f749854060b7a422497050
SHA256 c7919be431ce2fa1906ff9eeb19e4cb19a30a4680107ef8737ce894654b21a5a
SHA512 4f30e8c5893662d7889a049c206b08559ad1a34eb7927be313086d6dae40dca3571de3852dba2ad9324e028fa86e8a391a58ec48ba5dbd5c4a88660ffe8b30df

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-stdio-l1-1-0.dll

MD5 4614d03a94d46c0e9d1c5d96a3fe1d78
SHA1 cacb73ca3c7e31a4b8f749854060b7a422497050
SHA256 c7919be431ce2fa1906ff9eeb19e4cb19a30a4680107ef8737ce894654b21a5a
SHA512 4f30e8c5893662d7889a049c206b08559ad1a34eb7927be313086d6dae40dca3571de3852dba2ad9324e028fa86e8a391a58ec48ba5dbd5c4a88660ffe8b30df

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-convert-l1-1-0.dll

MD5 d749afffa2b3be4b2a9edac50c20b28b
SHA1 972253ed12c344b85290f7b3d5f9608a7f7b0670
SHA256 e64fbac3491b4693e79a3f7b0db1d788f93608d3fc82133edf25a868c80d2153
SHA512 4447b6960a6c178f7c37dbd38e9aec24ba5a0c58e19afcfaa2b70dca7d7bbe87ad7aa1ac9d48ab9b56b1f375768d4c4cb28d5afcf714102f9757faa2b3e728d9

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-convert-l1-1-0.dll

MD5 d749afffa2b3be4b2a9edac50c20b28b
SHA1 972253ed12c344b85290f7b3d5f9608a7f7b0670
SHA256 e64fbac3491b4693e79a3f7b0db1d788f93608d3fc82133edf25a868c80d2153
SHA512 4447b6960a6c178f7c37dbd38e9aec24ba5a0c58e19afcfaa2b70dca7d7bbe87ad7aa1ac9d48ab9b56b1f375768d4c4cb28d5afcf714102f9757faa2b3e728d9

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-math-l1-1-0.dll

MD5 85893a96a568ba9781f50f876ed303cd
SHA1 fb7473bc5b1e88e978b7e5664b45d69770c8f4fa
SHA256 08e34f12de24e89379a0533f21a23ce6fecbea05d4062796d4ffd4adc3012316
SHA512 864fa39423b8ca9c43fa177aca1484ec2ffae4868a434e7a8016efe88f396b67fb8ca3766f611de7218e9983653a8b7b88b07c2591b252dd93a0d9638980e7ff

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-math-l1-1-0.dll

MD5 85893a96a568ba9781f50f876ed303cd
SHA1 fb7473bc5b1e88e978b7e5664b45d69770c8f4fa
SHA256 08e34f12de24e89379a0533f21a23ce6fecbea05d4062796d4ffd4adc3012316
SHA512 864fa39423b8ca9c43fa177aca1484ec2ffae4868a434e7a8016efe88f396b67fb8ca3766f611de7218e9983653a8b7b88b07c2591b252dd93a0d9638980e7ff

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-locale-l1-1-0.dll

MD5 bacb72fa56de18d5ac63e4a0a3fe768f
SHA1 7db19efe649d30337781afd62616c0549255046e
SHA256 25905676b543c4f05e9dae135f929c03a57686a6941ce59be2b3450521feb943
SHA512 78d82962c11e5928e77c5bd0377ecb6b00c2eca242d637f76e68fbf907bce7381f3a5294100d055c30f6e2aee164db0b95dcf0c0c77e39edcec4a046cfc63ed4

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-locale-l1-1-0.dll

MD5 bacb72fa56de18d5ac63e4a0a3fe768f
SHA1 7db19efe649d30337781afd62616c0549255046e
SHA256 25905676b543c4f05e9dae135f929c03a57686a6941ce59be2b3450521feb943
SHA512 78d82962c11e5928e77c5bd0377ecb6b00c2eca242d637f76e68fbf907bce7381f3a5294100d055c30f6e2aee164db0b95dcf0c0c77e39edcec4a046cfc63ed4

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-time-l1-1-0.dll

MD5 38b633f132f8e2b3abc268537fa415ec
SHA1 ccccb8c3e31dce7b6b952022d245c11ff3ae8122
SHA256 46cb7b3a9f8aac5adcdbe23494e458f3195adf4b8ed1c71f2d934ddde651e57e
SHA512 23bd77d61c20b1af7f13b5bcbeb9fa74ee807f809bb3d4dd40c7709ca4870078fa6e8e94eefc83a725c0245c0ce02e3adbd4f370d6b986f0c9442ccbc2c2ab96

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-time-l1-1-0.dll

MD5 38b633f132f8e2b3abc268537fa415ec
SHA1 ccccb8c3e31dce7b6b952022d245c11ff3ae8122
SHA256 46cb7b3a9f8aac5adcdbe23494e458f3195adf4b8ed1c71f2d934ddde651e57e
SHA512 23bd77d61c20b1af7f13b5bcbeb9fa74ee807f809bb3d4dd40c7709ca4870078fa6e8e94eefc83a725c0245c0ce02e3adbd4f370d6b986f0c9442ccbc2c2ab96

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-environment-l1-1-0.dll

MD5 7a2874fe036f7dc86ed5f712adaa38e6
SHA1 440f2dc5379ceee35d29571c195dc7a76e8b70e7
SHA256 dd054e4de84144c2130fa8d28d563252a7c4089a58872e49d63bc43c9a1a3cb8
SHA512 d20811025f714b5fd3754d607422f4fb5cd6c456ffceef139edcb0cfaacd9b63a694ce2ea737db78385f0b23ddcfc283282a319b79e7a0e4bd50034e87aacb9a

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-environment-l1-1-0.dll

MD5 7a2874fe036f7dc86ed5f712adaa38e6
SHA1 440f2dc5379ceee35d29571c195dc7a76e8b70e7
SHA256 dd054e4de84144c2130fa8d28d563252a7c4089a58872e49d63bc43c9a1a3cb8
SHA512 d20811025f714b5fd3754d607422f4fb5cd6c456ffceef139edcb0cfaacd9b63a694ce2ea737db78385f0b23ddcfc283282a319b79e7a0e4bd50034e87aacb9a

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-process-l1-1-0.dll

MD5 9ee275466394a2088d7dfbbc0c716671
SHA1 4d2f94674587251c60805889395ab7377e8c5e17
SHA256 c68a61c260454c0aeb051ddb2bed52cbca44b96d50046017cbc351b41f225dc0
SHA512 996212d07b0b6e55f54e17d6a053f017b1fd00f50906db9de25b8ae5632eeac9c197e91db1c293e7abf0e8b823937cb18e26f43e166f76c02a6914c9776a72b3

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-process-l1-1-0.dll

MD5 9ee275466394a2088d7dfbbc0c716671
SHA1 4d2f94674587251c60805889395ab7377e8c5e17
SHA256 c68a61c260454c0aeb051ddb2bed52cbca44b96d50046017cbc351b41f225dc0
SHA512 996212d07b0b6e55f54e17d6a053f017b1fd00f50906db9de25b8ae5632eeac9c197e91db1c293e7abf0e8b823937cb18e26f43e166f76c02a6914c9776a72b3

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-conio-l1-1-0.dll

MD5 84a950e3c162d67f98516bb1744139e0
SHA1 05ff2fe60c5748c33ba8605aaf609b3bdfe2772f
SHA256 91f4db05c69c58ecb2493e30acc5297043c41b1ce6db50cee4e2922cd4bcd7f2
SHA512 7328c6a512d450f2538efeabf3f467489a898ed7c1d45c1952b98d118d898083510c9849182bc425411a408c113a351a28b41bedeb5b8de61427144b3fa87c80

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-conio-l1-1-0.dll

MD5 84a950e3c162d67f98516bb1744139e0
SHA1 05ff2fe60c5748c33ba8605aaf609b3bdfe2772f
SHA256 91f4db05c69c58ecb2493e30acc5297043c41b1ce6db50cee4e2922cd4bcd7f2
SHA512 7328c6a512d450f2538efeabf3f467489a898ed7c1d45c1952b98d118d898083510c9849182bc425411a408c113a351a28b41bedeb5b8de61427144b3fa87c80

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 73e14d927d075ca273b3237116351e8f
SHA1 0c15cea3c83c7f7e692dc6f8bd856b615c727d49
SHA256 966a7f15bfb2e0ff7888d583638ebd675d8f46b264194cf332f78140b7c129e1
SHA512 664f72d7adf48f8499321f8a5df952c6043532aae09bae9ffbd59da77b161cd43211a3aaef1ba85529dfe00498d1ac3a933a7c9cf437095c6a337c9bc0816b3f

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 73e14d927d075ca273b3237116351e8f
SHA1 0c15cea3c83c7f7e692dc6f8bd856b615c727d49
SHA256 966a7f15bfb2e0ff7888d583638ebd675d8f46b264194cf332f78140b7c129e1
SHA512 664f72d7adf48f8499321f8a5df952c6043532aae09bae9ffbd59da77b161cd43211a3aaef1ba85529dfe00498d1ac3a933a7c9cf437095c6a337c9bc0816b3f

C:\Users\Admin\AppData\Local\Temp\_MEI30002\base_library.zip

MD5 24036a8677bdaa5d94ac05fd4cf6023e
SHA1 eb1596657871cdfca0f7d56c1da39bc99cc903d3
SHA256 3bb7a3d471a1be3ba487895e5e60bebca068711639e6a54978bfdf1bdde2f82f
SHA512 2982b1b5e5e59d0fd25fe2eb1dafef581151376baa5fdf558d175ddd587b46346839f40c4fae24ccb73ff5aca01c93175227e0c430e42e5c2ef2b3480eb3e0f4

C:\Users\Admin\AppData\Local\Temp\_MEI30002\_ctypes.pyd

MD5 291a0a9b63bae00a4222a6df71a22023
SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

C:\Users\Admin\AppData\Local\Temp\_MEI30002\python3.DLL

MD5 c9f0b55fce50c904dff9276014cef6d8
SHA1 9f9ae27df619b695827a5af29414b592fc584e43
SHA256 074b06ae1d0a0b5c26f0ce097c91e2f24a5d38b279849115495fc40c6c10117e
SHA512 8dd188003d8419a25de7fbb37b29a4bc57a6fd93f2d79b5327ad2897d4ae626d7427f4e6ac84463c158bcb18b6c1e02e83ed49f347389252477bbeeb864ac799

\Users\Admin\AppData\Local\Temp\_MEI30002\python3.dll

MD5 c9f0b55fce50c904dff9276014cef6d8
SHA1 9f9ae27df619b695827a5af29414b592fc584e43
SHA256 074b06ae1d0a0b5c26f0ce097c91e2f24a5d38b279849115495fc40c6c10117e
SHA512 8dd188003d8419a25de7fbb37b29a4bc57a6fd93f2d79b5327ad2897d4ae626d7427f4e6ac84463c158bcb18b6c1e02e83ed49f347389252477bbeeb864ac799

\Users\Admin\AppData\Local\Temp\_MEI30002\_ctypes.pyd

MD5 291a0a9b63bae00a4222a6df71a22023
SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

C:\Users\Admin\AppData\Local\Temp\_MEI30002\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

\Users\Admin\AppData\Local\Temp\_MEI30002\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI30002\_socket.pyd

MD5 4827652de133c83fa1cae839b361856c
SHA1 182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
SHA512 8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

\Users\Admin\AppData\Local\Temp\_MEI30002\_socket.pyd

MD5 4827652de133c83fa1cae839b361856c
SHA1 182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
SHA512 8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

C:\Users\Admin\AppData\Local\Temp\_MEI30002\select.pyd

MD5 e21cff76db11c1066fd96af86332b640
SHA1 e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
SHA512 e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

\Users\Admin\AppData\Local\Temp\_MEI30002\select.pyd

MD5 e21cff76db11c1066fd96af86332b640
SHA1 e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
SHA512 e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

C:\Users\Admin\AppData\Local\Temp\_MEI30002\_ssl.pyd

MD5 d4dfd8c2894670e9f8d6302c09997300
SHA1 c3a6cc8d8079a06a4cac8950e0baba2b43fb1f8e
SHA256 0a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
SHA512 1422bf45d233e2e3f77dce30ba0123625f2a511f73dfdf42ee093b1755963d9abc371935111c28f0d2c02308c5e82867de2546d871c35e657da32a7182026048

\Users\Admin\AppData\Local\Temp\_MEI30002\_ssl.pyd

MD5 d4dfd8c2894670e9f8d6302c09997300
SHA1 c3a6cc8d8079a06a4cac8950e0baba2b43fb1f8e
SHA256 0a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
SHA512 1422bf45d233e2e3f77dce30ba0123625f2a511f73dfdf42ee093b1755963d9abc371935111c28f0d2c02308c5e82867de2546d871c35e657da32a7182026048

C:\Users\Admin\AppData\Local\Temp\_MEI30002\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

\Users\Admin\AppData\Local\Temp\_MEI30002\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

C:\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-utility-l1-1-0.dll

MD5 5cde35104a68606913af6e5bd3b1adea
SHA1 f1f28141585c000753ab4db9ffc61f90929d4a1a
SHA256 111f6dd2e7247071a33d75bf98d521a8d09c4071f90483a82e6ed9af69bb52c4
SHA512 caa5f80ac380a6e0242104f297fbfe6091260d743ef967fb1010720dbcba2a575baf8cb1f666b11fe780428d71a04767e2cc63d1bd9638d5f1af1063e3f43f91

\Users\Admin\AppData\Local\Temp\_MEI30002\api-ms-win-crt-utility-l1-1-0.dll

MD5 5cde35104a68606913af6e5bd3b1adea
SHA1 f1f28141585c000753ab4db9ffc61f90929d4a1a
SHA256 111f6dd2e7247071a33d75bf98d521a8d09c4071f90483a82e6ed9af69bb52c4
SHA512 caa5f80ac380a6e0242104f297fbfe6091260d743ef967fb1010720dbcba2a575baf8cb1f666b11fe780428d71a04767e2cc63d1bd9638d5f1af1063e3f43f91

C:\Users\Admin\AppData\Local\Temp\_MEI30002\libssl-1_1.dll

MD5 50bcfb04328fec1a22c31c0e39286470
SHA1 3a1b78faf34125c7b8d684419fa715c367db3daa
SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
SHA512 370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685

\Users\Admin\AppData\Local\Temp\_MEI30002\libssl-1_1.dll

MD5 50bcfb04328fec1a22c31c0e39286470
SHA1 3a1b78faf34125c7b8d684419fa715c367db3daa
SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
SHA512 370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685

C:\Users\Admin\AppData\Local\Temp\_MEI30002\_hashlib.pyd

MD5 5e5af52f42eaf007e3ac73fd2211f048
SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

\Users\Admin\AppData\Local\Temp\_MEI30002\_hashlib.pyd

MD5 5e5af52f42eaf007e3ac73fd2211f048
SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

C:\Users\Admin\AppData\Local\Temp\_MEI30002\_queue.pyd

MD5 dd146e2fa08302496b15118bf47703cf
SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c

\Users\Admin\AppData\Local\Temp\_MEI30002\_queue.pyd

MD5 dd146e2fa08302496b15118bf47703cf
SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c

C:\Users\Admin\AppData\Local\Temp\_MEI30002\_bz2.pyd

MD5 a49c5f406456b79254eb65d015b81088
SHA1 cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
SHA512 bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

Analysis: behavioral32

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

140s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\6.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\6.exe

"C:\Users\Admin\AppData\Local\Temp\26X\6.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
N/A 127.0.0.1:12306 tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 173.82.255.121:80 tcp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

126s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\12.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\26X\12.exe

"C:\Users\Admin\AppData\Local\Temp\26X\12.exe"

C:\Users\Admin\AppData\Local\Temp\26X\12.exe

"C:\Users\Admin\AppData\Local\Temp\26X\12.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
CN 124.223.197.47:80 tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI25802\python310.dll

MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

C:\Users\Admin\AppData\Local\Temp\_MEI25802\python310.dll

MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

C:\Users\Admin\AppData\Local\Temp\_MEI25802\VCRUNTIME140.dll

MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

C:\Users\Admin\AppData\Local\Temp\_MEI25802\VCRUNTIME140.dll

MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

C:\Users\Admin\AppData\Local\Temp\_MEI25802\base_library.zip

MD5 e8278aac8abc86754db48dae104f4dab
SHA1 65b9984d50700a8c022a47c489588eb345a299e6
SHA256 cc3e04aba3e9f914189bec0911c1b300766a17b1d5f471bb38528db5031b1a86
SHA512 aca1f89f525af7274e41b7d167ec25e325087ed0be15c97338471b0a80055bbb16a289bb787dc93af5b44a211ad4284c9690bc2cda3a62c35b2d48f28135951e

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_ctypes.pyd

MD5 79f339753dc8954b8eb45fe70910937e
SHA1 3ad1bf9872dc779f32795988eb85c81fe47b3dd4
SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
SHA512 21e567e813180ed0480c4b21be3e2e67974d8d787e663275be054cee0a3f5161fc39034704dbd25f1412feb021d6a21b300a32d1747dee072820be81b9d9b753

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_ctypes.pyd

MD5 79f339753dc8954b8eb45fe70910937e
SHA1 3ad1bf9872dc779f32795988eb85c81fe47b3dd4
SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
SHA512 21e567e813180ed0480c4b21be3e2e67974d8d787e663275be054cee0a3f5161fc39034704dbd25f1412feb021d6a21b300a32d1747dee072820be81b9d9b753

C:\Users\Admin\AppData\Local\Temp\_MEI25802\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI25802\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_socket.pyd

MD5 5dd51579fa9b6a06336854889562bec0
SHA1 99c0ed0a15ed450279b01d95b75c162628c9be1d
SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
SHA512 7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_socket.pyd

MD5 5dd51579fa9b6a06336854889562bec0
SHA1 99c0ed0a15ed450279b01d95b75c162628c9be1d
SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
SHA512 7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e

C:\Users\Admin\AppData\Local\Temp\_MEI25802\select.pyd

MD5 78d421a4e6b06b5561c45b9a5c6f86b1
SHA1 c70747d3f2d26a92a0fe0b353f1d1d01693929ac
SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
SHA512 83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012

C:\Users\Admin\AppData\Local\Temp\_MEI25802\select.pyd

MD5 78d421a4e6b06b5561c45b9a5c6f86b1
SHA1 c70747d3f2d26a92a0fe0b353f1d1d01693929ac
SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
SHA512 83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_ssl.pyd

MD5 11c5008e0ba2caa8adf7452f0aaafd1e
SHA1 764b33b749e3da9e716b8a853b63b2f7711fcc7c
SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
SHA512 fceb022d8694bce6504d6b64de4596e2b8252fc2427ee66300e37bcff297579cc7d32a8cb8f847408eaa716cb053e20d53e93fbd945e3f60d58214e6a969c9dd

C:\Users\Admin\AppData\Local\Temp\_MEI25802\libcrypto-1_1.dll

MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_ssl.pyd

MD5 11c5008e0ba2caa8adf7452f0aaafd1e
SHA1 764b33b749e3da9e716b8a853b63b2f7711fcc7c
SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
SHA512 fceb022d8694bce6504d6b64de4596e2b8252fc2427ee66300e37bcff297579cc7d32a8cb8f847408eaa716cb053e20d53e93fbd945e3f60d58214e6a969c9dd

C:\Users\Admin\AppData\Local\Temp\_MEI25802\libssl-1_1.dll

MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

C:\Users\Admin\AppData\Local\Temp\_MEI25802\libssl-1_1.dll

MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

C:\Users\Admin\AppData\Local\Temp\_MEI25802\libcrypto-1_1.dll

MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

C:\Users\Admin\AppData\Local\Temp\_MEI25802\libcrypto-1_1.dll

MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_hashlib.pyd

MD5 cfb9e0a73a6c9d6d35c2594e52e15234
SHA1 b86042c96f2ce6d8a239b7d426f298a23df8b3b9
SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
SHA512 22a5fd139d88c0eee7241c5597d8dbbf2b78841565d0ed0df62383ab50fde04b13a203bddef03530f8609f5117869ed06894a572f7655224285823385d7492d2

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_hashlib.pyd

MD5 cfb9e0a73a6c9d6d35c2594e52e15234
SHA1 b86042c96f2ce6d8a239b7d426f298a23df8b3b9
SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
SHA512 22a5fd139d88c0eee7241c5597d8dbbf2b78841565d0ed0df62383ab50fde04b13a203bddef03530f8609f5117869ed06894a572f7655224285823385d7492d2

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_queue.pyd

MD5 c9ee37e9f3bffd296ade10a27c7e5b50
SHA1 b7eee121b2918b6c0997d4889cff13025af4f676
SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
SHA512 c63bb1b5d84d027439af29c4827fa801df3a2f3d5854c7c79789cad3f5f7561eb2a7406c6f599d2ac553bc31969dc3fa9eef8648bed7282fbc5dc3fb3ba4307f

C:\Users\Admin\AppData\Local\Temp\_MEI25802\unicodedata.pyd

MD5 a40ff441b1b612b3b9f30f28fa3c680d
SHA1 42a309992bdbb68004e2b6b60b450e964276a8fc
SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
SHA512 5f9142b16ed7ffc0e5b17d6a4257d7249a21061fe5e928d3cde75265c2b87b723b2e7bd3109c30d2c8f83913134445e8672c98c187073368c244a476ac46c3ef

C:\Users\Admin\AppData\Local\Temp\_MEI25802\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

MD5 e9454a224d11e1bd68c7069b7f5f61a7
SHA1 793098653d93652415f8bace81434f6f4490cf1a
SHA256 711f292ace44576f5de4f592adebd9d21faf569357c289425251d8dce4fa84cc
SHA512 17d993a0c4b56219e8c224eb2bdea92d9cc4bd3809b0f9fa4cf0ddfdc5eab4371441d488ea851abf2f88c691d57a268d5cdcaa9d11d4dd091bc130638fe36460

C:\Users\Admin\AppData\Local\Temp\_MEI25802\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

MD5 e9454a224d11e1bd68c7069b7f5f61a7
SHA1 793098653d93652415f8bace81434f6f4490cf1a
SHA256 711f292ace44576f5de4f592adebd9d21faf569357c289425251d8dce4fa84cc
SHA512 17d993a0c4b56219e8c224eb2bdea92d9cc4bd3809b0f9fa4cf0ddfdc5eab4371441d488ea851abf2f88c691d57a268d5cdcaa9d11d4dd091bc130638fe36460

C:\Users\Admin\AppData\Local\Temp\_MEI25802\charset_normalizer\md.cp310-win_amd64.pyd

MD5 f0027550d46509b0514cf2bf0cc162bc
SHA1 5b5a9fd863a216b2444ccbd51b1f451d6eca8179
SHA256 77300a458bb8dc0d4ff4d8bddb3289e90cb079418dbed3e20d2c9a445f39746e
SHA512 bb09b814dbe3e4361abbafec4768208c98a7f455ef311b653d61b0b6098197bdac43e74e2e3868e486819f147b8f7c442c76e5181cc5a7eb13b6e2c2e07bf9b7

C:\Users\Admin\AppData\Local\Temp\_MEI25802\unicodedata.pyd

MD5 a40ff441b1b612b3b9f30f28fa3c680d
SHA1 42a309992bdbb68004e2b6b60b450e964276a8fc
SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
SHA512 5f9142b16ed7ffc0e5b17d6a4257d7249a21061fe5e928d3cde75265c2b87b723b2e7bd3109c30d2c8f83913134445e8672c98c187073368c244a476ac46c3ef

C:\Users\Admin\AppData\Local\Temp\_MEI25802\charset_normalizer\md.cp310-win_amd64.pyd

MD5 f0027550d46509b0514cf2bf0cc162bc
SHA1 5b5a9fd863a216b2444ccbd51b1f451d6eca8179
SHA256 77300a458bb8dc0d4ff4d8bddb3289e90cb079418dbed3e20d2c9a445f39746e
SHA512 bb09b814dbe3e4361abbafec4768208c98a7f455ef311b653d61b0b6098197bdac43e74e2e3868e486819f147b8f7c442c76e5181cc5a7eb13b6e2c2e07bf9b7

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_bz2.pyd

MD5 b45e82a398713163216984f2feba88f6
SHA1 eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839
SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
SHA512 b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_bz2.pyd

MD5 b45e82a398713163216984f2feba88f6
SHA1 eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839
SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
SHA512 b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_lzma.pyd

MD5 5a77a1e70e054431236adb9e46f40582
SHA1 be4a8d1618d3ad11cfdb6a366625b37c27f4611a
SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
SHA512 3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_lzma.pyd

MD5 5a77a1e70e054431236adb9e46f40582
SHA1 be4a8d1618d3ad11cfdb6a366625b37c27f4611a
SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
SHA512 3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635

C:\Users\Admin\AppData\Local\Temp\_MEI25802\_queue.pyd

MD5 c9ee37e9f3bffd296ade10a27c7e5b50
SHA1 b7eee121b2918b6c0997d4889cff13025af4f676
SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
SHA512 c63bb1b5d84d027439af29c4827fa801df3a2f3d5854c7c79789cad3f5f7561eb2a7406c6f599d2ac553bc31969dc3fa9eef8648bed7282fbc5dc3fb3ba4307f

Analysis: behavioral24

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

153s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\22.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Processes

C:\Users\Admin\AppData\Local\Temp\26X\22.exe

"C:\Users\Admin\AppData\Local\Temp\26X\22.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 254.130.241.8.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 captcha.jincheng4917.cn udp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
US 8.8.8.8:53 132.133.90.211.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
US 8.8.8.8:53 254.137.241.8.in-addr.arpa udp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp
CN 211.90.133.132:443 captcha.jincheng4917.cn tcp

Files

memory/3280-135-0x0000020264000000-0x0000020264041000-memory.dmp

memory/3280-136-0x0000020264DA0000-0x0000020265212000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

151s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\4.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Processes

C:\Users\Admin\AppData\Local\Temp\26X\4.exe

"C:\Users\Admin\AppData\Local\Temp\26X\4.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 sf-1257780318.cos.ap-beijing.myqcloud.com udp
CN 82.156.94.47:443 sf-1257780318.cos.ap-beijing.myqcloud.com tcp
US 8.8.8.8:53 47.94.156.82.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 jtexpress.life udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 jtexpress.life udp
US 188.114.96.0:8443 jtexpress.life tcp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 188.114.96.0:8443 jtexpress.life tcp
US 8.8.8.8:53 2.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 254.137.241.8.in-addr.arpa udp
US 188.114.96.0:8443 jtexpress.life tcp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp
US 188.114.96.0:8443 jtexpress.life tcp

Files

memory/2716-140-0x0000029141FB0000-0x0000029142030000-memory.dmp

memory/2716-142-0x0000029142040000-0x0000029142440000-memory.dmp

memory/2716-143-0x0000029142440000-0x0000029142496000-memory.dmp

memory/2716-144-0x0000029142440000-0x0000029142496000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

149s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\1.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\1.exe

"C:\Users\Admin\AppData\Local\Temp\26X\1.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 254.130.241.8.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 osce12-0-sc.url.asiainfo-sec.com udp
RU 163.171.142.19:443 osce12-0-sc.url.asiainfo-sec.com tcp
RU 163.171.142.19:443 osce12-0-sc.url.asiainfo-sec.com tcp
N/A 127.0.0.1:54178 tcp
N/A 127.0.0.1:54182 tcp
US 8.8.8.8:53 19.142.171.163.in-addr.arpa udp
US 8.8.8.8:53 591.cdn-vod.huaweicloud.com udp
CN 58.220.72.102:443 591.cdn-vod.huaweicloud.com tcp
US 8.8.8.8:53 102.72.220.58.in-addr.arpa udp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
US 8.8.8.8:53 14.34.125.123.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
US 8.8.8.8:53 126.129.241.8.in-addr.arpa udp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
US 8.8.8.8:53 2.77.109.52.in-addr.arpa udp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
CN 123.125.34.14:443 ns1.sge.com.cn tcp
CN 123.125.34.14:443 ns1.sge.com.cn tcp

Files

memory/4300-133-0x0000000007E70000-0x0000000007EB1000-memory.dmp

memory/4300-134-0x0000000007A70000-0x0000000007E70000-memory.dmp

memory/4300-135-0x0000000007E00000-0x0000000007E02000-memory.dmp

memory/4300-136-0x0000000007A70000-0x0000000007E70000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

141s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\13.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\13.exe

"C:\Users\Admin\AppData\Local\Temp\26X\13.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 126.129.241.8.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 254.49.247.8.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp

Files

memory/1444-133-0x00007FF63A6E0000-0x00007FF63ACB6000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\16.exe"

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run = "yes" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run = "yes" C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\H: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\L: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\M: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\P: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\S: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\T: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\E: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\Q: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\W: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\Y: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\B: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\R: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\U: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\G: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\I: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\J: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\K: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\N: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\O: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\X: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\Z: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.app.log C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 3016 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 3016 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 3016 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 2404 wrote to memory of 2180 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 2404 wrote to memory of 2180 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 2404 wrote to memory of 2180 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 2404 wrote to memory of 2180 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 2404 wrote to memory of 1688 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 2404 wrote to memory of 1688 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 2404 wrote to memory of 1688 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 2404 wrote to memory of 1688 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 1688 wrote to memory of 2496 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 1688 wrote to memory of 2496 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 1688 wrote to memory of 2496 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 1688 wrote to memory of 2496 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 1688 wrote to memory of 1796 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1796 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1796 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1796 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1796 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1796 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1796 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1964 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1964 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1964 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1964 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1964 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1964 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 1688 wrote to memory of 1964 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\16.exe

"C:\Users\Admin\AppData\Local\Temp\26X\16.exe"

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

"C:\$AsnDSTaTuP.KE32\SecsvT16.exe"

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

"C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe"

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

"C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32

Network

Country Destination Domain Proto
US 8.8.8.8:53 shuangbaotai.work udp
HK 43.132.178.128:6180 shuangbaotai.work tcp
HK 43.132.178.128:6180 shuangbaotai.work tcp
HK 43.132.178.128:6180 shuangbaotai.work tcp
US 192.74.255.101:80 tcp
N/A 127.0.0.1:3388 tcp
US 192.74.255.101:80 tcp
N/A 127.0.0.1:3388 tcp
US 192.74.255.101:80 tcp
N/A 127.0.0.1:3388 tcp
US 192.74.255.101:80 tcp

Files

\Users\Admin\AppData\Local\Temp\26X\Zso.dll

MD5 0ba30bd4a3b5eca3bf18cf6288cce264
SHA1 78fa2b8aba3197167758fa861491e804532e327b
SHA256 5cc34b05ca63403106a3951a88e6bf8d7d63ce949ebd2e00db05752cbd8804f7
SHA512 6426fd2d6f823eead69a4bfb995651626b192f1eddae3521348b9726990e2e5b8840d85d79aaa8bb632567a9d406a62bbbf662e5f3579ab31a4c19aa9d6cd7b0

memory/3016-58-0x0000000002410000-0x0000000002528000-memory.dmp

memory/3016-61-0x0000000002410000-0x0000000002528000-memory.dmp

memory/3016-62-0x0000000002410000-0x0000000002528000-memory.dmp

\$AsnDSTaTuP.KE32\SecsvT16.exe

MD5 7e6ca4cd2a33e10b0a5c02c975191641
SHA1 6232821e020ff7a8197c4f7ead5a81609b357f73
SHA256 6b1229ef851d46b831ed7716939899dc8cf265a205e1ac2beff0aa0d26a0741b
SHA512 71575b4f7913b0937b5e92e346b127f37c47179f167de4ad6b1304a70ed4a1a079dc3909e9c04e936653bfbe4b36857e6c5b96a4787882fc77c8fd69974d808e

\$AsnDSTaTuP.KE32\SecsvT16.exe

MD5 7e6ca4cd2a33e10b0a5c02c975191641
SHA1 6232821e020ff7a8197c4f7ead5a81609b357f73
SHA256 6b1229ef851d46b831ed7716939899dc8cf265a205e1ac2beff0aa0d26a0741b
SHA512 71575b4f7913b0937b5e92e346b127f37c47179f167de4ad6b1304a70ed4a1a079dc3909e9c04e936653bfbe4b36857e6c5b96a4787882fc77c8fd69974d808e

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

MD5 7e6ca4cd2a33e10b0a5c02c975191641
SHA1 6232821e020ff7a8197c4f7ead5a81609b357f73
SHA256 6b1229ef851d46b831ed7716939899dc8cf265a205e1ac2beff0aa0d26a0741b
SHA512 71575b4f7913b0937b5e92e346b127f37c47179f167de4ad6b1304a70ed4a1a079dc3909e9c04e936653bfbe4b36857e6c5b96a4787882fc77c8fd69974d808e

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

MD5 7e6ca4cd2a33e10b0a5c02c975191641
SHA1 6232821e020ff7a8197c4f7ead5a81609b357f73
SHA256 6b1229ef851d46b831ed7716939899dc8cf265a205e1ac2beff0aa0d26a0741b
SHA512 71575b4f7913b0937b5e92e346b127f37c47179f167de4ad6b1304a70ed4a1a079dc3909e9c04e936653bfbe4b36857e6c5b96a4787882fc77c8fd69974d808e

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

MD5 7e6ca4cd2a33e10b0a5c02c975191641
SHA1 6232821e020ff7a8197c4f7ead5a81609b357f73
SHA256 6b1229ef851d46b831ed7716939899dc8cf265a205e1ac2beff0aa0d26a0741b
SHA512 71575b4f7913b0937b5e92e346b127f37c47179f167de4ad6b1304a70ed4a1a079dc3909e9c04e936653bfbe4b36857e6c5b96a4787882fc77c8fd69974d808e

C:\Users\Admin\AppData\Local\Temp\26X\Zsk.dll

MD5 0ba30bd4a3b5eca3bf18cf6288cce264
SHA1 78fa2b8aba3197167758fa861491e804532e327b
SHA256 5cc34b05ca63403106a3951a88e6bf8d7d63ce949ebd2e00db05752cbd8804f7
SHA512 6426fd2d6f823eead69a4bfb995651626b192f1eddae3521348b9726990e2e5b8840d85d79aaa8bb632567a9d406a62bbbf662e5f3579ab31a4c19aa9d6cd7b0

memory/2404-76-0x00000000023C0000-0x00000000024D8000-memory.dmp

\Users\Admin\AppData\Local\Temp\26X\Zsk.dll

MD5 0ba30bd4a3b5eca3bf18cf6288cce264
SHA1 78fa2b8aba3197167758fa861491e804532e327b
SHA256 5cc34b05ca63403106a3951a88e6bf8d7d63ce949ebd2e00db05752cbd8804f7
SHA512 6426fd2d6f823eead69a4bfb995651626b192f1eddae3521348b9726990e2e5b8840d85d79aaa8bb632567a9d406a62bbbf662e5f3579ab31a4c19aa9d6cd7b0

memory/2404-79-0x00000000023C0000-0x00000000024D8000-memory.dmp

memory/2404-80-0x00000000023C0000-0x00000000024D8000-memory.dmp

memory/2404-81-0x0000000000390000-0x00000000003AB000-memory.dmp

memory/2404-84-0x0000000000390000-0x00000000003AB000-memory.dmp

memory/2404-85-0x0000000000390000-0x00000000003AB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Consys21.png

MD5 58046f486a4c4a29f8999793384e1ee7
SHA1 467d47a6c8fd80a20767d7357d5c872de194e723
SHA256 226d7c5c616e15b51addd30affc1e17d819a47c73632f88c6275ce968911f0dd
SHA512 8ced4f00171e7a46b5cc569b64fcc3f6ecdfe404279fecba8ec86515f666f4c7559a20ec56c1cfd0f81869bb9126c42d21f2bab6fc1950834d8115b7533970f8

memory/2404-106-0x00000000023C0000-0x00000000024D8000-memory.dmp

memory/2404-115-0x0000000000390000-0x00000000003AB000-memory.dmp

memory/2404-132-0x0000000003370000-0x000000000382A000-memory.dmp

memory/2404-135-0x0000000003370000-0x000000000382A000-memory.dmp

memory/2404-136-0x0000000003370000-0x000000000382A000-memory.dmp

memory/2404-142-0x0000000003990000-0x0000000003E4A000-memory.dmp

memory/2404-145-0x0000000003990000-0x0000000003E4A000-memory.dmp

memory/2404-146-0x0000000003990000-0x0000000003E4A000-memory.dmp

C:\SkySky\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

C:\SkySky\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\Users\Public\Documents\RECSLLE.BIN\system\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

memory/2404-199-0x0000000003990000-0x0000000003E4A000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

MD5 7e6ca4cd2a33e10b0a5c02c975191641
SHA1 6232821e020ff7a8197c4f7ead5a81609b357f73
SHA256 6b1229ef851d46b831ed7716939899dc8cf265a205e1ac2beff0aa0d26a0741b
SHA512 71575b4f7913b0937b5e92e346b127f37c47179f167de4ad6b1304a70ed4a1a079dc3909e9c04e936653bfbe4b36857e6c5b96a4787882fc77c8fd69974d808e

\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

C:\Users\Public\Documents\RECSLLE.BIN\system\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

memory/1688-218-0x0000000000260000-0x000000000026F000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

C:\Users\Public\Documents\RECSLLE.BIN\system\_2

MD5 1c6916b28d8c2dfee3145e5a134d418e
SHA1 59691aa2e15ff96cee3a651d1a4d0b9bfb193af4
SHA256 40279173a082e853e889cc29bc26313efc8c0f5af7806385607816593fbdb6f9
SHA512 398405b85de2c15c6d03dcb46bd7d8753b5b0166a77ee6689f083445b0efcdf2c376be97535311fa345d1c35e562fe212754675cc8fca58fc22ed2bc31848dfe

\Users\Public\Documents\RECSLLE.BIN\system\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

memory/1688-215-0x0000000000240000-0x0000000000260000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\_1.DLL

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

memory/1688-223-0x0000000000270000-0x000000000027D000-memory.dmp

\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

\Users\Public\Documents\RECSLLE.BIN\system\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\Users\Public\Documents\RECSLLE.BIN\system\_2.DLL

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

memory/1688-226-0x0000000000270000-0x000000000027D000-memory.dmp

\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

\Users\Public\Documents\RECSLLE.BIN\system\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

C:\Users\Public\Documents\RECSLLE.BIN\system\fntestDLL.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.dll

MD5 341229426758892193e28f75d8638645
SHA1 fd11629dffc713309bdf43cce549e43b5c90377b
SHA256 29cd5ba0788024d030ed09f826d6f335d6a97e8450b0ed01791353d1d135dc2b
SHA512 2314aaa9397b42926c3a6e09bd990b7dc860d8d1e3334fca314c8a0fe066e231e2ce7b7f630278073b7be33b820ad5b64be16bf59a6ef3cbd2303ffa34ef67da

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.dll

MD5 341229426758892193e28f75d8638645
SHA1 fd11629dffc713309bdf43cce549e43b5c90377b
SHA256 29cd5ba0788024d030ed09f826d6f335d6a97e8450b0ed01791353d1d135dc2b
SHA512 2314aaa9397b42926c3a6e09bd990b7dc860d8d1e3334fca314c8a0fe066e231e2ce7b7f630278073b7be33b820ad5b64be16bf59a6ef3cbd2303ffa34ef67da

memory/1688-229-0x00000000004A0000-0x00000000004D9000-memory.dmp

memory/1688-232-0x00000000004A0000-0x00000000004D9000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

memory/2496-237-0x0000000000250000-0x0000000000270000-memory.dmp

\Users\Public\Documents\RECSLLE.BIN\system\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

memory/2496-239-0x0000000000270000-0x000000000027F000-memory.dmp

\Users\Public\Documents\RECSLLE.BIN\system\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.dll

MD5 341229426758892193e28f75d8638645
SHA1 fd11629dffc713309bdf43cce549e43b5c90377b
SHA256 29cd5ba0788024d030ed09f826d6f335d6a97e8450b0ed01791353d1d135dc2b
SHA512 2314aaa9397b42926c3a6e09bd990b7dc860d8d1e3334fca314c8a0fe066e231e2ce7b7f630278073b7be33b820ad5b64be16bf59a6ef3cbd2303ffa34ef67da

memory/2496-244-0x0000000000280000-0x000000000028D000-memory.dmp

\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

memory/2496-249-0x0000000000280000-0x000000000028D000-memory.dmp

\Users\Public\Documents\RECSLLE.BIN\system\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

C:\Users\Admin\AppData\Roaming\apple\Runlnk.lnk

MD5 2309e87b042ac45d187fb7c430911659
SHA1 a980117dd814d20a163ef1e12f4c64736df998f9
SHA256 5ad7deb1d20dfdce9a81ecee8f86e657d9bf7463eeaccd7a57cc92e1acca3fa4
SHA512 d4eaa2a09170538bace3c86a9d3dcedf169440b27e2d83a0cb67384914b47340413255f3e594059f7abf7709b37e8e3c5ce4b8323d31f8fa0a1c3800ed09131e

\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\Users\Admin\AppData\Roaming\apple\Runinf.inf

MD5 62bb69ff89b339b279b69d1a13e9294e
SHA1 6a4daa541fea6807fd50bb2cc47e4e75be40a593
SHA256 cd1ed1c4d9194b87b10e0869af03bcecf01c084a1ba3b933bbb7468db89c0bad
SHA512 a45fd7b3b7d387e31285a20cc8c6aaa2a4630b08d9cedcd663e13659d56049d75017fdeca171c997d5e02857c945f56917776d4fd80a0c8f7966942116d5b8e6

memory/2496-263-0x00000000004A0000-0x00000000004D9000-memory.dmp

\Users\Admin\AppData\Local\Temp\26X\Rwm.dll

MD5 0ba30bd4a3b5eca3bf18cf6288cce264
SHA1 78fa2b8aba3197167758fa861491e804532e327b
SHA256 5cc34b05ca63403106a3951a88e6bf8d7d63ce949ebd2e00db05752cbd8804f7
SHA512 6426fd2d6f823eead69a4bfb995651626b192f1eddae3521348b9726990e2e5b8840d85d79aaa8bb632567a9d406a62bbbf662e5f3579ab31a4c19aa9d6cd7b0

memory/2180-269-0x00000000024A0000-0x00000000025B8000-memory.dmp

memory/2404-271-0x0000000003370000-0x000000000382A000-memory.dmp

memory/2180-273-0x00000000024A0000-0x00000000025B8000-memory.dmp

memory/1688-275-0x00000000004A0000-0x00000000004D9000-memory.dmp

memory/1688-288-0x00000000004A0000-0x00000000004D9000-memory.dmp

C:\Users\Admin\AppData\Roaming\ConsysFun.png

MD5 76216e9b45d0834104a3571f0868f9f4
SHA1 b2e21152dfac86f0f456a9fac3dbf6c247a6ce09
SHA256 0dbb8913a25b67593bf7f5f7d5b2433948391e0652a238ea353b514f94a598b2
SHA512 e01ae289558b07a33b1f21d8fcfd31073807626133102db7af4ce19980e226de6ca9a6d9d1207a1d991400d03b9fb4571f221ccc2d03fd143b849617763abf63

memory/1688-290-0x00000000004A0000-0x00000000004D9000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dnv.url

MD5 9aafa7e0e4ebd4bfba3ca03937d031c4
SHA1 cb4bd72e733b33c910913f2e00357dc527cdea87
SHA256 751d15fd3635ae3c036c6e8c84235cd9d16722da3647cf7c61037ad2078489f3
SHA512 2e6cd41144945d3efd240fbb06e376645ae9db8b29334f19f931a36f1d04fd61756f2d9c69b5d5a47d8cb7735c0fb8f318635656ecd220db5ad238e50292efd9

memory/1688-297-0x0000000002560000-0x000000000257B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dxv.url

MD5 0f6bd601a04b031ee847f665d1f0abfc
SHA1 7083d97f3fccdbba14e053591a980ee0d06aa27d
SHA256 335ac95b494f29b612009e1f5b71f06e9e3e4fa680c8de21abf0bcc8fa00d2bb
SHA512 904ff65626997577e082e4c330dd621c0e8c289ad99161ff405faa9e23b3ebefab7e6cb4fff1f1d7c960aad9326d9849787a5e69f7161f91b0ffafdb7cebdc90

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dnv.url

MD5 9aafa7e0e4ebd4bfba3ca03937d031c4
SHA1 cb4bd72e733b33c910913f2e00357dc527cdea87
SHA256 751d15fd3635ae3c036c6e8c84235cd9d16722da3647cf7c61037ad2078489f3
SHA512 2e6cd41144945d3efd240fbb06e376645ae9db8b29334f19f931a36f1d04fd61756f2d9c69b5d5a47d8cb7735c0fb8f318635656ecd220db5ad238e50292efd9

memory/1688-300-0x0000000002560000-0x000000000257B000-memory.dmp

memory/1688-301-0x0000000005F40000-0x00000000063FA000-memory.dmp

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dxv.url

MD5 0f6bd601a04b031ee847f665d1f0abfc
SHA1 7083d97f3fccdbba14e053591a980ee0d06aa27d
SHA256 335ac95b494f29b612009e1f5b71f06e9e3e4fa680c8de21abf0bcc8fa00d2bb
SHA512 904ff65626997577e082e4c330dd621c0e8c289ad99161ff405faa9e23b3ebefab7e6cb4fff1f1d7c960aad9326d9849787a5e69f7161f91b0ffafdb7cebdc90

memory/1688-304-0x0000000005F40000-0x00000000063FA000-memory.dmp

memory/1688-305-0x0000000005F40000-0x00000000063FA000-memory.dmp

memory/1688-306-0x0000000004F80000-0x000000000543A000-memory.dmp

memory/1688-309-0x0000000004F80000-0x000000000543A000-memory.dmp

memory/1688-310-0x0000000004F80000-0x000000000543A000-memory.dmp

C:\SkySky\_2

MD5 1c6916b28d8c2dfee3145e5a134d418e
SHA1 59691aa2e15ff96cee3a651d1a4d0b9bfb193af4
SHA256 40279173a082e853e889cc29bc26313efc8c0f5af7806385607816593fbdb6f9
SHA512 398405b85de2c15c6d03dcb46bd7d8753b5b0166a77ee6689f083445b0efcdf2c376be97535311fa345d1c35e562fe212754675cc8fca58fc22ed2bc31848dfe

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\SkySky\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\SkySky\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

C:\SkySky\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\SkySky\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

memory/1688-326-0x0000000005540000-0x00000000059FA000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\kugou.dll

MD5 fc9ae1671b31f2b6c4e8c3b766e67053
SHA1 e649a4aeb70dbdea6395485cfb12be0a683bdaaf
SHA256 3ef0769a7dbfe812ce3ae05fc2010d3a153c3a1ed7ea6834fde726d51e8be018
SHA512 a0033ebf6306870ea62213dae329f29e064cdae3e7556a542487d4be309a21ae3e0067cf67a4d4c307113227fa5e640b7f917042f488b1b4fbf938fe25b96716

C:\SkySky\QQMusic.dll

MD5 341229426758892193e28f75d8638645
SHA1 fd11629dffc713309bdf43cce549e43b5c90377b
SHA256 29cd5ba0788024d030ed09f826d6f335d6a97e8450b0ed01791353d1d135dc2b
SHA512 2314aaa9397b42926c3a6e09bd990b7dc860d8d1e3334fca314c8a0fe066e231e2ce7b7f630278073b7be33b820ad5b64be16bf59a6ef3cbd2303ffa34ef67da

C:\Users\Public\Documents\RECSLLE.BIN\system\TIM.exe

MD5 201bd1ec28614133f06d6b5eeaf391db
SHA1 199e42c769d3a2da770fedee28e269525b8bbbee
SHA256 3586a2c0c8a78902df81212faddb166c0117e942e53cf5c392895013fc542335
SHA512 8584b60be46c2068de31f6af20f16b802b1a40c95f4337dfca4594f13fe62b700df8010020dd9df1f6a8b9c8831200e7d182d4fb4e9d61e12467dc451b4e5113

C:\Users\Public\Documents\RECSLLE.BIN\system\ManicTime.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

memory/1688-368-0x0000000004F80000-0x000000000543A000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\HBuilderService.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

C:\Users\Public\Documents\RECSLLE.BIN\system\MiniStorPlay.exe

MD5 85416fbd2afed007c653c44cee003dcf
SHA1 51532afb39df497876ef7ac9746a836ae9eecb36
SHA256 aba1c5964bcd4edd88c1e85e166ea6a2280b602a5fcf1442c33c421f48edcd8d
SHA512 df531dcbe1ae5f487072481c14a2c3ff31b097083b3eb2911332ce153c0152c18ff9c088c989b9159159198b65db7a3c67d1b80c8849300e60cd6d589af31729

C:\Users\Public\Documents\RECSLLE.BIN\system\HBConfig.hb

MD5 d8e7fb978318ddb5b3dd1a050c4e6f64
SHA1 d98ae0d3c11331f1e95006885304a85b2ed47655
SHA256 918d1731e5d972dd0f6d364651aa2542639fb9cecaae1c5d37eaf205ee6567f2
SHA512 c5023f479018fe9c94cd772485e1f075a1564b1368092608c0b1a050c1d6b523aeb5bc98603b11844b0a5594bbb73e6dd02a8581a96afc5609b7fd33a0b44843

C:\Users\Public\Documents\RECSLLE.BIN\system\libcef.dll

MD5 73392b5176d6a702d1bcd845d1b6ad4d
SHA1 7fff77b4106e9ea22fcbf4151021ecec56f408bc
SHA256 93e2441993c797236212fe450c719a1d72befbc518cf2ba4763309b513651c04
SHA512 e1ddca9f79baeacacfe5cb55b90baa222249c1de8127419b7e07d58c8774bb44c814e52d38335571f4695f87fa33340dc232fe20792ec8e95a3895cf3db67501

C:\Users\Public\Documents\RECSLLE.BIN\system\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\Users\Public\Documents\RECSLLE.BIN\system\crt.dll

MD5 231cceb5005a9e71c114cbdac63c3ee1
SHA1 d2b87f942837bbe0967b274f51e6d751b3a4d7a4
SHA256 61cdf4be615472d358f6b91fa06ac0d17e59e92c2d33165a331baf1548a4a6a2
SHA512 fd39e3479ab5cc61443a0a28adbf04da19426fb0b5fca914e675c26ed9e3deb4ed94cdf9ea4eb1d5285f4f9f65bc6c086773bfbcfbfa11487860b13897e2d891

C:\Users\Public\Documents\RECSLLE.BIN\system\_3

MD5 89c9be6517d371e27cbe670b63a37e00
SHA1 88adac152dd202ab9ef4fb9d4141100419b827c6
SHA256 3003fdd00d40c2eaf5039f790959b34ec9ca6d8e0508d2a4c5357975df018f1e
SHA512 be843b1abffbb8a2fb92d253dfe49f5a0d2b1d7ea2339313ffc00fe87d056db06b00cda80a9650b3a9c1caec5a1670a19b414143779fcf3833082e964357e6e9

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\_1

MD5 6f12798e2a0ced431388cb13e8d236fc
SHA1 133603eea4d3cb11a79be2a270e9325ecd70857d
SHA256 b6df9f2dd085e96fc1369442e2312c6f47ddd12ab77b103cfabb89bd167cea73
SHA512 044e7a7a76269003ac3c11ee9b08d5f157dabe6d6d3662982ad3fd028b5b025bf59ec69a1397f7597f2a4ef3f23afdd601e07a86b4b06d3a3f6beb14f14cd184

C:\Users\Public\Documents\RECSLLE.BIN\_1

MD5 6f12798e2a0ced431388cb13e8d236fc
SHA1 133603eea4d3cb11a79be2a270e9325ecd70857d
SHA256 b6df9f2dd085e96fc1369442e2312c6f47ddd12ab77b103cfabb89bd167cea73
SHA512 044e7a7a76269003ac3c11ee9b08d5f157dabe6d6d3662982ad3fd028b5b025bf59ec69a1397f7597f2a4ef3f23afdd601e07a86b4b06d3a3f6beb14f14cd184

memory/1688-371-0x0000000005540000-0x00000000059FA000-memory.dmp

memory/1688-373-0x0000000005540000-0x00000000059FA000-memory.dmp

C:\Verifier\MaXRWM

MD5 341229426758892193e28f75d8638645
SHA1 fd11629dffc713309bdf43cce549e43b5c90377b
SHA256 29cd5ba0788024d030ed09f826d6f335d6a97e8450b0ed01791353d1d135dc2b
SHA512 2314aaa9397b42926c3a6e09bd990b7dc860d8d1e3334fca314c8a0fe066e231e2ce7b7f630278073b7be33b820ad5b64be16bf59a6ef3cbd2303ffa34ef67da

C:\SkySky\_2

MD5 1c6916b28d8c2dfee3145e5a134d418e
SHA1 59691aa2e15ff96cee3a651d1a4d0b9bfb193af4
SHA256 40279173a082e853e889cc29bc26313efc8c0f5af7806385607816593fbdb6f9
SHA512 398405b85de2c15c6d03dcb46bd7d8753b5b0166a77ee6689f083445b0efcdf2c376be97535311fa345d1c35e562fe212754675cc8fca58fc22ed2bc31848dfe

C:\Users\Public\Documents\RECSLLE.BIN\_1

MD5 6f12798e2a0ced431388cb13e8d236fc
SHA1 133603eea4d3cb11a79be2a270e9325ecd70857d
SHA256 b6df9f2dd085e96fc1369442e2312c6f47ddd12ab77b103cfabb89bd167cea73
SHA512 044e7a7a76269003ac3c11ee9b08d5f157dabe6d6d3662982ad3fd028b5b025bf59ec69a1397f7597f2a4ef3f23afdd601e07a86b4b06d3a3f6beb14f14cd184

C:\Verifier\ZSMxWEOG

MD5 fc9ae1671b31f2b6c4e8c3b766e67053
SHA1 e649a4aeb70dbdea6395485cfb12be0a683bdaaf
SHA256 3ef0769a7dbfe812ce3ae05fc2010d3a153c3a1ed7ea6834fde726d51e8be018
SHA512 a0033ebf6306870ea62213dae329f29e064cdae3e7556a542487d4be309a21ae3e0067cf67a4d4c307113227fa5e640b7f917042f488b1b4fbf938fe25b96716

memory/1688-450-0x0000000002560000-0x000000000257B000-memory.dmp

memory/1688-453-0x0000000005540000-0x00000000059FA000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

150s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\18.exe"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\26X\18.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4044 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\26X\18.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 4044 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\26X\18.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\26X\18.exe

"C:\Users\Admin\AppData\Local\Temp\26X\18.exe"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\26X\ÌÚѶÊÂÒµ²¿µÚ¶þ¼¾¶ÈÔÚÕиÚλ.docx" /o ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 254.137.241.8.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
CN 47.110.131.128:443 tcp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 24.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 169.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
CN 47.110.131.128:443 tcp
CN 119.23.236.255:443 tcp
CN 106.15.137.35:443 tcp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
CN 47.110.131.128:443 tcp
CN 47.110.131.128:443 tcp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp
CN 106.15.137.35:443 tcp

Files

memory/4044-133-0x00000243034E0000-0x0000024303560000-memory.dmp

memory/4044-138-0x00000243053B0000-0x0000024305403000-memory.dmp

memory/1228-139-0x00007FFDA3770000-0x00007FFDA3780000-memory.dmp

memory/1228-140-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-143-0x00007FFDA3770000-0x00007FFDA3780000-memory.dmp

memory/1228-145-0x00007FFDA3770000-0x00007FFDA3780000-memory.dmp

memory/1228-142-0x00007FFDA3770000-0x00007FFDA3780000-memory.dmp

memory/1228-141-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-144-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-146-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-147-0x00007FFDA3770000-0x00007FFDA3780000-memory.dmp

memory/1228-148-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-149-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-150-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-151-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-152-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-153-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-154-0x00007FFDA0F10000-0x00007FFDA0F20000-memory.dmp

memory/1228-155-0x00007FFDA0F10000-0x00007FFDA0F20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\26X\ÌÚѶÊÂÒµ²¿µÚ¶þ¼¾¶ÈÔÚÕиÚλ.docx

MD5 aad307d3bf7d20270c7f30dc6ca792f8
SHA1 2bfbc92cecb76b8a14bf369df0941c9fe8642c67
SHA256 64588c90a15bd5bfe63bd7b370fd59d603df22a48ed6a7e6fb624771b6296808
SHA512 ba9211b38d427beda0ade8d1cf0f5c04c1d7b6809174596ee293ff7080dce7dec290c08031a7d40e2af06ec2d2fcbe000389e85e3c93973c65d8459463d1d35e

memory/4044-164-0x00000243034E0000-0x0000024303560000-memory.dmp

memory/4044-165-0x00000243053B0000-0x0000024305403000-memory.dmp

memory/1228-166-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-167-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/1228-174-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-175-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-176-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-177-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-178-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-179-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-183-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

memory/1228-209-0x00007FFDA3770000-0x00007FFDA3780000-memory.dmp

memory/1228-210-0x00007FFDA3770000-0x00007FFDA3780000-memory.dmp

memory/1228-211-0x00007FFDA3770000-0x00007FFDA3780000-memory.dmp

memory/1228-212-0x00007FFDA3770000-0x00007FFDA3780000-memory.dmp

memory/1228-213-0x00007FFDE36F0000-0x00007FFDE38E5000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

119s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\2.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\2.exe

"C:\Users\Admin\AppData\Local\Temp\26X\2.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 asdf.jtexpress.life udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

136s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\20.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\20.exe

"C:\Users\Admin\AppData\Local\Temp\26X\20.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 254.136.241.8.in-addr.arpa udp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

140s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\24.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\AppData\Local\Temp\26X\24.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3972 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe C:\Users\Admin\AppData\Local\Temp\26X\24.exe
PID 3972 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe C:\Users\Admin\AppData\Local\Temp\26X\24.exe

Processes

C:\Users\Admin\AppData\Local\Temp\26X\24.exe

"C:\Users\Admin\AppData\Local\Temp\26X\24.exe"

C:\Users\Admin\AppData\Local\Temp\26X\24.exe

"C:\Users\Admin\AppData\Local\Temp\26X\24.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 448 -p 3740 -ip 3740

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3740 -s 1168

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
CN 82.156.153.122:11111 tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
CN 82.156.153.122:11111 tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
CN 82.156.153.122:11111 tcp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI39722\ucrtbase.dll

MD5 185420a98824f7718dc5d8197e2b3471
SHA1 f083dcb3dea4b7aab4a110431274f9f4970dbc60
SHA256 6b817ec9874cd110a0b17ae89422bbe3362e3eadce91a5e66729801f57758ec4
SHA512 bc8cd1f08aba813475f6cc9290a99ab90071fc441373cb72dd35f4c497d8a0d565db28fc43765464e1d0dece052e6595ef2e93502ab3f715af05a38cbfe4aa88

C:\Users\Admin\AppData\Local\Temp\_MEI39722\ucrtbase.dll

MD5 185420a98824f7718dc5d8197e2b3471
SHA1 f083dcb3dea4b7aab4a110431274f9f4970dbc60
SHA256 6b817ec9874cd110a0b17ae89422bbe3362e3eadce91a5e66729801f57758ec4
SHA512 bc8cd1f08aba813475f6cc9290a99ab90071fc441373cb72dd35f4c497d8a0d565db28fc43765464e1d0dece052e6595ef2e93502ab3f715af05a38cbfe4aa88

C:\Users\Admin\AppData\Local\Temp\_MEI39722\python38.dll

MD5 c0ed63bf515d04803906e1b703e9cb86
SHA1 61f9a465d7a782aedfd5e2b1a9dc8bff6c103b5a
SHA256 24bfc999a733d4759ca40425610555f597b1d015f87ef5f84e15c665297247a4
SHA512 78384c34cefc40cb86913dffdc6a360668467731a8a3678d5f8377d8ae63d244b45506b0b6e2498825b53abe8fd84d2b75b3e9fef3703fead90183ace433e70a

C:\Users\Admin\AppData\Local\Temp\_MEI39722\python38.dll

MD5 c0ed63bf515d04803906e1b703e9cb86
SHA1 61f9a465d7a782aedfd5e2b1a9dc8bff6c103b5a
SHA256 24bfc999a733d4759ca40425610555f597b1d015f87ef5f84e15c665297247a4
SHA512 78384c34cefc40cb86913dffdc6a360668467731a8a3678d5f8377d8ae63d244b45506b0b6e2498825b53abe8fd84d2b75b3e9fef3703fead90183ace433e70a

C:\Users\Admin\AppData\Local\Temp\_MEI39722\VCRUNTIME140.dll

MD5 6ba0dbcd2db8f44243799c891dbd2a59
SHA1 30a2719d4b8667fd237bcfb781660901c993d9fc
SHA256 263988a0868053b6b01835cd2959c8f71e3f943610421b269da646f2d9e3b333
SHA512 94dea85ef50d55cec0d1bbae4671386ce8ca02e870ce417abfef0a8499fdf0bd0eb5ba38debd07c213f7da39cbea63a18143484b05e9c7ca36b2f68e4520bb4d

C:\Users\Admin\AppData\Local\Temp\_MEI39722\base_library.zip

MD5 0528e9fde883b5f5ddd41903922b7499
SHA1 aa2a2296960ca7ed8ee49de44840a6141419f223
SHA256 d4a4fd83ef3caaf170460e1f513bd2693ac818319b5faf4d401b7dd469f09386
SHA512 66eebbed5cea4abf4342a60446123512b2d7058d6d9b31ff0896d3c70753d33930a0449b32bb66f3c0cf8a7ad5878a4b6cfae1188ff5e59a8fb5ae4a81221ffb

C:\Users\Admin\AppData\Local\Temp\_MEI39722\VCRUNTIME140.dll

MD5 6ba0dbcd2db8f44243799c891dbd2a59
SHA1 30a2719d4b8667fd237bcfb781660901c993d9fc
SHA256 263988a0868053b6b01835cd2959c8f71e3f943610421b269da646f2d9e3b333
SHA512 94dea85ef50d55cec0d1bbae4671386ce8ca02e870ce417abfef0a8499fdf0bd0eb5ba38debd07c213f7da39cbea63a18143484b05e9c7ca36b2f68e4520bb4d

C:\Users\Admin\AppData\Local\Temp\_MEI39722\tinyaes.cp38-win_amd64.pyd

MD5 629f76ef6491d11b06133c37692b04d6
SHA1 a55c64556929bb984906a16c3f3c2d425b0712c9
SHA256 83c3532c4355dfe635df4462da7bd767d8c96bf85cb60f80072cec3cf1da24c1
SHA512 f26dfa24bcc34f1958ce2f96db41f7a02ffed6577d18e07efce6ef89773604c257d709150235367e6b8866c536d679b159a6976037e02d2c8e28d321fd49c395

C:\Users\Admin\AppData\Local\Temp\_MEI39722\tinyaes.cp38-win_amd64.pyd

MD5 629f76ef6491d11b06133c37692b04d6
SHA1 a55c64556929bb984906a16c3f3c2d425b0712c9
SHA256 83c3532c4355dfe635df4462da7bd767d8c96bf85cb60f80072cec3cf1da24c1
SHA512 f26dfa24bcc34f1958ce2f96db41f7a02ffed6577d18e07efce6ef89773604c257d709150235367e6b8866c536d679b159a6976037e02d2c8e28d321fd49c395

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ctypes.pyd

MD5 ffde1baacbe6729ad5246068870915a4
SHA1 2d42751140fc244f19dece6b1948b2b67d36bab4
SHA256 cc839990fb1020520731c35a183c83c9dc927aa78fa6b149a92a39e9d156c8b8
SHA512 1ac3ec986c55af37eb93d35a15e8a64726e5154240c0c5aac8286f7e347c678482ec65c62b454cf237023253642335ce6b3f6c0cc084e1527e61d48aaf7752f1

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ctypes.pyd

MD5 ffde1baacbe6729ad5246068870915a4
SHA1 2d42751140fc244f19dece6b1948b2b67d36bab4
SHA256 cc839990fb1020520731c35a183c83c9dc927aa78fa6b149a92a39e9d156c8b8
SHA512 1ac3ec986c55af37eb93d35a15e8a64726e5154240c0c5aac8286f7e347c678482ec65c62b454cf237023253642335ce6b3f6c0cc084e1527e61d48aaf7752f1

C:\Users\Admin\AppData\Local\Temp\_MEI39722\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI39722\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_bz2.pyd

MD5 6909da62abc73216883a89a60b66e73b
SHA1 015eb36344e5f3fe2df467bd47a04bded616b052
SHA256 4c22e0d2786dd7e93f55e1f4a1c27d2e141a55682ed2c09b90320817fcf011f9
SHA512 eddabb51b6092b3c3e3b6968ea831a262f8f5f8a26b1c95badc616ca236d0928aa789334835130ec40137ffc623b5d2031a585e890162b489a26fd990845b63a

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_bz2.pyd

MD5 6909da62abc73216883a89a60b66e73b
SHA1 015eb36344e5f3fe2df467bd47a04bded616b052
SHA256 4c22e0d2786dd7e93f55e1f4a1c27d2e141a55682ed2c09b90320817fcf011f9
SHA512 eddabb51b6092b3c3e3b6968ea831a262f8f5f8a26b1c95badc616ca236d0928aa789334835130ec40137ffc623b5d2031a585e890162b489a26fd990845b63a

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_lzma.pyd

MD5 af8385e0cb374ae6caee59190175dd12
SHA1 a16d7d021ec3fa31fb1b2ce5929c2d3d4c96d6b8
SHA256 e414ee3efa6a4e1edf610dd780335ab9372cbe7919a73596bbb267b55ad23999
SHA512 3e4e26bbcf14ebcb4faedb8982c46b3f5318c88dd395c668c50e4f5ddbfe6c1836eb49e49e855cc95934e8247e63df0f7543f66e4fe13335558fc21c0c566b5b

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_lzma.pyd

MD5 af8385e0cb374ae6caee59190175dd12
SHA1 a16d7d021ec3fa31fb1b2ce5929c2d3d4c96d6b8
SHA256 e414ee3efa6a4e1edf610dd780335ab9372cbe7919a73596bbb267b55ad23999
SHA512 3e4e26bbcf14ebcb4faedb8982c46b3f5318c88dd395c668c50e4f5ddbfe6c1836eb49e49e855cc95934e8247e63df0f7543f66e4fe13335558fc21c0c566b5b

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_socket.pyd

MD5 fc47a3b4dc7353591970a20678b90a81
SHA1 5ca5436e0c66f468bb48b5ea16c69125fcc34bea
SHA256 4e7ee0ecf839c42d96c53309384737e8f84bb5e90ecd20d511cc3fc6ec135f44
SHA512 8f52f33ce49bc38a9356d46c63aef4f8f05d491377f4969f52fd84f83712faed3d9637044d27583bf06fc52687667b630ba8d2eb8ee27f4a810520df5499b725

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_socket.pyd

MD5 fc47a3b4dc7353591970a20678b90a81
SHA1 5ca5436e0c66f468bb48b5ea16c69125fcc34bea
SHA256 4e7ee0ecf839c42d96c53309384737e8f84bb5e90ecd20d511cc3fc6ec135f44
SHA512 8f52f33ce49bc38a9356d46c63aef4f8f05d491377f4969f52fd84f83712faed3d9637044d27583bf06fc52687667b630ba8d2eb8ee27f4a810520df5499b725

C:\Users\Admin\AppData\Local\Temp\_MEI39722\select.pyd

MD5 f4887f1d906dc336fe0c3f7dbb720ca3
SHA1 67def676ad3569029d2a357a40a138fc7570bdcc
SHA256 36552bc64127d4866c657c9b74c0399baad70957a5380896fd8202e3a6bb7b4f
SHA512 51006d164c2512adfab92d22be5fed7c093cb647821045a6cdfd2ed7a30d94e620a446b8434b3e91d5544ef737e1492f3dc6c29cadbfdfa5e41df7fb5106a301

C:\Users\Admin\AppData\Local\Temp\_MEI39722\select.pyd

MD5 f4887f1d906dc336fe0c3f7dbb720ca3
SHA1 67def676ad3569029d2a357a40a138fc7570bdcc
SHA256 36552bc64127d4866c657c9b74c0399baad70957a5380896fd8202e3a6bb7b4f
SHA512 51006d164c2512adfab92d22be5fed7c093cb647821045a6cdfd2ed7a30d94e620a446b8434b3e91d5544ef737e1492f3dc6c29cadbfdfa5e41df7fb5106a301

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_queue.pyd

MD5 1711e365021dae47498f552c1d000d49
SHA1 c0512da577c85c2c1b5822761baf535a7ed3dc2c
SHA256 2b4b4b0b1ea2c6ce8e33c3896e73af029962ffa1a5c7ddb2d0152991214a84b1
SHA512 065a2a94af1079f5e0cfa4807e026c9deb28cf559779e0527ed31b541814280b907094659906fc3ffd3520437c5a37bc0225937abc08b9aac18e3b5215bd5f29

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_queue.pyd

MD5 1711e365021dae47498f552c1d000d49
SHA1 c0512da577c85c2c1b5822761baf535a7ed3dc2c
SHA256 2b4b4b0b1ea2c6ce8e33c3896e73af029962ffa1a5c7ddb2d0152991214a84b1
SHA512 065a2a94af1079f5e0cfa4807e026c9deb28cf559779e0527ed31b541814280b907094659906fc3ffd3520437c5a37bc0225937abc08b9aac18e3b5215bd5f29

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ssl.pyd

MD5 bb726a022fa65d9db794e280372dbe3e
SHA1 c48e78b37e10a713380040d16145e0ef06050e8e
SHA256 87362816a16c45095ad9ac3dc174509b2a4dd794cd17f56cac356d11c992de12
SHA512 637b78e884b55e6819e64e1b8f57f8399099165b65bf5866f8d03adb1305655b4773096b80666f88c1ff65cdd0c74ee2e0bcfb3258456ddf04c47b597f4f4287

C:\Users\Admin\AppData\Local\Temp\_MEI39722\libcrypto-1_1.dll

MD5 4929f390f3b9132af172d38b22bd2a2b
SHA1 19d27dc93c402801b8cb582b3aa27b17d24403d3
SHA256 4c1cbe61f562459baf382d3153b4bfc8a651bfc4ab41c99b3c8c29e19de7fde0
SHA512 2c7f3dfaba9e2844bcfddd3b05897f97ef043cc1cd5576ec0442eb26c9740c4df69a707e28bf5c6a0796e27e8de77ea430626ec822d74e054d081d32aaae7d93

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ssl.pyd

MD5 bb726a022fa65d9db794e280372dbe3e
SHA1 c48e78b37e10a713380040d16145e0ef06050e8e
SHA256 87362816a16c45095ad9ac3dc174509b2a4dd794cd17f56cac356d11c992de12
SHA512 637b78e884b55e6819e64e1b8f57f8399099165b65bf5866f8d03adb1305655b4773096b80666f88c1ff65cdd0c74ee2e0bcfb3258456ddf04c47b597f4f4287

C:\Users\Admin\AppData\Local\Temp\_MEI39722\libssl-1_1.dll

MD5 facfcc9c58fe4238c847907689ddf485
SHA1 8382d1666627cd47855bc687615a9cc38eef7361
SHA256 d89a9009e10a2cb2d49771e694cd88f33d69cff0d3c92bc2d8e0b512e0ef9546
SHA512 f5d5f3e59438d6af1bcd22d85982107cc5eaea52c62243d11464a01f37172cb0aed343de68652882234349f1e0671b976fd5b6e77a532a9fa3cda7a0f77718c5

C:\Users\Admin\AppData\Local\Temp\_MEI39722\libssl-1_1.dll

MD5 facfcc9c58fe4238c847907689ddf485
SHA1 8382d1666627cd47855bc687615a9cc38eef7361
SHA256 d89a9009e10a2cb2d49771e694cd88f33d69cff0d3c92bc2d8e0b512e0ef9546
SHA512 f5d5f3e59438d6af1bcd22d85982107cc5eaea52c62243d11464a01f37172cb0aed343de68652882234349f1e0671b976fd5b6e77a532a9fa3cda7a0f77718c5

C:\Users\Admin\AppData\Local\Temp\_MEI39722\libcrypto-1_1.dll

MD5 4929f390f3b9132af172d38b22bd2a2b
SHA1 19d27dc93c402801b8cb582b3aa27b17d24403d3
SHA256 4c1cbe61f562459baf382d3153b4bfc8a651bfc4ab41c99b3c8c29e19de7fde0
SHA512 2c7f3dfaba9e2844bcfddd3b05897f97ef043cc1cd5576ec0442eb26c9740c4df69a707e28bf5c6a0796e27e8de77ea430626ec822d74e054d081d32aaae7d93

C:\Users\Admin\AppData\Local\Temp\_MEI39722\libcrypto-1_1.dll

MD5 4929f390f3b9132af172d38b22bd2a2b
SHA1 19d27dc93c402801b8cb582b3aa27b17d24403d3
SHA256 4c1cbe61f562459baf382d3153b4bfc8a651bfc4ab41c99b3c8c29e19de7fde0
SHA512 2c7f3dfaba9e2844bcfddd3b05897f97ef043cc1cd5576ec0442eb26c9740c4df69a707e28bf5c6a0796e27e8de77ea430626ec822d74e054d081d32aaae7d93

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_asyncio.pyd

MD5 efb12f5663a8924b50eab1ea31084f7f
SHA1 c35c635bc566d1180bfa3885aa6a482f3d8724b9
SHA256 75d2d17cf03cf3a4aa9f51c5d71e8a8edc54e5437a5286f30d36f7182bc85e00
SHA512 11ed3c94a545ebc16e615d27329e249906448a748a931ea4b7881cce43ecd36bdedf47a473b27f2e6363f64e366fc65aa078507dfeee8487b7e545e3804b9e0d

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_overlapped.pyd

MD5 07a111f08b382f456da32873ffe12f15
SHA1 9cc2f4e49698020b0211d837c9d30adcef9f6e72
SHA256 600c131efcb237fa992de26a3b38e472b16f731c9f14fb25c7d730bab27960c3
SHA512 f432fc289d54d8cc581efab8f623929c8d5d8625aa25f9c76bf37f335e928b15121236a3e2724fedf6d7ac55988c63caa365df4a53901109ff6b59f9360654e9

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_asyncio.pyd

MD5 efb12f5663a8924b50eab1ea31084f7f
SHA1 c35c635bc566d1180bfa3885aa6a482f3d8724b9
SHA256 75d2d17cf03cf3a4aa9f51c5d71e8a8edc54e5437a5286f30d36f7182bc85e00
SHA512 11ed3c94a545ebc16e615d27329e249906448a748a931ea4b7881cce43ecd36bdedf47a473b27f2e6363f64e366fc65aa078507dfeee8487b7e545e3804b9e0d

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_overlapped.pyd

MD5 07a111f08b382f456da32873ffe12f15
SHA1 9cc2f4e49698020b0211d837c9d30adcef9f6e72
SHA256 600c131efcb237fa992de26a3b38e472b16f731c9f14fb25c7d730bab27960c3
SHA512 f432fc289d54d8cc581efab8f623929c8d5d8625aa25f9c76bf37f335e928b15121236a3e2724fedf6d7ac55988c63caa365df4a53901109ff6b59f9360654e9

C:\Users\Admin\AppData\Local\Temp\_MEI39722\pyexpat.pyd

MD5 9db090f0ec76c0c5c198396104a5b983
SHA1 db5adfbbadef6d06383a7f031beb2784a0093d0a
SHA256 b3e7eeb1f863ebf2a0debe1f8cb5a830370647f5728b90fdb7c03d9f62500cd0
SHA512 059edf754d0dc0282205192483df2ed7a562e04f5bd0cd9695389fe8d79b9780ff325641a77eef4413bd897d804b3f4ab29ef0004db9e8d0ecf50badaa1dbe06

C:\Users\Admin\AppData\Local\Temp\_MEI39722\pyexpat.pyd

MD5 9db090f0ec76c0c5c198396104a5b983
SHA1 db5adfbbadef6d06383a7f031beb2784a0093d0a
SHA256 b3e7eeb1f863ebf2a0debe1f8cb5a830370647f5728b90fdb7c03d9f62500cd0
SHA512 059edf754d0dc0282205192483df2ed7a562e04f5bd0cd9695389fe8d79b9780ff325641a77eef4413bd897d804b3f4ab29ef0004db9e8d0ecf50badaa1dbe06

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_cffi_backend.cp38-win_amd64.pyd

MD5 af96b1d6482552688c6974ad8d4694e1
SHA1 e4e9612ff0cf34d06f71c73b7c31bc89ea6f7b48
SHA256 64b7e32fd6b492f7763d92727a5c23818cc5da3b977b324ca71117aef99dc6c7
SHA512 35ae72614da4cb4eb49851e64a0ef535298c6b96617360f3ce5723832b26f04a1931e48173737b055e7c6fe00f1d788e918489ea5c7775eb9fd0d98216779704

C:\Users\Admin\AppData\Local\Temp\_MEI39722\_cffi_backend.cp38-win_amd64.pyd

MD5 af96b1d6482552688c6974ad8d4694e1
SHA1 e4e9612ff0cf34d06f71c73b7c31bc89ea6f7b48
SHA256 64b7e32fd6b492f7763d92727a5c23818cc5da3b977b324ca71117aef99dc6c7
SHA512 35ae72614da4cb4eb49851e64a0ef535298c6b96617360f3ce5723832b26f04a1931e48173737b055e7c6fe00f1d788e918489ea5c7775eb9fd0d98216779704

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Hash\_MD5.pyd

MD5 9adc256c4384ee1fe8c0ad5c5e44cd95
SHA1 c5fc6e7ae0dfa5cf87833b23cd0294e9ae1f5bca
SHA256 77ee1e140414615113eabb5fc43dbba69daee5951b7e27e387ca295b0c5f651d
SHA512 4cb0905f0196b34aa66ac6ff191bd4705146a3e00dcd8b3f674740d29404c22b61f3c75b6ffb1fd5fdb044320c89a2f3ef224f1f1aa35342ff3dc5f701642b76

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Hash\_MD5.pyd

MD5 9adc256c4384ee1fe8c0ad5c5e44cd95
SHA1 c5fc6e7ae0dfa5cf87833b23cd0294e9ae1f5bca
SHA256 77ee1e140414615113eabb5fc43dbba69daee5951b7e27e387ca295b0c5f651d
SHA512 4cb0905f0196b34aa66ac6ff191bd4705146a3e00dcd8b3f674740d29404c22b61f3c75b6ffb1fd5fdb044320c89a2f3ef224f1f1aa35342ff3dc5f701642b76

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_raw_ecb.pyd

MD5 821aaa9a74b4ccb1f75bd38b13b76566
SHA1 907c8ee16f3a0c6e44df120460a7c675eb36f1dd
SHA256 614b4f9a02d0191c3994205ac2c58571c0af9b71853be47fcf3cb3f9bc1d7f54
SHA512 9d2ef8f1a2d3a7374ff0cdb38d4a93b06d1db4219bae06d57a075ee3dff5f7d6f890084dd51a972ac7572008f73fde7f5152ce5844d1a19569e5a9a439c4532b

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_raw_ecb.pyd

MD5 821aaa9a74b4ccb1f75bd38b13b76566
SHA1 907c8ee16f3a0c6e44df120460a7c675eb36f1dd
SHA256 614b4f9a02d0191c3994205ac2c58571c0af9b71853be47fcf3cb3f9bc1d7f54
SHA512 9d2ef8f1a2d3a7374ff0cdb38d4a93b06d1db4219bae06d57a075ee3dff5f7d6f890084dd51a972ac7572008f73fde7f5152ce5844d1a19569e5a9a439c4532b

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_raw_cbc.pyd

MD5 ff2c1c4a7ae46c12eb3963f508dad30f
SHA1 4d759c143f78a4fe1576238587230acdf68d9c8c
SHA256 73cf4155df136db24c2240e8db0c76bedcbb721e910558512d6008adaf7eed50
SHA512 453ef9eed028ae172d4b76b25279ad56f59291be19eb918de40db703ec31cddf60dce2e40003dfd1ea20ec37e03df9ef049f0a004486cc23db8c5a6b6a860e7b

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_raw_cbc.pyd

MD5 ff2c1c4a7ae46c12eb3963f508dad30f
SHA1 4d759c143f78a4fe1576238587230acdf68d9c8c
SHA256 73cf4155df136db24c2240e8db0c76bedcbb721e910558512d6008adaf7eed50
SHA512 453ef9eed028ae172d4b76b25279ad56f59291be19eb918de40db703ec31cddf60dce2e40003dfd1ea20ec37e03df9ef049f0a004486cc23db8c5a6b6a860e7b

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_raw_cfb.pyd

MD5 fe489576d8950611c13e6cd1d682bc3d
SHA1 2411d99230ef47d9e2e10e97bdea9c08a74f19af
SHA256 bb79a502eca26d3418b49a47050fb4015fdb24bee97ce56cdd070d0fceb96ccd
SHA512 0f605a1331624d3e99cfdc04b60948308e834aa784c5b7169986eefbce4791faa148325c1f1a09624c1a1340e0e8cf82647780ffe7b3e201fdc2b60bcfd05e09

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_raw_cfb.pyd

MD5 fe489576d8950611c13e6cd1d682bc3d
SHA1 2411d99230ef47d9e2e10e97bdea9c08a74f19af
SHA256 bb79a502eca26d3418b49a47050fb4015fdb24bee97ce56cdd070d0fceb96ccd
SHA512 0f605a1331624d3e99cfdc04b60948308e834aa784c5b7169986eefbce4791faa148325c1f1a09624c1a1340e0e8cf82647780ffe7b3e201fdc2b60bcfd05e09

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_raw_ofb.pyd

MD5 619fb21dbeaf66bf7d1b61f6eb94b8c5
SHA1 7dd87080b4ed0cba070bb039d1bdeb0a07769047
SHA256 a2afe994f8f2e847951e40485299e88718235fbefb17fccca7ace54cc6444c46
SHA512 ee3dbd00d6529fcfcd623227973ea248ac93f9095430b9dc4e3257b6dc002b614d7ce4f3daab3e02ef675502afdbe28862c14e30632e3c715c434440615c4dd4

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_raw_ofb.pyd

MD5 619fb21dbeaf66bf7d1b61f6eb94b8c5
SHA1 7dd87080b4ed0cba070bb039d1bdeb0a07769047
SHA256 a2afe994f8f2e847951e40485299e88718235fbefb17fccca7ace54cc6444c46
SHA512 ee3dbd00d6529fcfcd623227973ea248ac93f9095430b9dc4e3257b6dc002b614d7ce4f3daab3e02ef675502afdbe28862c14e30632e3c715c434440615c4dd4

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_raw_ctr.pyd

MD5 a33ac93007ab673cb2780074d30f03bd
SHA1 b79fcf833634e6802a92359d38fbdcf6d49d42b0
SHA256 4452cf380a07919b87f39bc60768bcc4187b6910b24869dbd066f2149e04de47
SHA512 5d8bdca2432cdc5a76a3115af938cc76cf1f376b070a7fd1bcbf58a7848d4f56604c5c14036012027c33cc45f71d5430b5abbfbb2d4adaf5c115ddbd1603ab86

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_raw_ctr.pyd

MD5 a33ac93007ab673cb2780074d30f03bd
SHA1 b79fcf833634e6802a92359d38fbdcf6d49d42b0
SHA256 4452cf380a07919b87f39bc60768bcc4187b6910b24869dbd066f2149e04de47
SHA512 5d8bdca2432cdc5a76a3115af938cc76cf1f376b070a7fd1bcbf58a7848d4f56604c5c14036012027c33cc45f71d5430b5abbfbb2d4adaf5c115ddbd1603ab86

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Util\_strxor.pyd

MD5 3af448b8a7ef86d459d86f88a983eaec
SHA1 d852be273fea71d955ea6b6ed7e73fc192fb5491
SHA256 bf3a209eda07338762b8b58c74965e75f1f0c03d3f389b0103cc2bf13acfe69a
SHA512 be8c0a9b1f14d73e1adf50368293eff04ad34bda71dbf0b776ffd45b6ba58a2fa66089bb23728a5077ab630e68bf4d08af2712c1d3fb7d79733eb06f2d0f6dbf

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Util\_strxor.pyd

MD5 3af448b8a7ef86d459d86f88a983eaec
SHA1 d852be273fea71d955ea6b6ed7e73fc192fb5491
SHA256 bf3a209eda07338762b8b58c74965e75f1f0c03d3f389b0103cc2bf13acfe69a
SHA512 be8c0a9b1f14d73e1adf50368293eff04ad34bda71dbf0b776ffd45b6ba58a2fa66089bb23728a5077ab630e68bf4d08af2712c1d3fb7d79733eb06f2d0f6dbf

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Hash\_BLAKE2s.pyd

MD5 cea18eb87e54403af3f92f8d6dbdd6e8
SHA1 f1901a397edd9c4901801e8533c5350c7a3a8513
SHA256 7fe364add28266c8211457896d2517fdb0ee9efc8cb65e716847965b3e9d789f
SHA512 74a3c94d8c4070b66258a5b847d9ced705f81673dd12316604e392c9d21ae6890e3720ca810b38e140650397c6ff05fd2fa0ff2d136fc5579570520ffdc1dbac

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Hash\_BLAKE2s.pyd

MD5 cea18eb87e54403af3f92f8d6dbdd6e8
SHA1 f1901a397edd9c4901801e8533c5350c7a3a8513
SHA256 7fe364add28266c8211457896d2517fdb0ee9efc8cb65e716847965b3e9d789f
SHA512 74a3c94d8c4070b66258a5b847d9ced705f81673dd12316604e392c9d21ae6890e3720ca810b38e140650397c6ff05fd2fa0ff2d136fc5579570520ffdc1dbac

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Hash\_SHA1.pyd

MD5 5e6fef0ff0c688db13ed2777849e8e87
SHA1 3e739107b1b5ff8f1ffaac2ede75b71d4ebd128f
SHA256 e88a0347f9969991756815dff0af940f00e966bc7875aa4763a2c80516f7e4ed
SHA512 b97d4aa0ae76f528e643180ed300f1a50eafe8b82c27212a95ce380bca85f9ce1ff1ac1190173d56776fd663f649817514d6501ce80518f526159398daa6f55c

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Hash\_SHA1.pyd

MD5 5e6fef0ff0c688db13ed2777849e8e87
SHA1 3e739107b1b5ff8f1ffaac2ede75b71d4ebd128f
SHA256 e88a0347f9969991756815dff0af940f00e966bc7875aa4763a2c80516f7e4ed
SHA512 b97d4aa0ae76f528e643180ed300f1a50eafe8b82c27212a95ce380bca85f9ce1ff1ac1190173d56776fd663f649817514d6501ce80518f526159398daa6f55c

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Hash\_SHA256.pyd

MD5 6abdcd64face45efb50a3f2d6d792b93
SHA1 038dbd53932c4a539c69db54707b56e4779f0eef
SHA256 1031ea4c1fd2f673089052986629b6f554e5b34582b2f38e134fd64876d9ce0f
SHA512 6ebe3572938734d0fa9e4ec5abdb7f63d17f28ba7e94f1fe40926be93668d1a542ffc963f9a49c5f020720caad0852579fed6c9c6d0ab71b682e27245adc916c

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Hash\_SHA256.pyd

MD5 6abdcd64face45efb50a3f2d6d792b93
SHA1 038dbd53932c4a539c69db54707b56e4779f0eef
SHA256 1031ea4c1fd2f673089052986629b6f554e5b34582b2f38e134fd64876d9ce0f
SHA512 6ebe3572938734d0fa9e4ec5abdb7f63d17f28ba7e94f1fe40926be93668d1a542ffc963f9a49c5f020720caad0852579fed6c9c6d0ab71b682e27245adc916c

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_Salsa20.pyd

MD5 e598d24941e68620aef43723b239e1c5
SHA1 fa3c711aa55a700e2d5421f5f73a50662a9cc443
SHA256 e63d4123d894b61e0242d53813307fa1ff3b7b60818827520f7ff20cabcd8904
SHA512 904e04fb28cffa2890c0cb4f1169a7cc830224740f0df3da622ac2eb9b8f8bdbb4de88836e40a0126be0eb3e5131a8d8b5aaacd782d1c5875a2fbbc939f78d5b

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Protocol\_scrypt.pyd

MD5 acd58f05ef429d4d85163b98b26a2307
SHA1 ccdf4a294b2e05b5e16784bae562bfdb474308a0
SHA256 bb2be221531d66ec5e6ef026f5548749430a785fd1fa1c1becb12375c0ca6d1d
SHA512 4cc272b161a7ea35e45274d2fb1358104f9bed5a7b460f1dc094c48ad834d94d779e73362c4e4ca3f3b7feae4da9812b5cd5f5edf7683668043a7c62b853a0d8

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Cipher\_Salsa20.pyd

MD5 e598d24941e68620aef43723b239e1c5
SHA1 fa3c711aa55a700e2d5421f5f73a50662a9cc443
SHA256 e63d4123d894b61e0242d53813307fa1ff3b7b60818827520f7ff20cabcd8904
SHA512 904e04fb28cffa2890c0cb4f1169a7cc830224740f0df3da622ac2eb9b8f8bdbb4de88836e40a0126be0eb3e5131a8d8b5aaacd782d1c5875a2fbbc939f78d5b

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Util\_cpuid_c.pyd

MD5 1831cb26fd8ee2b0ab0496f80272fc04
SHA1 bc8e78cc005859f7272c3615a3774ba7d687f0f4
SHA256 d830d77669527129bf3d10929aad1cc9ee5e44a9594e3fc651d3b5bc01c42c44
SHA512 df51d636a277c8ad83c90ae99a824f77c441da5c7b08a11c3d8752cd3661096ebf327008951ca97b4baf9632b2ca16df34a9f3e43bf837c8556bcb3c304bb2cc

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Protocol\_scrypt.pyd

MD5 acd58f05ef429d4d85163b98b26a2307
SHA1 ccdf4a294b2e05b5e16784bae562bfdb474308a0
SHA256 bb2be221531d66ec5e6ef026f5548749430a785fd1fa1c1becb12375c0ca6d1d
SHA512 4cc272b161a7ea35e45274d2fb1358104f9bed5a7b460f1dc094c48ad834d94d779e73362c4e4ca3f3b7feae4da9812b5cd5f5edf7683668043a7c62b853a0d8

C:\Users\Admin\AppData\Local\Temp\_MEI39722\Crypto\Util\_cpuid_c.pyd

MD5 1831cb26fd8ee2b0ab0496f80272fc04
SHA1 bc8e78cc005859f7272c3615a3774ba7d687f0f4
SHA256 d830d77669527129bf3d10929aad1cc9ee5e44a9594e3fc651d3b5bc01c42c44
SHA512 df51d636a277c8ad83c90ae99a824f77c441da5c7b08a11c3d8752cd3661096ebf327008951ca97b4baf9632b2ca16df34a9f3e43bf837c8556bcb3c304bb2cc

memory/3740-305-0x0000024C2A420000-0x0000024C2A421000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\18.exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\18.exe

"C:\Users\Admin\AppData\Local\Temp\26X\18.exe"

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\26X\ÌÚѶÊÂÒµ²¿µÚ¶þ¼¾¶ÈÔÚÕиÚλ.docx"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

Country Destination Domain Proto
CN 106.15.137.35:443 tcp
CN 106.15.137.35:443 tcp
CN 106.15.137.35:443 tcp
CN 106.15.137.35:443 tcp
CN 47.110.131.128:443 tcp
CN 47.110.131.128:443 tcp
CN 47.110.131.128:443 tcp

Files

memory/2780-54-0x00000000000C0000-0x0000000000140000-memory.dmp

memory/2780-56-0x0000000002080000-0x00000000020D3000-memory.dmp

memory/2376-57-0x000000002F3A0000-0x000000002F4FD000-memory.dmp

memory/2376-58-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2376-59-0x00000000713AD000-0x00000000713B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\26X\ÌÚѶÊÂÒµ²¿µÚ¶þ¼¾¶ÈÔÚÕиÚλ.docx

MD5 aad307d3bf7d20270c7f30dc6ca792f8
SHA1 2bfbc92cecb76b8a14bf369df0941c9fe8642c67
SHA256 64588c90a15bd5bfe63bd7b370fd59d603df22a48ed6a7e6fb624771b6296808
SHA512 ba9211b38d427beda0ade8d1cf0f5c04c1d7b6809174596ee293ff7080dce7dec290c08031a7d40e2af06ec2d2fcbe000389e85e3c93973c65d8459463d1d35e

memory/2780-72-0x00000000000C0000-0x0000000000140000-memory.dmp

memory/2780-73-0x0000000002080000-0x00000000020D3000-memory.dmp

memory/2376-74-0x000000002F3A0000-0x000000002F4FD000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/2376-84-0x00000000713AD000-0x00000000713B8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 7995abbdc1a3ca3c4335e7bd8dab9fd7
SHA1 0e107af94163b790631309af01e00359ae71dd78
SHA256 1c8df074751f3b923e2aac927aa480d866a2764346cb02687f72d6b7e882fb17
SHA512 dd47648ca4cffc50535cb100ea99401aef9789f7b0bc53f9fae4ae115a440a820dd2d45a0f6cf70c83424b91ba3d25bdc745416d425e61d5d17ce2bc62955a1a

memory/2376-107-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2376-108-0x00000000713AD000-0x00000000713B8000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

119s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\21.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\AppData\Local\Temp\26X\21.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1340 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\26X\21.exe C:\Windows\system32\WerFault.exe
PID 1340 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\26X\21.exe C:\Windows\system32\WerFault.exe
PID 1340 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\26X\21.exe C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\26X\21.exe

"C:\Users\Admin\AppData\Local\Temp\26X\21.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1340 -s 84

Network

N/A

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

143s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\4.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Processes

C:\Users\Admin\AppData\Local\Temp\26X\4.exe

"C:\Users\Admin\AppData\Local\Temp\26X\4.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 sf-1257780318.cos.ap-beijing.myqcloud.com udp
CN 82.156.94.17:443 sf-1257780318.cos.ap-beijing.myqcloud.com tcp
US 8.8.8.8:53 jtexpress.life udp
US 188.114.96.0:8443 jtexpress.life tcp
US 188.114.96.0:8443 jtexpress.life tcp
US 188.114.96.0:8443 jtexpress.life tcp
US 188.114.96.0:8443 jtexpress.life tcp

Files

memory/2508-68-0x00000000021D0000-0x0000000002250000-memory.dmp

memory/2508-70-0x0000000003660000-0x0000000003A60000-memory.dmp

memory/2508-71-0x0000000002400000-0x0000000002456000-memory.dmp

memory/2508-72-0x0000000002400000-0x0000000002456000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

119s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\1.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\1.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\1.exe

"C:\Users\Admin\AppData\Local\Temp\26X\1.exe"

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

121s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\14.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\14.exe

"C:\Users\Admin\AppData\Local\Temp\26X\14.exe"

Network

N/A

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

149s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\15.exe"

Signatures

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\26X\15.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3296 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\26X\15.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 3296 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\26X\15.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 3296 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\26X\15.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4352 wrote to memory of 4720 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4352 wrote to memory of 4720 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4352 wrote to memory of 4720 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 3128 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4720 wrote to memory of 1392 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Users\Admin\AppData\Local\Temp\26X\15.exe

"C:\Users\Admin\AppData\Local\Temp\26X\15.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\北京洁简天兴商贸有限责任公司报名航空股份机上经济舱洗漱包项目资质文件.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F6FDAE2F478DB5523020DBBC23E76EDA --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F29687E038865F93316E95782AE5936B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F29687E038865F93316E95782AE5936B --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=28A804ED564CFB88357305DC8F589944 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0EEA3BA958FC5E8672F19B7D6FC16D79 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=99F8E0C69DFE96D3429A09505F5800C7 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 137.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 202.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 254.137.241.8.in-addr.arpa udp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

memory/3296-138-0x00000000008C0000-0x0000000000E1B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\北京洁简天兴商贸有限责任公司报名航空股份机上经济舱洗漱包项目资质文件.pdf

MD5 a2c81183272ca47e33df253b3dffbf46
SHA1 78b8733372cc43219456ff3ecfb0c84ed5faad85
SHA256 5430750b4d8897a2c8580a8cb9b024476f5bf2f6c0f280df7275f042e2628d68
SHA512 25a03e5cdd73d4ebf292dca158614253f34f0e9b1bc8bebfb003ab312bca4e4002b72327b9d7d88b612585c300c7a1827d4864814433b7c7fe2c8649d3409f64

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 3b8ce167c039db18db5fd067b4d6825d
SHA1 c71764967a620fac660692fca687660e99a052c0
SHA256 c94a3c61a0c1a734381cd4a6d79ec76790893d5aadbb7d50a0dcadabcd2eea28
SHA512 b98ecd34a8b3583c53ccf7880b79055d757a1dcff41fd411b8f8f1e3df9ec9aca1a3225cd329f4d33ddbe54546cda7401ab7432ee4f63fa56aaaf636b4640a23

Analysis: behavioral10

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

139s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\14.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\14.exe

"C:\Users\Admin\AppData\Local\Temp\26X\14.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

153s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\16.exe"

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run = "yes" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run = "yes" C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\T: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\W: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\E: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\G: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\H: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\J: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\N: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\O: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\Q: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\R: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\S: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\B: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\U: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\V: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\X: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\I: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\K: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\M: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\P: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\Y: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
File opened (read-only) \??\Z: C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\Desktop C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\Desktop\DpiScalingVer = "1018" C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\Desktop\Win8DpiScaling = "1" C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\Desktop\LogPixels = "96" C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
N/A N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4332 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 4332 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 4332 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\26X\16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 4696 wrote to memory of 940 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 4696 wrote to memory of 940 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 4696 wrote to memory of 940 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\$AsnDSTaTuP.KE32\SecsvT16.exe
PID 4696 wrote to memory of 3500 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 4696 wrote to memory of 3500 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 4696 wrote to memory of 3500 N/A C:\$AsnDSTaTuP.KE32\SecsvT16.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 3500 wrote to memory of 4388 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 3500 wrote to memory of 4388 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 3500 wrote to memory of 4388 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe
PID 3500 wrote to memory of 4936 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 3500 wrote to memory of 4936 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 3500 wrote to memory of 4936 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 3500 wrote to memory of 4160 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 3500 wrote to memory of 4160 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe
PID 3500 wrote to memory of 4160 N/A C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe C:\Windows\SysWOW64\rundll32.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\$AsnDSTaTuP.KE32\SecsvT16.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\16.exe

"C:\Users\Admin\AppData\Local\Temp\26X\16.exe"

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

"C:\$AsnDSTaTuP.KE32\SecsvT16.exe"

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

"C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe"

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

"C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32

Network

Country Destination Domain Proto
US 8.8.8.8:53 126.129.241.8.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 shuangbaotai.work udp
HK 43.132.178.128:6180 shuangbaotai.work tcp
HK 43.132.178.128:6180 shuangbaotai.work tcp
US 8.8.8.8:53 128.178.132.43.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
HK 43.132.178.128:6180 shuangbaotai.work tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 192.74.255.101:80 tcp
N/A 127.0.0.1:3388 tcp
US 192.74.255.101:80 tcp
N/A 127.0.0.1:3388 tcp
US 192.74.255.101:80 tcp
N/A 127.0.0.1:3388 tcp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp
US 192.74.255.101:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\26X\Dcg.dll

MD5 0ba30bd4a3b5eca3bf18cf6288cce264
SHA1 78fa2b8aba3197167758fa861491e804532e327b
SHA256 5cc34b05ca63403106a3951a88e6bf8d7d63ce949ebd2e00db05752cbd8804f7
SHA512 6426fd2d6f823eead69a4bfb995651626b192f1eddae3521348b9726990e2e5b8840d85d79aaa8bb632567a9d406a62bbbf662e5f3579ab31a4c19aa9d6cd7b0

memory/4332-138-0x00000000026A0000-0x00000000027B8000-memory.dmp

memory/4332-141-0x00000000026A0000-0x00000000027B8000-memory.dmp

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

MD5 7e6ca4cd2a33e10b0a5c02c975191641
SHA1 6232821e020ff7a8197c4f7ead5a81609b357f73
SHA256 6b1229ef851d46b831ed7716939899dc8cf265a205e1ac2beff0aa0d26a0741b
SHA512 71575b4f7913b0937b5e92e346b127f37c47179f167de4ad6b1304a70ed4a1a079dc3909e9c04e936653bfbe4b36857e6c5b96a4787882fc77c8fd69974d808e

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

MD5 7e6ca4cd2a33e10b0a5c02c975191641
SHA1 6232821e020ff7a8197c4f7ead5a81609b357f73
SHA256 6b1229ef851d46b831ed7716939899dc8cf265a205e1ac2beff0aa0d26a0741b
SHA512 71575b4f7913b0937b5e92e346b127f37c47179f167de4ad6b1304a70ed4a1a079dc3909e9c04e936653bfbe4b36857e6c5b96a4787882fc77c8fd69974d808e

C:\Users\Admin\AppData\Local\Temp\26X\Igk.dll

MD5 0ba30bd4a3b5eca3bf18cf6288cce264
SHA1 78fa2b8aba3197167758fa861491e804532e327b
SHA256 5cc34b05ca63403106a3951a88e6bf8d7d63ce949ebd2e00db05752cbd8804f7
SHA512 6426fd2d6f823eead69a4bfb995651626b192f1eddae3521348b9726990e2e5b8840d85d79aaa8bb632567a9d406a62bbbf662e5f3579ab31a4c19aa9d6cd7b0

C:\Users\Admin\AppData\Local\Temp\26X\Igk.dll

MD5 0ba30bd4a3b5eca3bf18cf6288cce264
SHA1 78fa2b8aba3197167758fa861491e804532e327b
SHA256 5cc34b05ca63403106a3951a88e6bf8d7d63ce949ebd2e00db05752cbd8804f7
SHA512 6426fd2d6f823eead69a4bfb995651626b192f1eddae3521348b9726990e2e5b8840d85d79aaa8bb632567a9d406a62bbbf662e5f3579ab31a4c19aa9d6cd7b0

memory/4696-151-0x0000000002580000-0x0000000002698000-memory.dmp

memory/4696-154-0x0000000002580000-0x0000000002698000-memory.dmp

memory/4696-155-0x0000000002580000-0x0000000002698000-memory.dmp

memory/4696-156-0x0000000002580000-0x0000000002698000-memory.dmp

memory/4696-157-0x00000000024B0000-0x00000000024CB000-memory.dmp

memory/4696-160-0x00000000024B0000-0x00000000024CB000-memory.dmp

memory/4696-161-0x00000000024B0000-0x00000000024CB000-memory.dmp

memory/4332-162-0x00000000026A0000-0x00000000027B8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Consys21.png

MD5 58046f486a4c4a29f8999793384e1ee7
SHA1 467d47a6c8fd80a20767d7357d5c872de194e723
SHA256 226d7c5c616e15b51addd30affc1e17d819a47c73632f88c6275ce968911f0dd
SHA512 8ced4f00171e7a46b5cc569b64fcc3f6ecdfe404279fecba8ec86515f666f4c7559a20ec56c1cfd0f81869bb9126c42d21f2bab6fc1950834d8115b7533970f8

memory/4696-179-0x0000000002580000-0x0000000002698000-memory.dmp

memory/4696-192-0x00000000024B0000-0x00000000024CB000-memory.dmp

memory/4696-209-0x0000000003270000-0x000000000372A000-memory.dmp

memory/4696-216-0x0000000003270000-0x000000000372A000-memory.dmp

memory/4696-217-0x0000000003270000-0x000000000372A000-memory.dmp

memory/4696-220-0x0000000003890000-0x0000000003D4A000-memory.dmp

memory/4696-224-0x0000000003890000-0x0000000003D4A000-memory.dmp

C:\SkySky\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\SkySky\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

memory/4696-278-0x0000000003890000-0x0000000003D4A000-memory.dmp

C:\SkySky\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

C:\$AsnDSTaTuP.KE32\SecsvT16.exe

MD5 7e6ca4cd2a33e10b0a5c02c975191641
SHA1 6232821e020ff7a8197c4f7ead5a81609b357f73
SHA256 6b1229ef851d46b831ed7716939899dc8cf265a205e1ac2beff0aa0d26a0741b
SHA512 71575b4f7913b0937b5e92e346b127f37c47179f167de4ad6b1304a70ed4a1a079dc3909e9c04e936653bfbe4b36857e6c5b96a4787882fc77c8fd69974d808e

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.dll

MD5 341229426758892193e28f75d8638645
SHA1 fd11629dffc713309bdf43cce549e43b5c90377b
SHA256 29cd5ba0788024d030ed09f826d6f335d6a97e8450b0ed01791353d1d135dc2b
SHA512 2314aaa9397b42926c3a6e09bd990b7dc860d8d1e3334fca314c8a0fe066e231e2ce7b7f630278073b7be33b820ad5b64be16bf59a6ef3cbd2303ffa34ef67da

memory/3500-348-0x0000000000730000-0x0000000000750000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

memory/3500-352-0x00000000005D0000-0x00000000005DF000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\_2

MD5 1c6916b28d8c2dfee3145e5a134d418e
SHA1 59691aa2e15ff96cee3a651d1a4d0b9bfb193af4
SHA256 40279173a082e853e889cc29bc26313efc8c0f5af7806385607816593fbdb6f9
SHA512 398405b85de2c15c6d03dcb46bd7d8753b5b0166a77ee6689f083445b0efcdf2c376be97535311fa345d1c35e562fe212754675cc8fca58fc22ed2bc31848dfe

C:\Users\Public\Documents\RECSLLE.BIN\system\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

C:\Users\Public\Documents\RECSLLE.BIN\system\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

C:\Users\Public\Documents\RECSLLE.BIN\system\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

C:\Users\Public\Documents\RECSLLE.BIN\system\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\Users\Public\Documents\RECSLLE.BIN\system\fntestDLL.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.dll

MD5 341229426758892193e28f75d8638645
SHA1 fd11629dffc713309bdf43cce549e43b5c90377b
SHA256 29cd5ba0788024d030ed09f826d6f335d6a97e8450b0ed01791353d1d135dc2b
SHA512 2314aaa9397b42926c3a6e09bd990b7dc860d8d1e3334fca314c8a0fe066e231e2ce7b7f630278073b7be33b820ad5b64be16bf59a6ef3cbd2303ffa34ef67da

memory/3500-357-0x0000000002110000-0x000000000211D000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\Users\Public\Documents\RECSLLE.BIN\system\_1.DLL

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\Users\Public\Documents\RECSLLE.BIN\system\_2.DLL

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

C:\Users\Public\Documents\RECSLLE.BIN\system\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

memory/3500-361-0x0000000002110000-0x000000000211D000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

C:\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

memory/3500-365-0x0000000002170000-0x00000000021A9000-memory.dmp

memory/3500-368-0x0000000002170000-0x00000000021A9000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

memory/4388-376-0x0000000000640000-0x0000000000660000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\Users\Public\Documents\RECSLLE.BIN\system\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.dll

MD5 341229426758892193e28f75d8638645
SHA1 fd11629dffc713309bdf43cce549e43b5c90377b
SHA256 29cd5ba0788024d030ed09f826d6f335d6a97e8450b0ed01791353d1d135dc2b
SHA512 2314aaa9397b42926c3a6e09bd990b7dc860d8d1e3334fca314c8a0fe066e231e2ce7b7f630278073b7be33b820ad5b64be16bf59a6ef3cbd2303ffa34ef67da

memory/4388-379-0x0000000000660000-0x000000000066F000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

C:\Users\Public\Documents\RECSLLE.BIN\system\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

C:\Users\Admin\AppData\Roaming\apple\Runlnk.lnk

MD5 3fba9dc04e5d857f8ee9053e04075908
SHA1 a62db929c7041de74ae00af2f7ab0beb42eb0b5d
SHA256 3f8a07082cc0d091cc86823247d465a0e9b26825dbe468625783bd2cf2cef7d1
SHA512 8bf9cdf520bb376fd3f355d4e5cc628ec84c94933b69d523689fd2a591225ef49b5ca6ad7f42411b6efd819427f95d90c3a56d1dc39218baa09f4e99f177f5c9

C:\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

memory/4388-383-0x0000000002090000-0x000000000209D000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

memory/4388-397-0x0000000002090000-0x000000000209D000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\Users\Public\Documents\RECSLLE.BIN\system\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\Users\Public\Documents\RECSLLE.BIN\system\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

C:\Users\Public\Documents\RECSLLE.BIN\system\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

memory/4388-401-0x0000000002610000-0x0000000002649000-memory.dmp

memory/4388-404-0x0000000002610000-0x0000000002649000-memory.dmp

C:\Users\Admin\AppData\Roaming\apple\Runinf.inf

MD5 62bb69ff89b339b279b69d1a13e9294e
SHA1 6a4daa541fea6807fd50bb2cc47e4e75be40a593
SHA256 cd1ed1c4d9194b87b10e0869af03bcecf01c084a1ba3b933bbb7468db89c0bad
SHA512 a45fd7b3b7d387e31285a20cc8c6aaa2a4630b08d9cedcd663e13659d56049d75017fdeca171c997d5e02857c945f56917776d4fd80a0c8f7966942116d5b8e6

C:\Users\Admin\AppData\Local\Temp\26X\Akm.dll

MD5 0ba30bd4a3b5eca3bf18cf6288cce264
SHA1 78fa2b8aba3197167758fa861491e804532e327b
SHA256 5cc34b05ca63403106a3951a88e6bf8d7d63ce949ebd2e00db05752cbd8804f7
SHA512 6426fd2d6f823eead69a4bfb995651626b192f1eddae3521348b9726990e2e5b8840d85d79aaa8bb632567a9d406a62bbbf662e5f3579ab31a4c19aa9d6cd7b0

memory/940-413-0x0000000002690000-0x00000000027A8000-memory.dmp

memory/940-416-0x0000000002690000-0x00000000027A8000-memory.dmp

memory/940-417-0x0000000002690000-0x00000000027A8000-memory.dmp

memory/3500-419-0x0000000002170000-0x00000000021A9000-memory.dmp

memory/3500-435-0x0000000002170000-0x00000000021A9000-memory.dmp

memory/3500-437-0x0000000002170000-0x00000000021A9000-memory.dmp

C:\Users\Admin\AppData\Roaming\ConsysFun.png

MD5 76216e9b45d0834104a3571f0868f9f4
SHA1 b2e21152dfac86f0f456a9fac3dbf6c247a6ce09
SHA256 0dbb8913a25b67593bf7f5f7d5b2433948391e0652a238ea353b514f94a598b2
SHA512 e01ae289558b07a33b1f21d8fcfd31073807626133102db7af4ce19980e226de6ca9a6d9d1207a1d991400d03b9fb4571f221ccc2d03fd143b849617763abf63

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dxv.url

MD5 0f6bd601a04b031ee847f665d1f0abfc
SHA1 7083d97f3fccdbba14e053591a980ee0d06aa27d
SHA256 335ac95b494f29b612009e1f5b71f06e9e3e4fa680c8de21abf0bcc8fa00d2bb
SHA512 904ff65626997577e082e4c330dd621c0e8c289ad99161ff405faa9e23b3ebefab7e6cb4fff1f1d7c960aad9326d9849787a5e69f7161f91b0ffafdb7cebdc90

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dnv.url

MD5 9aafa7e0e4ebd4bfba3ca03937d031c4
SHA1 cb4bd72e733b33c910913f2e00357dc527cdea87
SHA256 751d15fd3635ae3c036c6e8c84235cd9d16722da3647cf7c61037ad2078489f3
SHA512 2e6cd41144945d3efd240fbb06e376645ae9db8b29334f19f931a36f1d04fd61756f2d9c69b5d5a47d8cb7735c0fb8f318635656ecd220db5ad238e50292efd9

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dxv.url

MD5 0f6bd601a04b031ee847f665d1f0abfc
SHA1 7083d97f3fccdbba14e053591a980ee0d06aa27d
SHA256 335ac95b494f29b612009e1f5b71f06e9e3e4fa680c8de21abf0bcc8fa00d2bb
SHA512 904ff65626997577e082e4c330dd621c0e8c289ad99161ff405faa9e23b3ebefab7e6cb4fff1f1d7c960aad9326d9849787a5e69f7161f91b0ffafdb7cebdc90

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dnv.url

MD5 9aafa7e0e4ebd4bfba3ca03937d031c4
SHA1 cb4bd72e733b33c910913f2e00357dc527cdea87
SHA256 751d15fd3635ae3c036c6e8c84235cd9d16722da3647cf7c61037ad2078489f3
SHA512 2e6cd41144945d3efd240fbb06e376645ae9db8b29334f19f931a36f1d04fd61756f2d9c69b5d5a47d8cb7735c0fb8f318635656ecd220db5ad238e50292efd9

memory/3500-439-0x0000000002170000-0x00000000021A9000-memory.dmp

memory/3500-445-0x0000000005460000-0x000000000591A000-memory.dmp

memory/3500-444-0x0000000004E60000-0x000000000531A000-memory.dmp

memory/3500-446-0x0000000005920000-0x000000000593B000-memory.dmp

memory/3500-452-0x0000000005460000-0x000000000591A000-memory.dmp

memory/3500-454-0x0000000004E60000-0x000000000531A000-memory.dmp

memory/3500-456-0x0000000005920000-0x000000000593B000-memory.dmp

C:\Verifier\CaLLYG

MD5 341229426758892193e28f75d8638645
SHA1 fd11629dffc713309bdf43cce549e43b5c90377b
SHA256 29cd5ba0788024d030ed09f826d6f335d6a97e8450b0ed01791353d1d135dc2b
SHA512 2314aaa9397b42926c3a6e09bd990b7dc860d8d1e3334fca314c8a0fe066e231e2ce7b7f630278073b7be33b820ad5b64be16bf59a6ef3cbd2303ffa34ef67da

memory/3500-563-0x0000000004E60000-0x000000000531A000-memory.dmp

C:\Verifier\RUExEEAU

MD5 fc9ae1671b31f2b6c4e8c3b766e67053
SHA1 e649a4aeb70dbdea6395485cfb12be0a683bdaaf
SHA256 3ef0769a7dbfe812ce3ae05fc2010d3a153c3a1ed7ea6834fde726d51e8be018
SHA512 a0033ebf6306870ea62213dae329f29e064cdae3e7556a542487d4be309a21ae3e0067cf67a4d4c307113227fa5e640b7f917042f488b1b4fbf938fe25b96716

memory/3500-594-0x00000000060A0000-0x000000000655A000-memory.dmp

C:\SkySky\_2

MD5 1c6916b28d8c2dfee3145e5a134d418e
SHA1 59691aa2e15ff96cee3a651d1a4d0b9bfb193af4
SHA256 40279173a082e853e889cc29bc26313efc8c0f5af7806385607816593fbdb6f9
SHA512 398405b85de2c15c6d03dcb46bd7d8753b5b0166a77ee6689f083445b0efcdf2c376be97535311fa345d1c35e562fe212754675cc8fca58fc22ed2bc31848dfe

C:\Users\Public\Documents\RECSLLE.BIN\_1

MD5 6f12798e2a0ced431388cb13e8d236fc
SHA1 133603eea4d3cb11a79be2a270e9325ecd70857d
SHA256 b6df9f2dd085e96fc1369442e2312c6f47ddd12ab77b103cfabb89bd167cea73
SHA512 044e7a7a76269003ac3c11ee9b08d5f157dabe6d6d3662982ad3fd028b5b025bf59ec69a1397f7597f2a4ef3f23afdd601e07a86b4b06d3a3f6beb14f14cd184

memory/3500-513-0x0000000005460000-0x000000000591A000-memory.dmp

memory/3500-598-0x00000000060A0000-0x000000000655A000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\ManicTime.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

C:\Users\Public\Documents\RECSLLE.BIN\system\HBuilderService.exe

MD5 d9746c8d55bed7b372ccef704f96ddda
SHA1 61c6b8ba9108fc7617264bb7d58e163457946e5b
SHA256 afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
SHA512 e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

C:\Users\Public\Documents\RECSLLE.BIN\system\TIM.exe

MD5 201bd1ec28614133f06d6b5eeaf391db
SHA1 199e42c769d3a2da770fedee28e269525b8bbbee
SHA256 3586a2c0c8a78902df81212faddb166c0117e942e53cf5c392895013fc542335
SHA512 8584b60be46c2068de31f6af20f16b802b1a40c95f4337dfca4594f13fe62b700df8010020dd9df1f6a8b9c8831200e7d182d4fb4e9d61e12467dc451b4e5113

C:\Users\Public\Documents\RECSLLE.BIN\system\MiniStorPlay.exe

MD5 85416fbd2afed007c653c44cee003dcf
SHA1 51532afb39df497876ef7ac9746a836ae9eecb36
SHA256 aba1c5964bcd4edd88c1e85e166ea6a2280b602a5fcf1442c33c421f48edcd8d
SHA512 df531dcbe1ae5f487072481c14a2c3ff31b097083b3eb2911332ce153c0152c18ff9c088c989b9159159198b65db7a3c67d1b80c8849300e60cd6d589af31729

C:\Users\Public\Documents\RECSLLE.BIN\system\HBConfig.hb

MD5 d8e7fb978318ddb5b3dd1a050c4e6f64
SHA1 d98ae0d3c11331f1e95006885304a85b2ed47655
SHA256 918d1731e5d972dd0f6d364651aa2542639fb9cecaae1c5d37eaf205ee6567f2
SHA512 c5023f479018fe9c94cd772485e1f075a1564b1368092608c0b1a050c1d6b523aeb5bc98603b11844b0a5594bbb73e6dd02a8581a96afc5609b7fd33a0b44843

memory/940-504-0x0000000002690000-0x00000000027A8000-memory.dmp

C:\Users\Public\Documents\RECSLLE.BIN\system\libcef.dll

MD5 73392b5176d6a702d1bcd845d1b6ad4d
SHA1 7fff77b4106e9ea22fcbf4151021ecec56f408bc
SHA256 93e2441993c797236212fe450c719a1d72befbc518cf2ba4763309b513651c04
SHA512 e1ddca9f79baeacacfe5cb55b90baa222249c1de8127419b7e07d58c8774bb44c814e52d38335571f4695f87fa33340dc232fe20792ec8e95a3895cf3db67501

C:\Users\Public\Documents\RECSLLE.BIN\system\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\Users\Public\Documents\RECSLLE.BIN\system\crt.dll

MD5 231cceb5005a9e71c114cbdac63c3ee1
SHA1 d2b87f942837bbe0967b274f51e6d751b3a4d7a4
SHA256 61cdf4be615472d358f6b91fa06ac0d17e59e92c2d33165a331baf1548a4a6a2
SHA512 fd39e3479ab5cc61443a0a28adbf04da19426fb0b5fca914e675c26ed9e3deb4ed94cdf9ea4eb1d5285f4f9f65bc6c086773bfbcfbfa11487860b13897e2d891

C:\SkySky\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\fntestdll.dll

MD5 a1290e88c20dc0300a22e31c6a354d97
SHA1 aad6bbfb85547b44449469ac4076ddda4d07671a
SHA256 a202c537251c9fddd48dea2a5701c6f1e6dc0170ae796baf4136dcd913d3d73d
SHA512 c39ab7087214fb9c83f9afea3077994d06097638f5e42f88f1ca7a359d07649e91c732ddf5d75057fd9cccdfa91d2a42b3da2c2b0ad250a2deff057c3a6dffbe

C:\SkySky\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

C:\SkySky\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\SkySky\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\Test.dll

MD5 b4c5dd6ffcb56e8f18b5fac7d2db5cf5
SHA1 1ca81c22f3d0b4220cc5ec3daae106bdd0ad3cc1
SHA256 112ba7f1cc0e52c98d9cc1a3d61b69d00796f9b15527c9a5510a1877586cb17c
SHA512 880f65aa64fd4687081907a373a7ddf706a850d9e2565e73ab1778f613ca9135ad6714b48369c6c8ef92fef28992de4ba52f46637aaa9a1cfccfd73bbc46a35d

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\_1.dll

MD5 d5f76166658c084a7f8fd0bb283db807
SHA1 21ed4a7b43bc683b7162966906453c28c7b92e24
SHA256 bcfe7b859b0cbd09773ce38789053ac48369da79911a7e762eb52e0048bd818e
SHA512 d7b9dd7acf48c976ea89172248808ecbc9d14ceff4fd428983fbf1f80cd234f0f68bab522bd98fd84218ecf0fe8dfb6864dd86d9874f59b4817f72ca062df804

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\_2.dll

MD5 2e9a9458914dde2f98c8a0286074c545
SHA1 55a95970a16f188593d959d6c6b7a2d5a84acb41
SHA256 fa8c8795cb6426229066313ca6038b5ab033653f1ded60847f4d5783c2199121
SHA512 3ed3ee05535edd5731501760776d3f97c0185f580ddae8db51f9fcb2e9218552837c797ef3353cb6a7eb2a37f285b3e7090532016349847bf71c5bf5dd4370a8

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\kugou.dll

MD5 fc9ae1671b31f2b6c4e8c3b766e67053
SHA1 e649a4aeb70dbdea6395485cfb12be0a683bdaaf
SHA256 3ef0769a7dbfe812ce3ae05fc2010d3a153c3a1ed7ea6834fde726d51e8be018
SHA512 a0033ebf6306870ea62213dae329f29e064cdae3e7556a542487d4be309a21ae3e0067cf67a4d4c307113227fa5e640b7f917042f488b1b4fbf938fe25b96716

C:\SkySky\QQMusic.dll

MD5 341229426758892193e28f75d8638645
SHA1 fd11629dffc713309bdf43cce549e43b5c90377b
SHA256 29cd5ba0788024d030ed09f826d6f335d6a97e8450b0ed01791353d1d135dc2b
SHA512 2314aaa9397b42926c3a6e09bd990b7dc860d8d1e3334fca314c8a0fe066e231e2ce7b7f630278073b7be33b820ad5b64be16bf59a6ef3cbd2303ffa34ef67da

C:\Users\Public\Documents\RECSLLE.BIN\system\_3

MD5 89c9be6517d371e27cbe670b63a37e00
SHA1 88adac152dd202ab9ef4fb9d4141100419b827c6
SHA256 3003fdd00d40c2eaf5039f790959b34ec9ca6d8e0508d2a4c5357975df018f1e
SHA512 be843b1abffbb8a2fb92d253dfe49f5a0d2b1d7ea2339313ffc00fe87d056db06b00cda80a9650b3a9c1caec5a1670a19b414143779fcf3833082e964357e6e9

C:\SkySky\_2

MD5 1c6916b28d8c2dfee3145e5a134d418e
SHA1 59691aa2e15ff96cee3a651d1a4d0b9bfb193af4
SHA256 40279173a082e853e889cc29bc26313efc8c0f5af7806385607816593fbdb6f9
SHA512 398405b85de2c15c6d03dcb46bd7d8753b5b0166a77ee6689f083445b0efcdf2c376be97535311fa345d1c35e562fe212754675cc8fca58fc22ed2bc31848dfe

C:\Users\Public\Documents\RECSLLE.BIN\8.3.26.21181\_1

MD5 6f12798e2a0ced431388cb13e8d236fc
SHA1 133603eea4d3cb11a79be2a270e9325ecd70857d
SHA256 b6df9f2dd085e96fc1369442e2312c6f47ddd12ab77b103cfabb89bd167cea73
SHA512 044e7a7a76269003ac3c11ee9b08d5f157dabe6d6d3662982ad3fd028b5b025bf59ec69a1397f7597f2a4ef3f23afdd601e07a86b4b06d3a3f6beb14f14cd184

C:\Users\Public\Documents\RECSLLE.BIN\_1

MD5 6f12798e2a0ced431388cb13e8d236fc
SHA1 133603eea4d3cb11a79be2a270e9325ecd70857d
SHA256 b6df9f2dd085e96fc1369442e2312c6f47ddd12ab77b103cfabb89bd167cea73
SHA512 044e7a7a76269003ac3c11ee9b08d5f157dabe6d6d3662982ad3fd028b5b025bf59ec69a1397f7597f2a4ef3f23afdd601e07a86b4b06d3a3f6beb14f14cd184

memory/3500-601-0x0000000005920000-0x000000000593B000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

144s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\21.exe"

Signatures

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\26X\21.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4228 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\26X\21.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4228 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\26X\21.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4228 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\26X\21.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 4228 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\26X\21.exe C:\Users\Admin\AppData\Local\Temp\26X\21.exe
PID 4228 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\26X\21.exe C:\Users\Admin\AppData\Local\Temp\26X\21.exe
PID 3648 wrote to memory of 1648 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3648 wrote to memory of 1648 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3648 wrote to memory of 1648 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 3348 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 1648 wrote to memory of 796 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Users\Admin\AppData\Local\Temp\26X\21.exe

"C:\Users\Admin\AppData\Local\Temp\26X\21.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Public\Documents\½ô¼±Í¨Öª.pdf"

C:\Users\Admin\AppData\Local\Temp\26X\21.exe

"C:\Users\Admin\AppData\Local\Temp\26X\21.exe" arg1 arg2 arg3 arg4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=606682CCCF2E4D402F6F217F558C7F24 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2A0C8DA1C4F307694713FAC51B6E64DB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2A0C8DA1C4F307694713FAC51B6E64DB --renderer-client-id=2 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=91C7BF82185E29BF5AE2B017009B34DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=91C7BF82185E29BF5AE2B017009B34DD --renderer-client-id=4 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3934B8D42AE5652124D4E2BBD8BCF516 --mojo-platform-channel-handle=2288 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FE8436B3C6B0CFF49FD2CAE16BE1F342 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D7D1317B9A2855E0DA4CC5378EB0544E --mojo-platform-channel-handle=2384 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 137.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 202.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 254.137.241.8.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 sojson.com udp
DE 185.232.59.133:443 sojson.com tcp
US 8.8.8.8:53 133.59.232.185.in-addr.arpa udp
US 8.8.8.8:53 www.bili123.com udp
DE 185.232.59.133:443 www.bili123.com tcp
DE 185.232.59.133:443 www.bili123.com tcp

Files

C:\Users\Public\Documents\½ô¼±Í¨Öª.pdf

MD5 caff24fb3b57b2269bc2688a6b30c87f
SHA1 7fa5654450032a3a8b9edffa32a0c775f38f0367
SHA256 b30cb3696a575958111f604ccf0622794e8df2c0bef8a6ed2365cb96646b0390
SHA512 4d507e169ed1fb22691d13a37dd60c1e2c50169ae66bc0bb84005e339ce64be90f83c07ff4398a7d987ab175d638a9839043a05e5624c13035b817fc77a7d94f

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 3b9288faa7d6843b2c4adbec927005a5
SHA1 bda0f5b572c1dec63b046a68e7e33010a1dfa6f0
SHA256 b4bba6039855b1cae63bb6b5d9205785028ec1c16e14de20d44c0748780150c1
SHA512 216c23b63408a99a9dae0abffcba6ef7d72b34c287e8e2bfdcda2bf20cc78e2db5d4ab639d6e85d1bf6a9706b9a392876c006cc5fa94b046eab0efbfbbfa619d

memory/3280-282-0x00000219F2050000-0x00000219F2150000-memory.dmp

memory/3280-283-0x00000219F04C0000-0x00000219F0531000-memory.dmp

memory/3280-284-0x00000219F2050000-0x00000219F2150000-memory.dmp

memory/3280-285-0x00000219F04C0000-0x00000219F0531000-memory.dmp

memory/3280-304-0x00000219F2450000-0x00000219F2454000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\24.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\24.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\24.exe

"C:\Users\Admin\AppData\Local\Temp\26X\24.exe"

C:\Users\Admin\AppData\Local\Temp\26X\24.exe

"C:\Users\Admin\AppData\Local\Temp\26X\24.exe"

Network

Country Destination Domain Proto
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp
CN 82.156.153.122:11111 tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI28042\ucrtbase.dll

MD5 185420a98824f7718dc5d8197e2b3471
SHA1 f083dcb3dea4b7aab4a110431274f9f4970dbc60
SHA256 6b817ec9874cd110a0b17ae89422bbe3362e3eadce91a5e66729801f57758ec4
SHA512 bc8cd1f08aba813475f6cc9290a99ab90071fc441373cb72dd35f4c497d8a0d565db28fc43765464e1d0dece052e6595ef2e93502ab3f715af05a38cbfe4aa88

\Users\Admin\AppData\Local\Temp\_MEI28042\ucrtbase.dll

MD5 185420a98824f7718dc5d8197e2b3471
SHA1 f083dcb3dea4b7aab4a110431274f9f4970dbc60
SHA256 6b817ec9874cd110a0b17ae89422bbe3362e3eadce91a5e66729801f57758ec4
SHA512 bc8cd1f08aba813475f6cc9290a99ab90071fc441373cb72dd35f4c497d8a0d565db28fc43765464e1d0dece052e6595ef2e93502ab3f715af05a38cbfe4aa88

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-core-localization-l1-2-0.dll

MD5 b402ed77d6f31d825bda175dbc0c4f92
SHA1 1f2a4b8753b3aae225feac5487cc0011b73c0eb7
SHA256 6ed17fb3ca5156b39fbc1ef7d1eefa95e739857607de4cd8d41cecfcd1350705
SHA512 ec04013139f3fd9dbf22b92121d82b2eb97e136f8619790cde2d0b660280e838962f9006d3e4c3a359627b017f2b6ade7edff3bbc26e559c3de37540585602d9

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-core-localization-l1-2-0.dll

MD5 b402ed77d6f31d825bda175dbc0c4f92
SHA1 1f2a4b8753b3aae225feac5487cc0011b73c0eb7
SHA256 6ed17fb3ca5156b39fbc1ef7d1eefa95e739857607de4cd8d41cecfcd1350705
SHA512 ec04013139f3fd9dbf22b92121d82b2eb97e136f8619790cde2d0b660280e838962f9006d3e4c3a359627b017f2b6ade7edff3bbc26e559c3de37540585602d9

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-core-processthreads-l1-1-1.dll

MD5 3d872be898581f00d0310d7ab9abaf2b
SHA1 420e0ab98bb748723130de414f0ffed117ef3f7e
SHA256 4de821884cbef4182b29d8c33cfe13e43e130ad58ee1281679e8d40a2edcb8ea
SHA512 35cfb9888a5f4299403a0d9c57f0ba79e3625431a9acc5e04ae2ae101b3dc521a0dcff5d4a1bf508b25dbf05dd432f6987d860ff494d15538ed95673a8b7376b

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-core-processthreads-l1-1-1.dll

MD5 3d872be898581f00d0310d7ab9abaf2b
SHA1 420e0ab98bb748723130de414f0ffed117ef3f7e
SHA256 4de821884cbef4182b29d8c33cfe13e43e130ad58ee1281679e8d40a2edcb8ea
SHA512 35cfb9888a5f4299403a0d9c57f0ba79e3625431a9acc5e04ae2ae101b3dc521a0dcff5d4a1bf508b25dbf05dd432f6987d860ff494d15538ed95673a8b7376b

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-core-file-l1-2-0.dll

MD5 9d8413744097196f92327f632a85acee
SHA1 dfc07f5e5a0634dd1f15fdc9ff9731748fbff919
SHA256 6878d8168d5cc159efe58f14e5ba10310d99b53ab8495521e54c966994dac50b
SHA512 a8f6e9ee1c5d65f68b8b20d406d3e666c186e15cb3b92575257b5637fe7dd5ac7d75e9ad51c839ba4490512f68f6b48822fc9edd316dd7625d3627d3b975fb2a

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-core-file-l1-2-0.dll

MD5 9d8413744097196f92327f632a85acee
SHA1 dfc07f5e5a0634dd1f15fdc9ff9731748fbff919
SHA256 6878d8168d5cc159efe58f14e5ba10310d99b53ab8495521e54c966994dac50b
SHA512 a8f6e9ee1c5d65f68b8b20d406d3e666c186e15cb3b92575257b5637fe7dd5ac7d75e9ad51c839ba4490512f68f6b48822fc9edd316dd7625d3627d3b975fb2a

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-core-timezone-l1-1-0.dll

MD5 6c180c8de3ecf27de7a5812ff055737e
SHA1 3aad20b71bb374bb2c5f7431a1b75b60956a01fd
SHA256 630466fd77ac7009c947a8370a0d0c20652169824c54ddcb8c05e8df45e23197
SHA512 e4aa79eb2b6b3be9b545e8cb8b43cd6052036dc5cce7077be40441b9942931b30d76c475d550a178d4e94c9c366cabc852f500e482b7fdcd361fc2a08e41c00e

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-core-timezone-l1-1-0.dll

MD5 6c180c8de3ecf27de7a5812ff055737e
SHA1 3aad20b71bb374bb2c5f7431a1b75b60956a01fd
SHA256 630466fd77ac7009c947a8370a0d0c20652169824c54ddcb8c05e8df45e23197
SHA512 e4aa79eb2b6b3be9b545e8cb8b43cd6052036dc5cce7077be40441b9942931b30d76c475d550a178d4e94c9c366cabc852f500e482b7fdcd361fc2a08e41c00e

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-core-file-l2-1-0.dll

MD5 361c6bcfcea263749419b0fbed7a0ce8
SHA1 03db13108ce9d5fc01cecf3199619ffbccbd855a
SHA256 b74aefd6fa638be3f415165c8109121a2093597421101abc312ee7ffa1130278
SHA512 aa8b585000cc65f9841b938e4523d91d8f6db650e0b4bb11efd740c27309bf81cdb77f05d0beda2489bf26f4fbc6d02c93ce3b64946502e2c044eea89696cc76

C:\Users\Admin\AppData\Local\Temp\_MEI28042\python38.dll

MD5 c0ed63bf515d04803906e1b703e9cb86
SHA1 61f9a465d7a782aedfd5e2b1a9dc8bff6c103b5a
SHA256 24bfc999a733d4759ca40425610555f597b1d015f87ef5f84e15c665297247a4
SHA512 78384c34cefc40cb86913dffdc6a360668467731a8a3678d5f8377d8ae63d244b45506b0b6e2498825b53abe8fd84d2b75b3e9fef3703fead90183ace433e70a

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-core-file-l2-1-0.dll

MD5 361c6bcfcea263749419b0fbed7a0ce8
SHA1 03db13108ce9d5fc01cecf3199619ffbccbd855a
SHA256 b74aefd6fa638be3f415165c8109121a2093597421101abc312ee7ffa1130278
SHA512 aa8b585000cc65f9841b938e4523d91d8f6db650e0b4bb11efd740c27309bf81cdb77f05d0beda2489bf26f4fbc6d02c93ce3b64946502e2c044eea89696cc76

\Users\Admin\AppData\Local\Temp\_MEI28042\python38.dll

MD5 c0ed63bf515d04803906e1b703e9cb86
SHA1 61f9a465d7a782aedfd5e2b1a9dc8bff6c103b5a
SHA256 24bfc999a733d4759ca40425610555f597b1d015f87ef5f84e15c665297247a4
SHA512 78384c34cefc40cb86913dffdc6a360668467731a8a3678d5f8377d8ae63d244b45506b0b6e2498825b53abe8fd84d2b75b3e9fef3703fead90183ace433e70a

C:\Users\Admin\AppData\Local\Temp\_MEI28042\VCRUNTIME140.dll

MD5 6ba0dbcd2db8f44243799c891dbd2a59
SHA1 30a2719d4b8667fd237bcfb781660901c993d9fc
SHA256 263988a0868053b6b01835cd2959c8f71e3f943610421b269da646f2d9e3b333
SHA512 94dea85ef50d55cec0d1bbae4671386ce8ca02e870ce417abfef0a8499fdf0bd0eb5ba38debd07c213f7da39cbea63a18143484b05e9c7ca36b2f68e4520bb4d

\Users\Admin\AppData\Local\Temp\_MEI28042\VCRUNTIME140.dll

MD5 6ba0dbcd2db8f44243799c891dbd2a59
SHA1 30a2719d4b8667fd237bcfb781660901c993d9fc
SHA256 263988a0868053b6b01835cd2959c8f71e3f943610421b269da646f2d9e3b333
SHA512 94dea85ef50d55cec0d1bbae4671386ce8ca02e870ce417abfef0a8499fdf0bd0eb5ba38debd07c213f7da39cbea63a18143484b05e9c7ca36b2f68e4520bb4d

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-runtime-l1-1-0.dll

MD5 55b80c522731ecb92914bf9cded028c2
SHA1 424c61bc659caf04281959ede1b1f03b703934ed
SHA256 4c787ff8d40bb803e75fe6218fec36a672cfa6cfc7f6e80e68a7eb0b77a10e5a
SHA512 3779b530c7dba624369cb0f5d15154d89547adc3c4c7cc0571f1e8326588165098b9b5768d0052ecf1ea4f2dc84ae7dcf4712e3bc9ebdadb5fca4b0f4de43812

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-runtime-l1-1-0.dll

MD5 55b80c522731ecb92914bf9cded028c2
SHA1 424c61bc659caf04281959ede1b1f03b703934ed
SHA256 4c787ff8d40bb803e75fe6218fec36a672cfa6cfc7f6e80e68a7eb0b77a10e5a
SHA512 3779b530c7dba624369cb0f5d15154d89547adc3c4c7cc0571f1e8326588165098b9b5768d0052ecf1ea4f2dc84ae7dcf4712e3bc9ebdadb5fca4b0f4de43812

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-heap-l1-1-0.dll

MD5 01370c79ebabd534e7b58d35072d2866
SHA1 8cd0cd21ff838a2a314246def4bd858bab184a5d
SHA256 742bb9bf4c232f84ad8008af4af8eda7a1ec3eb76f05d9d7ebb95f6a5cabd2d8
SHA512 b07d9634ac804b476d61b6a0fc87894947e88744cc3eecf7d68ede3714acd938fae14452e43f9110919b8f8f9f5d4222e9de2ca97a915dd07b3231d674729761

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-heap-l1-1-0.dll

MD5 01370c79ebabd534e7b58d35072d2866
SHA1 8cd0cd21ff838a2a314246def4bd858bab184a5d
SHA256 742bb9bf4c232f84ad8008af4af8eda7a1ec3eb76f05d9d7ebb95f6a5cabd2d8
SHA512 b07d9634ac804b476d61b6a0fc87894947e88744cc3eecf7d68ede3714acd938fae14452e43f9110919b8f8f9f5d4222e9de2ca97a915dd07b3231d674729761

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-string-l1-1-0.dll

MD5 7a2799f4bc45505e7104e06dc8e254f8
SHA1 323bc35e0101b351a4abde1fce698520832518a8
SHA256 92f72f495a6897f7d7cf2c2064b2b65f6b4fbd4f30911a534a5cd0de73395ebe
SHA512 2627da183779f17fcc9709a6da2e2916a296f61124adb9bf563c80d723ada9b769806cab8fbc4ed916f54fd4cde18f25e7ad53ed6c75e7e61fdef37c2f1ec9b2

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-string-l1-1-0.dll

MD5 7a2799f4bc45505e7104e06dc8e254f8
SHA1 323bc35e0101b351a4abde1fce698520832518a8
SHA256 92f72f495a6897f7d7cf2c2064b2b65f6b4fbd4f30911a534a5cd0de73395ebe
SHA512 2627da183779f17fcc9709a6da2e2916a296f61124adb9bf563c80d723ada9b769806cab8fbc4ed916f54fd4cde18f25e7ad53ed6c75e7e61fdef37c2f1ec9b2

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-stdio-l1-1-0.dll

MD5 4614d03a94d46c0e9d1c5d96a3fe1d78
SHA1 cacb73ca3c7e31a4b8f749854060b7a422497050
SHA256 c7919be431ce2fa1906ff9eeb19e4cb19a30a4680107ef8737ce894654b21a5a
SHA512 4f30e8c5893662d7889a049c206b08559ad1a34eb7927be313086d6dae40dca3571de3852dba2ad9324e028fa86e8a391a58ec48ba5dbd5c4a88660ffe8b30df

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-convert-l1-1-0.dll

MD5 d749afffa2b3be4b2a9edac50c20b28b
SHA1 972253ed12c344b85290f7b3d5f9608a7f7b0670
SHA256 e64fbac3491b4693e79a3f7b0db1d788f93608d3fc82133edf25a868c80d2153
SHA512 4447b6960a6c178f7c37dbd38e9aec24ba5a0c58e19afcfaa2b70dca7d7bbe87ad7aa1ac9d48ab9b56b1f375768d4c4cb28d5afcf714102f9757faa2b3e728d9

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-convert-l1-1-0.dll

MD5 d749afffa2b3be4b2a9edac50c20b28b
SHA1 972253ed12c344b85290f7b3d5f9608a7f7b0670
SHA256 e64fbac3491b4693e79a3f7b0db1d788f93608d3fc82133edf25a868c80d2153
SHA512 4447b6960a6c178f7c37dbd38e9aec24ba5a0c58e19afcfaa2b70dca7d7bbe87ad7aa1ac9d48ab9b56b1f375768d4c4cb28d5afcf714102f9757faa2b3e728d9

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-stdio-l1-1-0.dll

MD5 4614d03a94d46c0e9d1c5d96a3fe1d78
SHA1 cacb73ca3c7e31a4b8f749854060b7a422497050
SHA256 c7919be431ce2fa1906ff9eeb19e4cb19a30a4680107ef8737ce894654b21a5a
SHA512 4f30e8c5893662d7889a049c206b08559ad1a34eb7927be313086d6dae40dca3571de3852dba2ad9324e028fa86e8a391a58ec48ba5dbd5c4a88660ffe8b30df

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-math-l1-1-0.dll

MD5 85893a96a568ba9781f50f876ed303cd
SHA1 fb7473bc5b1e88e978b7e5664b45d69770c8f4fa
SHA256 08e34f12de24e89379a0533f21a23ce6fecbea05d4062796d4ffd4adc3012316
SHA512 864fa39423b8ca9c43fa177aca1484ec2ffae4868a434e7a8016efe88f396b67fb8ca3766f611de7218e9983653a8b7b88b07c2591b252dd93a0d9638980e7ff

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-math-l1-1-0.dll

MD5 85893a96a568ba9781f50f876ed303cd
SHA1 fb7473bc5b1e88e978b7e5664b45d69770c8f4fa
SHA256 08e34f12de24e89379a0533f21a23ce6fecbea05d4062796d4ffd4adc3012316
SHA512 864fa39423b8ca9c43fa177aca1484ec2ffae4868a434e7a8016efe88f396b67fb8ca3766f611de7218e9983653a8b7b88b07c2591b252dd93a0d9638980e7ff

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-locale-l1-1-0.dll

MD5 bacb72fa56de18d5ac63e4a0a3fe768f
SHA1 7db19efe649d30337781afd62616c0549255046e
SHA256 25905676b543c4f05e9dae135f929c03a57686a6941ce59be2b3450521feb943
SHA512 78d82962c11e5928e77c5bd0377ecb6b00c2eca242d637f76e68fbf907bce7381f3a5294100d055c30f6e2aee164db0b95dcf0c0c77e39edcec4a046cfc63ed4

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-locale-l1-1-0.dll

MD5 bacb72fa56de18d5ac63e4a0a3fe768f
SHA1 7db19efe649d30337781afd62616c0549255046e
SHA256 25905676b543c4f05e9dae135f929c03a57686a6941ce59be2b3450521feb943
SHA512 78d82962c11e5928e77c5bd0377ecb6b00c2eca242d637f76e68fbf907bce7381f3a5294100d055c30f6e2aee164db0b95dcf0c0c77e39edcec4a046cfc63ed4

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-time-l1-1-0.dll

MD5 38b633f132f8e2b3abc268537fa415ec
SHA1 ccccb8c3e31dce7b6b952022d245c11ff3ae8122
SHA256 46cb7b3a9f8aac5adcdbe23494e458f3195adf4b8ed1c71f2d934ddde651e57e
SHA512 23bd77d61c20b1af7f13b5bcbeb9fa74ee807f809bb3d4dd40c7709ca4870078fa6e8e94eefc83a725c0245c0ce02e3adbd4f370d6b986f0c9442ccbc2c2ab96

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-time-l1-1-0.dll

MD5 38b633f132f8e2b3abc268537fa415ec
SHA1 ccccb8c3e31dce7b6b952022d245c11ff3ae8122
SHA256 46cb7b3a9f8aac5adcdbe23494e458f3195adf4b8ed1c71f2d934ddde651e57e
SHA512 23bd77d61c20b1af7f13b5bcbeb9fa74ee807f809bb3d4dd40c7709ca4870078fa6e8e94eefc83a725c0245c0ce02e3adbd4f370d6b986f0c9442ccbc2c2ab96

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-process-l1-1-0.dll

MD5 9ee275466394a2088d7dfbbc0c716671
SHA1 4d2f94674587251c60805889395ab7377e8c5e17
SHA256 c68a61c260454c0aeb051ddb2bed52cbca44b96d50046017cbc351b41f225dc0
SHA512 996212d07b0b6e55f54e17d6a053f017b1fd00f50906db9de25b8ae5632eeac9c197e91db1c293e7abf0e8b823937cb18e26f43e166f76c02a6914c9776a72b3

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-process-l1-1-0.dll

MD5 9ee275466394a2088d7dfbbc0c716671
SHA1 4d2f94674587251c60805889395ab7377e8c5e17
SHA256 c68a61c260454c0aeb051ddb2bed52cbca44b96d50046017cbc351b41f225dc0
SHA512 996212d07b0b6e55f54e17d6a053f017b1fd00f50906db9de25b8ae5632eeac9c197e91db1c293e7abf0e8b823937cb18e26f43e166f76c02a6914c9776a72b3

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-environment-l1-1-0.dll

MD5 7a2874fe036f7dc86ed5f712adaa38e6
SHA1 440f2dc5379ceee35d29571c195dc7a76e8b70e7
SHA256 dd054e4de84144c2130fa8d28d563252a7c4089a58872e49d63bc43c9a1a3cb8
SHA512 d20811025f714b5fd3754d607422f4fb5cd6c456ffceef139edcb0cfaacd9b63a694ce2ea737db78385f0b23ddcfc283282a319b79e7a0e4bd50034e87aacb9a

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-environment-l1-1-0.dll

MD5 7a2874fe036f7dc86ed5f712adaa38e6
SHA1 440f2dc5379ceee35d29571c195dc7a76e8b70e7
SHA256 dd054e4de84144c2130fa8d28d563252a7c4089a58872e49d63bc43c9a1a3cb8
SHA512 d20811025f714b5fd3754d607422f4fb5cd6c456ffceef139edcb0cfaacd9b63a694ce2ea737db78385f0b23ddcfc283282a319b79e7a0e4bd50034e87aacb9a

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-conio-l1-1-0.dll

MD5 84a950e3c162d67f98516bb1744139e0
SHA1 05ff2fe60c5748c33ba8605aaf609b3bdfe2772f
SHA256 91f4db05c69c58ecb2493e30acc5297043c41b1ce6db50cee4e2922cd4bcd7f2
SHA512 7328c6a512d450f2538efeabf3f467489a898ed7c1d45c1952b98d118d898083510c9849182bc425411a408c113a351a28b41bedeb5b8de61427144b3fa87c80

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-conio-l1-1-0.dll

MD5 84a950e3c162d67f98516bb1744139e0
SHA1 05ff2fe60c5748c33ba8605aaf609b3bdfe2772f
SHA256 91f4db05c69c58ecb2493e30acc5297043c41b1ce6db50cee4e2922cd4bcd7f2
SHA512 7328c6a512d450f2538efeabf3f467489a898ed7c1d45c1952b98d118d898083510c9849182bc425411a408c113a351a28b41bedeb5b8de61427144b3fa87c80

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 73e14d927d075ca273b3237116351e8f
SHA1 0c15cea3c83c7f7e692dc6f8bd856b615c727d49
SHA256 966a7f15bfb2e0ff7888d583638ebd675d8f46b264194cf332f78140b7c129e1
SHA512 664f72d7adf48f8499321f8a5df952c6043532aae09bae9ffbd59da77b161cd43211a3aaef1ba85529dfe00498d1ac3a933a7c9cf437095c6a337c9bc0816b3f

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 73e14d927d075ca273b3237116351e8f
SHA1 0c15cea3c83c7f7e692dc6f8bd856b615c727d49
SHA256 966a7f15bfb2e0ff7888d583638ebd675d8f46b264194cf332f78140b7c129e1
SHA512 664f72d7adf48f8499321f8a5df952c6043532aae09bae9ffbd59da77b161cd43211a3aaef1ba85529dfe00498d1ac3a933a7c9cf437095c6a337c9bc0816b3f

C:\Users\Admin\AppData\Local\Temp\_MEI28042\base_library.zip

MD5 0528e9fde883b5f5ddd41903922b7499
SHA1 aa2a2296960ca7ed8ee49de44840a6141419f223
SHA256 d4a4fd83ef3caaf170460e1f513bd2693ac818319b5faf4d401b7dd469f09386
SHA512 66eebbed5cea4abf4342a60446123512b2d7058d6d9b31ff0896d3c70753d33930a0449b32bb66f3c0cf8a7ad5878a4b6cfae1188ff5e59a8fb5ae4a81221ffb

C:\Users\Admin\AppData\Local\Temp\_MEI28042\tinyaes.cp38-win_amd64.pyd

MD5 629f76ef6491d11b06133c37692b04d6
SHA1 a55c64556929bb984906a16c3f3c2d425b0712c9
SHA256 83c3532c4355dfe635df4462da7bd767d8c96bf85cb60f80072cec3cf1da24c1
SHA512 f26dfa24bcc34f1958ce2f96db41f7a02ffed6577d18e07efce6ef89773604c257d709150235367e6b8866c536d679b159a6976037e02d2c8e28d321fd49c395

\Users\Admin\AppData\Local\Temp\_MEI28042\tinyaes.cp38-win_amd64.pyd

MD5 629f76ef6491d11b06133c37692b04d6
SHA1 a55c64556929bb984906a16c3f3c2d425b0712c9
SHA256 83c3532c4355dfe635df4462da7bd767d8c96bf85cb60f80072cec3cf1da24c1
SHA512 f26dfa24bcc34f1958ce2f96db41f7a02ffed6577d18e07efce6ef89773604c257d709150235367e6b8866c536d679b159a6976037e02d2c8e28d321fd49c395

C:\Users\Admin\AppData\Local\Temp\_MEI28042\_ctypes.pyd

MD5 ffde1baacbe6729ad5246068870915a4
SHA1 2d42751140fc244f19dece6b1948b2b67d36bab4
SHA256 cc839990fb1020520731c35a183c83c9dc927aa78fa6b149a92a39e9d156c8b8
SHA512 1ac3ec986c55af37eb93d35a15e8a64726e5154240c0c5aac8286f7e347c678482ec65c62b454cf237023253642335ce6b3f6c0cc084e1527e61d48aaf7752f1

\Users\Admin\AppData\Local\Temp\_MEI28042\_ctypes.pyd

MD5 ffde1baacbe6729ad5246068870915a4
SHA1 2d42751140fc244f19dece6b1948b2b67d36bab4
SHA256 cc839990fb1020520731c35a183c83c9dc927aa78fa6b149a92a39e9d156c8b8
SHA512 1ac3ec986c55af37eb93d35a15e8a64726e5154240c0c5aac8286f7e347c678482ec65c62b454cf237023253642335ce6b3f6c0cc084e1527e61d48aaf7752f1

C:\Users\Admin\AppData\Local\Temp\_MEI28042\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

\Users\Admin\AppData\Local\Temp\_MEI28042\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI28042\_bz2.pyd

MD5 6909da62abc73216883a89a60b66e73b
SHA1 015eb36344e5f3fe2df467bd47a04bded616b052
SHA256 4c22e0d2786dd7e93f55e1f4a1c27d2e141a55682ed2c09b90320817fcf011f9
SHA512 eddabb51b6092b3c3e3b6968ea831a262f8f5f8a26b1c95badc616ca236d0928aa789334835130ec40137ffc623b5d2031a585e890162b489a26fd990845b63a

\Users\Admin\AppData\Local\Temp\_MEI28042\_bz2.pyd

MD5 6909da62abc73216883a89a60b66e73b
SHA1 015eb36344e5f3fe2df467bd47a04bded616b052
SHA256 4c22e0d2786dd7e93f55e1f4a1c27d2e141a55682ed2c09b90320817fcf011f9
SHA512 eddabb51b6092b3c3e3b6968ea831a262f8f5f8a26b1c95badc616ca236d0928aa789334835130ec40137ffc623b5d2031a585e890162b489a26fd990845b63a

C:\Users\Admin\AppData\Local\Temp\_MEI28042\_lzma.pyd

MD5 af8385e0cb374ae6caee59190175dd12
SHA1 a16d7d021ec3fa31fb1b2ce5929c2d3d4c96d6b8
SHA256 e414ee3efa6a4e1edf610dd780335ab9372cbe7919a73596bbb267b55ad23999
SHA512 3e4e26bbcf14ebcb4faedb8982c46b3f5318c88dd395c668c50e4f5ddbfe6c1836eb49e49e855cc95934e8247e63df0f7543f66e4fe13335558fc21c0c566b5b

\Users\Admin\AppData\Local\Temp\_MEI28042\_lzma.pyd

MD5 af8385e0cb374ae6caee59190175dd12
SHA1 a16d7d021ec3fa31fb1b2ce5929c2d3d4c96d6b8
SHA256 e414ee3efa6a4e1edf610dd780335ab9372cbe7919a73596bbb267b55ad23999
SHA512 3e4e26bbcf14ebcb4faedb8982c46b3f5318c88dd395c668c50e4f5ddbfe6c1836eb49e49e855cc95934e8247e63df0f7543f66e4fe13335558fc21c0c566b5b

C:\Users\Admin\AppData\Local\Temp\_MEI28042\_socket.pyd

MD5 fc47a3b4dc7353591970a20678b90a81
SHA1 5ca5436e0c66f468bb48b5ea16c69125fcc34bea
SHA256 4e7ee0ecf839c42d96c53309384737e8f84bb5e90ecd20d511cc3fc6ec135f44
SHA512 8f52f33ce49bc38a9356d46c63aef4f8f05d491377f4969f52fd84f83712faed3d9637044d27583bf06fc52687667b630ba8d2eb8ee27f4a810520df5499b725

\Users\Admin\AppData\Local\Temp\_MEI28042\_socket.pyd

MD5 fc47a3b4dc7353591970a20678b90a81
SHA1 5ca5436e0c66f468bb48b5ea16c69125fcc34bea
SHA256 4e7ee0ecf839c42d96c53309384737e8f84bb5e90ecd20d511cc3fc6ec135f44
SHA512 8f52f33ce49bc38a9356d46c63aef4f8f05d491377f4969f52fd84f83712faed3d9637044d27583bf06fc52687667b630ba8d2eb8ee27f4a810520df5499b725

C:\Users\Admin\AppData\Local\Temp\_MEI28042\select.pyd

MD5 f4887f1d906dc336fe0c3f7dbb720ca3
SHA1 67def676ad3569029d2a357a40a138fc7570bdcc
SHA256 36552bc64127d4866c657c9b74c0399baad70957a5380896fd8202e3a6bb7b4f
SHA512 51006d164c2512adfab92d22be5fed7c093cb647821045a6cdfd2ed7a30d94e620a446b8434b3e91d5544ef737e1492f3dc6c29cadbfdfa5e41df7fb5106a301

\Users\Admin\AppData\Local\Temp\_MEI28042\select.pyd

MD5 f4887f1d906dc336fe0c3f7dbb720ca3
SHA1 67def676ad3569029d2a357a40a138fc7570bdcc
SHA256 36552bc64127d4866c657c9b74c0399baad70957a5380896fd8202e3a6bb7b4f
SHA512 51006d164c2512adfab92d22be5fed7c093cb647821045a6cdfd2ed7a30d94e620a446b8434b3e91d5544ef737e1492f3dc6c29cadbfdfa5e41df7fb5106a301

C:\Users\Admin\AppData\Local\Temp\_MEI28042\_queue.pyd

MD5 1711e365021dae47498f552c1d000d49
SHA1 c0512da577c85c2c1b5822761baf535a7ed3dc2c
SHA256 2b4b4b0b1ea2c6ce8e33c3896e73af029962ffa1a5c7ddb2d0152991214a84b1
SHA512 065a2a94af1079f5e0cfa4807e026c9deb28cf559779e0527ed31b541814280b907094659906fc3ffd3520437c5a37bc0225937abc08b9aac18e3b5215bd5f29

\Users\Admin\AppData\Local\Temp\_MEI28042\_queue.pyd

MD5 1711e365021dae47498f552c1d000d49
SHA1 c0512da577c85c2c1b5822761baf535a7ed3dc2c
SHA256 2b4b4b0b1ea2c6ce8e33c3896e73af029962ffa1a5c7ddb2d0152991214a84b1
SHA512 065a2a94af1079f5e0cfa4807e026c9deb28cf559779e0527ed31b541814280b907094659906fc3ffd3520437c5a37bc0225937abc08b9aac18e3b5215bd5f29

C:\Users\Admin\AppData\Local\Temp\_MEI28042\_ssl.pyd

MD5 bb726a022fa65d9db794e280372dbe3e
SHA1 c48e78b37e10a713380040d16145e0ef06050e8e
SHA256 87362816a16c45095ad9ac3dc174509b2a4dd794cd17f56cac356d11c992de12
SHA512 637b78e884b55e6819e64e1b8f57f8399099165b65bf5866f8d03adb1305655b4773096b80666f88c1ff65cdd0c74ee2e0bcfb3258456ddf04c47b597f4f4287

\Users\Admin\AppData\Local\Temp\_MEI28042\_ssl.pyd

MD5 bb726a022fa65d9db794e280372dbe3e
SHA1 c48e78b37e10a713380040d16145e0ef06050e8e
SHA256 87362816a16c45095ad9ac3dc174509b2a4dd794cd17f56cac356d11c992de12
SHA512 637b78e884b55e6819e64e1b8f57f8399099165b65bf5866f8d03adb1305655b4773096b80666f88c1ff65cdd0c74ee2e0bcfb3258456ddf04c47b597f4f4287

C:\Users\Admin\AppData\Local\Temp\_MEI28042\libcrypto-1_1.dll

MD5 4929f390f3b9132af172d38b22bd2a2b
SHA1 19d27dc93c402801b8cb582b3aa27b17d24403d3
SHA256 4c1cbe61f562459baf382d3153b4bfc8a651bfc4ab41c99b3c8c29e19de7fde0
SHA512 2c7f3dfaba9e2844bcfddd3b05897f97ef043cc1cd5576ec0442eb26c9740c4df69a707e28bf5c6a0796e27e8de77ea430626ec822d74e054d081d32aaae7d93

\Users\Admin\AppData\Local\Temp\_MEI28042\libcrypto-1_1.dll

MD5 4929f390f3b9132af172d38b22bd2a2b
SHA1 19d27dc93c402801b8cb582b3aa27b17d24403d3
SHA256 4c1cbe61f562459baf382d3153b4bfc8a651bfc4ab41c99b3c8c29e19de7fde0
SHA512 2c7f3dfaba9e2844bcfddd3b05897f97ef043cc1cd5576ec0442eb26c9740c4df69a707e28bf5c6a0796e27e8de77ea430626ec822d74e054d081d32aaae7d93

C:\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-utility-l1-1-0.dll

MD5 5cde35104a68606913af6e5bd3b1adea
SHA1 f1f28141585c000753ab4db9ffc61f90929d4a1a
SHA256 111f6dd2e7247071a33d75bf98d521a8d09c4071f90483a82e6ed9af69bb52c4
SHA512 caa5f80ac380a6e0242104f297fbfe6091260d743ef967fb1010720dbcba2a575baf8cb1f666b11fe780428d71a04767e2cc63d1bd9638d5f1af1063e3f43f91

\Users\Admin\AppData\Local\Temp\_MEI28042\api-ms-win-crt-utility-l1-1-0.dll

MD5 5cde35104a68606913af6e5bd3b1adea
SHA1 f1f28141585c000753ab4db9ffc61f90929d4a1a
SHA256 111f6dd2e7247071a33d75bf98d521a8d09c4071f90483a82e6ed9af69bb52c4
SHA512 caa5f80ac380a6e0242104f297fbfe6091260d743ef967fb1010720dbcba2a575baf8cb1f666b11fe780428d71a04767e2cc63d1bd9638d5f1af1063e3f43f91

C:\Users\Admin\AppData\Local\Temp\_MEI28042\libssl-1_1.dll

MD5 facfcc9c58fe4238c847907689ddf485
SHA1 8382d1666627cd47855bc687615a9cc38eef7361
SHA256 d89a9009e10a2cb2d49771e694cd88f33d69cff0d3c92bc2d8e0b512e0ef9546
SHA512 f5d5f3e59438d6af1bcd22d85982107cc5eaea52c62243d11464a01f37172cb0aed343de68652882234349f1e0671b976fd5b6e77a532a9fa3cda7a0f77718c5

memory/916-225-0x0000000004130000-0x0000000004131000-memory.dmp

Analysis: behavioral30

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

141s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\5.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\26X\5.exe

"C:\Users\Admin\AppData\Local\Temp\26X\5.exe"

C:\Users\Admin\AppData\Local\Temp\26X\5.exe

"C:\Users\Admin\AppData\Local\Temp\26X\5.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 yiyasasa.top udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI39442\ucrtbase.dll

MD5 3c72fc810602812d8c03c8709519f115
SHA1 8956f79d95fe1eab1a06c4ad75588a49c2029994
SHA256 da572f7c674178ba7b91f7d47643fed07f7e71dbb4aeb46e1671ce08d1b31d73
SHA512 633f71aa2985e30870a3408dfb5b135b75c65ac89df24dc21b4f1057a6c8a489309ebdb263b3c46b054817dd81cde33ba47aa4677ee7f52237a5e0b821417901

C:\Users\Admin\AppData\Local\Temp\_MEI39442\python38.dll

MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

C:\Users\Admin\AppData\Local\Temp\_MEI39442\ucrtbase.dll

MD5 3c72fc810602812d8c03c8709519f115
SHA1 8956f79d95fe1eab1a06c4ad75588a49c2029994
SHA256 da572f7c674178ba7b91f7d47643fed07f7e71dbb4aeb46e1671ce08d1b31d73
SHA512 633f71aa2985e30870a3408dfb5b135b75c65ac89df24dc21b4f1057a6c8a489309ebdb263b3c46b054817dd81cde33ba47aa4677ee7f52237a5e0b821417901

C:\Users\Admin\AppData\Local\Temp\_MEI39442\python38.dll

MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

C:\Users\Admin\AppData\Local\Temp\_MEI39442\VCRUNTIME140.dll

MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

C:\Users\Admin\AppData\Local\Temp\_MEI39442\VCRUNTIME140.dll

MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

C:\Users\Admin\AppData\Local\Temp\_MEI39442\base_library.zip

MD5 24036a8677bdaa5d94ac05fd4cf6023e
SHA1 eb1596657871cdfca0f7d56c1da39bc99cc903d3
SHA256 3bb7a3d471a1be3ba487895e5e60bebca068711639e6a54978bfdf1bdde2f82f
SHA512 2982b1b5e5e59d0fd25fe2eb1dafef581151376baa5fdf558d175ddd587b46346839f40c4fae24ccb73ff5aca01c93175227e0c430e42e5c2ef2b3480eb3e0f4

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_ctypes.pyd

MD5 291a0a9b63bae00a4222a6df71a22023
SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

C:\Users\Admin\AppData\Local\Temp\_MEI39442\python3.DLL

MD5 c9f0b55fce50c904dff9276014cef6d8
SHA1 9f9ae27df619b695827a5af29414b592fc584e43
SHA256 074b06ae1d0a0b5c26f0ce097c91e2f24a5d38b279849115495fc40c6c10117e
SHA512 8dd188003d8419a25de7fbb37b29a4bc57a6fd93f2d79b5327ad2897d4ae626d7427f4e6ac84463c158bcb18b6c1e02e83ed49f347389252477bbeeb864ac799

C:\Users\Admin\AppData\Local\Temp\_MEI39442\python3.dll

MD5 c9f0b55fce50c904dff9276014cef6d8
SHA1 9f9ae27df619b695827a5af29414b592fc584e43
SHA256 074b06ae1d0a0b5c26f0ce097c91e2f24a5d38b279849115495fc40c6c10117e
SHA512 8dd188003d8419a25de7fbb37b29a4bc57a6fd93f2d79b5327ad2897d4ae626d7427f4e6ac84463c158bcb18b6c1e02e83ed49f347389252477bbeeb864ac799

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_ctypes.pyd

MD5 291a0a9b63bae00a4222a6df71a22023
SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

C:\Users\Admin\AppData\Local\Temp\_MEI39442\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI39442\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_socket.pyd

MD5 4827652de133c83fa1cae839b361856c
SHA1 182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
SHA512 8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

C:\Users\Admin\AppData\Local\Temp\_MEI39442\select.pyd

MD5 e21cff76db11c1066fd96af86332b640
SHA1 e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
SHA512 e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_socket.pyd

MD5 4827652de133c83fa1cae839b361856c
SHA1 182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
SHA512 8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

C:\Users\Admin\AppData\Local\Temp\_MEI39442\select.pyd

MD5 e21cff76db11c1066fd96af86332b640
SHA1 e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
SHA512 e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_ssl.pyd

MD5 d4dfd8c2894670e9f8d6302c09997300
SHA1 c3a6cc8d8079a06a4cac8950e0baba2b43fb1f8e
SHA256 0a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
SHA512 1422bf45d233e2e3f77dce30ba0123625f2a511f73dfdf42ee093b1755963d9abc371935111c28f0d2c02308c5e82867de2546d871c35e657da32a7182026048

C:\Users\Admin\AppData\Local\Temp\_MEI39442\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_ssl.pyd

MD5 d4dfd8c2894670e9f8d6302c09997300
SHA1 c3a6cc8d8079a06a4cac8950e0baba2b43fb1f8e
SHA256 0a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
SHA512 1422bf45d233e2e3f77dce30ba0123625f2a511f73dfdf42ee093b1755963d9abc371935111c28f0d2c02308c5e82867de2546d871c35e657da32a7182026048

C:\Users\Admin\AppData\Local\Temp\_MEI39442\libssl-1_1.dll

MD5 50bcfb04328fec1a22c31c0e39286470
SHA1 3a1b78faf34125c7b8d684419fa715c367db3daa
SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
SHA512 370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685

C:\Users\Admin\AppData\Local\Temp\_MEI39442\libssl-1_1.dll

MD5 50bcfb04328fec1a22c31c0e39286470
SHA1 3a1b78faf34125c7b8d684419fa715c367db3daa
SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
SHA512 370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685

C:\Users\Admin\AppData\Local\Temp\_MEI39442\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

C:\Users\Admin\AppData\Local\Temp\_MEI39442\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_hashlib.pyd

MD5 5e5af52f42eaf007e3ac73fd2211f048
SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_hashlib.pyd

MD5 5e5af52f42eaf007e3ac73fd2211f048
SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_queue.pyd

MD5 dd146e2fa08302496b15118bf47703cf
SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_queue.pyd

MD5 dd146e2fa08302496b15118bf47703cf
SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_bz2.pyd

MD5 a49c5f406456b79254eb65d015b81088
SHA1 cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
SHA512 bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_bz2.pyd

MD5 a49c5f406456b79254eb65d015b81088
SHA1 cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
SHA512 bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_lzma.pyd

MD5 cf9fd17b1706f3044a8f74f6d398d5f1
SHA1 c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
SHA512 5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a

C:\Users\Admin\AppData\Local\Temp\_MEI39442\_lzma.pyd

MD5 cf9fd17b1706f3044a8f74f6d398d5f1
SHA1 c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
SHA512 5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a

C:\Users\Admin\AppData\Local\Temp\_MEI39442\charset_normalizer\md.cp38-win_amd64.pyd

MD5 367426b02f93916d856dc20504c03a5d
SHA1 abe16956d5b2dd8d47d7434304030113989adf18
SHA256 cf1b152f1542c577bab3d52028a27412c2d275e772a9f0e553546af90fc15766
SHA512 21eb93bd1e656d5560320b67cabb9163c4c592194e9e8bc57d4f182ed92ca487e4870813958ce8f0bc46cd661f55668a0c5bdefa86dc43ec77cd642e14f9e5d6

C:\Users\Admin\AppData\Local\Temp\_MEI39442\charset_normalizer\md.cp38-win_amd64.pyd

MD5 367426b02f93916d856dc20504c03a5d
SHA1 abe16956d5b2dd8d47d7434304030113989adf18
SHA256 cf1b152f1542c577bab3d52028a27412c2d275e772a9f0e553546af90fc15766
SHA512 21eb93bd1e656d5560320b67cabb9163c4c592194e9e8bc57d4f182ed92ca487e4870813958ce8f0bc46cd661f55668a0c5bdefa86dc43ec77cd642e14f9e5d6

C:\Users\Admin\AppData\Local\Temp\_MEI39442\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

MD5 028e8677c6c7293e4cb6c671a4d414d9
SHA1 acc90cd69deb595f8010b5bf0c3d70938cb8057c
SHA256 cdb1201c350dc9f92e25765d550eab45a093772b421bffff5ac0ea8819b67d48
SHA512 f96ba2e24aae719233ef5c55b602f64da5d5f5e8d2540f0866447bfff8ac6a6d93581a2c0164d91ba53d1bceef9dda9adec68f419447ad882863ea725bb4b968

C:\Users\Admin\AppData\Local\Temp\_MEI39442\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

MD5 028e8677c6c7293e4cb6c671a4d414d9
SHA1 acc90cd69deb595f8010b5bf0c3d70938cb8057c
SHA256 cdb1201c350dc9f92e25765d550eab45a093772b421bffff5ac0ea8819b67d48
SHA512 f96ba2e24aae719233ef5c55b602f64da5d5f5e8d2540f0866447bfff8ac6a6d93581a2c0164d91ba53d1bceef9dda9adec68f419447ad882863ea725bb4b968

C:\Users\Admin\AppData\Local\Temp\_MEI39442\unicodedata.pyd

MD5 601aee84e12b87ca66826dfc7ca57231
SHA1 3a7812433ca7d443d4494446a9ced24b6774ceca
SHA256 d8091e62c74e1b2b648086f778c3c41ce01f09661a75ea207d3fea2cf26a8762
SHA512 7c2d64623c6cfd66d6729f59909c90aa944e810ff6514c58b2b3142ee90e8660b7ddf7fa187389dd333e47efe8b19e935dd4e9119c15375b69b4880d043877d7

C:\Users\Admin\AppData\Local\Temp\_MEI39442\unicodedata.pyd

MD5 601aee84e12b87ca66826dfc7ca57231
SHA1 3a7812433ca7d443d4494446a9ced24b6774ceca
SHA256 d8091e62c74e1b2b648086f778c3c41ce01f09661a75ea207d3fea2cf26a8762
SHA512 7c2d64623c6cfd66d6729f59909c90aa944e810ff6514c58b2b3142ee90e8660b7ddf7fa187389dd333e47efe8b19e935dd4e9119c15375b69b4880d043877d7

Analysis: behavioral3

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

146s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\11.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\11.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\11.exe

"C:\Users\Admin\AppData\Local\Temp\26X\11.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 mayo.edu udp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp
US 129.176.1.88:443 mayo.edu tcp

Files

memory/1392-54-0x0000000000400000-0x00000000007F2000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

120s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\12.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26X\12.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\12.exe

"C:\Users\Admin\AppData\Local\Temp\26X\12.exe"

C:\Users\Admin\AppData\Local\Temp\26X\12.exe

"C:\Users\Admin\AppData\Local\Temp\26X\12.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI15322\python310.dll

MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

\Users\Admin\AppData\Local\Temp\_MEI15322\python310.dll

MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

Analysis: behavioral11

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

151s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\15.exe"

Signatures

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\15.exe

"C:\Users\Admin\AppData\Local\Temp\26X\15.exe"

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\北京洁简天兴商贸有限责任公司报名航空股份机上经济舱洗漱包项目资质文件.pdf"

Network

N/A

Files

memory/2124-55-0x0000000000050000-0x00000000005AB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\北京洁简天兴商贸有限责任公司报名航空股份机上经济舱洗漱包项目资质文件.pdf

MD5 a2c81183272ca47e33df253b3dffbf46
SHA1 78b8733372cc43219456ff3ecfb0c84ed5faad85
SHA256 5430750b4d8897a2c8580a8cb9b024476f5bf2f6c0f280df7275f042e2628d68
SHA512 25a03e5cdd73d4ebf292dca158614253f34f0e9b1bc8bebfb003ab312bca4e4002b72327b9d7d88b612585c300c7a1827d4864814433b7c7fe2c8649d3409f64

memory/1324-57-0x00000000020A0000-0x0000000002116000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 7314ad8b79097aafd106c338328be358
SHA1 f92176c566b53261ece7e6fbb8bd7e0392c694d3
SHA256 ab90b99d8df4439f01e322cd99586df8bad8ba658d5782d7db5b986ce24c9987
SHA512 dad7a5a4fc7137afb14df2a1c0b050f08219ace1c62e0b90d2e3d48916c256cd58de1a4f8ab0fcc8d65d614f01e9c6ae97e44c3ae407cf54c0c3241613143444

Analysis: behavioral18

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win10v2004-20230703-en

Max time kernel

118s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\2.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\2.exe

"C:\Users\Admin\AppData\Local\Temp\26X\2.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 254.130.241.8.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 asdf.jtexpress.life udp
US 8.8.8.8:53 asdf.jtexpress.life udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 48.101.122.92.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2023-08-15 12:22

Reported

2023-08-15 12:26

Platform

win7-20230712-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26X\22.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\26X\22.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\26X\22.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\26X\22.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\26X\22.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26X\22.exe

"C:\Users\Admin\AppData\Local\Temp\26X\22.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 captcha.jincheng4917.cn udp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp
CN 118.212.235.109:443 captcha.jincheng4917.cn tcp

Files

memory/2072-55-0x0000000000220000-0x0000000000261000-memory.dmp

memory/2072-56-0x0000000002E60000-0x00000000032D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabA029.tmp

MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c