Malware Analysis Report

2024-08-06 07:55

Sample ID 230924-h8z8csch9w
Target a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b
SHA256 a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b
Tags
cobaltstrike 0 1359593325 backdoor trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b

Threat Level: Known bad

The file a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b was found to be: Known bad.

Malicious Activity Summary

cobaltstrike 0 1359593325 backdoor trojan

Cobaltstrike

Executes dropped EXE

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates system info in registry

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-09-24 07:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-24 07:25

Reported

2023-09-24 07:27

Platform

win7-20230831-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2220 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe
PID 2220 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe
PID 2220 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe

"C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe

"C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe"

Network

Country Destination Domain Proto
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp

Files

memory/2220-0-0x0000000140000000-0x000000014048C000-memory.dmp

memory/2220-1-0x0000000140000000-0x000000014048C000-memory.dmp

memory/2220-2-0x0000000140000000-0x000000014048C000-memory.dmp

memory/2220-3-0x0000000140000000-0x000000014048C000-memory.dmp

memory/2220-4-0x0000000140000000-0x000000014048C000-memory.dmp

memory/2220-5-0x0000000140000000-0x000000014048C000-memory.dmp

\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe

MD5 0879240b4047e4dc87269f83721a2b28
SHA1 bbc682ee4d6bda2e3459acf729a27baaab73a182
SHA256 4ee8504d39d731716e84252271a61dcbe8ba12421cbf71f3bd5c5ecf3b4d7cf2
SHA512 07eeda2ac7afd18e0e886faad879c273d448d55e62f1a7560dfffaa3df58fb6a8c808c2e0abd09864430c4f5ce59a515edbb2edbaa1f74e67afaf05c22a446ee

\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\vcruntime140.dll

MD5 ade7aac069131f54e4294f722c17a412
SHA1 fede04724bdd280dae2c3ce04db0fe5f6e54988d
SHA256 92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76
SHA512 76a810a41eb739fba2b4c437ed72eda400e71e3089f24c79bdabcb8aab0148d80bd6823849e5392140f423addb7613f0fc83895b9c01e85888d774e0596fc048

C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\VCRUNTIME140.dll

MD5 ade7aac069131f54e4294f722c17a412
SHA1 fede04724bdd280dae2c3ce04db0fe5f6e54988d
SHA256 92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76
SHA512 76a810a41eb739fba2b4c437ed72eda400e71e3089f24c79bdabcb8aab0148d80bd6823849e5392140f423addb7613f0fc83895b9c01e85888d774e0596fc048

\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\python38.dll

MD5 c381edf39a0c3ed74f1df4a44fbab4ba
SHA1 688af6616d5f2f67ff9f49dc6790583825fb82ab
SHA256 f8c622753feb3cec062a535f2a285b17f6d118fee0bf8ed5a2f3d06ca53e729d
SHA512 88abc4ef225593e176050a6526b4873c08aca3b464616b502e64e7995368e82ec413cdf9e0bc8902994b2be25aa0aaf2e5135977599e57a0e8e1809f2b67eeec

C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\python38.dll

MD5 c381edf39a0c3ed74f1df4a44fbab4ba
SHA1 688af6616d5f2f67ff9f49dc6790583825fb82ab
SHA256 f8c622753feb3cec062a535f2a285b17f6d118fee0bf8ed5a2f3d06ca53e729d
SHA512 88abc4ef225593e176050a6526b4873c08aca3b464616b502e64e7995368e82ec413cdf9e0bc8902994b2be25aa0aaf2e5135977599e57a0e8e1809f2b67eeec

C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe

MD5 0879240b4047e4dc87269f83721a2b28
SHA1 bbc682ee4d6bda2e3459acf729a27baaab73a182
SHA256 4ee8504d39d731716e84252271a61dcbe8ba12421cbf71f3bd5c5ecf3b4d7cf2
SHA512 07eeda2ac7afd18e0e886faad879c273d448d55e62f1a7560dfffaa3df58fb6a8c808c2e0abd09864430c4f5ce59a515edbb2edbaa1f74e67afaf05c22a446ee

C:\Users\Admin\AppData\Local\Temp\onefile_2220_133400139180618000\bd1.exe

MD5 0879240b4047e4dc87269f83721a2b28
SHA1 bbc682ee4d6bda2e3459acf729a27baaab73a182
SHA256 4ee8504d39d731716e84252271a61dcbe8ba12421cbf71f3bd5c5ecf3b4d7cf2
SHA512 07eeda2ac7afd18e0e886faad879c273d448d55e62f1a7560dfffaa3df58fb6a8c808c2e0abd09864430c4f5ce59a515edbb2edbaa1f74e67afaf05c22a446ee

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

MD5 9755d3747e407ca70a4855bc9e98cfb9
SHA1 5a1871716715ba7f898afaae8c182bd8199ed60a
SHA256 213937a90b1b91a31d3d4b240129e30f36108f46589ba68cd07920ce18c572c2
SHA512 fb2d709b4a8f718c1ab33a1b65ac990052e3a5a0d8dd57f415b4b12bce95189397bfddb5fb3a7fc1776c191eb92fd28e3aaebbebdf1024ecd99e412376ca4467

\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

MD5 9755d3747e407ca70a4855bc9e98cfb9
SHA1 5a1871716715ba7f898afaae8c182bd8199ed60a
SHA256 213937a90b1b91a31d3d4b240129e30f36108f46589ba68cd07920ce18c572c2
SHA512 fb2d709b4a8f718c1ab33a1b65ac990052e3a5a0d8dd57f415b4b12bce95189397bfddb5fb3a7fc1776c191eb92fd28e3aaebbebdf1024ecd99e412376ca4467

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

memory/2408-24-0x0000000000140000-0x0000000000141000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab604B.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

memory/2220-41-0x0000000140000000-0x000000014048C000-memory.dmp

memory/2408-43-0x000000000B9A0000-0x000000000BDA0000-memory.dmp

memory/2408-42-0x000007FEF6D10000-0x000007FEF6DBC000-memory.dmp

memory/2408-44-0x000000013FDB0000-0x0000000140113000-memory.dmp

memory/2408-45-0x000007FEF6D10000-0x000007FEF6DBC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tar7D21.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

memory/2408-83-0x000000000B9A0000-0x000000000BDA0000-memory.dmp

memory/2408-85-0x000007FEF6D10000-0x000007FEF6DBC000-memory.dmp

memory/2408-166-0x000007FEF6D10000-0x000007FEF6DBC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-24 07:25

Reported

2023-09-24 07:27

Platform

win10v2004-20230915-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe"

Signatures

Cobaltstrike

trojan backdoor cobaltstrike

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\bd1.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\bd1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\bd1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\bd1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\bd1.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 216 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\bd1.exe
PID 216 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\bd1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe

"C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\bd1.exe

"C:\Users\Admin\AppData\Local\Temp\a6ddfe7eb1863581ddc6bbef1e28fffbace0c94168b622c0ae8afc6a62dd604b.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
CN 119.96.194.181:4466 outlook.live.com tcp
US 8.8.8.8:53 181.194.96.119.in-addr.arpa udp
CN 119.96.194.181:4466 outlook.live.com tcp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 outlook.live.com tcp
CN 119.96.194.181:4466 tcp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

memory/216-0-0x0000000140000000-0x000000014048C000-memory.dmp

memory/216-1-0x0000000140000000-0x000000014048C000-memory.dmp

memory/216-2-0x0000000140000000-0x000000014048C000-memory.dmp

memory/216-3-0x0000000140000000-0x000000014048C000-memory.dmp

memory/216-4-0x0000000140000000-0x000000014048C000-memory.dmp

memory/216-5-0x0000000140000000-0x000000014048C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\python38.dll

MD5 c381edf39a0c3ed74f1df4a44fbab4ba
SHA1 688af6616d5f2f67ff9f49dc6790583825fb82ab
SHA256 f8c622753feb3cec062a535f2a285b17f6d118fee0bf8ed5a2f3d06ca53e729d
SHA512 88abc4ef225593e176050a6526b4873c08aca3b464616b502e64e7995368e82ec413cdf9e0bc8902994b2be25aa0aaf2e5135977599e57a0e8e1809f2b67eeec

C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\bd1.exe

MD5 0879240b4047e4dc87269f83721a2b28
SHA1 bbc682ee4d6bda2e3459acf729a27baaab73a182
SHA256 4ee8504d39d731716e84252271a61dcbe8ba12421cbf71f3bd5c5ecf3b4d7cf2
SHA512 07eeda2ac7afd18e0e886faad879c273d448d55e62f1a7560dfffaa3df58fb6a8c808c2e0abd09864430c4f5ce59a515edbb2edbaa1f74e67afaf05c22a446ee

C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\python38.dll

MD5 c381edf39a0c3ed74f1df4a44fbab4ba
SHA1 688af6616d5f2f67ff9f49dc6790583825fb82ab
SHA256 f8c622753feb3cec062a535f2a285b17f6d118fee0bf8ed5a2f3d06ca53e729d
SHA512 88abc4ef225593e176050a6526b4873c08aca3b464616b502e64e7995368e82ec413cdf9e0bc8902994b2be25aa0aaf2e5135977599e57a0e8e1809f2b67eeec

C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\bd1.exe

MD5 0879240b4047e4dc87269f83721a2b28
SHA1 bbc682ee4d6bda2e3459acf729a27baaab73a182
SHA256 4ee8504d39d731716e84252271a61dcbe8ba12421cbf71f3bd5c5ecf3b4d7cf2
SHA512 07eeda2ac7afd18e0e886faad879c273d448d55e62f1a7560dfffaa3df58fb6a8c808c2e0abd09864430c4f5ce59a515edbb2edbaa1f74e67afaf05c22a446ee

C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\VCRUNTIME140.dll

MD5 ade7aac069131f54e4294f722c17a412
SHA1 fede04724bdd280dae2c3ce04db0fe5f6e54988d
SHA256 92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76
SHA512 76a810a41eb739fba2b4c437ed72eda400e71e3089f24c79bdabcb8aab0148d80bd6823849e5392140f423addb7613f0fc83895b9c01e85888d774e0596fc048

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

MD5 9755d3747e407ca70a4855bc9e98cfb9
SHA1 5a1871716715ba7f898afaae8c182bd8199ed60a
SHA256 213937a90b1b91a31d3d4b240129e30f36108f46589ba68cd07920ce18c572c2
SHA512 fb2d709b4a8f718c1ab33a1b65ac990052e3a5a0d8dd57f415b4b12bce95189397bfddb5fb3a7fc1776c191eb92fd28e3aaebbebdf1024ecd99e412376ca4467

C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\_ctypes.pyd

MD5 9755d3747e407ca70a4855bc9e98cfb9
SHA1 5a1871716715ba7f898afaae8c182bd8199ed60a
SHA256 213937a90b1b91a31d3d4b240129e30f36108f46589ba68cd07920ce18c572c2
SHA512 fb2d709b4a8f718c1ab33a1b65ac990052e3a5a0d8dd57f415b4b12bce95189397bfddb5fb3a7fc1776c191eb92fd28e3aaebbebdf1024ecd99e412376ca4467

C:\Users\Admin\AppData\Local\Temp\onefile_216_133400139195286680\vcruntime140.dll

MD5 ade7aac069131f54e4294f722c17a412
SHA1 fede04724bdd280dae2c3ce04db0fe5f6e54988d
SHA256 92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76
SHA512 76a810a41eb739fba2b4c437ed72eda400e71e3089f24c79bdabcb8aab0148d80bd6823849e5392140f423addb7613f0fc83895b9c01e85888d774e0596fc048

memory/1328-23-0x0000022887AF0000-0x0000022887AF1000-memory.dmp

memory/216-26-0x0000000140000000-0x000000014048C000-memory.dmp

memory/1328-27-0x00007FF6ABCF0000-0x00007FF6AC053000-memory.dmp

memory/1328-28-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-29-0x0000022887E20000-0x0000022888220000-memory.dmp

memory/1328-35-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-36-0x0000022887E20000-0x0000022888220000-memory.dmp

memory/1328-39-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-42-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-45-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-48-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-51-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-54-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-57-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-60-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-63-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-66-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp

memory/1328-69-0x00007FFD91B70000-0x00007FFD91BFD000-memory.dmp