Malware Analysis Report

2025-08-11 01:35

Sample ID 231207-s5np9sda29
Target 69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae
SHA256 69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae
Tags
upx vmprotect
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae

Threat Level: Likely malicious

The file 69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae was found to be: Likely malicious.

Malicious Activity Summary

upx vmprotect

Drops file in Drivers directory

VMProtect packed file

Unexpected DNS network traffic destination

UPX packed file

Checks computer location settings

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious behavior: LoadsDriver

Suspicious use of UnmapMainImage

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-07 15:42

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-07 15:42

Reported

2023-12-07 15:48

Platform

win7-20231130-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 223.5.5.5 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\err_2404.log C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe

"C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 de108ad81976e232.vbnm34567.xyz udp
US 114.114.114.114:53 down.magiforet.cn udp
CN 122.189.171.115:443 down.magiforet.cn tcp
CN 122.189.171.115:443 down.magiforet.cn tcp
US 8.8.8.8:53 dns.alidns.com udp
CN 223.5.5.5:443 dns.alidns.com tcp
US 8.8.8.8:53 www.microsoft.com udp
CN 223.5.5.5:80 dns.alidns.com tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 114.114.114.114:53 down.zhangyaping.top udp
CN 223.5.5.5:53 dns.alidns.com udp
US 8.8.8.8:53 down.zhangyaping.top udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 yzzcommon.tyui54345.xyz udp
US 114.114.114.114:53 udp

Files

memory/2404-0-0x0000000000870000-0x00000000008FC000-memory.dmp

memory/2404-3-0x0000000000870000-0x00000000008FC000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarB5AE.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 acaf413588493dc7baca941c372f8988
SHA1 a3b8452c2d7c3c85e840a302378b5326fbb3b473
SHA256 49d41b33e3f0949c0f466a69199400a17314cdd28ffcbcb55c9621e6c6bc3829
SHA512 1cdf78b6520ddfa6508fdef8897d68e377d46982ddc55fe20c00586f9d33dcee9b4b17c6d0680f55d351ca8761d097dfed076e2fe7b294a63c6c9562a038c231

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

memory/2404-149-0x0000000000870000-0x00000000008FC000-memory.dmp

memory/2404-444-0x0000000000870000-0x00000000008FC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-07 15:42

Reported

2023-12-07 15:48

Platform

win10v2004-20231127-en

Max time kernel

157s

Max time network

160s

Command Line

winlogon.exe

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\U7FeZz7.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\sS5ZoA1ifV.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\hZb9AQdBmHkp.xdu C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\LPGk0Hb8rmp27Z.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\d4QGIyINeZ8G4.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\SplkBSckZsEg.aoz C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\Py19ciuUE4MMIn.rqt C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\bmGHlwiwASffI.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\drivers\xIoIDSzkrhwl.xzr C:\Windows\Explorer.EXE N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 223.5.5.5 N/A N/A
Destination IP 114.114.114.114 N/A N/A
Destination IP 114.114.114.114 N/A N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\2IKhi9fq3x.ooa C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\sER2c8anygtj.atm C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\u21MpWXh2eeRWT.uhi C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\ePir2f8ynV1TeW.niw C:\Windows\Explorer.EXE N/A
File created C:\Windows\system32\ \Windows\System32\1mLvviJ.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\9mmF3MUER0qz.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\eGf2J6oAw4.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\mTZayFsjlcN.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\system32\R5CgfXmsbeU.sys C:\Windows\Explorer.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\MSBuild\manifest.json C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\MSBuild\lib\646f0627.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\mSZyp7kzpXBPqO.bpm C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\9NJKE76RPKnw.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\1u3CT0fPoC1K.btq C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\f5CUCniPrF.wvq C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\mA9B9YaOsNqC.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\oo7DsU97NXz6.exr C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\HZPUle5Qr9.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\MSBuild\47bd0465.html C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\DmwFLupC8fKkMA.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\3ZGvGLhEEsFI.pgi C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\MSBuild\56160546.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\wWeYyGqo3ygx.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\ScXObMqnfU5M.zet C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\ZrJg9IsJ3zDZJ.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\MSBuild\39640384.js C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\GOmOqlVX0q.bzb C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\js5DAENaJnVmL.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files\2godp7kif8g.uce C:\Windows\Explorer.EXE N/A
File opened for modification C:\Program Files (x86)\SjnmwrU38Ot1.sys C:\Windows\Explorer.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\err_4100.log C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
File created C:\Windows\lngYHck.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\YM5fwb9xAIGSt5.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\ZleNaTtsqI.qfz C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\mzwlAIbYfbMcs.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\dzwHPKqrXh0.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\Po73k5EZf0z2n.wmo C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\82GdkTtyV4JR.sys C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\HjXmILXUrL3.tno C:\Windows\Explorer.EXE N/A
File opened for modification C:\Windows\XYanE8zcuv2.iko C:\Windows\Explorer.EXE N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\Explorer.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\Explorer.EXE N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\Explorer.EXE N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeBackupPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\dwm.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\dwm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4100 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\Explorer.EXE
PID 4100 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\Explorer.EXE
PID 4100 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\Explorer.EXE
PID 4100 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\Explorer.EXE
PID 4100 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\Explorer.EXE
PID 4100 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\system32\winlogon.exe
PID 4100 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\system32\winlogon.exe
PID 4100 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\system32\winlogon.exe
PID 4100 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\system32\winlogon.exe
PID 4100 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\system32\winlogon.exe
PID 4100 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\SysWOW64\cmd.exe
PID 4100 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\SysWOW64\cmd.exe
PID 4100 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe C:\Windows\SysWOW64\cmd.exe
PID 724 wrote to memory of 4048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 724 wrote to memory of 4048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 724 wrote to memory of 4048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3376 wrote to memory of 1012 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3376 wrote to memory of 1012 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3376 wrote to memory of 1012 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3376 wrote to memory of 1012 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3376 wrote to memory of 1012 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe
PID 3376 wrote to memory of 1012 N/A C:\Windows\Explorer.EXE C:\Windows\system32\dwm.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe

"C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\69e17a9252a663a2a70b7827651c9591c7ac8d088fae572ced13a2350a29c0ae.exe"

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

Network

Country Destination Domain Proto
US 8.8.8.8:53 250.194.19.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 155.245.36.23.in-addr.arpa udp
US 8.8.8.8:53 de108ad81976e232.vbnm34567.xyz udp
US 114.114.114.114:53 down.magiforet.cn udp
US 8.8.8.8:53 114.114.114.114.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
CN 122.189.171.115:443 down.magiforet.cn tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 115.171.189.122.in-addr.arpa udp
US 8.8.8.8:53 dns.alidns.com udp
CN 223.5.5.5:443 dns.alidns.com tcp
US 8.8.8.8:53 5.5.5.223.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 114.114.114.114:53 down.zhangyaping.top udp
CN 223.5.5.5:53 dns.alidns.com udp
US 8.8.8.8:53 down.zhangyaping.top udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 114.114.114.114:53 down.hjkl45678.xyz udp
CN 122.246.12.168:443 down.hjkl45678.xyz tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.tyui54345.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 f0b526d3a42e13ea.zxcv56745.xyz udp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
CN 223.5.5.5:443 dns.alidns.com tcp
CN 223.5.5.5:80 dns.alidns.com tcp
US 8.8.8.8:53 192.240.110.104.in-addr.arpa udp
US 8.8.8.8:53 yzzcommon.tyui54345.xyz udp
US 114.114.114.114:53 down.nugong.asia udp
CN 110.249.196.101:443 down.nugong.asia tcp
US 8.8.8.8:53 101.196.249.110.in-addr.arpa udp
US 8.8.8.8:53 down.nugong.asia udp
CN 42.231.136.215:80 down.nugong.asia tcp
CN 42.231.136.215:80 down.nugong.asia tcp
CN 42.231.136.215:80 down.nugong.asia tcp
CN 110.249.196.101:443 down.nugong.asia tcp
US 8.8.8.8:53 apps.game.qq.com udp
CN 101.227.134.49:443 apps.game.qq.com tcp
US 8.8.8.8:53 215.136.231.42.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 ocsp.trust-provider.cn udp
CN 117.27.246.96:80 ocsp.trust-provider.cn tcp
US 8.8.8.8:53 ocsp.digicert.cn udp
NL 47.246.48.205:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 sp1.baidu.com udp
US 8.8.8.8:53 49.134.227.101.in-addr.arpa udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 205.48.246.47.in-addr.arpa udp
US 8.8.8.8:53 96.246.27.117.in-addr.arpa udp
US 104.193.88.77:443 sp1.baidu.com tcp
US 8.8.8.8:53 77.88.193.104.in-addr.arpa udp
CN 42.231.136.215:80 down.nugong.asia tcp
CN 42.231.136.215:80 down.nugong.asia tcp
CN 42.231.136.215:80 down.nugong.asia tcp
CN 42.231.136.215:80 down.nugong.asia tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
N/A 234.2.2.2:27878 udp
N/A 233.123.112.211:17181 udp
US 8.8.8.8:53 2.2.2.234.in-addr.arpa udp
US 8.8.8.8:53 211.112.123.233.in-addr.arpa udp
CN 42.231.136.215:80 down.nugong.asia tcp
CN 42.231.136.215:80 down.nugong.asia tcp
CN 42.231.136.215:80 down.nugong.asia tcp
CN 42.231.136.215:80 down.nugong.asia tcp
CN 42.231.136.215:80 down.nugong.asia tcp
US 8.8.8.8:53 nreprot.nugong.asia udp
US 8.8.8.8:53 b2rpt.hjkl45678.xyz udp
CN 42.231.136.215:80 nreprot.nugong.asia tcp
CN 42.192.71.187:8088 b2rpt.hjkl45678.xyz tcp
CN 110.249.196.101:443 nreprot.nugong.asia tcp
CN 42.231.136.215:80 nreprot.nugong.asia tcp
CN 42.231.136.215:80 nreprot.nugong.asia tcp
US 8.8.8.8:53 187.71.192.42.in-addr.arpa udp
US 8.8.8.8:53 mprrpt.nugong.asia udp
CN 42.231.136.215:80 mprrpt.nugong.asia tcp
CN 42.231.136.215:80 mprrpt.nugong.asia tcp
CN 58.144.226.248:443 mprrpt.nugong.asia tcp
US 8.8.8.8:53 248.226.144.58.in-addr.arpa udp
US 8.8.8.8:53 9.195.19.2.in-addr.arpa udp
US 8.8.8.8:53 249.194.19.2.in-addr.arpa udp
US 8.8.8.8:53 43.77.123.92.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

memory/4100-0-0x0000000000890000-0x000000000091C000-memory.dmp

memory/4100-11-0x0000000000890000-0x000000000091C000-memory.dmp

memory/4100-17-0x0000000000890000-0x000000000091C000-memory.dmp

memory/4100-20-0x0000000000890000-0x000000000091C000-memory.dmp

memory/3376-24-0x0000000000CA0000-0x0000000000CA3000-memory.dmp

memory/3376-26-0x0000000000CA0000-0x0000000000CA3000-memory.dmp

memory/3376-28-0x0000000000CA0000-0x0000000000CA3000-memory.dmp

memory/3376-29-0x0000000008390000-0x0000000008441000-memory.dmp

memory/3376-27-0x0000000008390000-0x0000000008441000-memory.dmp

memory/3376-31-0x00007FF895960000-0x00007FF895970000-memory.dmp

memory/3376-30-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

memory/620-34-0x00000184E2480000-0x00000184E24A8000-memory.dmp

memory/620-35-0x00000184E24C0000-0x00000184E24C1000-memory.dmp

memory/4100-43-0x0000000000890000-0x000000000091C000-memory.dmp

memory/4100-68-0x0000000000890000-0x000000000091C000-memory.dmp

memory/3376-69-0x00007FF895960000-0x00007FF895970000-memory.dmp

memory/3376-70-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

memory/3376-71-0x00007FF7036D0000-0x00007FF7036D1000-memory.dmp

memory/3376-72-0x0000000008390000-0x0000000008441000-memory.dmp

memory/3376-74-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

memory/3376-73-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

memory/3376-78-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

memory/3376-77-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

memory/3376-76-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

memory/3376-75-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

memory/620-79-0x00000184E2480000-0x00000184E24A8000-memory.dmp

memory/3376-81-0x0000000008EB0000-0x0000000008F5F000-memory.dmp

C:\Windows\82GdkTtyV4JR.sys

MD5 d15f5f23df8036bd5089ce8d151b0e0d
SHA1 4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256 f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512 feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

C:\Windows\YM5fwb9xAIGSt5.sys

MD5 b1e7c4de63a2c140e8fa7587ed419df4
SHA1 e7d49903edbb94e55a33342fb8bfc0f93393c311
SHA256 fdab20951de2e1e0f962d7a69a16f2f58e680b94b4b3de492fa3b8759cd26fb7
SHA512 c1871dca63679fdb87c9285fd0181a8f1d28152401700ad0035360512f4c12755909b5c5183288b8795a45cdc1d888ef4ecb338b93e3ae66ce1c8803c7e94acd

C:\Windows\mzwlAIbYfbMcs.sys

MD5 64bc1983743c584a9ad09dacf12792e5
SHA1 0f14098f523d21f11129c4df09451413ddff6d61
SHA256 057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA512 9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

C:\Windows\dzwHPKqrXh0.sys

MD5 e179596389b3702069974c7874582da7
SHA1 ab682eda3200c0c25547fe2e41aa06bafc44a7e5
SHA256 16a1c8883671c158ddda399a6abdd0978c33975542e3ad76de830e306b160f12
SHA512 be87433a0b0dc11bced4763b614325b3c2d51f391a682af067406e572e6172a75fcd2030d7cb0445db22eceece44869185a89d0d0c5f6ba2233bca09fe9fa987

memory/3376-193-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

MD5 0a38657816f619c5e9b0ad5348a4fd2d
SHA1 d2934dadb324225b475564ca6e5d66a5567a5bbc
SHA256 130270d62ca1374d32cc0bae4b06b7c404c8267821a50196daaa396344682130
SHA512 7e9614021720a063e7a7fa941c1119c2550360650897e22462252d7d9b1e3fa90d9919893aa0231cb241ecab8014bbb004eedffda33596d9e78611390c334bcb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

MD5 9ba47a279b7950e198b6076171704bd8
SHA1 2d40167fb1cffc590d18f00b6ae5a22a7ba2bcab
SHA256 1d855e013b588989a67757730de9fef0ae45fba49359eeeb9ca7ce03089f75c6
SHA512 d048eb90cc64e568aa36c857a19ab9d4ebbb829716ec397d91fe92ab7cf0e5addbb2928cabfdec043ed46db02b2705a079668184474c08f5e7e57d58122d83c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 b3e886f0a26b67c1234b30c755341758
SHA1 8a881fb559672e95834def740fc5ba017879b0db
SHA256 808b71ea8048ef6e5014fbd1dedbd496516bf963107c8dff13a53d807c60686f
SHA512 66f612ae244a65d623617290f58bd01b8db16fcb98d9b60dca78adc7b2371bfff0ad03dbb244def434e8f243efcef37337a39a30871c64dcd1f6db6e57f50524

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 cd461e7af7c0feaf7b1a2d7c2e092260
SHA1 c2fbfa21d16ee7cf445e4bb6d3d93cf897f0e6b9
SHA256 a2d70cf14d2cc82b0939906a572d6b1aad9cecb564ffb3e31a79b2f05e283ef9
SHA512 a01efb2fd486fba95101f03b98b861172fafa25c0c0db341047922cca001f9663fd1e6d70588a8c8a224ebdb707e334746b362f425a2961ee7db9f76972f5135

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DED9969D7ED2C6E555C5C9254A43EDE4

MD5 3fefedd2d651734aab0aff2f8161db56
SHA1 eda0d013d0db080e6477965234bf4db2aceb215e
SHA256 4a2a561a396876d9ef6387f7f5394313a82d06945aae92d672a39b3db8cc5f01
SHA512 0ac825bf61b063f64e93eb4638ebeb63457309068e8a8ac27ea15b79c0ae7968ec1db6df757d74d9350abfd262d2a834ab54ee47f8d04dbb6451f7133072a56e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4

MD5 ecbd6d4a03dacc3156cf4f73118415ca
SHA1 391c30392f5786820a728749c5a89ded447d3100
SHA256 5381ced44ac6caffdc14c7f261626dec00286ac721604d7ba22c04779554661a
SHA512 1aa67b3ea9d15658a54f9e28c1294b8d2682893dc88eea8e6cfbbe67458caa44ee9d219532a94e10b532e7f0f395a7d22fb57f2fbc02d10db1a9443c391deb5a

memory/3376-200-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

memory/1012-201-0x0000017F1E330000-0x0000017F1E333000-memory.dmp

memory/3376-202-0x0000000002870000-0x0000000002871000-memory.dmp

memory/1012-203-0x0000017F1E330000-0x0000017F1E333000-memory.dmp

memory/1012-204-0x0000017F1E350000-0x0000017F1E3FF000-memory.dmp

memory/1012-205-0x0000017F1E410000-0x0000017F1E510000-memory.dmp

memory/1012-206-0x0000017F1E510000-0x0000017F1E511000-memory.dmp

memory/3376-207-0x0000000008FF0000-0x0000000008FF4000-memory.dmp

memory/3376-208-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

memory/3376-209-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

memory/3376-210-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

memory/3376-211-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

memory/3376-212-0x0000000008EB0000-0x0000000008F5F000-memory.dmp

memory/1012-213-0x0000017F1E350000-0x0000017F1E3FF000-memory.dmp

memory/1012-214-0x0000017F1E410000-0x0000017F1E510000-memory.dmp