Malware Analysis Report

2024-11-13 13:40

Sample ID 240614-b31hlstgqm
Target 470822d9688c7dbebfbdf0a27749a520.bin
SHA256 98cfa4a514a53938fe48a4cd1466acdac9cad38340cffbe755139dd69c6f5860
Tags
upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

98cfa4a514a53938fe48a4cd1466acdac9cad38340cffbe755139dd69c6f5860

Threat Level: Shows suspicious behavior

The file 470822d9688c7dbebfbdf0a27749a520.bin was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx

Loads dropped DLL

Executes dropped EXE

Deletes itself

UPX packed file

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: CmdExeWriteProcessMemorySpam

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 01:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 01:40

Reported

2024-06-14 01:43

Platform

win7-20240611-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File opened for modification C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1948 set thread context of 2648 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1628 set thread context of 1560 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\dllhost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\dllhost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\dllhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\dllhost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs1.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File created C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\dllhost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs1.ini C:\Windows\SysWOW64\dllhost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File opened for modification C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\dllhost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1948 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1948 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1948 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1948 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1948 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1948 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 2892 wrote to memory of 1628 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 2892 wrote to memory of 1628 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 2892 wrote to memory of 1628 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 2892 wrote to memory of 1628 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1628 wrote to memory of 1560 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\dllhost.exe
PID 1628 wrote to memory of 1560 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\dllhost.exe
PID 1628 wrote to memory of 1560 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\dllhost.exe
PID 1628 wrote to memory of 1560 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\dllhost.exe
PID 1628 wrote to memory of 1560 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\dllhost.exe
PID 1628 wrote to memory of 1560 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\dllhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe

"C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

C:\Windows\system32\cmd.exe

cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Windows\SysWOW64\dllhost.exe

C:\Windows\System32\dllhost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

Network

Country Destination Domain Proto
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp

Files

memory/1948-5-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-11-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-9-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-8-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-4-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-2-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-13-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-20-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-29-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-27-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-31-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-25-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-23-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-17-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-33-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-32-0x0000000000220000-0x0000000000275000-memory.dmp

memory/1948-15-0x0000000000220000-0x0000000000275000-memory.dmp

\Windows\SysWOW64\kernel64.dll

MD5 9b98d47916ead4f69ef51b56b0c2323c
SHA1 290a80b4ded0efc0fd00816f373fcea81a521330
SHA256 96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA512 68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

memory/1948-22-0x0000000000220000-0x0000000000275000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 5b85700764c7f8ed2db3d99aba090ff3
SHA1 89521db8d1abb29e082628efdd23c547fa54ef44
SHA256 ade5e3636e8684f5845c18666a04a6b22d7a0f2631ea268a1aec910857c42e24
SHA512 00600e12dc1067eba53760eedfc4f408e88053a87462d55f01478887a9b4095138d471cc186684f0c14f4c2559da978e0ef3f78341910ecf1ca8caac9f67a642

memory/2648-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2648-70-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2648-71-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2648-74-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2648-77-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA

MD5 f697e0c5c1d34f00d1700d6d549d4811
SHA1 f50a99377a7419185fc269bb4d12954ca42b8589
SHA256 1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512 d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

memory/2648-75-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2648-85-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-89-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-101-0x00000000000F0000-0x0000000000145000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

MD5 7172a23e7e8060e7cd167a832bec182f
SHA1 de84498a3da758d808860e1ac7306138f67d089a
SHA256 71118122eb60159b03ce3fb8a7884e86c9f916857ffe387c5277681f0d3062f7
SHA512 b1b81013b37a3ad46f4dbc9c6c1e28d29c38c5e1ee8c324cf95855a045e41262cc59f5e33c9e0163243a464b98e6d2a12817e2d5a96fdf704bdfff14883dcd39

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

MD5 a4ef93de80711124d4b7e080ccf42edb
SHA1 f4530f5e6d362781fa6dfa4982d25f3ad15dbf99
SHA256 9a09d2a2b23760cbc02ab362728b30783f943d90beebbdbd03c4e8b288492d24
SHA512 707c5a1a84a1cd490e3e0109c30b32724a69d27021653265bbd838065458e1eea20b470f145612f9ea5486711c47a59dcb515f9625829e63689a89af75901fa2

memory/2648-99-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-97-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-95-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-94-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-91-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-87-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-83-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-81-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-79-0x00000000000F0000-0x0000000000145000-memory.dmp

memory/2648-78-0x00000000000F0000-0x0000000000145000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

MD5 ebcf0bcf60b644befacfc8e40735600c
SHA1 d92b107ad66ceabeb4fa3f37691271798488a6a3
SHA256 bab0415fbdd7c8be8d09e0b1f7c294d43c64890b72537a67d331fa285eefd94d
SHA512 d1b29b7ef96c85991b5702081aaee39efd88248c7f71c1ce3fb5ebf8374ace09669866c78e2047f1d43076547e33631cfcd47771df10ab04d06bb60a1444b037

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

MD5 8b841eca5ac6ffae0da8bb0a9f3c6275
SHA1 41f08fdd83524ae6241674c083e15727b35e3236
SHA256 d62bdf68167974e608b0a04e28c048cc699bc1da7dd7eb7df8d239ef06c5bdac
SHA512 1b04bb5f1edb9a1e237eb7a2bfa1c97ffe91b07bc20326d8b6d5bdcf3d405351b1e917a02467f08ec1adb7b10b30b71a8e576621553c91b3a1e253d3eb515451

memory/1560-172-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2648-223-0x0000000000400000-0x000000000042D000-memory.dmp

memory/1560-224-0x0000000000400000-0x000000000042D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 01:40

Reported

2024-06-14 01:43

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File created C:\Windows\SysWOW64\kernel64.dll C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1300 set thread context of 4436 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1044 set thread context of 4492 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs1.ini C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Windows\SysWOW64\svchost.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
File opened for modification C:\Windows\web\606C646364636479.tmp C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
N/A N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1300 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1300 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1300 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1300 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1300 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1300 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1300 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 1300 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe C:\Windows\SysWOW64\svchost.exe
PID 2388 wrote to memory of 1044 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 2388 wrote to memory of 1044 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 2388 wrote to memory of 1044 N/A C:\Windows\system32\cmd.exe C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
PID 1044 wrote to memory of 4492 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1044 wrote to memory of 4492 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1044 wrote to memory of 4492 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1044 wrote to memory of 4492 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe
PID 1044 wrote to memory of 4492 N/A C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe

"C:\Users\Admin\AppData\Local\Temp\470822d9688c7dbebfbdf0a27749a520.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

C:\Windows\system32\cmd.exe

cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840

C:\Windows\SysWOW64\svchost.exe

C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.bjbflt.com udp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.web35370.bjl002.vhost007.cn udp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 43.43.201.23.in-addr.arpa udp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
CN 114.118.11.2:80 www.web35370.bjl002.vhost007.cn tcp
N/A 127.0.0.1:8080 tcp
US 8.8.8.8:53 www.lfmpw.com udp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
N/A 127.0.0.1:8080 tcp
CN 123.56.127.108:80 www.bjbflt.com tcp
N/A 127.0.0.1:8080 tcp

Files

memory/1300-7-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-13-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-31-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-33-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-32-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-30-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-27-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-25-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-23-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-19-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-17-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-15-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-11-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-9-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-21-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-2-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-5-0x00000000021E0000-0x0000000002235000-memory.dmp

memory/1300-3-0x00000000021E0000-0x0000000002235000-memory.dmp

C:\Windows\SysWOW64\kernel64.dll

MD5 eccf28d7e5ccec24119b88edd160f8f4
SHA1 98509587a3d37a20b56b50fd57f823a1691a034c
SHA256 820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512 c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 6fc8c3a45f282558e52cfd6de5611865
SHA1 d5ac64c2e1c9765f9a8c7ba8ff3fadfc745db090
SHA256 7b3c7bca6abe91aac4feb76156237890b17d55c8020c0f99632aae9192119da4
SHA512 48d7fb2c46c931ea802d55149246d8716f3113f7ed11f79216b4fc5c9c8723d1ea494f6afd549b72b40b8e481ed6bfc079f7d504c9fa0556e81002996c722c84

C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 2c7262495edb225253caae800a7dd8fb
SHA1 450ee8c561cf873b6c1ea49b18eb83d9b4c15e06
SHA256 ada20fbf4d83dc428cc0526f05605c99f0e82e50381246e828dbd9b8dddad7fd
SHA512 cb73d3f3eee7014eb96c2d2226d0cfce83fb31af5c5f4557520320b6f39a1ae28caaf71750ba9983493cc6096af8564abb2c38a4fc4b24feee730ba7b516ae1d

C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

MD5 1ee1be9a3bb465533e2d52548122f88f
SHA1 7fe7cfe087a4e09e663ea79a4b0a033b89d611df
SHA256 907e129d252bafaf2a95dab13221ad4d60ff803334a6668cd1e2130f955513ef
SHA512 8e9ddbf032777844cbe26cc2cc3c522a408a1d699aeb1216f77b626deb4a813cf7baa5d81968d0138abd7df7627faf50db11dc28a3e8d62ed1096e53a64b7d1e

C:\Windows\Web\606C646364636479.tmp

MD5 f697e0c5c1d34f00d1700d6d549d4811
SHA1 f50a99377a7419185fc269bb4d12954ca42b8589
SHA256 1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512 d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

memory/4436-97-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4436-100-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4436-101-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4436-103-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4436-113-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-115-0x0000000002970000-0x00000000029C5000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

MD5 7172a23e7e8060e7cd167a832bec182f
SHA1 de84498a3da758d808860e1ac7306138f67d089a
SHA256 71118122eb60159b03ce3fb8a7884e86c9f916857ffe387c5277681f0d3062f7
SHA512 b1b81013b37a3ad46f4dbc9c6c1e28d29c38c5e1ee8c324cf95855a045e41262cc59f5e33c9e0163243a464b98e6d2a12817e2d5a96fdf704bdfff14883dcd39

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

MD5 a4ef93de80711124d4b7e080ccf42edb
SHA1 f4530f5e6d362781fa6dfa4982d25f3ad15dbf99
SHA256 9a09d2a2b23760cbc02ab362728b30783f943d90beebbdbd03c4e8b288492d24
SHA512 707c5a1a84a1cd490e3e0109c30b32724a69d27021653265bbd838065458e1eea20b470f145612f9ea5486711c47a59dcb515f9625829e63689a89af75901fa2

memory/4436-131-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-129-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-125-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-123-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-121-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-119-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-117-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-127-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-111-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-109-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-108-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-106-0x0000000002970000-0x00000000029C5000-memory.dmp

memory/4436-104-0x0000000002970000-0x00000000029C5000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg

MD5 016daa1ef7f61d3144acb073eab9feb4
SHA1 94e183afc34e31bb124845d6dcdbaa24f407ad41
SHA256 902ba77198b933233ef79a1cd95fb7c13c1a0520cae2a580d3830b538cec3a4d
SHA512 8611086f1551236d86a857939eb357792581d8c6a1307776bba0e209fc3b4c040dc5aeadf523e9711eb781575e8f96abf4a3d00c4a39935c213498d12cd490e6

C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

MD5 bba40037af48d18d2743640b8f98bedc
SHA1 17f2f5d2beca3e9630a68c0e4d381a599f24da6a
SHA256 b791fc62e0a3b6eb35ed165855bbf8518b2b0329bc0ec3a65627e4dba9987fbb
SHA512 3e3a148652935f3972566d934e01817235a2762116c2a675a23ec85f8401ac3b800b833705f3277c4e57e2e8bc7065aefefb33fbf62bbf2344d01578fc5584b7

C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

MD5 1dbf87366c580760f9843f56c4082ea8
SHA1 bc77fdb76c59e583a2d7fa8587ef4ed0b94ebc39
SHA256 8ff85e81cc1071436214abae02d093e77c37a5bd0c0962947a812dd504f3c3d2
SHA512 7ce60082592c76135af02197f9334e17b759f36f25c0b017772ec4ca1bd3303f49fad68458e9e0afd25727f8ba565a45fde6166a29c9dc62486c733e6ac426c7

memory/4492-197-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4436-245-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4492-246-0x0000000000400000-0x000000000042D000-memory.dmp