Malware Analysis Report

2024-09-23 11:19

Sample ID 240615-krhcbsxhnp
Target MBROverWrite.exe
SHA256 0a9278fdc1ab7e2dc78820324bf0ddf72c2af05ae5e571ecab3b44faa507ba4c
Tags
pyinstaller bootkit persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

0a9278fdc1ab7e2dc78820324bf0ddf72c2af05ae5e571ecab3b44faa507ba4c

Threat Level: Shows suspicious behavior

The file MBROverWrite.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller bootkit persistence

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Detects Pyinstaller

Unsigned PE

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-15 08:49

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 08:49

Reported

2024-06-15 08:50

Platform

win10-20240404-en

Max time kernel

11s

Max time network

13s

Command Line

"C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe N/A
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3532 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe
PID 3532 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe

Processes

C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe

"C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe"

C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe

"C:\Users\Admin\AppData\Local\Temp\MBROverWrite.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0 /state0:0xa3aef855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI35322\ucrtbase.dll

MD5 ce61d777d8b6e98f1b85c54e8ccbadd7
SHA1 f3edb1780c3d0bf6603687f14716aef4fd25fb03
SHA256 c74c386223cca6096c17828add7c13e25525c1653fa05261c36782b287e9fe66
SHA512 917f2a70ffbcd7178b5a4724aefed95b02b819d867e59468a438178295959de4372e00bc6a338b60f82b296d91f1528a76778a55d239a321aecd10ea5a85eb82

C:\Users\Admin\AppData\Local\Temp\_MEI35322\python310.dll

MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

C:\Users\Admin\AppData\Local\Temp\_MEI35322\VCRUNTIME140.dll

MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

C:\Users\Admin\AppData\Local\Temp\_MEI35322\base_library.zip

MD5 6f0a29080b69f3ad0dfc4ecefe555ed1
SHA1 75a0bb740df70981f0a851fca1977d2eefdddcd8
SHA256 94b6a6c8cf8e3ecb691abf433663fe94738515656ceabe7a1177628a0af29fae
SHA512 30f9665f9da697099cd5d5b116006bd4bf402ec3777b419adbaa9665fc1a5cf170c08dd1093898cedbfa08573f83230a029a5296a95293f86343987b2f45ef77

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-file-l1-2-0.dll

MD5 41e8fa0ea82e40f56648b1c58a9ad763
SHA1 1ab6cafa7fb8435e8d0315e1e3e202a48d8fb4b0
SHA256 7509e30d7156b6a480a85280445674cc4ac64bbb8e8180b3d0f479d5edc0ce60
SHA512 6e00cec61c6fc19860175b47c201ad77c4af2bbad368a71d1a1bc94c972cfa25b7e449bb0dac36390a7c6235309cec23337d5f0eba659fa4b6a5dd3c190a799b

C:\Users\Admin\AppData\Local\Temp\_MEI35322\_socket.pyd

MD5 5dd51579fa9b6a06336854889562bec0
SHA1 99c0ed0a15ed450279b01d95b75c162628c9be1d
SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
SHA512 7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e

\Users\Admin\AppData\Local\Temp\_MEI35322\win32\win32file.cp310-win_amd64.pyd

MD5 b072a060b722dbbbea8d515ace5693ee
SHA1 40cdb40fe389a5532fe664992d56502fa2baf1c9
SHA256 3d1114dd79f63cb4ce72255acf401a23159055f1ca6fa6788fbcf57571b00fe9
SHA512 102a38c850c561ccebda7de4ddc45da6a86fb06ac5c8d60af99340c4895aa1b0a4eb93a17080d8218c933984ec4cb3c4ebde2cb6b63d9cf2f2d0da574b2586f4

C:\Users\Admin\AppData\Local\Temp\_MEI35322\pywin32_system32\pywintypes310.dll

MD5 9276c55377d441371d4e88f4b9e63fa6
SHA1 29c24b4b5a183a1e60b4d0699de39c4c8d2f177c
SHA256 b4ba4c5a120023f4dabaa5b866f6c1f5e2219929126e939e7fc5c7808a9a5e3f
SHA512 aa364643597e3331379b4e8552689c61abfa3a5adff8f3b22a079893dd66573cffe94d90d61b54850f31ae8b6b5603ebe150585a69d45704977e7cf02ab398a6

\Users\Admin\AppData\Local\Temp\_MEI35322\win32\win32gui.cp310-win_amd64.pyd

MD5 bcc5c333ad525a7b8c2321e839d12868
SHA1 6b3616af382a2b96370ae72d4e608dc365df93a3
SHA256 d228b1b8f31785d1ee2594c1d275899c005db0f729e3c006b52364da8ca1a764
SHA512 38da68102acd8009114fd18999fa717de4f6f692fac7bd929a140f07922c734c92a6f1dfd6d359f1750f86e0564870d3d1a92a0863e22ed816068ade27867e64

\Users\Admin\AppData\Local\Temp\_MEI35322\win32\win32api.cp310-win_amd64.pyd

MD5 e1f682af0b6da784c0dd3fef2c590d14
SHA1 161069fc654ee9b8bb1b523fac07db5e3a424010
SHA256 4235d9dbd64509c978d7898c17c692ae65df3b80257d6a8d8b83b96a8c2004ab
SHA512 de8a1302bc7468549e13d6a6ae11d8ef6d0748cd7e6ce2cfea6b3cee41541a8262c10c46fc4ecfdc44fafd7366312dc93379fbe8f2181429aa922cdc6c23c10a

C:\Users\Admin\AppData\Local\Temp\_MEI35322\_lzma.pyd

MD5 5a77a1e70e054431236adb9e46f40582
SHA1 be4a8d1618d3ad11cfdb6a366625b37c27f4611a
SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
SHA512 3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635

C:\Users\Admin\AppData\Local\Temp\_MEI35322\_hashlib.pyd

MD5 cfb9e0a73a6c9d6d35c2594e52e15234
SHA1 b86042c96f2ce6d8a239b7d426f298a23df8b3b9
SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
SHA512 22a5fd139d88c0eee7241c5597d8dbbf2b78841565d0ed0df62383ab50fde04b13a203bddef03530f8609f5117869ed06894a572f7655224285823385d7492d2

C:\Users\Admin\AppData\Local\Temp\_MEI35322\_decimal.pyd

MD5 1cdd7239fc63b7c8a2e2bc0a08d9ea76
SHA1 85ef6f43ba1343b30a223c48442a8b4f5254d5b0
SHA256 384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690
SHA512 ba4e19e122f83d477cc4be5e0dea184dafba2f438a587dd4f0ef038abd40cb9cdc1986ee69c34bac3af9cf2347bea137feea3b82e02cca1a7720d735cea7acda

C:\Users\Admin\AppData\Local\Temp\_MEI35322\_bz2.pyd

MD5 b45e82a398713163216984f2feba88f6
SHA1 eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839
SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
SHA512 b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8

C:\Users\Admin\AppData\Local\Temp\_MEI35322\unicodedata.pyd

MD5 a40ff441b1b612b3b9f30f28fa3c680d
SHA1 42a309992bdbb68004e2b6b60b450e964276a8fc
SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
SHA512 5f9142b16ed7ffc0e5b17d6a4257d7249a21061fe5e928d3cde75265c2b87b723b2e7bd3109c30d2c8f83913134445e8672c98c187073368c244a476ac46c3ef

C:\Users\Admin\AppData\Local\Temp\_MEI35322\select.pyd

MD5 78d421a4e6b06b5561c45b9a5c6f86b1
SHA1 c70747d3f2d26a92a0fe0b353f1d1d01693929ac
SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
SHA512 83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012

C:\Users\Admin\AppData\Local\Temp\_MEI35322\libcrypto-1_1.dll

MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

C:\Users\Admin\AppData\Local\Temp\_MEI35322\boot.bin

MD5 85e460a876e53160dd35cdcccaff8a40
SHA1 97bdece911ce89174554d4300a2fb1302d09679f
SHA256 2c9afe88209bf866599afc7edbfb7904332a83c0ba625c32fee9d65a88e5004f
SHA512 cfe8cc1936f5b32ea3f71d0a6097b7d95711ee1389b0080f25fe9393bd74e1eea2eaae31728c20a1c245a84c4c47ef179154f5c1c498527a7f60bab1660c5c52

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-utility-l1-1-0.dll

MD5 60c166a938da05283bde44d5f7dd40f2
SHA1 c235297c63c52619b8f0fc90ee3614838a9535bc
SHA256 39bc6a28f3522f33ba1fa4077e44bdeb1e4188d76e85373de6a233c9eb238eb0
SHA512 2d7ba5bfe54c6ae6c79f9082c01fd488e7d4316a9324e3b28154375e04cc37c44ced7f357ef35df50064cdcbf455c67552642e709b369d018be9897df51dd264

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-time-l1-1-0.dll

MD5 bbd056d0c704c2ed609826debd3e3070
SHA1 51b010d8e7a59529ad55538a76e52db4f3c65b55
SHA256 6692692fa9f0fb312474c3150a51893a98f254c64b42140b157829a6a7b2e2f0
SHA512 638fc0ac81dda4f3bcac2cfabb1cfdb6807d8b166ba9734bdd06aa858bbe9eaa7f601d012bbf812737ddb91f5133c1186f185fbd9b5ab8010be7cae8f0beaf3f

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-string-l1-1-0.dll

MD5 20fce027b3c775661e78b474f09123f1
SHA1 f3b3aeade900d455f07e9a647a50c7019923dfa0
SHA256 1ac5214032320ce22380587c2e04217c2e763676fe26e505a242f290874d9b1c
SHA512 b946da8811a1014836c7a3fcb784dce3e8319cf1ed5721d93d40be63cf98ff9f721e4b3535f349f5949f048eb53aea239f3c30a719928f87ef900e88665d0562

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-stdio-l1-1-0.dll

MD5 daf5dcd1863ac995028cf4fe0e697c46
SHA1 b99b38ebd266a3b95cf835bc0d00390f8a7892c9
SHA256 545ec8a4978ab553f6f37a92655670c7053c8899ef8f80d5bd888ca9c6604eef
SHA512 cc280391d588fb1c19d675ecbbbd9ad033a686306c177363cc5a046d6e79acb8a2c09b78abe298f7d1801c4e19bdfbd8a2f0de1306f3884be462f5aceb9d10d5

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-runtime-l1-1-0.dll

MD5 5711c92d207146c56293c13d70921f4b
SHA1 a54c1e920407c80231318ef4f6e1376bd37e29be
SHA256 f56272d5ba88098cba75b6fddbfdf66c972c70c2ca474a01a8fb6004b28e9cd2
SHA512 9c2e6fec4177a87f5f1b0675e8d62ee5c0b926049f44b2c132b2437897f9958247ffd653c872775be4aeba615814fa2341cd286b92da94361b6ede6fcfcf9528

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-process-l1-1-0.dll

MD5 9822f49b501f00501fe9f0e7e65a63b1
SHA1 9d0e209fd0e26dda1a366e7bf56f5c928e96c316
SHA256 b5c7055d1caa8fc3426991de5d379958fd80a56ce38d1bc24e393e7d19f022e3
SHA512 28cbfb19b0f1b38a8dde42a75145b1cb70e1bc4e5dc87415fd30c5223997d1db62d57114d52d4c05e3de9a1e81daf387917eb9b88438d602c3175c2a685485b8

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 b97a91602c7b7863c161aae7a9ce245e
SHA1 41103a916c1234ba66901982a62beb6fbac7ea46
SHA256 8ffca6053efde126638029acdb741c5a9f2eeb7d2494be2a86b21c38e6a1c92b
SHA512 0b870322165145b4516a33ca4814df2b7ddcd8ce914c51c478249b3a5f3120550f48a5500fd658ef505ac13b44eb1395e03bd1f1d4dcf6df2c8bff8a4d5ad4b1

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-math-l1-1-0.dll

MD5 0ec1fc035d1f0053b531fb2177833dde
SHA1 0234175b084db72807dfbefe44222e9d5082b596
SHA256 5ecfe2ffe88dc02fb2ee2d73f9863846e7c96a95353477cef2d942a926235840
SHA512 a4867754081ec999db3ec4a22cde9f6f818dcc3cbaf81bf76f9e5f16d0083bde85070ce36a044d11b10cceb840737594154a404081bd6a8f221cccb0ff5b0f21

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-locale-l1-1-0.dll

MD5 cefb2f89dbc6bc3011945a65950413e8
SHA1 1cd47df38bb33521e26994d62b11096d655d2372
SHA256 0c46652c5ea0d8ffb7537a785f47d41803721eea897e2a062f55eac57e985557
SHA512 db2bc0043fc2c43f7894a31a54f50d5853df7388a1b04b7486bf9ff652a6dd9742d6f296c20c0c8cdb1d142d5564f0eca713a02579f034b3bc0aa13463957e04

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-heap-l1-1-0.dll

MD5 b549e8aefec84ae9bdc9ee4f6711c9f6
SHA1 8ddf1e6984560a20c429a6369d4a00ef60abc09b
SHA256 8fb31f284fe28e088e386b60ea40fadc258315574a825e5f597971153677a010
SHA512 c04047c6e43a33540ad7cc6d8cba4bc7a49d4e7abad4377c93bc50bf90f0647af24efaf1130c4c101e7dca5adba6ffed93a4b82434d9035acf056f69813c18ca

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 98b3eab92e4a89a44b7753da8c30243f
SHA1 43aff1903f3083974b30c33a7f782f4d879fc089
SHA256 6f0a7a9d36f0765bbfb6be1862dd789d33cfdc27154bb962e407e7c86f6c9eb4
SHA512 0dc69f08d2b17a87c3112d29af5bee63c411c5068dce2f1a5d0df20009f0f67406de244546a1c626cff9dddf0d1021943b1e019eccebf9e7b013ad30b6a12973

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-environment-l1-1-0.dll

MD5 18b4b5a9c622334d1c64b04de8bce582
SHA1 027155c2d2267fea0880f79eab7446f93dc2538a
SHA256 71fcd88c2c7e8b5081dfb7cb50a3e4cb0663d57a418fd72a778d8989f2a07f0b
SHA512 08ec3a63503f166f1c94c7dbfe52abb8b9715d37670a0e8c66d963966b7bc3002c12aac5bc700f57d37ee3290d778371b162ad316e5c6567fd9ce926c56ff7f5

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-convert-l1-1-0.dll

MD5 3747db6a541d522b534a2cd6e843fd3d
SHA1 e3fb025b5ae5e2d507f464ba3c9b1405267719c6
SHA256 c74b56c6a17c48d928e30af7bfaddc9cf920dc6b679f369292dee6daaee736c1
SHA512 cf4652df7fea02adce21f6f3aa8c0684300a79b63f280301a690e4d92230a49a2c69fe0f8db1288fd2e242dcd811a314ce700734fe1ad65cc771c851ab9bb085

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-crt-conio-l1-1-0.dll

MD5 19cd5a77df667e6f2b54e3cac4af3da1
SHA1 1ce194fd7dcee63a237a5646a74d9c7d8d4c80cc
SHA256 ddff97de0d3598b544652f49a5049f7535e43eaa95ed79583387da3a940023ea
SHA512 1116ba1675c5777433704e75a45255401ae150a1f09327ba7deaa7bea6c2664f150f6e3086bad403cbbf429a88641340af030593082c5fe86922171928b02e78

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-util-l1-1-0.dll

MD5 82f122f39c100d4c7d44adbfb0356a35
SHA1 0d10d0d06e3847855f1a016450ffd0b1103d4b24
SHA256 8189598ae1c53267641e2368c148c61a842145e698d3a6ae771a60eb88bf455b
SHA512 34846b4c862a9541e374be2d7eb168c66f023be480d9a74c5654839d4d397f01f3fb34abcf994b34964da67f1fd25ba3c0accdb7ad7bbfc432c4e6ff878ba379

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-timezone-l1-1-0.dll

MD5 1873273b894647ad63134bf2a0def8fd
SHA1 b6f593b3b413b1f502c543fdc7a00bafb07accab
SHA256 0af3e58319f2ae02478a115718f813da65d1407b62fdf6ae0cfea83d664d999d
SHA512 4d0ed0752164cec8f66e4069931fe11af26149e0969ede498e08ec1363020115f47492810553eeb6c99fc4c6698c50056cf1f70af77791fc13214d68fe5992e8

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 4caa7f9dfc7e6df28f4f0e00717b1105
SHA1 5c166754137f7b8ef2aa9315941ebde1330215aa
SHA256 fe6400ba43a128263dcd7bdeac2f4589d0c50515610964f5c2ba00c9a14ad2be
SHA512 18181ce48b14200291f0347d26910cdc8b2461a5bd103d680d948b2489d160418d970db16cccc6e57cb7a86611b8dc3f53b85f166ed2ddd629324c34c5a8fb45

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-synch-l1-2-0.dll

MD5 f64a78093a0b493e8719b1e2c46232f3
SHA1 61f88da0bcff904add797da67df567d19952073b
SHA256 da79322d8a06c3f35505484e0b51a2bd9b3054fd35ddc683b1ab4fb6ae738ba3
SHA512 ce74b0fec89cabc8c5dfe7deccd8ec6362eed6f57cd0e9b93b8e923dba6e4060a7e529f334cc808d217fa13702500e7fbb8df2411838612a1e21701da29160d2

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-synch-l1-1-0.dll

MD5 624215316fde23ccbe653cb3c9d1e808
SHA1 0d40a803c57ab870d8899bc2fc0a82258e3eee19
SHA256 1c087c3273ca26917e9bc52e3091cfcf9e32aef8758540b9beaee9b4080209db
SHA512 758b26ad7fd9f4433dc4446ae7f9ac386045d0c0d88ee0e244ebc14c8d9051837c3821d63394a626dc2bf3cc6a3f8f4bc5a5d3cb5e58a858ed83bbfb53143598

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-string-l1-1-0.dll

MD5 33e6e68c1a5922cc2ce54f584d6ff364
SHA1 bcf4ba393688e7b6842e986782db6c35f863ed87
SHA256 0e82385198168e2ad5a77e5620b9ba9c36277795984ade921bdce0ee6109b76c
SHA512 500db845dbd37a81c0a6309bb811f9ae2b83a9dbfd1207c84460113dd73e7294b9ee243f622ac7cec30242576dad390e0ee6921a803b43fc3481bccf3d551b37

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 cf54ebc2c19667ab0363563aebf26534
SHA1 87ddfe0e270cd83f5c9abc668971f8f1cde29bca
SHA256 0dad735d078c8161337cbac3555953f926e73e504b7b4d846162380674bc9f84
SHA512 76fb8554998125b4f1d6edfa833fd7d1f6f91572a0518bc371044c1642ed435b8afdfef1b0c51fe8bb9cb01f7df71ae90e68d513fd362ac90460dfe9693c2abb

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-profile-l1-1-0.dll

MD5 37fbc3f4232199066c43ea5fa91b28c7
SHA1 fa27a240691d8f5727d64afdac9c665ca810ef48
SHA256 3df5a3857b3cc0bbde6e11a028e83ba89c2510f695b2c1e10244b668910891d6
SHA512 f6eb807de4dbb851303e1b72dc23a9bb838adf526310ccb0a5ff7818de1dd98682830b902c5b6f152f4dbe9f28a85e824bd8f0f1003cb401a132aefe56ce706c

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-processthreads-l1-1-1.dll

MD5 e3a77ab9cb4e56c1782b5ee7f81cc80d
SHA1 2f37f25fe81cc8d3b84fd739222b748c1e21422b
SHA256 d2813925346d16942e1be36784db8eb78cc41e110ac1c81ea802b77fda321b86
SHA512 21ac0f5515ced436cb57e7c6db64b7dd8a595af24d1de626be13e3d6ceeae94942a4c882e1ea0bd08667ff08e3fae7d36c72a17d505ae89eaea8c0cfeed924ae

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-processthreads-l1-1-0.dll

MD5 2fd34bdda0a1b1e178c67f48160010be
SHA1 1113977e9d787d0378a105c98743ce86942e3312
SHA256 01bc49501d59614ec435b24369733bebecefb6f18834493999addcae7a5f6da4
SHA512 dd2e973522d6623b05dd884985b4a1e1c04592940d2c2feb670727fc35abe0b82488bc86acdf81354435cbbef29cfd8df2e06756a3550c488d45ad9003f776f3

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 b18adb8db8dac26dc7cd901a8b48b69f
SHA1 a695968906046c62a541b58c8a48407e6adbad5d
SHA256 c6f3b98709021c05792ebc18278e2451002163428fe1357258b7d740defd926e
SHA512 d1554649a3dae34c530f48ff2c8663e497ba0dad12887c6c4209aebe71c869184dbe3d43e4603a2edb34d3afa2c1f915dd2fc158c1785e43747a072c2ccf42fe

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 438d9d911ad135fcb8a8d653fe85ac0e
SHA1 0d0720566fac26a10d1c4b9dc8eff4f6e90ba894
SHA256 72854e88ce615118509b5d258e8d57216ac77558df60db18ac28ef97254320aa
SHA512 dc80c06d1e99f9029cba1e210ceda7d987699bc013df61167ec72165ada33f79d28150ef3e87073dfbf7eba82d3a6cc8df600c5ae514964e80a493ee1a496a1b

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-memory-l1-1-0.dll

MD5 faba2737798c3ab4098c2f09c8d8ccce
SHA1 6a2b04f9c5c3bdfed69685b216f226d16172abdd
SHA256 3cfadc0132a3a36dabb42dedeb9704d3607180479eec4ac6f71057df1810dda7
SHA512 913024d8ec694a1d2ce1597d21b84284c190fc280b85f6260e863d9391b29c30fa757e86181bbb581f4be5120991ac88ecf41ca93e637bcc8bd8cb6ca10bc979

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-localization-l1-2-0.dll

MD5 14bc5fd174cb3854da8dc4e2a770b2ca
SHA1 43462798689a0e76e80fb56b908a96f97819e7e7
SHA256 ecfe952c778460f204f65560ff5a98f33f7a3cf98d2301983098d197bd08f0cf
SHA512 169e7df65bbb4864eea14ab405e55e53f755b79c5e0476bdc56cbead3edea97d09377d530729536c5584066b7bc13a00c6201e4c6dc85982ba5884eb5fe3306c

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 2796d7edf328e159719a79e1d20df837
SHA1 c74be542704ae68da161aa18db38692bccfc983b
SHA256 583f12544b23f388ea7237b6f969be7bd8400ab747c3d4988d1399127d34aafa
SHA512 dd0c7dad51ff6729106f1600e833cdc75f1c6fda74d01500a83180edd869c8e0c3bc4e94ae6694ae1ac0aa8ee01947a10e516c188d88e33310e88911d84c350d

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-interlocked-l1-1-0.dll

MD5 90e49c43352beb28c5071256ef71e690
SHA1 dac118b8dfad0d74626cfbc20d3db70ea01b72fc
SHA256 098c607ca9e1812ea9ecf516c0268f15b82b99dc47315f024098dc0cf132323b
SHA512 f3b72db04b2a32272bf3ecc3b5e4c9dd8f10bf2983646ab2afe8a6f47174efa4a45f9f619e327ea27c4c89bf9746fde1dd85c424f006c50f8eb7aa1bb7c5de4c

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-heap-l1-1-0.dll

MD5 77167a1da5fb5c78401d43855f8581b0
SHA1 cd95cf53949a4638d17286972a94ba509342be24
SHA256 8924e80edf100c2cc27629e2475aa1168750622ca426b235ac3bc8fe4447bfb0
SHA512 c670da31e09e6b719f2ad16c4ea0eb76a126b170a408c6da095a8fd4c945595d2f184d498ce47e985a596e8800aba9cf20bb2e547c772e74ddf10e78d1d10448

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-handle-l1-1-0.dll

MD5 950715078bde45146a9968d7029f96ac
SHA1 91e1ced54f4e7ac8dcb68b50594555cd20035684
SHA256 63cfd1e99cd27651a129faec07f348b8f68e6904889b2d3a694041764e495696
SHA512 9f7cbb2bba4225b28c16e658307b1faa4e86ca08f95f529a958db9da2afabf26e419b0014c61522fc7fbb4e11f1594e05d9c32a69d88fde836236ee875b98dc5

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-file-l2-1-0.dll

MD5 cb1ddfe277e28a19646394c1c41a0f96
SHA1 b2ee421e5f4d92676314e413506e699c6fa8667c
SHA256 37ae4f6446c94b3817a8a0b9506c67d47f2372059a8a5101152e6bf365ded2ac
SHA512 e9c8a010d9c71cefeaa9ec77a09715ff785decebdefd37732590b9523fc78e58c96722ffc03e26d03bce797cc1da06d21f4e8be7c1b056d2e9b7ca291c247e14

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-file-l1-1-0.dll

MD5 a2ee2ccd1806241f5e3748f28ec13de1
SHA1 5bb3fca3523ad439c2982408c28df4abf2a52688
SHA256 949c449724ee0abbd9132a7fe1ed194325905b9411a8fa32fd34d19d5ed9c32e
SHA512 b5fa26e479eac423a42d3d99371a8dad5c3a18cbdaf689fde4556e66c0c2501635a909955f2568542a2f04c4c9e1c651a42a78776b9c97af2651fd496efc3ae1

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-fibers-l1-1-0.dll

MD5 9e6bf4a99b69a6c9549630053820779f
SHA1 211800bedd656790c58193f47658802ff6cee508
SHA256 6da0efee024ef3b08770c82ae346352ec6d37c9d37ea1bc30ae1b3f6d7f71afb
SHA512 09f6024f8b54433c8cefff81230a71a2cb8edefb58cb8e6348e09d03fae77d528b5d405298f4130abc5541c54eedca9c245cc3a0ad526f626dacb769ed57626b

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 3741c89798a1a7f5f21d4e88375f1fd4
SHA1 a10fa6c464b23db6b0e0d05a0602bbe5d28d8288
SHA256 ca1d7b8f79cf9686e3f64039f234983b1a481db74c4dfe0c45df2b064138a771
SHA512 3e95ea822218b91203ec13694c9e6868e121e87c505e240d49f263daab3b336cc649258f7bb05f96d03bdaa34a0a0ba6c834ab63e8a7766544b481b9cbfcec0f

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-debug-l1-1-0.dll

MD5 2b5bfefd109f6a2e6b69c4b80eb8a9b2
SHA1 5789b01b5148d807c9f7b8d0e69f1b71923d61e4
SHA256 b9e8c24181b386feff1edc6e73a61577bdf8e141b20743160db28537a1bfb1d7
SHA512 ccb97f15661347cceccde345dd7cfee7f9474cbc4b948200578507b71a7007070bbc92f41393e3431f22e48cb6c418e314b8a41873e96ffb3bdcc80da87d7f8b

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-datetime-l1-1-0.dll

MD5 2e8c0b251b58f3f2dedf9053b97b1835
SHA1 a3b2faff51778efcee59d782836cd3271da5d0e7
SHA256 146cb31671f76950fe60315b23a7ce0ec30237d721e6f6020ddd56f94a8951ae
SHA512 0b3bba689ea6e46aa90c35c3360f524fdfe7e20042fac9aef33c4da2077f61021961c239b2ede489dcc4cf96533fcabd3e0bb6c6c7f41f80f1dd07ece962f0a0

C:\Users\Admin\AppData\Local\Temp\_MEI35322\api-ms-win-core-console-l1-1-0.dll

MD5 2a634408d4b7fe6289758c0a9aea9703
SHA1 ddb0c80be3dbe6b801517742f408966d5368c134
SHA256 ab7d468d6dc3be7acd571e75e9447817964d36d4b34df004c60dff621551bb21
SHA512 b33775520bb17a1afc260b31083e50118c4eed216a4780b43c1d62595120b1ac6ea968bb280e15d9ae2b4e4f563b83671318ffb67705d4eab750ba583e855e6d