Analysis Overview
SHA256
f722341e30811c6ffe43330adc28b032ebb031d6312f1b483a9a6473bbd66c1e
Threat Level: Known bad
The file local.exe was found to be: Known bad.
Malicious Activity Summary
Wannacry
Deletes shadow copies
Reads user/profile data of web browsers
Modifies file permissions
Drops startup file
Executes dropped EXE
Loads dropped DLL
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Adds Run key to start application
Sets desktop wallpaper using registry
Unsigned PE
System Location Discovery: System Language Discovery
Detects Pyinstaller
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Suspicious behavior: EnumeratesProcesses
Modifies registry key
Suspicious use of AdjustPrivilegeToken
Views/modifies file attributes
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-14 18:36
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-14 18:36
Reported
2024-09-14 18:39
Platform
win7-20240903-en
Max time kernel
120s
Max time network
128s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\local.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\local.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\local.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\local.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\local.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\local.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\local.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2172 wrote to memory of 1516 | N/A | C:\Users\Admin\AppData\Local\Temp\local.exe | C:\Users\Admin\AppData\Local\Temp\local.exe |
| PID 2172 wrote to memory of 1516 | N/A | C:\Users\Admin\AppData\Local\Temp\local.exe | C:\Users\Admin\AppData\Local\Temp\local.exe |
| PID 2172 wrote to memory of 1516 | N/A | C:\Users\Admin\AppData\Local\Temp\local.exe | C:\Users\Admin\AppData\Local\Temp\local.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\local.exe
"C:\Users\Admin\AppData\Local\Temp\local.exe"
C:\Users\Admin\AppData\Local\Temp\local.exe
"C:\Users\Admin\AppData\Local\Temp\local.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI21722\ucrtbase.dll
| MD5 | 34168a4af676d6a5733bbf7a0905d3c7 |
| SHA1 | ba63e51ab3cd90666eb9a9bb0232502a5ec629ff |
| SHA256 | 2ab2a74bcb5bfd8248d232eb3bc56698fb5173b9ff7fc0daf87d8120d0f448d7 |
| SHA512 | c049c166b2b00dc30b0edae5d78badfffea7fb105f0cff9f3ae2c947ddf3ecde6331855b7ebed3f4ce923cc365b053b3a679319b2c6efa85ed0b9a7ddb5676ab |
C:\Users\Admin\AppData\Local\Temp\_MEI21722\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | bdd63ea2508c27b43e6d52b10da16915 |
| SHA1 | 2a379a1ac406f70002f200e1af4fed95b62e7cb8 |
| SHA256 | 7d4252ab1b79c5801b58a08ce16efd3b30d8235733028e5823f3709bd0a98bcf |
| SHA512 | b0393f0d2eb2173766238d2139ae7dea7a456606f7cb1b0e8bc0375a405bc25d28ef1c804802dddb5c3dbd88cfd047bfa5c93cbb475d1d6b5a9a893b51e25128 |
C:\Users\Admin\AppData\Local\Temp\_MEI21722\api-ms-win-core-file-l2-1-0.dll
| MD5 | adb3471f89e47cd93b6854d629906809 |
| SHA1 | 2cfc0c379fd7f23db64d15bdff2925778ff65188 |
| SHA256 | 355633a84db0816ab6a340a086fb41c65854c313bd08d427a17389c42a1e5b69 |
| SHA512 | f53e11aa35911d226b676d454e873d0e84c189dd1caea8a0fe54d738933cd6b139eca48630f37f5979ef898950d99f3277cba6c7a697103f505d876bea62818c |
C:\Users\Admin\AppData\Local\Temp\_MEI21722\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 6b4f2ca3efceb2c21e93f92cdc150a9d |
| SHA1 | 2532af7a64ef4b5154752f61290dcf9ebeea290f |
| SHA256 | b39a515b9e48fc6589703d45e14dcea2273a02d7fa6f2e1d17985c0228d32564 |
| SHA512 | 63a42dd1cb95fd38ddde562108c78e39cb5d7c9406bf749339e717c2cd866f26268d49b6bd966b338de1c557a426a01a24c2480f64762fef587bc09d44ada53b |
C:\Users\Admin\AppData\Local\Temp\_MEI21722\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | 247061d7c5542286aeddade76897f404 |
| SHA1 | 7285f85440b6eff8731943b73502f58ae40e95a2 |
| SHA256 | ccb974c24ddfa7446278ca55fc8b236d0605d2caaf273db8390d1813fc70cd5b |
| SHA512 | 23ef467f6bb336d3e8c38000d30a92dac68e2662891863475ff18dbddbbbce909c12d241b86dbdea085e7d19c82cd20d80a60ffb2845f6afebedf06507afe5bc |
C:\Users\Admin\AppData\Local\Temp\_MEI21722\api-ms-win-core-file-l1-2-0.dll
| MD5 | 19df2b0f78dc3d8c470e836bae85e1ff |
| SHA1 | 03f2b5b848a51ee52980bf8595c559b89865de07 |
| SHA256 | bd9e07bbc62ce82dbc30c23069a17fbfa17f1c26a9c19e50fe754d494e6cd0b1 |
| SHA512 | c1c2b97f484e640bfdda17f7ed604d0583c3d4eaf21abf35491ccedc37fa4866480b59a692776687e5fda3eaeafb4c7bdb34dec91f996fd377a328a89c8d5724 |
C:\Users\Admin\AppData\Local\Temp\_MEI21722\python312.dll
| MD5 | d521654d889666a0bc753320f071ef60 |
| SHA1 | 5fd9b90c5d0527e53c199f94bad540c1e0985db6 |
| SHA256 | 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2 |
| SHA512 | 7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-14 18:36
Reported
2024-09-14 18:39
Platform
win10v2004-20240802-en
Max time kernel
149s
Max time network
152s
Command Line
Signatures
Wannacry
Deletes shadow copies
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD1DE3.tmp | C:\Users\Admin\AppData\Local\Temp\cry.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD1DF9.tmp | C:\Users\Admin\AppData\Local\Temp\cry.exe | N/A |
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\icacls.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgkizqbavnk632 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" | C:\Windows\SysWOW64\reg.exe | N/A |
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" | C:\Users\Admin\AppData\Local\Temp\cry.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\attrib.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\attrib.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\taskse.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\taskdl.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\reg.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\icacls.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\cry.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cscript.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Modifies registry key
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\reg.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\vssvc.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\whoami.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\taskse.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\taskse.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\taskse.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\taskse.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\taskse.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\taskse.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\taskse.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\taskse.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\@[email protected] | N/A |
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\local.exe
"C:\Users\Admin\AppData\Local\Temp\local.exe"
C:\Users\Admin\AppData\Local\Temp\local.exe
"C:\Users\Admin\AppData\Local\Temp\local.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "start cry.exe"
C:\Users\Admin\AppData\Local\Temp\cry.exe
cry.exe
C:\Windows\SysWOW64\attrib.exe
attrib +h .
C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 274081726339040.bat
C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
C:\Users\Admin\AppData\Local\Temp\@[email protected]
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
C:\Users\Admin\AppData\Local\Temp\@[email protected]
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "whoami"
C:\Windows\system32\whoami.exe
whoami
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
C:\Users\Admin\AppData\Local\Temp\@[email protected]
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hgkizqbavnk632" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "hgkizqbavnk632" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
C:\Users\Admin\AppData\Local\Temp\@[email protected]
C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
C:\Users\Admin\AppData\Local\Temp\@[email protected]
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
C:\Users\Admin\AppData\Local\Temp\@[email protected]
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.140.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 146.190.196.61:8989 | tcp | |
| US | 8.8.8.8:53 | 61.196.190.146.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| N/A | 127.0.0.1:9050 | tcp | |
| FR | 212.47.229.2:9001 | tcp | |
| DE | 131.188.40.189:443 | tcp | |
| N/A | 127.0.0.1:58769 | tcp | |
| CH | 195.15.242.29:9001 | tcp | |
| US | 8.8.8.8:53 | 2.229.47.212.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 189.40.188.131.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.242.15.195.in-addr.arpa | udp |
| N/A | 127.0.0.1:9050 | tcp | |
| N/A | 127.0.0.1:9050 | tcp | |
| N/A | 127.0.0.1:9050 | tcp | |
| US | 8.8.8.8:53 | 11.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI45562\ucrtbase.dll
| MD5 | 34168a4af676d6a5733bbf7a0905d3c7 |
| SHA1 | ba63e51ab3cd90666eb9a9bb0232502a5ec629ff |
| SHA256 | 2ab2a74bcb5bfd8248d232eb3bc56698fb5173b9ff7fc0daf87d8120d0f448d7 |
| SHA512 | c049c166b2b00dc30b0edae5d78badfffea7fb105f0cff9f3ae2c947ddf3ecde6331855b7ebed3f4ce923cc365b053b3a679319b2c6efa85ed0b9a7ddb5676ab |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\python312.dll
| MD5 | d521654d889666a0bc753320f071ef60 |
| SHA1 | 5fd9b90c5d0527e53c199f94bad540c1e0985db6 |
| SHA256 | 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2 |
| SHA512 | 7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\VCRUNTIME140.dll
| MD5 | be8dbe2dc77ebe7f88f910c61aec691a |
| SHA1 | a19f08bb2b1c1de5bb61daf9f2304531321e0e40 |
| SHA256 | 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83 |
| SHA512 | 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\base_library.zip
| MD5 | 68f96a1f0b49d240b392ebb7ea147939 |
| SHA1 | 5d8aa0cccc0f744f17e546ef7120308016cb5438 |
| SHA256 | 29556cc179d145e9f64d287f0455991bd62a8dc4304e20429f83a1a40959fd09 |
| SHA512 | b326d5feb4f9b3d76254240dc3b0d16cb60c0a47d75ab7a1742fe7bb0bdfafff00a9d24a4c84559f1b2b04d23fd4f53d3b8d654532cb7c57c60bb83041331d35 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\python3.dll
| MD5 | a07661c5fad97379cf6d00332999d22c |
| SHA1 | dca65816a049b3cce5c4354c3819fef54c6299b0 |
| SHA256 | 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b |
| SHA512 | 6ddeb9d89ccb4d2ec5d994d85a55e5e2cc7af745056dae030ab8d72ee7830f672003f4675b6040f123fc64c19e9b48cabd0da78101774dafacf74a88fbd74b4d |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\_ctypes.pyd
| MD5 | fb454c5e74582a805bc5e9f3da8edc7b |
| SHA1 | 782c3fa39393112275120eaf62fc6579c36b5cf8 |
| SHA256 | 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1 |
| SHA512 | 727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\libffi-8.dll
| MD5 | 0f8e4992ca92baaf54cc0b43aaccce21 |
| SHA1 | c7300975df267b1d6adcbac0ac93fd7b1ab49bd2 |
| SHA256 | eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a |
| SHA512 | 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\_lzma.pyd
| MD5 | 195defe58a7549117e06a57029079702 |
| SHA1 | 3795b02803ca37f399d8883d30c0aa38ad77b5f2 |
| SHA256 | 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a |
| SHA512 | c47a9b1066dd9744c51ed80215bd9645aab6cc9d6a3f9df99f618e3dd784f6c7ce6f53eabe222cf134ee649250834193d5973e6e88f8a93151886537c62e2e2b |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\unicodedata.pyd
| MD5 | cc8142bedafdfaa50b26c6d07755c7a6 |
| SHA1 | 0fcab5816eaf7b138f22c29c6d5b5f59551b39fe |
| SHA256 | bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268 |
| SHA512 | c3b0c1dbe5bf159ab7706f314a75a856a08ebb889f53fe22ab3ec92b35b5e211edab3934df3da64ebea76f38eb9bfc9504db8d7546a36bc3cabe40c5599a9cbd |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\tk86t.dll
| MD5 | 4cdd92e60eb291053d2ad12bf0710749 |
| SHA1 | 31424e8d35459ba43672f05abba1e37c23f74536 |
| SHA256 | b30576b60aee548838243601952a05b70a9fc937f5a607f6b1413cd5ed04d900 |
| SHA512 | 80c3bb58817578708e14ba173bfbe8f62fb54efa22feb8ff08b9eefa4462b74062654f956f965c7caa8aa16295229b58ef9eea8d2c4c94652bde1e61038e6ffe |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\tcl86t.dll
| MD5 | 108d97000657e7b1b95626350784ed23 |
| SHA1 | 3814e6e5356b26e6e538f2c1803418eb83941e30 |
| SHA256 | 3d2769e69d611314d517fc9aad688a529670af94a7589f728107180ae105218f |
| SHA512 | 9475cd1c8fe2e769ed0e8469d1f19cdf808f930cccc3baf581888a705f195c9be02652168d9c1c25ba850502f94e7eb87687c2c75f0f699c38309bc92b9004a0 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\select.pyd
| MD5 | d0cc9fc9a0650ba00bd206720223493b |
| SHA1 | 295bc204e489572b74cc11801ed8590f808e1618 |
| SHA256 | 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019 |
| SHA512 | d3ebcb91d1b8aa247d50c2c4b2ba1bf3102317c593cbf6c63883e8bf9d6e50c0a40f149654797abc5b4f17aee282ddd972a8cd9189bfcd5b9cec5ab9c341e20b |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\pyexpat.pyd
| MD5 | 958231414cc697b3c59a491cc79404a7 |
| SHA1 | 3dec86b90543ea439e145d7426a91a7aca1eaab6 |
| SHA256 | efd6099b1a6efdadd988d08dce0d8a34bd838106238250bccd201dc7dcd9387f |
| SHA512 | fd29d0aab59485340b68dc4552b9e059ffb705d4a64ff9963e1ee8a69d9d96593848d07be70528d1beb02bbbbd69793ee3ea764e43b33879f5c304d8a912c3be |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\libssl-3.dll
| MD5 | 19a2aba25456181d5fb572d88ac0e73e |
| SHA1 | 656ca8cdfc9c3a6379536e2027e93408851483db |
| SHA256 | 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006 |
| SHA512 | df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\libcrypto-3.dll
| MD5 | e547cf6d296a88f5b1c352c116df7c0c |
| SHA1 | cafa14e0367f7c13ad140fd556f10f320a039783 |
| SHA256 | 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de |
| SHA512 | 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-utility-l1-1-0.dll
| MD5 | f440dc5623419e013d07dd1fcd197156 |
| SHA1 | 0e717f3ab9ccf1826a61eeccda9551d122730713 |
| SHA256 | bba068f29609630e8c6547f1e9219e11077426c4f1e4a93b712bfba11a149358 |
| SHA512 | e3fc916011d0caa0f8e194464d719e25eec62f48282c2bf815e4257d68eddb35e2e88cb44983fe2f202ee56af12bb026da90a5261a99272dabf2a13794a69898 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-time-l1-1-0.dll
| MD5 | 05af3f787a38ed1974ff3bda3d752e69 |
| SHA1 | c88117f16a0ae4ccb4f3d3c8e733d213de654b04 |
| SHA256 | f4163cbc464a82fce47442447351265a287561c8d64ecc2f2f97f5e73bcb4347 |
| SHA512 | 9bc364a4361e6ce3e9fc85317e8a252516006d1bae4bf8d2e0273337bbb7fe4a068a3e29966ff2707e974af323dd9ab7b086582504d3caed2ceb1e14d4a37559 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-string-l1-1-0.dll
| MD5 | 3a96f417129d6e26232dc64e8fee89a0 |
| SHA1 | 47f9d89ea1694b94f4f8c5558311a915eca45379 |
| SHA256 | 01e3c0aa24ce9f8d62753702df5d7a827c390af5e2b76d1f1a5b96c777fd1a4e |
| SHA512 | 0898c2c8751a6a0f75417c54157228ccf0e9f3facbfecc1268ecbd3d50eca69a3909c39ca788d9e2d5ccbf3b5ebcdc960df49e40a9c945fc8007d2dc4474f718 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-stdio-l1-1-0.dll
| MD5 | 53e23e326c11191a57ddf7ada5aa3c17 |
| SHA1 | af60bcca74f5b4b65c2b322ac7a5cedb9609c238 |
| SHA256 | 293c76a26fbc0c86dcf5906dd9d9ddc77a5609ea8c191e88bdc907c03b80a3a5 |
| SHA512 | 82c71b003332006beeafb99306dbcc6517a0f31f9659ea6b1607a88d6a2b15420aef6c47dfaf21fd3bd7502135fb37ba7a9321fc2a9b82c7deb85a75d43a6f58 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-runtime-l1-1-0.dll
| MD5 | c25321fe3a7244736383842a7c2c199f |
| SHA1 | 427ea01fc015a67ffd057a0e07166b7cd595dcfd |
| SHA256 | bf55134f17b93d8ac4d8159a952bee17cb0c925f5256aa7f747c13e5f2d00661 |
| SHA512 | 3aa08138a4bba4d5619e894e3ec66cc540db9f5fe94e226c9b4fc8a068ddb13039335aa72731e5dbdb89dfc6550c9f5d8f03441001c8fd43a77795a2197a8c60 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-process-l1-1-0.dll
| MD5 | e18fd20e089cb2c2c58556575828be36 |
| SHA1 | 1ccdc9443bae71a5455eff93a304eae16f087be7 |
| SHA256 | b06b2d8c944bff73bd5a4aad1cad6a4d724633e7bd6c6b9e236e35a99b1d35f2 |
| SHA512 | 630d4992120ff0646f16d95a5a2cea6c727f87e01124ebd7f1158cef69adcd7d04b5676bd47fac4462c05cf070c520b6dc0016c30705b50894d406992c81f44f |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-private-l1-1-0.dll
| MD5 | b4be272187cb85e719dfb5bf48bb9b1b |
| SHA1 | 1c1b672759c2922082da07af77f0769d27e2e9aa |
| SHA256 | ccaf41e616b9a872d35c8083cbf8fdc14371fa3ef159fe699514643c26a4ebf3 |
| SHA512 | d73ec9acad4fc73c27749ae136914a9dfcac0e965dec7db0f4784aac8d4b9d0e8cde3d28be8a53f53faab06ca0aa9e1a2962a03bd88fc8b044c46db36a00c446 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-math-l1-1-0.dll
| MD5 | 877c5ff146078466ff4370f3c0f02100 |
| SHA1 | 85cf4c4a59f3b0442cdc346956b377bae5b9ca76 |
| SHA256 | 9b05a43fdc185497e8c2cea3c6b9eb0d74327bd70913a298a6e8af64514190e8 |
| SHA512 | 4bc5116d160c31aa24264f02e5d8ba0bd33e26e9632f9ad9018f5bb1964a5c99b325b19db9895483efb82f173962c8dfe70a857db3dfd11796cba82c0d9acd8d |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-locale-l1-1-0.dll
| MD5 | 0d50a16c2b3ec10b4d4e80ffeb0c1074 |
| SHA1 | b81f1639d62dfc7be7ae4d51dd3fae7f29a1a297 |
| SHA256 | fab41a942f623590402e4150a29d0f6f918ee096dba1e8b320ade3ec286c7475 |
| SHA512 | bfee8b2fa8bc5d95e699a82d01a6841a9ac210c288b9dd0aba20b7ebbcfb4363adde439404fe98dc03a6db38873902a335bca77e484fb46f04218696395f1877 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-heap-l1-1-0.dll
| MD5 | 5d409d47f9aebd6015f7c71d526028c3 |
| SHA1 | 0da61111b1e3dbb957162705aa2dbc4e693efb35 |
| SHA256 | 7050043b0362c928aa63dd7800e5b123c775425eba21a5c57cbc052ebc1b0ba2 |
| SHA512 | 62d2e5a6399f3cbd432e233cea8db0199df5c534870c29d7f5b30f935154cb9b756977d865514e57f52ff8b9be37f25cce5118d83c9039e47d9e8f95aa2575ce |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-filesystem-l1-1-0.dll
| MD5 | d76f73be5b6a2b5e2fa47bc39eccdfe5 |
| SHA1 | dfed2b210e65d61bf08847477a28a09b7765e900 |
| SHA256 | 6c86e40c956eb6a77313fa8dd9c46579c5421fa890043f724c004a66796d37a6 |
| SHA512 | 72a048fd647ba22d25f7680884ec7f9216c6bdbb7011869731b221d844a9a493dd502770d08dabb04f867c47ece29ca89b8762d97d71afe6788d72e3f8a30bb7 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-environment-l1-1-0.dll
| MD5 | fe93c3825a95b48c27775664dc54cae4 |
| SHA1 | bae2925776e15081f445fbdd708e0179869b126d |
| SHA256 | c4ed8f65c5a0dbf325482a69ab9f8cbd8c97d6120b87ce90ac4cba54ac7d377a |
| SHA512 | 23a7bc53b35de4893219a3b864c2355fd08f297b3c096000e1621ca0db974aa4b4799fd037f3a25b023e9ee81f304d351f92409aa6d9623bf27b5a8971b58a23 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-convert-l1-1-0.dll
| MD5 | afc20d2ef1f6042f34006d01bfe82777 |
| SHA1 | a13adfc0d03bb06d4a8fe7fb4516f3e21258c333 |
| SHA256 | cd5256b2fb46deaa440950e4a68466b2b0ff61f28888383094182561738d10a9 |
| SHA512 | 2c9f87d50d60ebe4c56257caf4dcf3db4d36739768274acc1d41d98676c3dd1527a9fdc998bfa00227d599fb9893aa20756bc34623fa9b678da5c10a0d0d2550 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-crt-conio-l1-1-0.dll
| MD5 | e3d0f4e97f07033c1feaf72362bbb367 |
| SHA1 | 2a175cea6f80ebe468d71260afb88da98df43bed |
| SHA256 | 3067981026fad83882f211bfe32210ce17f89c6a15916c13e62069e00d5a19e3 |
| SHA512 | 794ae1574883a5320c97f32e4d8a45c211151223ba8b8f790a5a6f2b2bd8366a6fcb1b5e1d9b4a14d28372f15e05c6ad45801d67059e0aba4f5e0a62aa20966c |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-util-l1-1-0.dll
| MD5 | 7a664d454e9675cb3aac9f7c5a7b32b3 |
| SHA1 | e583b12a9d1463eb05d847e623d5a39d38d055c6 |
| SHA256 | 77b53d3970c7e3f68e0c31b7f3cd64b671a3003c5a771d4659c48339331f2994 |
| SHA512 | 1826bb69b9689960b78edbab7eb3c792a6ef2eedb4a7db2c801af4f6b53305614b4200b21fb2e27e2f0931881ea0ff1cc480bc63d7c31f4a5e043a6ac168b7b0 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | bdd63ea2508c27b43e6d52b10da16915 |
| SHA1 | 2a379a1ac406f70002f200e1af4fed95b62e7cb8 |
| SHA256 | 7d4252ab1b79c5801b58a08ce16efd3b30d8235733028e5823f3709bd0a98bcf |
| SHA512 | b0393f0d2eb2173766238d2139ae7dea7a456606f7cb1b0e8bc0375a405bc25d28ef1c804802dddb5c3dbd88cfd047bfa5c93cbb475d1d6b5a9a893b51e25128 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-sysinfo-l1-1-0.dll
| MD5 | 178eaf8111dfdd995e15fd2e3f4545cb |
| SHA1 | 2e15e1f76a8128584b48b742f03e0bb11eccddee |
| SHA256 | 2fa840523904c7b133ded29ec073a9c24184202e8847c9e731897fdd8473b367 |
| SHA512 | b237d180e1743bd230b13e931e3fe725d6e8f430360311b532eed71eb3e42ca604d99d43f42969bf657cdb46ea9b0fd5027f553e0292c7376a18bf586adf6789 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-synch-l1-2-0.dll
| MD5 | b9bc664a451424342a73a8b12918f88d |
| SHA1 | c65599def1e69aed55ea557847d78bb3717d1d62 |
| SHA256 | 0c5c4dfea72595fb7ae410f8fa8da983b53a83ce81aea144fa20cab613e641b7 |
| SHA512 | fe3f393fd61d35b368e42c3333656298a8243ba91b8242ee356950f8925317bf32ce4f37670b16a5a5ab5091903e61ae9c49c03fdc5f93193f215a58d80b9311 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-synch-l1-1-0.dll
| MD5 | fc2e64b5eea906d30694db192603b21f |
| SHA1 | 98ca55d28ae0e9d5609a5d586c8054285ffedf89 |
| SHA256 | 59e86b54319f7a6872cd888582c75559b96ae6f67c0dfe554184538b0ed08cd7 |
| SHA512 | 8b87825bc0d4166c0278c5eafe83cad2065126deab6cd7eae9d3290711ac5f6fcf858cfb5216791ed0709c14e280e7d02caa1004699879359bcc6f6766abf08d |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-string-l1-1-0.dll
| MD5 | 6ba0b8044f21a5c0086f5b8d2ac15d89 |
| SHA1 | 52d0bb8eea87682adf4ab77b45b5bc71d9545170 |
| SHA256 | ac18630de43781ac58f0a8a1aba4304292e0f73db93acbe606b1814fecea0822 |
| SHA512 | d3e92cab97b5de5ca72e1af0c558c24a922b9776cf54f5400dd6d3412d7524c42973ca4d17c8d1ae998b79e8c9b29e75edeb90d438812106d249b7e8d30aef13 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-rtlsupport-l1-1-0.dll
| MD5 | fdb1476dcb99850f82b9567956a7a46b |
| SHA1 | d2d1004fbecb1e25f26da7a6a3d8f7a87fb1ee7a |
| SHA256 | ea04e9b6cf4646d36ab691ff93964f0c7b0b01fd194b8db37a96fb1513ae656a |
| SHA512 | eef15096b7535f13795102442619d8e6651c49b119261c09fe4404cdbd4dc2e63f3a073e92365d67598076501f26485dc6eeb6c2bbae9ec882319fd5ee4f7629 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-profile-l1-1-0.dll
| MD5 | f8a266ba5362a17c89df60b5b5ebef41 |
| SHA1 | 7f3f9d5875ef3c2d79667a1231d85d9eb619fbc9 |
| SHA256 | 753494588fa1c14146a9a3f7d0f02ddd0a6850ba6a719e2513a64cf9dbf1ae7d |
| SHA512 | 12bebb1186974a9974aaae5630d0957f339c96add2d8bb4bb35ee4b97873fd8d23d73e427ccdee984f0baa79aa2406b25ed198e2e7ad8212ee087be8229c0be9 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | 247061d7c5542286aeddade76897f404 |
| SHA1 | 7285f85440b6eff8731943b73502f58ae40e95a2 |
| SHA256 | ccb974c24ddfa7446278ca55fc8b236d0605d2caaf273db8390d1813fc70cd5b |
| SHA512 | 23ef467f6bb336d3e8c38000d30a92dac68e2662891863475ff18dbddbbbce909c12d241b86dbdea085e7d19c82cd20d80a60ffb2845f6afebedf06507afe5bc |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-processthreads-l1-1-0.dll
| MD5 | c12244db4c14058f457bfb3b9a1fd21f |
| SHA1 | 8c96972da78b6424958cf976dc7313497ebeaeb5 |
| SHA256 | bc5ddb364256a38e57b21b1a16b5736a8eacbae32b4c3760514cf51629066881 |
| SHA512 | da1bb9099e5fa0c65ae361ef10bd06199b76132bb40cfc3078824fcdfb8032ff745ca852edf65ec5e0e948d5e1413cc219bbba366906d417095b9e46bdea6011 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-processenvironment-l1-1-0.dll
| MD5 | f4f8bd9a68cecff1d22204d29cf8a914 |
| SHA1 | 1fbd4fc3c3edae151ee2d4ad4861a6667a736f44 |
| SHA256 | 6088c2aa22ae8a579518c347163571e243d9a74d542176d63520f370040382e3 |
| SHA512 | 3d9da1e0d4531cb006ba72d0afaf49bc54a4db9f782125a375444b1e97d012d4caf6bdd26128614362137c6aac616ce6d84bda24c629a4e59b55347f69b12b5c |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-namedpipe-l1-1-0.dll
| MD5 | 627327251bc258aa258848de32b698ba |
| SHA1 | dd5831226ba1ed697cb1b74b3a4136ca17aba19a |
| SHA256 | 5ebd891df029e795372f8665db7f15b4964d434aa8d58eb2b50634bc58d74132 |
| SHA512 | 874a76efd19d1ad5f479b975bfe23ae70b3049f872d7371b461de48f3f3a2f76346d6eab406529b32d05fa0894b716ddd2f27980b8e5332b241dce168afc9261 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-memory-l1-1-0.dll
| MD5 | d14c0b3bc3032a043ddffbc39d26db7c |
| SHA1 | c196d43f13c6bf8f0596e3c9b9f54a555099ed48 |
| SHA256 | d699e0c0de1d2f12bb69b3d464faa7ad4734d18a3e725877d8a96aabf29c0542 |
| SHA512 | a4913cc0ed609764c9c5ebdb46d888af332394fd8efc9be173b2795f2ac00901b3f7643d83ebd2faf0ddc5fd75df5520687daa5b85a2b9a2f9775accecb7aaa9 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 6b4f2ca3efceb2c21e93f92cdc150a9d |
| SHA1 | 2532af7a64ef4b5154752f61290dcf9ebeea290f |
| SHA256 | b39a515b9e48fc6589703d45e14dcea2273a02d7fa6f2e1d17985c0228d32564 |
| SHA512 | 63a42dd1cb95fd38ddde562108c78e39cb5d7c9406bf749339e717c2cd866f26268d49b6bd966b338de1c557a426a01a24c2480f64762fef587bc09d44ada53b |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-libraryloader-l1-1-0.dll
| MD5 | 3e3a777cad2aafde613836ee88179a58 |
| SHA1 | fe55ffef83601f654504f0a2256e11e1913635db |
| SHA256 | 4a02983d6632c2fb92409d56269ca9a5bb0c31d33a8f2a89b0ab847d263c3f96 |
| SHA512 | e217d4fc5bc832623cea21c86b74b97018d1bfad46e65cef36476f6e2ebec7dcfe814c0d848182e9fd8dd3cb26eef04ba9b77df394501b1d808f6cd689aa813d |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-interlocked-l1-1-0.dll
| MD5 | 7ee0013d07ed45c081df41e64ab14889 |
| SHA1 | 5f4543e008cbe86c0f14e2bfc2f803cf38d34c40 |
| SHA256 | 26f90d2086687edf6fc02be5dcfd7575faad2022c3d716cdd0b5ca3e70a3c022 |
| SHA512 | 7c083a20ea9fa3903234abc642730527ef68f96b05732d8befd8d6daf1204bfdcc51fa1996fa2fb8d532825142b4fca3fd9c4ce5be43fa9a3edc2ad8afed6c34 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-heap-l1-1-0.dll
| MD5 | 11a672968ce4879767afaf573e4ede0c |
| SHA1 | 79abb1976f249f6b45014fd692af6fca4e3ded06 |
| SHA256 | 6a803d6cbe4dcbb6e4c9e8b8945d92d7edbd1f51cfb875d3d6c312d83840dde2 |
| SHA512 | 460bb15ac2baa8d802988cc9a22ad68acf413aa1e0584c451c686ac5a86055007cc35ba0035464811179a0e0641b28a77b6a306873eb803b0719cc7857a8b9c7 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-handle-l1-1-0.dll
| MD5 | 968c1759f5d4aa2bed859a2df67acc8f |
| SHA1 | 2890a554fd106cc6572213e55c3a932be6eaadcd |
| SHA256 | 8a52a26afaf4d7cd698cf79dcd339ec3f1b3ab3c0031a8ae9064d50f63462b99 |
| SHA512 | cd903b6909d7a55e3b1b3c6894d3774bac758279bb7b62dcd6b94dc8991e98106f59dda9f3e312a1d8d3de17383d905f33bdfb96992517bcfd9b8fa52b3f7de2 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-file-l2-1-0.dll
| MD5 | adb3471f89e47cd93b6854d629906809 |
| SHA1 | 2cfc0c379fd7f23db64d15bdff2925778ff65188 |
| SHA256 | 355633a84db0816ab6a340a086fb41c65854c313bd08d427a17389c42a1e5b69 |
| SHA512 | f53e11aa35911d226b676d454e873d0e84c189dd1caea8a0fe54d738933cd6b139eca48630f37f5979ef898950d99f3277cba6c7a697103f505d876bea62818c |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-file-l1-2-0.dll
| MD5 | 19df2b0f78dc3d8c470e836bae85e1ff |
| SHA1 | 03f2b5b848a51ee52980bf8595c559b89865de07 |
| SHA256 | bd9e07bbc62ce82dbc30c23069a17fbfa17f1c26a9c19e50fe754d494e6cd0b1 |
| SHA512 | c1c2b97f484e640bfdda17f7ed604d0583c3d4eaf21abf35491ccedc37fa4866480b59a692776687e5fda3eaeafb4c7bdb34dec91f996fd377a328a89c8d5724 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-file-l1-1-0.dll
| MD5 | b90485eb6d2e835f975c6f1011be880f |
| SHA1 | 714ff49459f0c0743d2d8c6784e6d28ea7f81599 |
| SHA256 | 72e79ce895ab6506d2c85bcd1709ef6a250b63c990c76c9df530ec4e5b5cbb6a |
| SHA512 | 78d09d109b3f5d796aa1f7148437a9ba49062c011fea4a0cda43ef7616176f1ad3c00aeb8b204b264e6bbd27c66afc710e221536529f0a66bf65424c52de15ae |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-errorhandling-l1-1-0.dll
| MD5 | 31990aaab1aeeae6bff96eaf3809eda9 |
| SHA1 | aa2cd6fab320643eaeb41303d5b3a802cd2365da |
| SHA256 | d71714c34fabf8a93ae316a0d8679bb8cdc843f6128c9afd42e18e0de70b1a91 |
| SHA512 | d25baf53f667d8e2239141c846a59c08636b887c8c11ba60b61992f91765c0a3cf9a993fc2017191b9cd8f0735b6c9af19bb0ecd8eff16d293f17cdc1d3b9059 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-debug-l1-1-0.dll
| MD5 | f91f7dc238de2c03dc64aa5d2e3b4e49 |
| SHA1 | 53b1fe15e7a9800456f063e8dbd11f240f6095a3 |
| SHA256 | d3b5273eccc758493c9cfac5cc43ea74f08216bb1c195609ab27e9b2a241d8b3 |
| SHA512 | d8db7213a4bb58bb497d4ee2d06a021a607436ca691462d0dc0c06c17ae345349d03406729a399d2931715cb6dc5a653247851dce701a02e254d8a258bea7fcb |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-datetime-l1-1-0.dll
| MD5 | b3f46f0820b641c5a9a9d0a4bfc94355 |
| SHA1 | 1aa8579aa13d4075c4082245317cb1dcc4ba6b4e |
| SHA256 | e353ecf9deb083da0f00f40f2fe99cc4eea4a904e7118a1cac4ef6e43f89b154 |
| SHA512 | 67a678e125e9e0ce0b9c5fed35cad0513c3b5ff6f86760b32991cfeff5234ec65840c808be2911d57876d8c49076302033e8dcb5032a05f4c0e11964d81b33e8 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\api-ms-win-core-console-l1-1-0.dll
| MD5 | e4a519ef5d0a378ea82c423fe1e4586e |
| SHA1 | ae69723c2540eb1c13ef047c3df25e103e6ec1d9 |
| SHA256 | 5c1cbd16acf9191f17525f5dd887d944b4eb0083c5ec1adb68ce1b82639182ae |
| SHA512 | 6be292efb363b5e00b4f303621a90d6ea20cf3512e3538508c58bc12f6ac024080eb9f0bc2ea112935ad0a955b05d19d784d22de815ba0c2b4feaf6412d11a07 |
C:\Users\Admin\AppData\Local\Temp\_MEI45562\_bz2.pyd
| MD5 | 5bebc32957922fe20e927d5c4637f100 |
| SHA1 | a94ea93ee3c3d154f4f90b5c2fe072cc273376b3 |
| SHA256 | 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62 |
| SHA512 | afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6 |
memory/1892-1092-0x00007FF938B30000-0x00007FF938B5A000-memory.dmp
memory/1892-1093-0x00007FF92A6E0000-0x00007FF92C7BA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnry
| MD5 | 35c2f97eea8819b1caebd23fee732d8f |
| SHA1 | e354d1cc43d6a39d9732adea5d3b0f57284255d2 |
| SHA256 | 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e |
| SHA512 | 908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf |
memory/2460-1138-0x0000000010000000-0x0000000010010000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\@[email protected]
| MD5 | 7bf2b57f2a205768755c07f238fb32cc |
| SHA1 | 45356a9dd616ed7161a3b9192e2f318d0ab5ad10 |
| SHA256 | b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25 |
| SHA512 | 91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9 |
C:\Users\Admin\AppData\Local\Temp\@[email protected]
| MD5 | 7e6b6da7c61fcb66f3f30166871def5b |
| SHA1 | 00f699cf9bbc0308f6e101283eca15a7c566d4f9 |
| SHA256 | 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e |
| SHA512 | e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3 |
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]
| MD5 | 501a9a5129de7239f6ce0de5b26a7588 |
| SHA1 | dfb57c92304f5eb55856903af4dfe1f1bd6b113f |
| SHA256 | 416ba8fd89c42fefc956bf4df1aae6f6131745ca82aa89e1e82ea43c004a0424 |
| SHA512 | 569deeffb251281b552c02eacb51787808827b0f9ef11d1fbfcde4c84fa20fcabdba2adc3e18640dd0b4646c6f7910882a7f57a21d7e5575ce872e0860370345 |
C:\Users\Default\Desktop\@[email protected]
| MD5 | c17170262312f3be7027bc2ca825bf0c |
| SHA1 | f19eceda82973239a1fdc5826bce7691e5dcb4fb |
| SHA256 | d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa |
| SHA512 | c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c |
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\tor.exe
| MD5 | fe7eb54691ad6e6af77f8a9a0b6de26d |
| SHA1 | 53912d33bec3375153b7e4e68b78d66dab62671a |
| SHA256 | e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb |
| SHA512 | 8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f |
memory/2088-2485-0x0000000073690000-0x00000000738AC000-memory.dmp
memory/2088-2487-0x00000000739C0000-0x00000000739E2000-memory.dmp
memory/2088-2488-0x0000000000780000-0x0000000000A7E000-memory.dmp
memory/2088-2486-0x0000000073930000-0x00000000739B2000-memory.dmp
memory/2088-2484-0x0000000073A10000-0x0000000073A92000-memory.dmp
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
| MD5 | cb1d894ee5441be51fc1d29e92a09327 |
| SHA1 | c85b212230384af83366dd4e8cef9b6e9d610492 |
| SHA256 | ca2949f62e8a7ccdb201cc9316785d1b879bfe3f4f1ad90978db9ffb07141b40 |
| SHA512 | 6f580d0275eb904f05a5c630c2bc9b8fd0f88b24e141af58708b0c7b5d4d5df9819f3b92bf834d2632161f8e27b84f4283ed1ac7fb744f32812b24477aeb137d |
memory/2088-2517-0x0000000073A10000-0x0000000073A92000-memory.dmp
memory/2088-2522-0x0000000073690000-0x00000000738AC000-memory.dmp
memory/2088-2521-0x00000000738B0000-0x0000000073927000-memory.dmp
memory/2088-2520-0x00000000739C0000-0x00000000739E2000-memory.dmp
memory/2088-2519-0x0000000073930000-0x00000000739B2000-memory.dmp
memory/2088-2518-0x00000000739F0000-0x0000000073A0C000-memory.dmp
memory/2088-2516-0x0000000000780000-0x0000000000A7E000-memory.dmp
memory/2088-2528-0x0000000000780000-0x0000000000A7E000-memory.dmp
memory/2088-2537-0x0000000000780000-0x0000000000A7E000-memory.dmp
memory/2088-2550-0x0000000000780000-0x0000000000A7E000-memory.dmp
memory/2088-2556-0x0000000073690000-0x00000000738AC000-memory.dmp
memory/2088-2581-0x0000000000780000-0x0000000000A7E000-memory.dmp