Overview
overview
10Static
static
5115Q3申報清單.exe
windows10-2004-x64
10115Q3申報清單.exe
windows11-ltsc_2024-x64
10DriverLib.dll
windows10-2004-x64
7DriverLib.dll
windows11-ltsc_2024-x64
7appshare.dll
windows10-2004-x64
1appshare.dll
windows11-ltsc_2024-x64
1mediastores.dll
windows10-2004-x64
1mediastores.dll
windows11-ltsc_2024-x64
1msvcp140.dll
windows10-2004-x64
1msvcp140.dll
windows11-ltsc_2024-x64
1msvcp140_1.dll
windows10-2004-x64
1msvcp140_1.dll
windows11-ltsc_2024-x64
1msvcp140_2.dll
windows10-2004-x64
1msvcp140_2.dll
windows11-ltsc_2024-x64
1msvcp140_a...it.dll
windows10-2004-x64
1msvcp140_a...it.dll
windows11-ltsc_2024-x64
1msvcp140_c...ds.dll
windows10-2004-x64
1msvcp140_c...ds.dll
windows11-ltsc_2024-x64
1util.dll
windows10-2004-x64
1util.dll
windows11-ltsc_2024-x64
1vccorlib140.dll
windows10-2004-x64
1vccorlib140.dll
windows11-ltsc_2024-x64
1vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1vcruntime140_1.dll
windows10-2004-x64
1vcruntime140_1.dll
windows11-ltsc_2024-x64
1vcruntime1...ds.dll
windows10-2004-x64
1vcruntime1...ds.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 03:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
115Q3申報清單.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
115Q3申報清單.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
DriverLib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
DriverLib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
appshare.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
appshare.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
mediastores.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
mediastores.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
msvcp140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
msvcp140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
msvcp140_1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
msvcp140_1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
msvcp140_2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
msvcp140_2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
msvcp140_atomic_wait.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
msvcp140_atomic_wait.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
msvcp140_codecvt_ids.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
msvcp140_codecvt_ids.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
util.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
util.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
vccorlib140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
vccorlib140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
vcruntime140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
vcruntime140_1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
vcruntime140_1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
vcruntime140_threads.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
vcruntime140_threads.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 115Q3申報清單.exe
- Size 343KB
- Sample260928-d8ty5avyht
- SHA256 6d3fee81ad1339b8e9a2ae7d24669fc9ad9ec84c3b13932289fb20a25bce5596
- MD5 a8c9c91d9f556ddc4c3dee2e7af7c140
- SHA1 05cd34af731e5f29a9fe5b7950c25450a893b20e
- SHA512 3aace6b6ac91b50bff730a2a01c1c1fc7ee50b932d1464b82ff2b3ea265b033c5b67067a92f1968dd56f619a22f0ab75ad28311a6c0ce73a352a03f3120472fc
- SSDEEP 6144:yheV9dmppO7+6q4XZ5iNmlRO2Wst9t+jX:yh6h+KTDRWsntu
- TLSH T1CF743C933B5A1C96F897C0394657BE02EB727C990312C6DBA360B55A5F3B6E03D78E10
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
108.187.43.208:449
-
108.187.43.208:443
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 6 IoCs
resource yara_rule behavioral2/memory/1892-30-0x0000021963010000-0x0000021963060000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1892-32-0x0000021963010000-0x0000021963060000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/1892-31-0x0000021963010000-0x0000021963060000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/5516-36-0x00000248FB5E0000-0x00000248FB630000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/5516-38-0x00000248FB5E0000-0x00000248FB630000-memory.dmp family_valleyrat_stage_2_v2 behavioral2/memory/5516-37-0x00000248FB5E0000-0x00000248FB630000-memory.dmp family_valleyrat_stage_2_v2 - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceController = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " Loader.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: Loader.exe File opened (read-only) \??\P: Loader.exe File opened (read-only) \??\T: Loader.exe File opened (read-only) \??\G: Loader.exe File opened (read-only) \??\Y: Loader.exe File opened (read-only) \??\Q: Loader.exe File opened (read-only) \??\T: Loader.exe File opened (read-only) \??\X: Loader.exe File opened (read-only) \??\H: Loader.exe File opened (read-only) \??\L: Loader.exe File opened (read-only) \??\Q: Loader.exe File opened (read-only) \??\S: Loader.exe File opened (read-only) \??\D: Loader.exe File opened (read-only) \??\L: Loader.exe File opened (read-only) \??\S: Loader.exe File opened (read-only) \??\Y: Loader.exe File opened (read-only) \??\B: Loader.exe \??\F:\ Loader.exe File opened (read-only) \??\I: Loader.exe File opened (read-only) \??\M: Loader.exe File opened (read-only) \??\R: Loader.exe File opened (read-only) \??\W: Loader.exe File opened (read-only) \??\B: Loader.exe File opened (read-only) \??\P: Loader.exe File opened (read-only) \??\D: Loader.exe File opened (read-only) \??\G: Loader.exe File opened (read-only) \??\H: Loader.exe File opened (read-only) \??\O: Loader.exe File opened (read-only) \??\R: Loader.exe File opened (read-only) \??\U: Loader.exe File opened (read-only) \??\V: Loader.exe File opened (read-only) \??\W: Loader.exe File opened (read-only) \??\V: Loader.exe \??\F:\ Loader.exe File opened (read-only) \??\M: Loader.exe File opened (read-only) \??\Z: Loader.exe File opened (read-only) \??\J: Loader.exe File opened (read-only) \??\N: Loader.exe File opened (read-only) \??\X: Loader.exe File opened (read-only) \??\J: Loader.exe File opened (read-only) \??\K: Loader.exe File opened (read-only) \??\O: Loader.exe File opened (read-only) \??\U: Loader.exe File opened (read-only) \??\Z: Loader.exe File opened (read-only) \??\I: Loader.exe File opened (read-only) \??\N: Loader.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 5 IoCs
pid Process 1284 ~tmp_36462.tmp 1892 Loader.exe 2196 ~tmp_17468.tmp 5516 Loader.exe 4376 ~tmp_94002.tmp - Loads dropped DLL 15 IoCs
pid Process 1892 Loader.exe 1892 Loader.exe 1892 Loader.exe 1892 Loader.exe 1892 Loader.exe 1892 Loader.exe 1892 Loader.exe 1892 Loader.exe 5516 Loader.exe 5516 Loader.exe 5516 Loader.exe 5516 Loader.exe 5516 Loader.exe 5516 Loader.exe 5516 Loader.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Loader.exe - Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\CLSID\{712FE367-ECCC-42AD-8E0E-1015F088FD60} 115Q3申報清單.exe Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\CLSID\{712FE367-ECCC-42AD-8E0E-1015F088FD60}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " 115Q3申報清單.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\CLSID\{712FE367-ECCC-42AD-8E0E-1015F088FD60}\Shell\Manage\command 115Q3申報清單.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\CLSID 115Q3申報清單.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\CLSID\{712FE367-ECCC-42AD-8E0E-1015F088FD60}\Shell 115Q3申報清單.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\CLSID\{712FE367-ECCC-42AD-8E0E-1015F088FD60}\Shell\Manage 115Q3申報清單.exe - Modifies system certificate store 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 115Q3申報清單.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 115Q3申報清單.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 115Q3申報清單.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 6b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 115Q3申報清單.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff16b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf69200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 115Q3申報清單.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 808 Process not Found 808 Process not Found 808 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4276 explorer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2800 wrote to memory of 5708 2800 115Q3申報清單.exe 91 PID 4276 wrote to memory of 1892 4276 explorer.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\115Q3申報清單.exe"C:\Users\Admin\AppData\Local\Temp\115Q3申報清單.exe"1⤵
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\explorer.exeexplorer.exe shell:::{712FE367-ECCC-42AD-8E0E-1015F088FD60}2⤵PID:5708
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_36462.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_36462.tmp1⤵
- Executes dropped EXE
PID:1284
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:1892
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_17468.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_17468.tmp1⤵
- Executes dropped EXE
PID:2196
-
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"1⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:5516
-
C:\Users\Admin\AppData\Local\Temp\~tmp_94002.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_94002.tmp1⤵
- Executes dropped EXE
PID:4376
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\OpenraVPN\DriverLib.dll
- Size 387KB
- SHA256 d1f93def665db5c4debf60314af20c13f054913bed2241dd370bb20b43245f5c
- MD5 f9b195c25ef24ad6c3d9cb84ad163233
- SHA1 51ce94fbc6980d7f8e06fc42531b927854e069f1
- SHA512 62d3ba908a034846b9e54b8bdc787482b9a80839f327a1efd5cd6d340ba99ecf7e5c0ee83b76e9b75fa5f6be2611d42796933f88a36800bfb438601f157ac09f
- SSDEEP 6144:8N9/TrJmP9K+eeDnjmGhsBOa8CQYOO+2LKHxXR/iinpoO:8N9/PJL+fDyGCBGCRHGHxFtn
- TLSH T1BF846C4AF7A40475E0F79278CD735906DA727C5A0370D68F23A4465B2F37FA0AA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\Loader.exe
- Size 343KB
- SHA256 6d3fee81ad1339b8e9a2ae7d24669fc9ad9ec84c3b13932289fb20a25bce5596
- MD5 a8c9c91d9f556ddc4c3dee2e7af7c140
- SHA1 05cd34af731e5f29a9fe5b7950c25450a893b20e
- SHA512 3aace6b6ac91b50bff730a2a01c1c1fc7ee50b932d1464b82ff2b3ea265b033c5b67067a92f1968dd56f619a22f0ab75ad28311a6c0ce73a352a03f3120472fc
- SSDEEP 6144:yheV9dmppO7+6q4XZ5iNmlRO2Wst9t+jX:yh6h+KTDRWsntu
- TLSH T1CF743C933B5A1C96F897C0394657BE02EB727C990312C6DBA360B55A5F3B6E03D78E10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\appshare.dll
- Size 251KB
- SHA256 339cef1ca6daa65126507c76b5ff93540d4696329370750129039b760455af6b
- MD5 d851b136bed962463d079d025799e6f9
- SHA1 3ae5afa8cbd7822598f0077e94a587ce4bbe3f8b
- SHA512 f50245c56ebb83a35a9b2c7334bb86f07f661b50a1e6ea07ee49f97c6c543a3f8621ee042cbc8762a8bc84f710456e1e3e0f596f99d3ed0eaf7a08f9aa4d3e4e
- SSDEEP 3072:Rkcg8XxocWobfaa3gZ4Mb5k+51RIj6lMXMSpAZAqCQmfCJ9uOuXFb+EUWLqouZA3:jfZ3guM9kq1R46qvpFCXyLuNoOKfp
- TLSH T18C445C5673E40C74FDB79339CD634A05DA72BC524761EA8F03A0425A9F3BBA0653E722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\mediastores.dll
- Size 248KB
- SHA256 02f7f062d9065e15b064afd94137da0723ac19db953733800ea3a04394ba44b5
- MD5 30d90bec43a43d238788d2ecd4b0d2b8
- SHA1 04d2ee43de24b328cece7a530472b19e19a39319
- SHA512 d1155b4278a2ffa4d49b8698c7e89ae638ec82fffe08e901c87b37b1527a3ec5507261183ba85492721dfe432f215701f53d33fb201de8087bf0332c88c8f054
- SSDEEP 3072:P4rdtoPiLB+aInY5cGqKZKi1Ncho0fUf+M6uINQkd1q2M3vETo/jK5oIQ28xwR:tqLAaInilT4zUfv6uqt1q2WET+fxy
- TLSH T1BA44294B665408F7D8ABD17C89878A07EBB2391A4351D7CF07D0965A0F0B7E1BE3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\msvcp140.dll
- Size 553KB
- SHA256 3048df1cf8d476e998dde28ed6b67856b47ec5ae2b2c221fb1733f43c550c701
- MD5 e3791c5b54bd3f1d2a61b1beff9ef5f2
- SHA1 f55535eff838a93bcab300673e93447c3d0a54ef
- SHA512 14931c8e05484989bdbea942f797b0e3d1ef6fb1e60a47b30f3f84b56adc35e18a3c7943004f75e96fbf1a2d5df0452b2511a18418705b3c84c57f2d11b11c04
- SSDEEP 12288:0Tv2OuTt6DRh4l0PU+tDLjfhQEKZm+jWodEEVT6um:0FU+1hQEKZm+jWodEExZm
- TLSH T186C41923B75905A0E195E3B891838705D7F07C4A8322A3C792FBD5AE2F5B7D1A73B250
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\util.dll
- Size 1.4MB
- SHA256 889c8747e20356a83f7e81c1206de869beeed3707408716656ab5b5a14451044
- MD5 1d37b895bdba65c274df607b212774eb
- SHA1 0b4ceb589c01cb9ce4a59194d2f1cec969f93f1c
- SHA512 44f25f52921ecae4256c63fe45c496c419ec509220a9dcc4bd9cea2bd2c2b3485aae581771f94cbaa3ddb38eeee7e9d18a3fb446d7b5b0f465476f3875a28f79
- SSDEEP 24576:/lYdN1TFOxYFzgq1vmz1K+M4bNclnCKqYh:9YdNdFOxnqST1bNclnj
- TLSH T1BB654B890246A6CAC855F53CEE42A413F3F6B911035DCEE7943184BA0F772E69A7EF41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\vcruntime140.dll
- Size 108KB
- SHA256 9593801b89cf3c0a46056f4d923d67b5c685fb8760f007b4d194e4a6a6ed9396
- MD5 41e66b1c590019dc99f544513c0693bc
- SHA1 d882329c786bd1038bbeeecc58c2f3b2a085ac22
- SHA512 8296f7e4113d4e6dbee72a7d29358a67b4ffd1e284a01a3b7fbf4e85878a07444777df6d3c2e6efdea7e7d7a1f167d7fad755f78a655cdb2b89d0330265ed611
- SSDEEP 1536:gQOierMULrYaTw+xkU4X3X6pjxP9vPOiDxvkcYYbBD4ZecbuHcTa3xzZY:g/trT2XH6POiDxMcYoKZecbuHcTUxtY
- TLSH T193B36B8A72A003F7D16AC239C1A32A16F771F8548760A7CF03A54A7A1F53BE15E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\vcruntime140_1.dll
- Size 38KB
- SHA256 b49a9b9c334e66bb14e0bd784be2e0a86edc7d24a9ebf90d1b2bbd71451695c9
- MD5 15e66163e8bdaaaf8bb775b29d9f98b0
- SHA1 48a854b69efa1ab9ef2ebae9b465e4b8ea415ffb
- SHA512 e9f3cd24957045ecd2fe9e175de2909474ce9c69b2c81e4575e965ab4e7b34d7ea7eef3071079b0a176ed67ca2324423b57189713b8d9312804f24dabf1a4ca8
- SSDEEP 384:QHbrv6WeyJSGeWuh1fD/Hk+GlbjWyIhHz6Yf2Q1mPOw6U8z3WrfKWdtT7nHRN76L:zWeMk/D/HunfmHz6SC8MD1Q9zVp
- TLSH T14E034B9467B84086E0AF91B4C4D76F17BA7CF9650B50938F0BA1919C2F637D0AB3E316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~tmp_36462.tmp
- Size 285KB
- SHA256 09761bfc8230d1443f7f804c4ebac5d97010ee1ca76478510407fc7adc712e3c
- MD5 6bb204ca940d4d7774f31cf54efd21b0
- SHA1 603beda76eea3d36d061c1f463e52b0b0b2745fe
- SHA512 b1fa80498caa357938ce5698e0733a50dc8d3aa1638c65e88dae7896599504569d14266700432fc8e0fe083f16445ebc5fe580a1725d4946306463f0b4203c7e
- SSDEEP 6144:Odl/B6XQUsJhlk4Fw7NzzdqrnHWWJPzzeecqySUFk0r5Bz:ul/2ik8w+JP/e9qy//z
- TLSH T11154014246A458D1FDDBAE70C0B4ED5B9DB2FB512F918CCF0175C0684DA2BE06E3855B
- MD5 SHA1 SHA512 SSDEEP TLSH