Resubmissions

02-09-2021 19:12

210902-xwla1aeefq 10

02-09-2021 19:09

210902-xtsbjabea9 8

Analysis

  • max time kernel
    65s
  • max time network
    64s
  • platform
    windows7_x64
  • resource
    win7-jp
  • submitted
    02-09-2021 19:12

General

  • Target

    Anime-Fighters-Infin_734316524.exe

  • Size

    3.9MB

  • MD5

    bd2b73492acf20dec004360b1605032d

  • SHA1

    60ddf3c107d94bbeb102a2d7ede945eb5edd2b35

  • SHA256

    12b6272825140a15eabec58f97b49aed3ce5db7816a0b3c2674f6ae8746367ca

  • SHA512

    dae236259e32a9e4b789f020dbd8082b376e3c2b56fd94523a44cf4b5a557f3661aeefc24b5605218ba0479ee1b9a8cb7b5c1df6c103673a99f13bc4210c90da

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 19 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe
    "C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Users\Admin\AppData\Local\Temp\is-0G7EG.tmp\Anime-Fighters-Infin_734316524.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-0G7EG.tmp\Anime-Fighters-Infin_734316524.tmp" /SL5="$8015C,3656070,140800,C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Program Files (x86)\Vel\magnam\Expedita.exe
        "C:\Program Files (x86)\Vel/\magnam\Expedita.exe" 32cb7aca069a0c8bb8d51fccce1d3826
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1364
        • C:\Users\Admin\AppData\Local\Temp\q5XC3eLZ\tQX8KOqP9O.exe
          C:\Users\Admin\AppData\Local\Temp\q5XC3eLZ\tQX8KOqP9O.exe /usthree SUB=32cb7aca069a0c8bb8d51fccce1d3826
          4⤵
          • Executes dropped EXE
          PID:1648
        • C:\Users\Admin\AppData\Local\Temp\CKUXqKGI\KCYg6pTj0.exe
          C:\Users\Admin\AppData\Local\Temp\CKUXqKGI\KCYg6pTj0.exe /qn CAMPAIGN="642"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates connected drives
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1544
          • C:\Windows\SysWOW64\msiexec.exe
            "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=642 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\CKUXqKGI\KCYg6pTj0.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\CKUXqKGI\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630350882 /qn CAMPAIGN=""642"" " CAMPAIGN="642"
            5⤵
              PID:1112
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2E4D24B3B18C24DCC7DD15DB00F885C2 C
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1384
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 894E29D581178576C9D0913CB686A04F
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1456
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
          3⤵
          • Kills process with taskkill
          PID:1872

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Install Root Certificate

    1
    T1130

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Vel\magnam\Expedita.exe
      MD5

      8c8b1e33a4bf38b9b76bc1cbb961ed96

      SHA1

      cd033cf4183b91ab93ffb5ed49ce789b18009054

      SHA256

      7c5882ad4c9b9b10bd55c37d3390a0f19bba8c198f9db8f4497fe605d725c8a7

      SHA512

      4a27d39411d56281678b1b0847f2051b50d4d4730445cefe80324ae4c07f46123114b10a2c5f1857fecebf191c4116907a3bb873aba6b061fec401fcc8284e8a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
      MD5

      0a82df3614268536a0afde569de119de

      SHA1

      4445132a22acd3ddb9f3f3d78c120b48cf3d17db

      SHA256

      48b010ffa02994062ce48f483820c85f79dfbd22dbd36e9b78e02aebd1a1e1dc

      SHA512

      e68723c7420e23d18a7dd54a2f457c397bd25e5bc0d9abd489b9ea7d1a78018403dd23d6eed04423aea563719df82fdcf038f01fef039310accf03a8a67bb2df

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_7ACDCC18BE3F9272783F723CF7E4C78B
      MD5

      337372f698a268fc1818d86a743874ec

      SHA1

      0c1b23bbd7d09af7ddf2ad5b9d3f2d51ce175f85

      SHA256

      c0e7f9368f4b82146eb85a8449245c433f40cbd8d6c29e29c3445b5ad17223fd

      SHA512

      39401b8fbddc912f4fbc4411f8094a98da09cc6b58be202d315e2bb9840c062f0dd21a00aa84d57f4bd641e7adba4469a9e049210fc8900d984333bc7e928261

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
      MD5

      41f28f54a836d95d0b987ce98ecf0e5e

      SHA1

      0352b56548c68f721ecb280da1b5127a072bab66

      SHA256

      bdf9890b40692c79e4edbcdd75afebb9365fc152237e78a6e1b7a2ee0416cc2b

      SHA512

      745ba08235ea61c29f88c6daf3062e6e84cd4f71a341bedce80fb3b1cbca0126b3f55016335fb9a57f9898fdffc0e6841896afa7cd63e71dcadc5213d4b74f06

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      MD5

      7d2089faf7fec8061e386d273f4da74b

      SHA1

      298116728c5463f81ad207be8a9f606f2b618dc3

      SHA256

      c48161d7e45b3ef269d0b74f7d395b0a78a24871694fdb24fd0d021addefb5a8

      SHA512

      464a04ec85f6759aabab9ce942ce558fa760be14bed06cf0796dd8a252a3245b7aba2d6b3f37c1129e63f48b4d6b60a28a402eaa150abb2d2a6833e8cf519b3d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_7ACDCC18BE3F9272783F723CF7E4C78B
      MD5

      87a2b2374d9c880e49a2bda7a2a6f6ca

      SHA1

      1bd452919614f3d5ba59173bcdcbd1d043c9a5e4

      SHA256

      142f35ab45f55e94683254d34e6c5651a9149cf15dd914d839e68ae7aac9d15c

      SHA512

      1324f3427651ec69ff5c0d6fc35e6c520059b514cdb9c66777b6b6d91a1eb199071a4660c042643d2379523c0d42b971ae89802976a4998141bac3b80ca43928

    • C:\Users\Admin\AppData\Local\AdvinstAnalytics\6073fee5118372253d99d22b\1.0.0\tracking.ini
      MD5

      9d420efa077a15ef234f52f9e3936fd7

      SHA1

      e6dc947c5f09660182b311948063de8c138942cd

      SHA256

      3fdf1c6744ca281a06fcc9ea32f2c98beff29ca915bacb61a62203d2d26b19d1

      SHA512

      0795083d81cf7647c5659780f39e875709e018946f2619a9f60ecbde92e2f49270d9b802a7e7492d7f3053eff4dcc372c7c17148667c906240ae987c211cc27d

    • C:\Users\Admin\AppData\Local\Temp\CKUXqKGI\KCYg6pTj0.exe
      MD5

      c313ddb7df24003d25bf62c5a218b215

      SHA1

      20a3404b7e17b530885fa0be130e784f827986ee

      SHA256

      e3bc81a59fc45dfdfcc57b0078437061cb8c3396e1d593fcf187e3cdf0373ed1

      SHA512

      542e2746626a066f3e875ae2f0d15e2c4beb5887376bb0218090f0e8492a6fdb11fa02b035d7d4200562811df7d2187b8a993a0b7f65489535919bdf11eb4cff

    • C:\Users\Admin\AppData\Local\Temp\CKUXqKGI\KCYg6pTj0.exe
      MD5

      c313ddb7df24003d25bf62c5a218b215

      SHA1

      20a3404b7e17b530885fa0be130e784f827986ee

      SHA256

      e3bc81a59fc45dfdfcc57b0078437061cb8c3396e1d593fcf187e3cdf0373ed1

      SHA512

      542e2746626a066f3e875ae2f0d15e2c4beb5887376bb0218090f0e8492a6fdb11fa02b035d7d4200562811df7d2187b8a993a0b7f65489535919bdf11eb4cff

    • C:\Users\Admin\AppData\Local\Temp\MSI4651.tmp
      MD5

      0981d5c068a9c33f4e8110f81ffbb92e

      SHA1

      badb871adf6f24aba6923b9b21b211cea2aeca77

      SHA256

      b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

      SHA512

      59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

    • C:\Users\Admin\AppData\Local\Temp\MSI477A.tmp
      MD5

      43d68e8389e7df33189d1c1a05a19ac8

      SHA1

      caf9cc610985e5cfdbae0c057233a6194ecbfed4

      SHA256

      85dc7518ad5aa46ef572f17050e3b004693784d1855cca9390da1143a64fceae

      SHA512

      58a76b4cb8f53cee73a8fc2afbd69388a1f2ea30ea3c0007beaa361cb0cc3d4d18c1fa8ccf036a2d2cf8fa07b01451000a704a626d95bd050afe6ba808e6de1e

    • C:\Users\Admin\AppData\Local\Temp\is-0G7EG.tmp\Anime-Fighters-Infin_734316524.tmp
      MD5

      3e82d951014d6fa1f34b7ea9a6bab125

      SHA1

      8135d385bcb6cad13dc3f4524e6a3b4584939b22

      SHA256

      ec822c16b67f304645977e8b20a81b06eb9d577e890aeec33155d3b19fe61854

      SHA512

      4a8c24ddb0841c5e75bd6b9c1f3015c2be637827db914f4279c3445e9c82ab1eb7790b0611cafdaff99b5115ecd255d913b03e5d11c2a7d094e04a24bb1681bc

    • C:\Users\Admin\AppData\Local\Temp\is-0G7EG.tmp\Anime-Fighters-Infin_734316524.tmp
      MD5

      3e82d951014d6fa1f34b7ea9a6bab125

      SHA1

      8135d385bcb6cad13dc3f4524e6a3b4584939b22

      SHA256

      ec822c16b67f304645977e8b20a81b06eb9d577e890aeec33155d3b19fe61854

      SHA512

      4a8c24ddb0841c5e75bd6b9c1f3015c2be637827db914f4279c3445e9c82ab1eb7790b0611cafdaff99b5115ecd255d913b03e5d11c2a7d094e04a24bb1681bc

    • C:\Users\Admin\AppData\Local\Temp\q5XC3eLZ\tQX8KOqP9O.exe
      MD5

      510bdc47bcc20fb075a12a62b61fe1e8

      SHA1

      cc74647eba86347185b7c776cd275a75183bd6a4

      SHA256

      39d84e0c1fa355e2ec5f5d6080b189ca8682c831ab1ae25ebb30b24298295de6

      SHA512

      a947609d7953f5a15334b7666da65aca327ff1124bfd6b7d2e6b715e7595fe0c6614782861c3e9d945a070b885ac53b48cffdcf12bcb630caa0036ebaa8225d9

    • C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi
      MD5

      98e537669f4ce0062f230a14bcfcaf35

      SHA1

      a19344f6a5e59c71f51e86119f5fa52030a92810

      SHA256

      6f515aac05311f411968ee6e48d287a1eb452e404ffeff75ee0530dcf3243735

      SHA512

      1ebc254289610be65882a6ceb1beebbf2be83006117f0a6ccbddd19ab7dc807978232a13ad5fa39b6f06f694d4f7c75760b773d70b87c0badef1da89bb7af3ac

    • C:\Windows\Installer\MSI4CFA.tmp
      MD5

      7468eca4e3b4dbea0711a81ae9e6e3f2

      SHA1

      4a0c34c342ee7c9df2a0d58d0b5e8bfe94d1251d

      SHA256

      73af1e816ec70be2a3e087af6ed7abc783c50c06b9df224f101e13a792df9837

      SHA512

      3f93a70c8cc05426e08a404c9d1922a46dd4122e7f42bc292f3b5064903a15e13069b58cb615918cc06deaf31bd5805a925cbd656aabc5d78068eb7224a63f56

    • C:\Windows\Installer\MSI4F7A.tmp
      MD5

      0981d5c068a9c33f4e8110f81ffbb92e

      SHA1

      badb871adf6f24aba6923b9b21b211cea2aeca77

      SHA256

      b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

      SHA512

      59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

    • C:\Windows\Installer\MSI5065.tmp
      MD5

      0981d5c068a9c33f4e8110f81ffbb92e

      SHA1

      badb871adf6f24aba6923b9b21b211cea2aeca77

      SHA256

      b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

      SHA512

      59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

    • C:\Windows\Installer\MSI517F.tmp
      MD5

      0981d5c068a9c33f4e8110f81ffbb92e

      SHA1

      badb871adf6f24aba6923b9b21b211cea2aeca77

      SHA256

      b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

      SHA512

      59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

    • C:\Windows\Installer\MSI51DE.tmp
      MD5

      7468eca4e3b4dbea0711a81ae9e6e3f2

      SHA1

      4a0c34c342ee7c9df2a0d58d0b5e8bfe94d1251d

      SHA256

      73af1e816ec70be2a3e087af6ed7abc783c50c06b9df224f101e13a792df9837

      SHA512

      3f93a70c8cc05426e08a404c9d1922a46dd4122e7f42bc292f3b5064903a15e13069b58cb615918cc06deaf31bd5805a925cbd656aabc5d78068eb7224a63f56

    • C:\Windows\Installer\MSI52D8.tmp
      MD5

      f719bd774bbb856e97ff13440b710e9c

      SHA1

      462b464fc253b68222656ef2747c2c322cab00e3

      SHA256

      3682e5eab67c86cf79f289c115d0e3a2231fadc226fe6cf6ab25db2c9b4c4c4b

      SHA512

      870c355a5983872c4ff6afc3e2bc3899856b25c467db31a94ccf8dfa6567ca488f9cbade8548a200631eb4949dbb6f3a95bd56bd36f9430a023b13290898d81a

    • \Program Files (x86)\Vel\magnam\Expedita.exe
      MD5

      8c8b1e33a4bf38b9b76bc1cbb961ed96

      SHA1

      cd033cf4183b91ab93ffb5ed49ce789b18009054

      SHA256

      7c5882ad4c9b9b10bd55c37d3390a0f19bba8c198f9db8f4497fe605d725c8a7

      SHA512

      4a27d39411d56281678b1b0847f2051b50d4d4730445cefe80324ae4c07f46123114b10a2c5f1857fecebf191c4116907a3bb873aba6b061fec401fcc8284e8a

    • \Users\Admin\AppData\Local\Temp\CKUXqKGI\KCYg6pTj0.exe
      MD5

      c313ddb7df24003d25bf62c5a218b215

      SHA1

      20a3404b7e17b530885fa0be130e784f827986ee

      SHA256

      e3bc81a59fc45dfdfcc57b0078437061cb8c3396e1d593fcf187e3cdf0373ed1

      SHA512

      542e2746626a066f3e875ae2f0d15e2c4beb5887376bb0218090f0e8492a6fdb11fa02b035d7d4200562811df7d2187b8a993a0b7f65489535919bdf11eb4cff

    • \Users\Admin\AppData\Local\Temp\INA44E9.tmp
      MD5

      7468eca4e3b4dbea0711a81ae9e6e3f2

      SHA1

      4a0c34c342ee7c9df2a0d58d0b5e8bfe94d1251d

      SHA256

      73af1e816ec70be2a3e087af6ed7abc783c50c06b9df224f101e13a792df9837

      SHA512

      3f93a70c8cc05426e08a404c9d1922a46dd4122e7f42bc292f3b5064903a15e13069b58cb615918cc06deaf31bd5805a925cbd656aabc5d78068eb7224a63f56

    • \Users\Admin\AppData\Local\Temp\MSI4651.tmp
      MD5

      0981d5c068a9c33f4e8110f81ffbb92e

      SHA1

      badb871adf6f24aba6923b9b21b211cea2aeca77

      SHA256

      b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

      SHA512

      59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

    • \Users\Admin\AppData\Local\Temp\MSI477A.tmp
      MD5

      43d68e8389e7df33189d1c1a05a19ac8

      SHA1

      caf9cc610985e5cfdbae0c057233a6194ecbfed4

      SHA256

      85dc7518ad5aa46ef572f17050e3b004693784d1855cca9390da1143a64fceae

      SHA512

      58a76b4cb8f53cee73a8fc2afbd69388a1f2ea30ea3c0007beaa361cb0cc3d4d18c1fa8ccf036a2d2cf8fa07b01451000a704a626d95bd050afe6ba808e6de1e

    • \Users\Admin\AppData\Local\Temp\is-0G7EG.tmp\Anime-Fighters-Infin_734316524.tmp
      MD5

      3e82d951014d6fa1f34b7ea9a6bab125

      SHA1

      8135d385bcb6cad13dc3f4524e6a3b4584939b22

      SHA256

      ec822c16b67f304645977e8b20a81b06eb9d577e890aeec33155d3b19fe61854

      SHA512

      4a8c24ddb0841c5e75bd6b9c1f3015c2be637827db914f4279c3445e9c82ab1eb7790b0611cafdaff99b5115ecd255d913b03e5d11c2a7d094e04a24bb1681bc

    • \Users\Admin\AppData\Local\Temp\is-LPIN1.tmp\_isetup\_iscrypt.dll
      MD5

      a69559718ab506675e907fe49deb71e9

      SHA1

      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

      SHA256

      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

      SHA512

      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

    • \Users\Admin\AppData\Local\Temp\is-LPIN1.tmp\_isetup\_shfoldr.dll
      MD5

      92dc6ef532fbb4a5c3201469a5b5eb63

      SHA1

      3e89ff837147c16b4e41c30d6c796374e0b8e62c

      SHA256

      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

      SHA512

      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    • \Users\Admin\AppData\Local\Temp\is-LPIN1.tmp\_isetup\_shfoldr.dll
      MD5

      92dc6ef532fbb4a5c3201469a5b5eb63

      SHA1

      3e89ff837147c16b4e41c30d6c796374e0b8e62c

      SHA256

      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

      SHA512

      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    • \Users\Admin\AppData\Local\Temp\q5XC3eLZ\tQX8KOqP9O.exe
      MD5

      510bdc47bcc20fb075a12a62b61fe1e8

      SHA1

      cc74647eba86347185b7c776cd275a75183bd6a4

      SHA256

      39d84e0c1fa355e2ec5f5d6080b189ca8682c831ab1ae25ebb30b24298295de6

      SHA512

      a947609d7953f5a15334b7666da65aca327ff1124bfd6b7d2e6b715e7595fe0c6614782861c3e9d945a070b885ac53b48cffdcf12bcb630caa0036ebaa8225d9

    • \Users\Admin\AppData\Local\Temp\q5XC3eLZ\tQX8KOqP9O.exe
      MD5

      510bdc47bcc20fb075a12a62b61fe1e8

      SHA1

      cc74647eba86347185b7c776cd275a75183bd6a4

      SHA256

      39d84e0c1fa355e2ec5f5d6080b189ca8682c831ab1ae25ebb30b24298295de6

      SHA512

      a947609d7953f5a15334b7666da65aca327ff1124bfd6b7d2e6b715e7595fe0c6614782861c3e9d945a070b885ac53b48cffdcf12bcb630caa0036ebaa8225d9

    • \Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll
      MD5

      2ca6d4ed5dd15fb7934c87e857f5ebfc

      SHA1

      383a55cc0ab890f41b71ca67e070ac7c903adeb6

      SHA256

      39412aacdcddc4b2b3cfeb126456edb125ce8cadb131ca5c23c031db4431c5fc

      SHA512

      ce11aa5bd7b0da4baf07146e8377ff0331c1d4b04aaa4408373b4dd0fe2c3f82c84b179d9a90d26cdaa02180f22276d96cf491f9ede66f5f1da6f43cc72e5ac4

    • \Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll
      MD5

      2ca6d4ed5dd15fb7934c87e857f5ebfc

      SHA1

      383a55cc0ab890f41b71ca67e070ac7c903adeb6

      SHA256

      39412aacdcddc4b2b3cfeb126456edb125ce8cadb131ca5c23c031db4431c5fc

      SHA512

      ce11aa5bd7b0da4baf07146e8377ff0331c1d4b04aaa4408373b4dd0fe2c3f82c84b179d9a90d26cdaa02180f22276d96cf491f9ede66f5f1da6f43cc72e5ac4

    • \Windows\Installer\MSI4CFA.tmp
      MD5

      7468eca4e3b4dbea0711a81ae9e6e3f2

      SHA1

      4a0c34c342ee7c9df2a0d58d0b5e8bfe94d1251d

      SHA256

      73af1e816ec70be2a3e087af6ed7abc783c50c06b9df224f101e13a792df9837

      SHA512

      3f93a70c8cc05426e08a404c9d1922a46dd4122e7f42bc292f3b5064903a15e13069b58cb615918cc06deaf31bd5805a925cbd656aabc5d78068eb7224a63f56

    • \Windows\Installer\MSI4F7A.tmp
      MD5

      0981d5c068a9c33f4e8110f81ffbb92e

      SHA1

      badb871adf6f24aba6923b9b21b211cea2aeca77

      SHA256

      b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

      SHA512

      59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

    • \Windows\Installer\MSI5065.tmp
      MD5

      0981d5c068a9c33f4e8110f81ffbb92e

      SHA1

      badb871adf6f24aba6923b9b21b211cea2aeca77

      SHA256

      b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

      SHA512

      59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

    • \Windows\Installer\MSI517F.tmp
      MD5

      0981d5c068a9c33f4e8110f81ffbb92e

      SHA1

      badb871adf6f24aba6923b9b21b211cea2aeca77

      SHA256

      b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

      SHA512

      59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

    • \Windows\Installer\MSI51DE.tmp
      MD5

      7468eca4e3b4dbea0711a81ae9e6e3f2

      SHA1

      4a0c34c342ee7c9df2a0d58d0b5e8bfe94d1251d

      SHA256

      73af1e816ec70be2a3e087af6ed7abc783c50c06b9df224f101e13a792df9837

      SHA512

      3f93a70c8cc05426e08a404c9d1922a46dd4122e7f42bc292f3b5064903a15e13069b58cb615918cc06deaf31bd5805a925cbd656aabc5d78068eb7224a63f56

    • \Windows\Installer\MSI52D8.tmp
      MD5

      1824b1ec9ffa78298b0ab86aded6a205

      SHA1

      eef66f38576c4fd30cdfa509f08e66b90a5a92fa

      SHA256

      a31cded298586024e3e37ef3312fa264483f8d75f7ba8077d247b02c25e9b43c

      SHA512

      3e67660b551cef99f2402badd07c73a777b51f29ef30c9c2ef553dd571ff79e37ba8ad7341065d3bcfd3fc2872540b169ca2a12432600cd53e9ff6aaff412275

    • memory/1092-90-0x000007FEFC291000-0x000007FEFC293000-memory.dmp
      Filesize

      8KB

    • memory/1112-98-0x0000000000000000-mapping.dmp
    • memory/1364-71-0x00000000002F0000-0x00000000002F1000-memory.dmp
      Filesize

      4KB

    • memory/1364-73-0x00000000051F0000-0x00000000051F2000-memory.dmp
      Filesize

      8KB

    • memory/1364-67-0x0000000000000000-mapping.dmp
    • memory/1364-70-0x0000000000400000-0x00000000019C2000-memory.dmp
      Filesize

      21.8MB

    • memory/1384-92-0x0000000000000000-mapping.dmp
    • memory/1456-105-0x0000000000000000-mapping.dmp
    • memory/1544-87-0x0000000000190000-0x000000000022D000-memory.dmp
      Filesize

      628KB

    • memory/1544-79-0x0000000000000000-mapping.dmp
    • memory/1648-88-0x0000000000220000-0x0000000000268000-memory.dmp
      Filesize

      288KB

    • memory/1648-76-0x0000000000000000-mapping.dmp
    • memory/1648-89-0x0000000000400000-0x0000000002B5E000-memory.dmp
      Filesize

      39.4MB

    • memory/1872-110-0x0000000000000000-mapping.dmp
    • memory/1888-64-0x0000000074ED1000-0x0000000074ED3000-memory.dmp
      Filesize

      8KB

    • memory/1888-63-0x0000000000240000-0x0000000000241000-memory.dmp
      Filesize

      4KB

    • memory/1888-56-0x0000000000000000-mapping.dmp
    • memory/1920-53-0x0000000076B51000-0x0000000076B53000-memory.dmp
      Filesize

      8KB

    • memory/1920-58-0x0000000000400000-0x000000000042D000-memory.dmp
      Filesize

      180KB