Malware Analysis Report

2024-09-11 02:36

Sample ID 220128-xq5gpabafn
Target a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1
SHA256 a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1
Tags
strongpity spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1

Threat Level: Known bad

The file a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1 was found to be: Known bad.

Malicious Activity Summary

strongpity spyware stealer

StrongPity Spyware

StrongPity

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2022-01-28 19:04

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-28 19:04

Reported

2022-01-28 19:41

Platform

win7-en-20211208

Max time kernel

146s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe"

Signatures

StrongPity

stealer spyware strongpity

StrongPity Spyware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\winbox.exe N/A
N/A N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A
N/A N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A
N/A N/A C:\Windows\SysWOW64\printque.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe N/A
N/A N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A
N/A N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A
N/A N/A C:\Windows\SysWOW64\printque.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\wvsvcs32.exe C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe N/A
File created C:\Windows\SysWOW64\printque.exe C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1388 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Users\Admin\AppData\Local\Temp\winbox.exe
PID 1388 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Users\Admin\AppData\Local\Temp\winbox.exe
PID 1388 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Users\Admin\AppData\Local\Temp\winbox.exe
PID 1388 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Users\Admin\AppData\Local\Temp\winbox.exe
PID 1388 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Windows\SysWOW64\wvsvcs32.exe
PID 1388 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Windows\SysWOW64\wvsvcs32.exe
PID 1388 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Windows\SysWOW64\wvsvcs32.exe
PID 1388 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Windows\SysWOW64\wvsvcs32.exe
PID 460 wrote to memory of 1644 N/A C:\Windows\SysWOW64\wvsvcs32.exe C:\Windows\SysWOW64\printque.exe
PID 460 wrote to memory of 1644 N/A C:\Windows\SysWOW64\wvsvcs32.exe C:\Windows\SysWOW64\printque.exe
PID 460 wrote to memory of 1644 N/A C:\Windows\SysWOW64\wvsvcs32.exe C:\Windows\SysWOW64\printque.exe
PID 460 wrote to memory of 1644 N/A C:\Windows\SysWOW64\wvsvcs32.exe C:\Windows\SysWOW64\printque.exe
PID 1644 wrote to memory of 288 N/A C:\Windows\SysWOW64\printque.exe C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml
PID 1644 wrote to memory of 288 N/A C:\Windows\SysWOW64\printque.exe C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml
PID 1644 wrote to memory of 288 N/A C:\Windows\SysWOW64\printque.exe C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml
PID 1644 wrote to memory of 288 N/A C:\Windows\SysWOW64\printque.exe C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml

Processes

C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe

"C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe"

C:\Users\Admin\AppData\Local\Temp\winbox.exe

"C:\Users\Admin\AppData\Local\Temp\winbox.exe"

C:\Windows\SysWOW64\wvsvcs32.exe

C:\Windows\system32\\wvsvcs32.exe help

C:\Windows\SysWOW64\wvsvcs32.exe

C:\Windows\SysWOW64\wvsvcs32.exe

C:\Windows\SysWOW64\printque.exe

"C:\Windows\system32\\printque.exe"

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml

"C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml"

Network

Country Destination Domain Proto
US 8.8.8.8:53 apn-state-upd2.com udp

Files

\Users\Admin\AppData\Local\Temp\winbox.exe

MD5 fe0a8fb59460f41c5a2a1ca6d5e6729d
SHA1 2d17786694abee4e2b6151d7bba5081933f8c8b4
SHA256 b300a83ad84f844f68d6ca4ca4c4f3823ac0239ea227e33147737db5e4cab782
SHA512 937ed71dada7f435939fa51781ff0256e190d26e583a646553c5a17e2261a6bd5f7808e84230bf6ee7432a1908cf0407b843f8bce4d33629733767baa7eda98f

\Users\Admin\AppData\Local\Temp\winbox.exe

MD5 fe0a8fb59460f41c5a2a1ca6d5e6729d
SHA1 2d17786694abee4e2b6151d7bba5081933f8c8b4
SHA256 b300a83ad84f844f68d6ca4ca4c4f3823ac0239ea227e33147737db5e4cab782
SHA512 937ed71dada7f435939fa51781ff0256e190d26e583a646553c5a17e2261a6bd5f7808e84230bf6ee7432a1908cf0407b843f8bce4d33629733767baa7eda98f

C:\Users\Admin\AppData\Local\Temp\winbox.exe

MD5 fe0a8fb59460f41c5a2a1ca6d5e6729d
SHA1 2d17786694abee4e2b6151d7bba5081933f8c8b4
SHA256 b300a83ad84f844f68d6ca4ca4c4f3823ac0239ea227e33147737db5e4cab782
SHA512 937ed71dada7f435939fa51781ff0256e190d26e583a646553c5a17e2261a6bd5f7808e84230bf6ee7432a1908cf0407b843f8bce4d33629733767baa7eda98f

\Windows\SysWOW64\wvsvcs32.exe

MD5 263fd208754ff500b72d6fa2d76f096c
SHA1 987363037f0304a7440c5b50c764ab9a8e25e1b6
SHA256 9cd7b03de50ae5902794efdfd62775f37674af4b02ee1f6336e9cca637faa7e3
SHA512 c988ffb3e5413d7793d067f925fe7ad23fb12e01b20a56ab3ef9e5d1150ca7173b6dc36297852e1775000d72fd0005c8b204c61a00ee227bc323ffa2234d2456

memory/1668-59-0x00000000758A1000-0x00000000758A3000-memory.dmp

C:\Windows\SysWOW64\wvsvcs32.exe

MD5 263fd208754ff500b72d6fa2d76f096c
SHA1 987363037f0304a7440c5b50c764ab9a8e25e1b6
SHA256 9cd7b03de50ae5902794efdfd62775f37674af4b02ee1f6336e9cca637faa7e3
SHA512 c988ffb3e5413d7793d067f925fe7ad23fb12e01b20a56ab3ef9e5d1150ca7173b6dc36297852e1775000d72fd0005c8b204c61a00ee227bc323ffa2234d2456

C:\Windows\SysWOW64\wvsvcs32.exe

MD5 263fd208754ff500b72d6fa2d76f096c
SHA1 987363037f0304a7440c5b50c764ab9a8e25e1b6
SHA256 9cd7b03de50ae5902794efdfd62775f37674af4b02ee1f6336e9cca637faa7e3
SHA512 c988ffb3e5413d7793d067f925fe7ad23fb12e01b20a56ab3ef9e5d1150ca7173b6dc36297852e1775000d72fd0005c8b204c61a00ee227bc323ffa2234d2456

\Windows\SysWOW64\printque.exe

MD5 6cdd4a2f81f453c478cf08c4d60cb88e
SHA1 512583ca2252a394836b9995a40075707c6e8235
SHA256 6424307ea25f1889e4b9fb8a64d860e42681cddf71a5a70af7963ab282225c8d
SHA512 112112d72182e882256fbecdb655b5e0640d593e36b7416c7951fc65157a39cf09b4171d22d702133afea66a4e1488889a901f365ad199055de57bdded349252

C:\Windows\SysWOW64\printque.exe

MD5 6cdd4a2f81f453c478cf08c4d60cb88e
SHA1 512583ca2252a394836b9995a40075707c6e8235
SHA256 6424307ea25f1889e4b9fb8a64d860e42681cddf71a5a70af7963ab282225c8d
SHA512 112112d72182e882256fbecdb655b5e0640d593e36b7416c7951fc65157a39cf09b4171d22d702133afea66a4e1488889a901f365ad199055de57bdded349252

\Windows\SysWOW64\printque.exe

MD5 6cdd4a2f81f453c478cf08c4d60cb88e
SHA1 512583ca2252a394836b9995a40075707c6e8235
SHA256 6424307ea25f1889e4b9fb8a64d860e42681cddf71a5a70af7963ab282225c8d
SHA512 112112d72182e882256fbecdb655b5e0640d593e36b7416c7951fc65157a39cf09b4171d22d702133afea66a4e1488889a901f365ad199055de57bdded349252

C:\Windows\SysWOW64\printque.exe

MD5 6cdd4a2f81f453c478cf08c4d60cb88e
SHA1 512583ca2252a394836b9995a40075707c6e8235
SHA256 6424307ea25f1889e4b9fb8a64d860e42681cddf71a5a70af7963ab282225c8d
SHA512 112112d72182e882256fbecdb655b5e0640d593e36b7416c7951fc65157a39cf09b4171d22d702133afea66a4e1488889a901f365ad199055de57bdded349252

\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml

MD5 784926962cba0ecaa4ca117308869482
SHA1 ab1df9bc3d3030a099aaf539861e9782581808e9
SHA256 110b6aa04e50be42045c3143cc753162076b8d630ac7e96df61f0641bbb2f5a5
SHA512 b5212538299e77759ed2df31073dd137c72767683c18bd38b69c6e0fa843a29729888f5112a991879a092a382527513520b7d7332eaefc9d7f375e9137930c1b

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml

MD5 784926962cba0ecaa4ca117308869482
SHA1 ab1df9bc3d3030a099aaf539861e9782581808e9
SHA256 110b6aa04e50be42045c3143cc753162076b8d630ac7e96df61f0641bbb2f5a5
SHA512 b5212538299e77759ed2df31073dd137c72767683c18bd38b69c6e0fa843a29729888f5112a991879a092a382527513520b7d7332eaefc9d7f375e9137930c1b

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml

MD5 784926962cba0ecaa4ca117308869482
SHA1 ab1df9bc3d3030a099aaf539861e9782581808e9
SHA256 110b6aa04e50be42045c3143cc753162076b8d630ac7e96df61f0641bbb2f5a5
SHA512 b5212538299e77759ed2df31073dd137c72767683c18bd38b69c6e0fa843a29729888f5112a991879a092a382527513520b7d7332eaefc9d7f375e9137930c1b

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847544_0.sft

MD5 18606f2d4b0f74acdee3ecabb0311c3b
SHA1 2b5179a3ad1fd15160da12f803b7a6cb6367c511
SHA256 67c99078491135eefac251569300882f6f9ec5b2659c77accb8d74ba1f361dbd
SHA512 dcef3ba559b26ec9499be6496b2b855dc2018257841713619b1976019060da802eeffa46d519e5c264bad58c1560167f9824464e47439be45a1dc942cc18e082

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847544_1.sft

MD5 9913ba89e7794d9028dcd37579fdb285
SHA1 5841b6c6e0a2aef66edc487afde37151f66bf813
SHA256 2f05f29808498ea4d62ac8ef62c3ff19c02132c1a16b4a1dc4af7167278d01b4
SHA512 6f594842c95c57a6927435a9130ded262e53347c92f8ba3f5654378b402ac213a9401fbff8054c4ca31d1232d363612e294f3aa61eb8b7837c67260c344a6ec0

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847544_2.sft

MD5 aaede194a7d89b9cb2880e4e5f605b34
SHA1 8be2bfae867ae7734d088969557b7e53393f38e1
SHA256 7fdb5c909147ed0a235496f19b50294337aa3765f2bd0805bf706f67ee8bbb14
SHA512 06e417732e7bfc0327cc62ec2d556fa25839144968c93aa6a987b1e51935967e4a663789aed7ca1c068287294ba35a1cbe888352325f232d9e4637c27afd51b9

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847544_3.sft

MD5 ba32f248e389a3f8a592e23f942613ce
SHA1 7d10cf9480fd24014756cd92a8872a3bc3d2da9a
SHA256 054a6e3a25f2fb4bc8bee4e1153f964adbf860e6399195f99508a86d1f9e636b
SHA512 7f02e8f134b4d5061221ae6806efe0645f476ff898b6f0417909657f4415ad0b223bddbfc412156e2b2729ef710107b41834610e4e7a361830a57834e691db91

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847544_4.sft

MD5 77d2ded6bb8eda4347d1a52cf8506aaf
SHA1 a5d4c8722cdad1afeddf9f14ad7830b9e2f4e675
SHA256 3620ce22908e8be2db8322d180637fb3c86f1562a35919ad95384e1f6309c5fc
SHA512 49805f99edf6a8f6affed5c657093bf6f532d2c13a102087567b8cf1c3fc5173cd9c1dc2c82c05ddb16a054550be7df84c20bc93961b8bfc74de682e6eeb7641

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847544_5.sft

MD5 73976581d6c29f18ac58deff986e6dde
SHA1 84fa37102b002b233c7e06aebfc556e1ea2532d5
SHA256 c826e7a992516be5f88ec78f8a1e58b9dfa23fc780503a3e2303e816eea7afa6
SHA512 e237bac52756d3c9c2ad9807d900bca32567bc0ff8f56d347ad79c9a0289b7d9d2859bfef6975c68f3f8b15f41882168a36ae6ec32b15327a1dc36e363806654

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847544_6.sft

MD5 a0f7e3ccdacf4083ee29f15d7bbdab9b
SHA1 e1b48b0b45e239b27f9829cc7f21749cde556b7a
SHA256 1dd6f139ca3e4df38fadfd9bc47355de7d1f9e03f6940534ea70dc54bdf195d2
SHA512 81b4651e80360dd6dd3af98154b3218230178de59df458a7e29fee6d4919256348a6c35282860b5246e078f0ddba8fbab3ce15b06fbc753466a925987f76a973

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847544_7.sft

MD5 d908c36cbce7cfa533c1d7caacd7f1cc
SHA1 6a4783681f458801abded6125d8fedc5f5a05c54
SHA256 7b1c5b38189831c98f95918c1e404adaf4981bdaf242cd1ff3f5f7f66318f0d6
SHA512 7c676968870781ce304b5ee8d4a94e48dc8029629f2a42d41acc4aacfdabca4db007a8247f2302507ba9f6a24b5c269db8ff235434a831dc8a618479c6d98e85

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847544_8.sft

MD5 12df5fb81dca06561b1b9619cc2db341
SHA1 9e7dc5bde11a71cd630cc0d39df3aadd80f60ab2
SHA256 2552a099c030b0cfa4151a26f2f4b3b7761eb092e02e22f633edb3820298d040
SHA512 4ac35c52b59ba8a9cdfa9ce3e5267e3ba308d18a415813de57b821686851efb582f2b931d48301ed85d78dab75291564b1bc709bc0f5eac12035836409d35a39

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847622_0.sft

MD5 8a38b8d58a50a3b5e17df0a1c62f9113
SHA1 9e18e9245564a64a72e430246df43c125d13d65a
SHA256 1472c71727c77bd07f4fc08360028c75f3c2410036da8ef88630f811d0a6edd1
SHA512 b194b2e63155ea929a441303e63195c6d28f358b04b2dcdade399b5f7b9de3d9b46b5b3f60e1ef77fcd8e1e72aa1f59d52144f2cab31c180dfc021da2d9335b5

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847622_1.sft

MD5 623c68be25a8fba41a09142b63fdbc62
SHA1 a3523bcc67d317b3f942bf52248cb4abed42aa78
SHA256 8aa2cdacfd8060b1fd743dd81e548e6dcde45b7eace60106d09591926d553adb
SHA512 266f84cb4e03a1d8a30969499edf50d5f52196eab05679d76cf7eb531a1b3162d9b4dd861a1415c0d7eed8ab99f6f3ad52f97cdc400534b723c9c054f25494c5

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847622_2.sft

MD5 bf552740d6573f680acffd5cbb3f5edc
SHA1 99615ea54247fff77f70dc3ef10f098ad66fe238
SHA256 9f1551a35acc5211bf4745172ef02d08946ab5b0e50151f5412506f2fcd33e52
SHA512 293407d7f96e0d8a972a750f0eed2a8a6c6195030b67a78ab35b1854fcec39fdeeff3dc8329a333c8d494a7755884996d7a3b4437f1136d6dc9913503c508d10

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847622_3.sft

MD5 8749da0da0a4510ec55374e435923bf0
SHA1 08fcb1c41425d520cc9c00d8336df237140eb414
SHA256 3a63f142dede7e0396a9e5f9a736d61f9840e9e41a8efd373f81d930e04db70e
SHA512 d3cc1e3a590c3493c1995290fc7a1ea6caf0aa722598f61bad8b0af2bac219580d955b86c77cfba8da69396fbdcba91652cbf8e22c077d49eb3ce43efd4201f6

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847622_4.sft

MD5 170065d3235199b45a64df359a6b5de2
SHA1 45d388b339310505d8803902d6a4c71e36aa8af8
SHA256 c1c3dc4eb2c8c1d42893432fb7a960adc67d58efb55304d4bad8e0605a5812b0
SHA512 dc0d9dba6f6c8d054d193bd0e27f875b90b496168d5fbf142764e279de0a71c8b0a085c491417826636614def84addc799fd002e2825465bf43bd22beac159e7

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847622_5.sft

MD5 cbd98f8c03a0230bc5582fb50254338c
SHA1 41dd12f7353540b711036549e543fa32f832a927
SHA256 b95386d6f16107133effff3a3f6dc1570629108ddd3e52ca572b581b36d53b2c
SHA512 c87d6492e210db4a1e33edf9b85e42281e11b3c2e76a3a316fc44ee06352e76c5710ac7239389b721be064c7fea15cc8a1e3fdbd10076672aac3f80011ddceb7

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847622_6.sft

MD5 2246f5169c01eb92bbc93465e9dd4089
SHA1 1779c5ee412c3afabafab7abdb10eaa78fa3af60
SHA256 0e79aede3cfd9c27d80b07b7487b93ca704b34ac56a17a4a74fbeb27cf172b67
SHA512 7d90a80f23487b38d9429099506648f88762a7d540aacafe43f2ed8d66b4608fb818c665f539c6d86ec0a94d8807227855bfcdc0e7d11aef6901f9f00ebeea57

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847700_0.sft

MD5 37f0fb87f79733beebacb8d5964d95ba
SHA1 fb304ba16b55437205f2dc3cd4a77b052923c513
SHA256 294ee6dc47cb85ccdf6efee650a04a90202408c7a717b2f968aeec1e24f78aeb
SHA512 a1f6c22a02fb5a29ee84eb5e46d66864b0c90e302e0ba7dfca8fa8b19007e5cf06dcae619d233fea5dd03f70b338a8d9bbedb70fbe592f9197541d27b862b7c4

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847793_0.sft

MD5 6990382119b394368b8de15c7856e492
SHA1 23c0777efc696e0d7cdc5c1a9fe73ba6d15e5335
SHA256 b552b4372767da415acdc041c20e4eed0f86f098afc7d3d50dca29f6e2dc2a91
SHA512 836d872e634032886f1b0058e2d1d691a5ab330eac1ade1b164d42da0d5a9e861fb9487c6e912665979c2c5e5a6b91b4dfc8ddd45e4531f1a2f8e78e794755e0

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847809_0.sft

MD5 49945b0cadc2a7a570f6e2269ac2e118
SHA1 126721c5707d68ce9bb28918828e663aaadf9b52
SHA256 a6c54ee5620f79155d5e34e0a2397c0aafeee2f7d2a2e75509158b20d2a83e0d
SHA512 10465c9bd7388edd0d823505151529bc248879724f1b7ba9af0c90d0b4453789c33d8bcd8095c1d9ec84321ad0dbae2e6b82d142fbc42c15f5f3e020bc6505bc

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847825_0.sft

MD5 1bb981ab58ab477defdf3dc28b820b44
SHA1 3b6e649fe4cdb35e29ff0348b519fc3c0d2839f9
SHA256 6c7f1df9d39b9fb4f7ef7884fb967bdb78165777f83051426eec34eec6d5b83f
SHA512 2058e2ca35ee2bb4464d097466cd411d625d4eac942a26fe8e802e31d7de66248dda0c42fb7ca3ec9430eb2387751dad6e11866006c6e28b45b8659a2112ab88

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_0.sft

MD5 a462219e5d93cd45d7c2573889c18a7e
SHA1 27676a2b4f36a8fdba73accc91c580fe2b6b3144
SHA256 f392b337b22442d04bc2884101c114a7e99db5d87be18c332affc6eccb52a3f3
SHA512 ec95c909efbad492d3c7e203a4bf9ebb490f400518e074f1e532bd9a909b3fbd13c6bfd166327e40fd26e5e7e48372a3e3a56c65a4267e5dca7a4f9059bf2692

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_1.sft

MD5 2a322b22a0249d005434a544fec8fa40
SHA1 3d93523d3b3cbc173bdfc54818e284b64adec762
SHA256 46aab536bb5a0ee01c7dd41fdcae51bde81aa221a99d48917761573c17cfced9
SHA512 71ce66bcb5d592a4e0e668215bc3394ebe5b2355aca337214fe28ab0a9d39c26aca77932be436625b41441ba959bf78bfabd3212fcf17bced8c32e0805ba8885

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_10.sft

MD5 7a4942302ff4d6bd071caadaf1ae96cc
SHA1 ada4ba58978a88ad911f3cd1a376474ca9912c55
SHA256 7a82dd6b8afb8d05e61179f0aad6cab0a6095df1ccb64b4224dd5eacaf13da52
SHA512 fb0ebfb6d5793059cdf562952ee7b3eb07af03b7da076f0c6fbd49cfa6c9358405899bbd9363c6a7b2bb064f37d86d166eaa36ff34eea1808d4bc958c27665a4

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_11.sft

MD5 74d89e2e9e4f9a99686b47b4f0f62dd7
SHA1 9371abfa9691fd5e1ad64e4fb949de1c5ad2d7a7
SHA256 509dd5b480ded897bbd0380078f0d2c4884636cc14a8c473339ad0fa37c0c0b0
SHA512 3ab2ebc6e4f83dcb8532667e9fa23cacbd77942635320c27c95476701486e2dd83f6bd5d9cfc389d70ea804d6677a21d68e72b4c0c3af035f653afb07171e65b

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_4.sft

MD5 99bfec8d92b84a81ca6c30a6389a7382
SHA1 30b50ef8823ceca8b0599499c773c7562917f8a7
SHA256 4739c8137b443a79e469441ec1a6ca722ebdc6dd239a937ba3261138599ca030
SHA512 7640b6ee6d0020db5105352bb65916ee92227a4c70685a202a479fcfa00d0085de2b4804246e7f79217adc9ec912a183fbbe37e3629737feb32de69c61697fe9

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_3.sft

MD5 b012fb37b02b362d880fe02c280cf403
SHA1 79f20b2d8801b61dee7f688529c2c82712a0f19d
SHA256 4d78655b525d9362a6d18e10e00db5f9f04710d9859f7cc989e0a4a6405e0f5b
SHA512 72d9365c1af79fe10d101cd1cbd690e487371dc4a9a252b0eb64006e868d15304a45df29058f019e44abe9d9af6e75c7ae17d7fa1cc113a2bce16d8b08409bd0

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_21.sft

MD5 40fff53812dcfc29ef0353c064a914c6
SHA1 c3c2d5e00a53469d02353ede76d98e52a7e6033b
SHA256 0cd9b18f0749ae79b6d6a856826661f3ea1117ac06d284b04a2b3f8b81200ef4
SHA512 3e7b27be254711e62c52d13b7b330d44743605c6126007973c5376f71ac5bd1d0cae3e0370457c3ddf5d5161598fb998472b8d87fed94f998f741ae0d470eb19

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_20.sft

MD5 9e64b667902c74cddc52a2a0930dc016
SHA1 3402b7c9ae2746e1ebd89c199ef0071d47ddee54
SHA256 7976753206b75bd0ed7470b551fd3e814056f2d9fb38fddefcb9dca11216177d
SHA512 b5059518105221cb73fa7a7da9462e07b1392719026ae4c1e4f7ba533d061180c139a20469e44e494bcd5ecad662fa9c5ee664625f699e9a2fbccb4ee35d4ac1

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_2.sft

MD5 5858b31f66ea1e6210d1cf3248d6d4d9
SHA1 17c3a65352cd2bbc914deeacb9a08fe7aa322812
SHA256 cca55ef1fe6e308f8f273338293d00d52744715044629e2727181dc1f2483494
SHA512 45e5c7345dcb99e4408db5650ee72b57450cf8687864bb1acb2ff385ac9f75e7b58ef41aa9368371efdccdee1a396164a4c90872c49d3056ca5ebd704fd099f0

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_19.sft

MD5 0c961a233cc920d8ad0a9d6c125ad508
SHA1 08ad805392e25a0c77e519894b43f668d47a0042
SHA256 ee753a5fe055b7d32b06ad90a6f589f7f12e2348e05b330a10f3b746e5f8684f
SHA512 087c5d213151f8f19bf08711860e132bde5db142782e13497b73adeede33300fa5346f30f763e574dcd2d7399468db48db2bd2f3e32f8b9816892873b6a25037

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_18.sft

MD5 fc6088f008d98f8c5421c5310b60fe16
SHA1 26d3deccf8693da5535da0d9dff8b3228a0fb2e2
SHA256 2a4d7dec71e88f4da0335df96a940b1aa06567da11127b022f198204fd5f2c72
SHA512 c5a08f7b58b07e0631c4641b3a19a2daeaca1f6299ab95c2960725a40daedb397b37efb95c7b20e42b6bd47cb229ea9c7d8d0720d5ab5fe671b56beb675d795d

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_17.sft

MD5 e2b537166df97e4c3f161780c585ff60
SHA1 32af779858312340a715b937b4c528ddf7dbde37
SHA256 e5b813eb6724cdbd2b0fd40c02b2497e09ed5e7e2e08a52cd12c360a987f8070
SHA512 e6db01cf7f2d5f4c8d88a5def149915e10aed28807d29240f273370af603d7ec867e50b4266dd1bde70b9b5deb1d33d8b80f21323ee245dc323a391ea9e05567

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_16.sft

MD5 cd6f97c743faabab39b13141d0ca6116
SHA1 1266a20077e2c332392e235def144b72e799575f
SHA256 2e785d7bfe09fbe337ee1b7f75b08feab45e26535377962f18c9096aa27852c3
SHA512 7dbe32e45d56685a7bb3c50fb656a2a176b73a7b0d9310d15121fa029ecf39be79dd9e2b780cdbc809c2f17dd7d954e2f36dd917ed42c894bb65f1ebedd5c09a

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_15.sft

MD5 8679848a923c15c0de629764af7f2eaa
SHA1 ce5bd7c1ffbb482ed89bd0e7cd70b6a02657561c
SHA256 a3a10faac61ad9fb22a4406ec0ef7ae90c58782cc0d9776790ffe0d4bda35714
SHA512 6877e332107116c863f1aa0c23d0ac0f957178a87817ec5be0686976b1bf9db3c55e2642731083edd15680f39c58eff57bbf1fd02cc9deee851c5e07591942e8

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_14.sft

MD5 30aea1dcd5050ba47347559f356a2001
SHA1 0dd2cfb30c70c734409dda3314c43c99eaead2e4
SHA256 4691905d500c805056e266768aceaf0ac7c58c830284d187196fa3f4926833c1
SHA512 f971a52f683e2c9662942cdff4a774573c1aa32667ea0dfe30fd732483c591e3e420ecda9e44a8ff8eee508e0141511c65968b7aa1c406b0c58baba7a6cc0397

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_13.sft

MD5 6fa3f77b22cc05455f8b70dd152a3b97
SHA1 8c67ebd37125b23e2d48f56b7c0a282a7e8d6701
SHA256 d177066bc363f23bbb47bfb49f0c93b5108ba03a5ea99363c474ff2984c8d966
SHA512 4ae24993b2d642e8a9a579c69933cf1bcaba63e21bd0423b59f1d464e2a3ac12af500d20533c64402aa69f90156a88004b97e51930a7a7629ff5d57e38354e1b

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_12.sft

MD5 81d9e43b506baff7c6a559acecc3bb6e
SHA1 52f4bef3993f6f42a8f73c563fbdea9e9d7b63aa
SHA256 884fcdcfda92e6b349391d0d0f12d53529b34c63f64fd036bcfc306f6005bbe9
SHA512 bf8d20d190621dfd3a20c8233f399afa52b9da3e23c1cc35651ac9124d1150d2574f652decd78507f80fc7a3140111700039258036d279eb688b25f7e023a75c

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_11.sft

MD5 d9a9aa826bcb4db12782dee310803d63
SHA1 12831845deeb6fa23ef3c5b41be726269db2d9c3
SHA256 32b622a741015d747d013b3a2fd5a6845018f39142bee63158928e039217aa2f
SHA512 9cbc597c0c999bd13af1b198dc70089419a66188cb94de4bd1e25b527ac3091ac0b84c78330c56de5e48e086b0ce64189e7c41b2b6397a6f066103353cfe4734

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_10.sft

MD5 ac5e0a01048d690a445aa6e571a13a3a
SHA1 ab9c72b9384c092d699dfabe727f6e5486c1b88b
SHA256 72018bbe288f286a7f4632ab05c1e23b29890cbdd199a0ccbf8b441ba9cc95f6
SHA512 c59247a4aec1da903dff557982692a9a627221791cb4c3737056844ee039170bea2627f13b7e37ce4d7efa0f6c231a9b7a4bb817c355761230c2f328151d615f

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_1.sft

MD5 567ad973b0047ec06cf4cc89a4ae8915
SHA1 8602fc4e17d07ae5e4aa7ebf78372409937d384d
SHA256 5f9fee1f0f7bbb797c7c707120a1462925bfd1b959e6606dcb33f791a1538ee0
SHA512 8bf2d0f1fae5259a1bd623cf92f09049eda61b74d19a234471a30a36a91226a506b8242f444faa7261360f8dd09df7fd3449ea0df16cbdddee4558e9c822dd4f

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203848433_0.sft

MD5 28c801e439de490c44ee20c7ce521389
SHA1 2faf70a4ba6675ff55f68c37afad64469aae58b4
SHA256 9e3b24263b243a48ee8c648fd146b90c08bd72f1490c3b4480a0a87041b33e8b
SHA512 7ee9cf7b1bf4084e8654593e641233e28fb458465c182ae2a08a72c96ed6fe5faa12ebb45390c50f083500007680e19370b46cd02da9c7a029dcc3f28c2bfa48

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_9.sft

MD5 9ae4964d71fa2da9904237f44bc03e21
SHA1 d6c87fb17d98c9ed2f1cefa70b67121e3d154a2f
SHA256 909739e32a2d2c68910daaad2bd5209790e32e6e2aa5d2c156ca5e6add25d858
SHA512 cadd399300ebbf841527fe2fd9f648bc4f37eb30df78201a07e54a88661d36c2a39275b001248fd1c75d69121427336553d54621a1e2fcfb37cf7780c478423d

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_8.sft

MD5 080b20565351f85b413bb6d7e9861f3a
SHA1 d38bd75f74a957328a0fc526b3d7a235c3c0bdc1
SHA256 f4e91dc75e07689766d5ff5f3b9c1eaf34e515eed93bd6c9cbdc4f72621682ab
SHA512 8958223ee0b60ba599c7403ceb1e60618609704f6b62106178162950c3bbde54e023297c5543ae3d90c8eecfa0e3dcc1967df321b269b62de68d7ce79d95434b

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_7.sft

MD5 fd67bafe72030485709ed5f494cb4dd4
SHA1 3dd16b3825367f426cfaf61dc9ebe9a1b768283a
SHA256 9634ecaceab28e3bac57392e69cbfe1fbfb52ab18d9e4df85f25ab6a09f187a2
SHA512 8375be0ecac27c2b5b107d3aa0f0a09268e5724a900224800b5641647a4d272fa3a58be0af102daf7078850d75f5e5fb9c311e469bb0fff39a97b3a82d975fe2

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_6.sft

MD5 5fdb3bd2311fdf47896a504cff1d847c
SHA1 4c35bf6a0e08d020e91d593956cf1dddf1fd93e4
SHA256 e147f493a19078c28055a5d92f9e1b87e7bc4244e1bf35970e3b7181f79f41ee
SHA512 66b27ec004ee20390340223e5d14f09f37cb43885de85cd900d88a698758bbd1616574614f1de3048dbe52958eb5b912c3bb83f63bcb44da25247954af61b209

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_5.sft

MD5 6918884f54bab4e9968e1a9cf50cfe0f
SHA1 2656c320d2d661792de759ede1e2dcfbe6c64d90
SHA256 876ef42c6ecb234717b41fc0ae3cf72ef6e56c65bb867bf7f2741d9faf73560c
SHA512 79f329f1ef9627554db4fdfce41d99d0024d3464b63e1f5bf837f4176c17cfcdd443bf7806ca4234b341b3e3b2b03860cfb1adda847dc5df18da4300a19040be

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_4.sft

MD5 dbd2badb1ceb33948bd5be563cc62478
SHA1 7debd08cbb71b729ccf416309571f4f45fe6efb0
SHA256 3348091b98262d6b4dd7bad8063793ec880362461e8c05a142f81114a015f2a9
SHA512 8e17a4573668ed5fc635476726c9e62f4e808b49fca5d6b1b7fe776e53e92b90ae04f00273885c83a65c182869f67c70d2ebd2d55e393882346d6416c682d3df

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_3.sft

MD5 564ca0b1c65defe1f39739feef58f0fd
SHA1 a09ceefd6d14609566664aeb277e5be3bad546ec
SHA256 ab92d17ba5c2e2880bf71837e4ac53352b6a88d356842e99ab7eb1c304f5c15f
SHA512 6d5b0c786f550e502a819345df2d3fb3786fcdbc134be486f97c25a8a63dbca50b852f099576c251153288d0d5829c2207d0f6bfd3c88fa05fbabe75c995c237

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_2.sft

MD5 3319397334716b817c50ee1a1d7da9a7
SHA1 9a06ba9f2f8df18b361f058cfdd0cd4ca2a01dbe
SHA256 84da8ac25ea47e8b5a6379a8ab83ac7d7eb71f6c2f205c2582f00e61a1dafcd5
SHA512 12cbe7d1582ac7fefb12ca83152ff1cb4bfd523e8e910fa587fe0d970ef1a638a37d3df5054b210dbbcad5f5f352b2cb22a380f1f69940af5e5455f71a5e6a24

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_13.sft

MD5 3179ce524e97c355e08a412f0009b9e5
SHA1 df850aa9e240753725b693a69a1513e7be0eccae
SHA256 6045a8a5538a483b7527a7a9499cad4eb633e856e360bef68a0d640a2f334602
SHA512 3e5a177c8aaae1fefe2990ea4fa9274a8c8ea3766fcd4b38da91a7afeceaf3559b872f6f37e32f567efb53940d170f6dd693e1566269f4d224df34f753d6cebb

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_251566352_0128203847903_12.sft

MD5 e256cf73e8da8e05ea5c413c03b32d42
SHA1 ab86751d1e55b9789fb3bba505fc3e224a93c109
SHA256 013052b72c29dec258d9786523fd72a62af10bc317cec91794ecf3f47be0f6ea
SHA512 fcd2a424fd82ebdd2023e60d792edbff3bb2e1c8ff9da33d88c0f5cb9e2bd931b544378cf4ea487d75c2d0d411017f31baced569968cb6e567e0564009e4ed23

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-28 19:04

Reported

2022-01-28 19:40

Platform

win10-en-20211208

Max time kernel

157s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe"

Signatures

StrongPity

stealer spyware strongpity

StrongPity Spyware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\winbox.exe N/A
N/A N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A
N/A N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A
N/A N/A C:\Windows\SysWOW64\printque.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\wvsvcs32.exe C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe N/A
File created C:\Windows\SysWOW64\printque.exe C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A
N/A N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wvsvcs32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2420 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Users\Admin\AppData\Local\Temp\winbox.exe
PID 2420 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Users\Admin\AppData\Local\Temp\winbox.exe
PID 2420 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Users\Admin\AppData\Local\Temp\winbox.exe
PID 2420 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Windows\SysWOW64\wvsvcs32.exe
PID 2420 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Windows\SysWOW64\wvsvcs32.exe
PID 2420 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe C:\Windows\SysWOW64\wvsvcs32.exe
PID 1328 wrote to memory of 4080 N/A C:\Windows\SysWOW64\wvsvcs32.exe C:\Windows\SysWOW64\printque.exe
PID 1328 wrote to memory of 4080 N/A C:\Windows\SysWOW64\wvsvcs32.exe C:\Windows\SysWOW64\printque.exe
PID 1328 wrote to memory of 4080 N/A C:\Windows\SysWOW64\wvsvcs32.exe C:\Windows\SysWOW64\printque.exe
PID 4080 wrote to memory of 4072 N/A C:\Windows\SysWOW64\printque.exe C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml
PID 4080 wrote to memory of 4072 N/A C:\Windows\SysWOW64\printque.exe C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml
PID 4080 wrote to memory of 4072 N/A C:\Windows\SysWOW64\printque.exe C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml

Processes

C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe

"C:\Users\Admin\AppData\Local\Temp\a97702b25fea7863bff4a1f37b5e5a4733f2772f9e0cb55e73956acaddf53ab1.exe"

C:\Users\Admin\AppData\Local\Temp\winbox.exe

"C:\Users\Admin\AppData\Local\Temp\winbox.exe"

C:\Windows\SysWOW64\wvsvcs32.exe

C:\Windows\system32\\wvsvcs32.exe help

C:\Windows\SysWOW64\wvsvcs32.exe

C:\Windows\SysWOW64\wvsvcs32.exe

C:\Windows\SysWOW64\printque.exe

"C:\Windows\system32\\printque.exe"

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml

"C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml"

Network

Country Destination Domain Proto
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp
US 8.8.8.8:53 apn-state-upd2.com udp

Files

C:\Users\Admin\AppData\Local\Temp\winbox.exe

MD5 fe0a8fb59460f41c5a2a1ca6d5e6729d
SHA1 2d17786694abee4e2b6151d7bba5081933f8c8b4
SHA256 b300a83ad84f844f68d6ca4ca4c4f3823ac0239ea227e33147737db5e4cab782
SHA512 937ed71dada7f435939fa51781ff0256e190d26e583a646553c5a17e2261a6bd5f7808e84230bf6ee7432a1908cf0407b843f8bce4d33629733767baa7eda98f

C:\Users\Admin\AppData\Local\Temp\winbox.exe

MD5 fe0a8fb59460f41c5a2a1ca6d5e6729d
SHA1 2d17786694abee4e2b6151d7bba5081933f8c8b4
SHA256 b300a83ad84f844f68d6ca4ca4c4f3823ac0239ea227e33147737db5e4cab782
SHA512 937ed71dada7f435939fa51781ff0256e190d26e583a646553c5a17e2261a6bd5f7808e84230bf6ee7432a1908cf0407b843f8bce4d33629733767baa7eda98f

C:\Windows\SysWOW64\wvsvcs32.exe

MD5 263fd208754ff500b72d6fa2d76f096c
SHA1 987363037f0304a7440c5b50c764ab9a8e25e1b6
SHA256 9cd7b03de50ae5902794efdfd62775f37674af4b02ee1f6336e9cca637faa7e3
SHA512 c988ffb3e5413d7793d067f925fe7ad23fb12e01b20a56ab3ef9e5d1150ca7173b6dc36297852e1775000d72fd0005c8b204c61a00ee227bc323ffa2234d2456

C:\Windows\SysWOW64\wvsvcs32.exe

MD5 263fd208754ff500b72d6fa2d76f096c
SHA1 987363037f0304a7440c5b50c764ab9a8e25e1b6
SHA256 9cd7b03de50ae5902794efdfd62775f37674af4b02ee1f6336e9cca637faa7e3
SHA512 c988ffb3e5413d7793d067f925fe7ad23fb12e01b20a56ab3ef9e5d1150ca7173b6dc36297852e1775000d72fd0005c8b204c61a00ee227bc323ffa2234d2456

C:\Windows\SysWOW64\wvsvcs32.exe

MD5 263fd208754ff500b72d6fa2d76f096c
SHA1 987363037f0304a7440c5b50c764ab9a8e25e1b6
SHA256 9cd7b03de50ae5902794efdfd62775f37674af4b02ee1f6336e9cca637faa7e3
SHA512 c988ffb3e5413d7793d067f925fe7ad23fb12e01b20a56ab3ef9e5d1150ca7173b6dc36297852e1775000d72fd0005c8b204c61a00ee227bc323ffa2234d2456

C:\Windows\SysWOW64\printque.exe

MD5 6cdd4a2f81f453c478cf08c4d60cb88e
SHA1 512583ca2252a394836b9995a40075707c6e8235
SHA256 6424307ea25f1889e4b9fb8a64d860e42681cddf71a5a70af7963ab282225c8d
SHA512 112112d72182e882256fbecdb655b5e0640d593e36b7416c7951fc65157a39cf09b4171d22d702133afea66a4e1488889a901f365ad199055de57bdded349252

C:\Windows\SysWOW64\printque.exe

MD5 6cdd4a2f81f453c478cf08c4d60cb88e
SHA1 512583ca2252a394836b9995a40075707c6e8235
SHA256 6424307ea25f1889e4b9fb8a64d860e42681cddf71a5a70af7963ab282225c8d
SHA512 112112d72182e882256fbecdb655b5e0640d593e36b7416c7951fc65157a39cf09b4171d22d702133afea66a4e1488889a901f365ad199055de57bdded349252

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml

MD5 784926962cba0ecaa4ca117308869482
SHA1 ab1df9bc3d3030a099aaf539861e9782581808e9
SHA256 110b6aa04e50be42045c3143cc753162076b8d630ac7e96df61f0641bbb2f5a5
SHA512 b5212538299e77759ed2df31073dd137c72767683c18bd38b69c6e0fa843a29729888f5112a991879a092a382527513520b7d7332eaefc9d7f375e9137930c1b

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\sqlhostserv.xml

MD5 784926962cba0ecaa4ca117308869482
SHA1 ab1df9bc3d3030a099aaf539861e9782581808e9
SHA256 110b6aa04e50be42045c3143cc753162076b8d630ac7e96df61f0641bbb2f5a5
SHA512 b5212538299e77759ed2df31073dd137c72767683c18bd38b69c6e0fa843a29729888f5112a991879a092a382527513520b7d7332eaefc9d7f375e9137930c1b

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753256_0.sft

MD5 45374a049ad9f3f90473371d3e9ca712
SHA1 eb7b7fee7383f3c67e5167b9bad90d11c45cfd3f
SHA256 459fd71d7ac4f1e5bedf580874e31d7bed85eaf16440740585ce65f1d3486dd8
SHA512 34f18dd614db779a07d1f98ccfe979b97abf729b8f37833080d50077ae6f031b91130240b5cb8c7d76fd4339de2ae7df93cf465bc3f12c53ac55533555c6282e

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753256_1.sft

MD5 b646f468e8ae2fe2179f06dbe8979fed
SHA1 d27d3d46a195a77a85ce14ee26fc221d144858e6
SHA256 f2c45d8d67eb9f10b78dfa8d96b8a65f10ef9facda8d42ac273c38b6617e48ac
SHA512 d3f0f68311e04cbf33c2e1b0a08918cbc2af3d5088d6902ee5aca3814497df6fd6f0f0a714e4eaa40e966c78a94dd2867f9d9f73c30770eb9710c1d3f04c3ed6

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753256_2.sft

MD5 854c03ce9bd95487d2e70115ad769aea
SHA1 7a244a10996cd53488ad9b2a5a94119c76595f7f
SHA256 4779f1f29497e8fe2d687d187aa269f2a12ec7a03663b9c7721a186ccdb08784
SHA512 b435d6dffa63f3e6ac7a5e09e69d0cc7bfe8aff64d3c4ead5bad3870d0ea5a3626bc4e01fcf3d901a8290e7dba5e98e6eb1692516a8b772dbd4b4a1fd1a7c1a3

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753256_3.sft

MD5 90d6f1d95c2514a70083ad819d0030d1
SHA1 5e3be73703e832bb8ae303d8059832b3cae073c6
SHA256 e0da222202926048f97189a249aec8ea3b9f8b08e592045eaebbd5ef8cd363ce
SHA512 1a3996a8113f19f110ee4d2a598b23564600365eda934b7118b2e0167cb6ac7ec83c0c141d57b46aa88758e9d3a70b5d03c0b36ceb18b974223fcea734818421

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753256_4.sft

MD5 e26fba3a3b3237bbc4b0bffd0369561e
SHA1 37cf6f86421e60ecf996cab3f77d6eba5bd9aa7a
SHA256 4077b0bd90c538fd8ad453ea3098e9ca1cf9e82c740c0e8f774526c6b757eb58
SHA512 16a21ed8c95facfb02f85a65893b8c027b2e030088e3f1332c8daead1484f08aee0e4c63fb1a4477097ed53735e9a600a31dd3e25fbeaa5fa5a5bc87bf94faa7

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753256_5.sft

MD5 033f799ac982c2a51a798fddf19393e0
SHA1 93d10d5dd3efdbdcd52cc3c0cbddef312976e5df
SHA256 24b2438824d9455e69b1e0693b984f8186698031cfcd9a8b17cd88788505a689
SHA512 c48b8e7ae39be90614ab333d359e592c68490f63f7913093275ace874d2306a68f32c9bfdb8f3365d1463de8c9fb734456f56236c6266129bc85880be2fa660f

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753256_6.sft

MD5 a940fbd9cc025ed2f63fff8bafae2b4e
SHA1 2d3b037160bac74eea22f5ca3aa4d71f63f3d651
SHA256 5f48053e0c40e36dee5854551a563113b86949ca1ea401045e60c4014bef02ab
SHA512 3b29fc2b555c44fabc7d44941a11b83790f4e4caacecf0d0a5105a49610d0f580821b4d05b1b88e10a24d9770049f51bf52d4a63c1e18de1079aba3cfdcfcaa3

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753303_0.sft

MD5 e47b3e767dc2e7d686b91bae403d826b
SHA1 7ee2e7c6c7c3603326e033c32284dae07a579198
SHA256 f00b3900c05a409f71b02c7ed1e5edb679484d404f2b9dde62b5b072d0efceb2
SHA512 75464718dd6e1a94d2912727a348ff3a2e8a22746017d41b5bb7f9d6e9926f8a5107c00cd4b2a925deacd0dc69d6632125590690ad6af17ae112561e82915223

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753303_1.sft

MD5 248b468aed0c269b55a87d94f06b376e
SHA1 f6a645cae6f1785e2eb16da4e5aafbff62a0e750
SHA256 15f2e77db7cceb0a61e608d82bf08a44d5ace1f1a00cf9406eba52ffa07c4976
SHA512 7d30901a98429ce9cda05bdb4844acb5f4bc0af163a7fd9c9e1e002d168a544c7f67c7f8ddf412a0d2a332ce749a9b0ee65d14ffe3a2abe0f43c8a8cb467405c

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753303_2.sft

MD5 d0e92e6c09ba78dd526956c37e9adc9a
SHA1 7e2c7ad2f1ee7fb879f99a1421bf73996fa9b148
SHA256 fd465c7ae71e8b2dd848f6694db4817cc8254aa3150b76191378ac61fe359e1a
SHA512 3b4f5a88174b310fe308c39f1c427297d8e722715d3b25c09e0e7ea3e77b04266fb9d238831d17253adc90f4aad2607bfa34eebb31899d5acbbd3bd8042cd33d

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753303_3.sft

MD5 86752a55090d057e9c53ab82f5aeb6e5
SHA1 7fa9b97b81f70a045342852ff7d585eb8b26e184
SHA256 263a8e97f3273c216c502fb4d015c3de8f4461a88d373aa45deb10cc30cd2fbf
SHA512 c5e3d2786309f86adc4ba0cb33347ea84496e61036f3b5bada4880a6eed0a1445f56fd517ee907d013fa713a87847968ae67bc2d8a531ecdee50d4dae383d43a

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753365_0.sft

MD5 d9b70a3a9d2ffc854e0cd70ceac47591
SHA1 b3ffd195fcb247822460e4138b4d5c55cd87843f
SHA256 9656f683713ba49609101ae07f33fde6100829597b0aeb5134801922c73fb4f5
SHA512 32a92ee684b74fcaa9ccf8b2313eca6250e8580d89ff0f370ae3322e59ed8edc1f013689e76285d7050eb4041f202dd9b0599ab120d22cd44546c586bb1304cc

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753365_1.sft

MD5 90eab83e325ef6cb1717305e8bcb6822
SHA1 68d1ffc74492e0f793b79c54ea2bb7c0a575906b
SHA256 37e41a0319ce33596d2a7fd02822efa55e439f3c597d431892d8ce59956f9835
SHA512 c84fb5201705a1ff5ab8fb7f09e33d9a6f3b2e0e814b114a3d0fb470705e6aa70d615d5ea8b92133bf9b361713734d53d8784dd4cd731d633af31b4523044bc2

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753365_2.sft

MD5 f280f87877113782fb8740b0ee274558
SHA1 c8110783d0e77f43ee74c4b8608f747b9bb62f74
SHA256 e77a34c2fe802c2c91100e09f4d406cee7b95547efeb07e5a113e75b1f817ceb
SHA512 f4670be4a1224fd21902bc21ef15cffdba44f8a7a6b01a7d4e21fee98f9a4d163a84baf24c1953c5b33120ae750fc28eaef468a7887c5f428d5654b3f6591d34

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753365_3.sft

MD5 7b9f8bbfd0e972267e3f4f6df343a9cd
SHA1 4ddb88481d7425a30946eaf9b0fa67d2cf21cbb9
SHA256 07ee7da03282eaacbc4e207f95528e45a88add18222252b2e476a2f3a590f3a7
SHA512 4dd5e2831417319ed8a5ade1ab5a5337bfba5a53c4b39fe54fd4c4e293d4f8c2fe56de55708b70c32e36232c3505820555b2bd7d645894e207f184e596599413

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753365_4.sft

MD5 e975a52c2d90fdf37f2c6bd62b3852be
SHA1 57f4b68d5508cc2399f5c27de203efc96dff264f
SHA256 a1e2ee92680f9d02bcc93ef8237f02b60a4925dc7757789e68beeeaf3b9e252a
SHA512 16c1e6763bc158dd422ba7a8bbafc65ccaacab9b9f3269169f32cb2c278d1d5c1db525732dc436aee09aa1d0883ce3cee55320c8ca66a7e356e00213c138db06

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753365_5.sft

MD5 34efb804ffef9a68254ed0938a68c847
SHA1 79ed54348c5b9c07cc7a82ea3fedd8f86ce04e0a
SHA256 e1d9d05fba3c5225c850f47bc18a339d183f9fa11c471547efcf803a2f67bcd8
SHA512 e557ffd86837bc78f31a9c8b5be4141f839f61a64c9e421f8c54ea4653dc25c08541e93f9ac2f0d50ebda03496315966b443bd8ab9aa04d558ee9c8296392667

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753428_0.sft

MD5 7519001d705968f8dfa524f066301253
SHA1 2681b4ef02d71e779d772b94965c006b66c33ac3
SHA256 db94e24e15ea59c155b5f5045a409dfd962d52e6d6eb98ad01d996b84dc28500
SHA512 550380716e61e464d284e8a838db4b39ef958e6f502c3f424de0c7540cfd2720dd34bbf9865caa0c244f0ee98920dd6a518d4f32171bb592039f550f2a578173

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753428_1.sft

MD5 287dc1e8538884e27805861a3692c2ce
SHA1 e0c8703102e49e9bccca5da30d39da537f053803
SHA256 a52b1aeecaa082ad32e0f413d5e7af957ec2559746e0c34efda966194bb72feb
SHA512 550ff73df357fcd653879cb2bde656eff5eea88d6bf561f05d2c629b89d3c887c745b7ac580fe64359d3e6fb8620a0fc4e000bca0558ab9890d2a84a05bbc322

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753428_2.sft

MD5 d66345e8df103706d181b7717fdfc758
SHA1 6f740833080f1060bc7a017a24ff8fbb91295e9c
SHA256 2b18ce486872ea0e8085fa3e5be3da34bc34a56fcfb7828aaf4e9f1105a7469c
SHA512 6936fdf29c89c0054e204a2c76df89d5493181733eb1472d3d60478903b8707c6a6cd2c18c6366d2f6aeefba2b854d4b9be4372a269c0502cf04769a543ec3db

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753428_3.sft

MD5 b123c470172dc94d9453bbcdbaf50ab3
SHA1 8f4c9354691ac7fbd6f0d27fa450304f8d71a86f
SHA256 fc7706f137848aab2e47843cf8896deb29f4fcded4fc12f359611cf4a2aef1b1
SHA512 f002ffd226e5a249d76fc20f9702732c1818a0316a46086211730c927ac1919ae774cec35b5eee092943db0f48005b75343cf6cc549cec5f7daf93645831ed7c

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753428_4.sft

MD5 742bab8010bf11bbc1e53f475806b2a6
SHA1 58be143f31ba71e01ee459c3d662b590c2caf8cf
SHA256 76fb6c97cfbb78edf46277e8e1fdb2575e21cfc3836cf6e452308601d2ac4be7
SHA512 6b7219d24fca2e2dab97cd231f348f568310a2b9ea8c962b888f41a65817dc9c484f913ea428c3e23d949afa80d78e557f3f7ddbb2e4d56d6d5909cd6d66bcb1

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753428_5.sft

MD5 85db02bb44e5c95d4b6ebdda7a2721cf
SHA1 91abeb5097fffaeb038b41c29601c40175cecb7e
SHA256 a98f1ee5712f1ef13aa5d6d2e4bb60d3b9a32fea3a0f8eb10f219de68e63a09d
SHA512 070e3afc5e1f0cb8d3cef2d04b715decbbdfa5332be1fc74d594e0b9df3aa99b1a355bab1e487ee521bd4e692467b8ada0e031eecbd97c4e54793dbd88e79d03

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753428_6.sft

MD5 e570ed47e3ffe71ebf53d302cd026ee2
SHA1 26e61530d6439796780e04812330be3dd6b743f4
SHA256 05475c02dc293bff383e1339c63cc754ba97056fb503efd468bb280fd3383a7e
SHA512 02e06ded0b2fcb9df41565c5fd4501e5358a509215891022700952f5a311f310604741bbe9802434b664da52400404d18df686b7e34a7914a0bf7b5ab28ae943

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753428_7.sft

MD5 723fa109d3ac9e1baa7e8296da8e4b6a
SHA1 1fd69396aabf5501ef49ec67fd43110031373bc5
SHA256 344ac975635ca4d1a69d6c29ec305062dd4fbd587f452a8a389cafc0d569915e
SHA512 ba43ef0013be33860f5c87bbe32390f31fb3c3b530598d3fa5394541666ada06386f578e9068ec1c99a9a7a0f7fc8ae6545cb13c8cf442e874fa07e83949c6b7

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753522_0.sft

MD5 37f0fb87f79733beebacb8d5964d95ba
SHA1 fb304ba16b55437205f2dc3cd4a77b052923c513
SHA256 294ee6dc47cb85ccdf6efee650a04a90202408c7a717b2f968aeec1e24f78aeb
SHA512 a1f6c22a02fb5a29ee84eb5e46d66864b0c90e302e0ba7dfca8fa8b19007e5cf06dcae619d233fea5dd03f70b338a8d9bbedb70fbe592f9197541d27b862b7c4

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753662_0.sft

MD5 6eadc26a3fd9842cd29bfc5608824724
SHA1 abb0c4050c5c27008442a01ac640a3ab5445e64d
SHA256 5c44cff83b966206df9164163187401a48eb4c7b993d03956d92d453069e3cda
SHA512 7f761a5d99aea58be6716ec3063e84d50be53270e5c4453eff1bf2e01ceef956cde42a9ea5da70b6cff83a09cae5a4a5081c56e2c581134128158286def221be

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753662_2.sft

MD5 9ebf937842cdacf0ef89521d8ec32da5
SHA1 9cd45ddfb71bcb6d2efd5576ae28f32b005c004e
SHA256 7164edc2f0015d62c9a539221f9b2943ab5ec4bb785d5434e8a6b61e2a67800a
SHA512 484bbb7c8ad9e93d90d54a540f46bb143fa098a539836ddaad6fe6ce55789de8ed6998b62a0ef76a90363fbd2da7932b3c9844f2dcc6ef83e3ff2c879853e75a

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753662_1.sft

MD5 6501ace80fb695a10ba1f83888addc77
SHA1 4d8d5ef4d3e018287655e05c669ee0aa5ee90a4e
SHA256 be485b64a115c7832b98d4cf96a0c2ca47af46cf05d5d37027c9635ee1816d1f
SHA512 b674e9752b74201a59f7cdc40d74a75771f6132ff3701f5016694b3b6a29bcf5a6235b011d215f3e46597acfe6dae9382cd41a0aff919d0ccf62654640539c67

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753662_3.sft

MD5 b64243b266ac39688951ce3f76598d0e
SHA1 ef493974e526193e7eec32a62eefef3a557dc7d2
SHA256 0efbdc47eb13878f6a5bdd7fe06bfc4d5058c7e910ed487c73326ceedc208c81
SHA512 c9a460b53d1d1cbeade462ebe4c94d0bc0b7ae34ee17d10625c0e8b823b9abb1af74e0ecaa710494f70c74f330e4acd1603f19983c99d421374e9b756710a80d

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753662_4.sft

MD5 743079b2e06bb0171de3c2abd269e8e0
SHA1 00ef6ca2e6c7789d6367b3103486ca5e3e03fe67
SHA256 da693f00b010471727157f72aa959bdac76cfc34623a61a826ebbf366ed816b7
SHA512 93439b4e1c0e378a89a86cfddc16034b8aaad114efa887b90498ee58115e230f93fcd0ded26af599bc173fffc5b69f8ad4ac7eae191ee4a49bf8084b99db4031

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753693_0.sft

MD5 96d11b59b210098cf12aa168b933e539
SHA1 eb872e3d0fa44c78247510453c3a96c3f3f5211e
SHA256 b890cdbb66a93c9cbf6c6fadf133e76b3ea9b63375c2e5a46a1e5edb1be33948
SHA512 2c5ce7305581d8f4e5fbe3cb53b8d56daae9a1f708d8c7d47dd0a094bf9db90d843ed3233149e1f12a77d1b2a91f4f475da39610fed64370066d41238289af5b

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753693_1.sft

MD5 805cf4125fed174e4f2c0e48fb8b2530
SHA1 c8ad8d17449434d8ab0c04e6290be4288950e414
SHA256 3bb991a4431f58a54932ff3fdfab0bf648ac5a4280d0b242e07289a6eef8576d
SHA512 3fe56a01de9e463031b0a6cbcf0998397b8a095d6ad91c72ee8cd7940df1a7381bae5301bcadeea8c0e2a0d9f3511953ba85fe8b1c9c9704965261a56aa73b8f

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193753693_2.sft

MD5 1523faa7bd7b7cc8eb656ea02d6db2de
SHA1 8bc795a9166fffad92c7222abd8830bd7b2726c6
SHA256 9c211e8f5b74db5cef727616dfe1ef9cd249e9543949b02ba543cbe51fe3b01f
SHA512 9f13a62f1209d0caa05e747307e35705bc50810ce11eee763c02a6cd09ecce1462885ce1d8f61fd12492a90f6697503eb1bdb5f245389aa84e2f4ec5c4cd002a

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754256_0.sft

MD5 6990382119b394368b8de15c7856e492
SHA1 23c0777efc696e0d7cdc5c1a9fe73ba6d15e5335
SHA256 b552b4372767da415acdc041c20e4eed0f86f098afc7d3d50dca29f6e2dc2a91
SHA512 836d872e634032886f1b0058e2d1d691a5ab330eac1ade1b164d42da0d5a9e861fb9487c6e912665979c2c5e5a6b91b4dfc8ddd45e4531f1a2f8e78e794755e0

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754443_0.sft

MD5 1bb981ab58ab477defdf3dc28b820b44
SHA1 3b6e649fe4cdb35e29ff0348b519fc3c0d2839f9
SHA256 6c7f1df9d39b9fb4f7ef7884fb967bdb78165777f83051426eec34eec6d5b83f
SHA512 2058e2ca35ee2bb4464d097466cd411d625d4eac942a26fe8e802e31d7de66248dda0c42fb7ca3ec9430eb2387751dad6e11866006c6e28b45b8659a2112ab88

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754475_0.sft

MD5 31cc264b58389846ae2fa430f89e43da
SHA1 53d00ba53da1048971e3282df80e03277d70a437
SHA256 847ad9b5f99dd044373a010951e6aae5e301141c76dffdc5961a79c3bd94eb29
SHA512 852d0e07205cba88fcde3fbfca446e35c5c5e4966729a808faff5c4dc00a26b374683945025a626d8cb8fbc8b3a680dfaf38b2dd95d8bf9bfe8a52f7d74cf428

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754475_1.sft

MD5 056705247a4cbbc8002aff33e1c28e5f
SHA1 5f47c8a0223e3df0ef0c4c5a28e1518a64456f06
SHA256 3d21e19bc16c5f424de622c578576d4b630f48c204b153964d25c65d4c8d6a97
SHA512 1660b14d39442e161aaf4289ce758ce6ea217a82cd109497ed959a73d250157479316849d23b552c31a261f745bb40e82d5b4e4ff06a087061e00ad67b9a2b5a

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754568_0.sft

MD5 a922923839be5924321d080425611e21
SHA1 836095e5e9c3251f594efe2c2b141f3e9df1a28e
SHA256 6507b6b61886ecd793a93d6defa8b2fde4d5e9271b4ec5724bcc5ce188ffb059
SHA512 d9eed9343ed04aba4a9f9234bad6a3c61497fdcec72a6a73cbfcf974920904c363d4feaf0ce1d593a25bbae666ec95b9a2b5dab7d4b97f6b8f9bd84e17ddb2d4

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754568_2.sft

MD5 ae4a8a6fc122ce849617c2cbbad67f9c
SHA1 319a32179a50236c2dff8e0a8d1f5d7b51ff8082
SHA256 13553dcc157ad930462247ea5da494fb1635d831bab37f60c7857fdfd1eb24e6
SHA512 999b4e3b51ee1cb5c2b995a6f55287eb8c0761bf53adca1dceb6366b94b666e0bc63161faff709f8f9f6db0426eaba8f43a2301b8868644e3a2f664062100c03

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754600_0.sft

MD5 61bd692e68bbeaf584b6f0569f02247d
SHA1 25cf7651bbf4853594bf1c6692d24eda4353f837
SHA256 f72c99514f2124dd99a49daf851ab8b5e50510208982f22b454ad659e3f1eb00
SHA512 e2ce62b7cf960d9237c60aad6c4ef59a7c63473b7336257f0c4e7e9e1e44e0405ac71427677c137e566c445ccc2b7dee80ba02d51d4506aa2dfd5609f7f097f8

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754600_1.sft

MD5 e7463f1fbe008d40bbf6298e7ebc3af9
SHA1 f45d7e9084e12af20e25eef4a4705a5d9580272e
SHA256 42ba73973c3ee38ee24ba821311401f04d8c15fd8bc696ac2996f922b8c716b9
SHA512 d99a53e626c15ef704e4b57437253b152ee72b052f47ee4caebda9553b108ff99ad86742e6de339394c2330ad1cae759329bbbf8fc65aade9dcbabaff52ad4f1

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754600_2.sft

MD5 7f1c7032ccaefdf09bf07a3d86ed0b40
SHA1 031373396da945af437696206c14b489b10f5a86
SHA256 9a80d0e6685df1cac083c01c73531380761a12e09b9487f8c33cefb4c32a1a84
SHA512 31234b86e4121b02827675f8c4c3ec308def0c5308bfc5fe2cec2598ff4366e0a458451bf9c1785a4b902736d7324dfeaff2fb80cad0d8f32eca261a758a4e4d

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754600_3.sft

MD5 8cc55535a9104f2a12d1ef334d8fdd7d
SHA1 040aa6983eddf4abecae295cf1b3ea274cdfbf21
SHA256 bfdc5982bd74d1fa56ebbbacdff233a50111398eb6ab75df77c93d291cf678e6
SHA512 a1988b856c9053455b67877c2fc8de6136908d6a1b14a24f714b24251f1e9f57d8ac2cbacc5c0124885dfedae7b92ac6ddd78f67bf51307a24f105851647dfc2

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754600_4.sft

MD5 42b5f8c8bff9e43e38194fb5a3c4610c
SHA1 6947c5e8afd4511bc9d27db1e950e9eab84679d7
SHA256 875937a1cd32a16b7f6a19a7e3c03fc23ba69dbf1326106d046d680c85ae01f8
SHA512 fca9bcaf5f77272a41049cb362e904ab766b472d59b7a530e3468f94c82bd8bd4f38d54719fd0b7529be08e19215ddfca84836bfe94bd3af7cad7d1ca798c692

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754943_0.sft

MD5 cf4b9bad4c374bc61bf6d475e6575623
SHA1 8469dbc7a33d820f8d21fc8b1b4e1bf70acd8b7a
SHA256 72a3a48be146746b8f5907c153c0ac47f9ad9592201fdbfedbb8ae71460d67df
SHA512 f7b0a6b935cf8153f73b9ecfc30f4818cf87fd20e45e8b1048322222f650b60383cc05ed686da790430c3043ddad0274fdc046b1b6864af6d1dd934398990967

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754975_0.sft

MD5 9aabf5b23f0c5a2aecbde78e816adf87
SHA1 a4f8a5c21a05b6bf4ce860cffe97d2f02a347287
SHA256 0ff57eecbe71a5853692ba6feee3a6896baabe8b106cf011efcb84885c79b632
SHA512 9c91520368281fa818392cde728752eaa97490df02c9c1b7fd1abef957d1393cb4a91ce709f90d7483e209a09e9d04785b38c1fd3250b049e8eb0744f3f40d38

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754975_3.sft

MD5 8727848f862e3e5219bcf863c2aa1883
SHA1 9783a17b30e4c931c4d063d4cf430626d985c1b3
SHA256 d7d73d052648dde9525ce760db0aa70d82ab53e59b8d413464f6f1c57aeeb12d
SHA512 79fd40f2fbc559e12451bba81e2e6d537db21c2b9f4b113dd741b3cfeb5f33b67e08d20b66c7822554fd62e72b409331c1c049b91db65425b1f1d61107b02b51

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754975_2.sft

MD5 326e9949151bfc2048f37e8318206ff1
SHA1 5c2c6d0f3fad02736e2a9600472a717442b95a30
SHA256 07ef99f50662872a321fb05db6b35358a56aee210bc8c022bc60289a7208dd56
SHA512 4ecbcf60c36b1f398f516058857adf44ce6088905465d1518aeba08bf61a4d4fad06583a272c8b95660ad9c7180ef305c3d4296a05d63f062501b13abff04d4c

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754975_1.sft

MD5 9819915b8788dce81c0b11df406f402a
SHA1 f1071dadff858909d3352a060ed0c2f1c1e12a05
SHA256 bbb19ce3130e3c8a8ec08d9d85b8dbd1e1deca05f14c1c17fd8467b14509c005
SHA512 ae7d6d8e13e00700a8be6f375a573d64def57ad8dcb671edba22d7e2add7c245fa392ed71f5efdfaef74c44cea32245f28b7d836b932e66c73754a3ad01b577c

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754568_3.sft

MD5 d42e5528422a65d2a7632b2a102ce8e7
SHA1 9d3f80c5dcc1b8e7bf03202998b53e5228b3366e
SHA256 fd95d6fa7e5d44c4b3f99020d339582e18ac45baf58838a429df10994689fa62
SHA512 8982ef5144e2dff2d83def0206eca3e29c8d9f05632acfa79266c3e72876fb145af130b0ff9f4cd55682d41d97f099964cc90c0d90868b4fed7ccbc90cfe3e58

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754568_1.sft

MD5 43b0829e9222583cca3d6f08f3a0ea58
SHA1 fedade6d0e13f8dcaf16732e5ea6feebbc0ef2d8
SHA256 95b25d65f5dfb2c364e6c2b95c3a1bac61a2eb40c534ceeb85cb0e1dc73cf6d6
SHA512 f729db497b6b3968f8a1c4ccbb6b30e3beaef283004257364f6b93b2d3aa0eaee99e55e3e8f6751e26e5f2adedb34cef410e969ecf734fe4f37340421e7f0415

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754475_3.sft

MD5 f534be2d154affc6326f7c708d067740
SHA1 4f276dd1406c77a0a9ac5e2ed60a69aea5bacbd1
SHA256 81de813a28b9f3bd2558a202d60c675003686503912a249dd5c87dc5ab6134d0
SHA512 0e0e53d2533ae00cf917e38ed7a63d259ccec775e35cb8bd2660512211aec829e398ec3fd206292ad55d7d2abc9e8c3d39bd371f40189d187b6bbdd484c2139d

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754475_2.sft

MD5 125e8a44aaf4bb0b6874715e05ed945e
SHA1 49def4fb9d66337b324f12ddfeff59792209b391
SHA256 de1b0de6745357c7f526eb4fa7b22ff252b85ae94322d916b57cfa27ff14741c
SHA512 dd042783ae4455b00117d4c346022ab418e3b14b62d96f34585f20e3473140d307814ca2e77e8aee2b7e50a5f4760ccaf1694db01ee3f543e635954c12c33cef

C:\Users\Admin\AppData\Local\Temp\5AD-CA113D-416AA\guid_app0_2122217367_0131193754287_0.sft

MD5 49945b0cadc2a7a570f6e2269ac2e118
SHA1 126721c5707d68ce9bb28918828e663aaadf9b52
SHA256 a6c54ee5620f79155d5e34e0a2397c0aafeee2f7d2a2e75509158b20d2a83e0d
SHA512 10465c9bd7388edd0d823505151529bc248879724f1b7ba9af0c90d0b4453789c33d8bcd8095c1d9ec84321ad0dbae2e6b82d142fbc42c15f5f3e020bc6505bc