Analysis

  • max time kernel
    86s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    29-05-2022 23:28

General

  • Target

    0c9517537946584f436e123d6c7f32e18d3b489df53385dc52bb3d2ac339c582.exe

  • Size

    3.4MB

  • MD5

    3b3a826007da0239ad57573aa4e18ff0

  • SHA1

    7a05eb1dcfa6d0dcce8e3cc9f8b1c5692d7c3cca

  • SHA256

    0c9517537946584f436e123d6c7f32e18d3b489df53385dc52bb3d2ac339c582

  • SHA512

    708f25c50bf9a79506426bc51c137b0569168e9c56b7df6fdeb4725051dd109c17e715abb258813427ff9e6cdfb9ac236bf95b8c9fdab471f896f899d1e97fdc

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 36 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • HTTP links in PDF interactive object 8 IoCs

    Detects HTTP links in interactive objects within PDF files.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c9517537946584f436e123d6c7f32e18d3b489df53385dc52bb3d2ac339c582.exe
    "C:\Users\Admin\AppData\Local\Temp\0c9517537946584f436e123d6c7f32e18d3b489df53385dc52bb3d2ac339c582.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Users\Admin\AppData\Local\Gtarcade\app\GTARCADE.EXE
      "C:\Users\Admin\AppData\Local\Gtarcade\app\GTARCADE.EXE" /flag=0c9517537946584f436e123d6c7f32e18d3b489df53385dc52bb3d2ac339c582 /user_frome=0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\Users\Admin\AppData\Local\Gtarcade\app\GTaCrashHandler.exe
        "C:\Users\Admin\AppData\Local\Gtarcade\app\GTaCrashHandler.exe" /log_path="C:\Users\Admin\AppData\Local\Gtarcade\app\log\20220530020429935\ "
        3⤵
        • Executes dropped EXE
        PID:436
      • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
        "C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe" --start-from-gtarapp=3.1.5.3258
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
          "C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe" --type=gpu-process --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 gtarcade/1.0 webpage QtWebEngine ver/3.1.5.3258" --lang=en-US --gpu-preferences=KAAAAAAAAACAA4BAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 gtarcade/1.0 webpage QtWebEngine ver/3.1.5.3258" --lang=en-US --service-request-channel-token=3227A4883ECE63A7496F7B4E1092B2B9 --mojo-platform-channel-handle=944 --ignored=" --type=renderer " /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1280
        • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
          "C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe" --type=renderer --js-flags=--expose-wasm --service-pipe-token=387A71F7DA41A5E8CE426E2EE2D0A25F --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 gtarcade/1.0 webpage QtWebEngine ver/3.1.5.3258" --ppapi-flash-path=../pepflashplayer.dll --ppapi-flash-version=32.0.0.113 --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=387A71F7DA41A5E8CE426E2EE2D0A25F --renderer-client-id=3 --mojo-platform-channel-handle=1444 /prefetch:1
          4⤵
            PID:1584
        • C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcadehelper.exe
          "C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcadehelper.exe" /action=start-from-gtar
          3⤵
          • Executes dropped EXE
          PID:1240
        • C:\Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
          "C:\Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe" /prod=gtar_report
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:1868
        • C:\Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
          "C:\Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe" /prod=gtar_report
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1540

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Gtarcade\app\DuiLib.dll
      Filesize

      1.9MB

      MD5

      829590ea74f561afcac42328ac74f721

      SHA1

      b229bdc107d14fddfc6151dd74880933e656f039

      SHA256

      36922560e296125ff2d00b69ae697ced310078b29ffd8a4258bf0f738b69c72b

      SHA512

      31ac3786741fd5fe2398c4f28ed6fe593ec33a29f2863e031583eab2a0b134ffd43d210fd6b1ebb8f1ae7d2a33c2eda9af952286b6ee598c2dcf119be6141a01

    • C:\Users\Admin\AppData\Local\Gtarcade\app\GTaCrashHandler.exe
      Filesize

      871KB

      MD5

      4ac3c9da1047cf8138acb0d995061a3a

      SHA1

      e9ba33b9413002bab50183d26614fdccb334a907

      SHA256

      32e785e0bb311d45db06cd7a0bc4a343fd80e72e756a1b1a66b273948dadcc4b

      SHA512

      2761e7f7041fd83b6d3126eb673deb9b122481895f65a0b032b6fbe210341c736515a636b9caff7fcdcf23119b6408ef35dfd01a3a949b30275c9dee24d4d520

    • C:\Users\Admin\AppData\Local\Gtarcade\app\GTaCrashHandler.exe
      Filesize

      871KB

      MD5

      4ac3c9da1047cf8138acb0d995061a3a

      SHA1

      e9ba33b9413002bab50183d26614fdccb334a907

      SHA256

      32e785e0bb311d45db06cd7a0bc4a343fd80e72e756a1b1a66b273948dadcc4b

      SHA512

      2761e7f7041fd83b6d3126eb673deb9b122481895f65a0b032b6fbe210341c736515a636b9caff7fcdcf23119b6408ef35dfd01a3a949b30275c9dee24d4d520

    • C:\Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
      Filesize

      2.3MB

      MD5

      ec8d9a9f772ec078df0b0e728524c0f0

      SHA1

      9db1ae3ff01ce20fdcc6ee5379935e79b877ff7f

      SHA256

      9a0d38e1176406e67c7535e6b4572da6d346227fe54fb39a33bb3604ca25725a

      SHA512

      f65629692cb799b5a819cb0d7172d467b9fb87ae4cf695a650fb6747ec8d7635236b3d78688f05b785015c6bcfe0a672d268d3150df2cd56cb67d07530cbdb32

    • C:\Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
      Filesize

      2.3MB

      MD5

      ec8d9a9f772ec078df0b0e728524c0f0

      SHA1

      9db1ae3ff01ce20fdcc6ee5379935e79b877ff7f

      SHA256

      9a0d38e1176406e67c7535e6b4572da6d346227fe54fb39a33bb3604ca25725a

      SHA512

      f65629692cb799b5a819cb0d7172d467b9fb87ae4cf695a650fb6747ec8d7635236b3d78688f05b785015c6bcfe0a672d268d3150df2cd56cb67d07530cbdb32

    • C:\Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
      Filesize

      2.3MB

      MD5

      ec8d9a9f772ec078df0b0e728524c0f0

      SHA1

      9db1ae3ff01ce20fdcc6ee5379935e79b877ff7f

      SHA256

      9a0d38e1176406e67c7535e6b4572da6d346227fe54fb39a33bb3604ca25725a

      SHA512

      f65629692cb799b5a819cb0d7172d467b9fb87ae4cf695a650fb6747ec8d7635236b3d78688f05b785015c6bcfe0a672d268d3150df2cd56cb67d07530cbdb32

    • C:\Users\Admin\AppData\Local\Gtarcade\app\GTarcadeHelper.exe
      Filesize

      1.1MB

      MD5

      454c815fec365d71f936aefdfcadab5b

      SHA1

      b42e123d58bc39f31ef76d22d171f40d6e4467d4

      SHA256

      ce001baaef33ffcdca7e65804e10519ebc7e647dc51fe1fb26eb8bbbfccb9b85

      SHA512

      7a7527f3d425aa366c139a3a1be6894fcba58157ed249aefbbfdccd64978e69f748ee250a5f5ea4c236a53cc3c54d01d2ce6ad270a90fdc00805ff8d71de98cf

    • C:\Users\Admin\AppData\Local\Gtarcade\app\Gtarcade.exe
      Filesize

      5.3MB

      MD5

      51374673837d6cceeb4f213ed27b2c13

      SHA1

      ec6584a4d7aa31aa2427841762f8b0f1a97fa71f

      SHA256

      66bf8a67aeb39becefdc602f97db2da384857506ee98fa59b806c03136c5bf19

      SHA512

      70a334deacb09a51f2ad57562e67ed25ab91ffa0c72c56f489a72ca1c8a44690dc91372e9b2427d676d9e98036e227a9a2e42b660d9e5c60c864cfa8ab430cf3

    • C:\Users\Admin\AppData\Local\Gtarcade\app\IPC.dll
      Filesize

      197KB

      MD5

      39d0f6ec589fa04fed81f9be7adc266c

      SHA1

      d8610757ee5e47800723f136871598e0531a29c7

      SHA256

      175573c9405fabdeaec4941028b5eaa0c4242c8fcebbea2da34178c10e62a08e

      SHA512

      ee466d2cb38fc5229b7b62ce01a7db6de9abc381ac06c43b7ca0f89338e10448934fb28d92b9b64c8e28e0a4aaa1844efa356626fd4399f4bfaa68b3b1d9126e

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamedata\game.json
      Filesize

      8KB

      MD5

      de6a1abf2cd5d9868237d3002fe407c1

      SHA1

      5e5cff63fa272b3e82d989feb080a07b68c99620

      SHA256

      06c9d2540d40f9cb3a227097841b3a817807a9cb97214e396586988780a75742

      SHA512

      78da09e57a82595a89b342c983ddd1bd7bdac279cb0262230a0524ce45ae230be6b321c212eaaddfa42ba1dda55256e8005f6da557ba06aa04901c05e7cbf6cc

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
      Filesize

      2.3MB

      MD5

      dac92bea30242e7e0f426eba58109bf6

      SHA1

      5fec099a4ecc1b8b17018ca44811f2df4d85f44c

      SHA256

      93b5f01ab4a031fa026905ac83921a4c6f26b37f83cc5ee70f401ad6d5e6a092

      SHA512

      6d7d7e60e0adcfcc09a812effa4511634b45a330b07b2717e375816531f2e94d2ed051bd174a29daf25ac672bc356c6ada438b47db2d9f3cde07bdb9e9fc6440

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
      Filesize

      2.3MB

      MD5

      dac92bea30242e7e0f426eba58109bf6

      SHA1

      5fec099a4ecc1b8b17018ca44811f2df4d85f44c

      SHA256

      93b5f01ab4a031fa026905ac83921a4c6f26b37f83cc5ee70f401ad6d5e6a092

      SHA512

      6d7d7e60e0adcfcc09a812effa4511634b45a330b07b2717e375816531f2e94d2ed051bd174a29daf25ac672bc356c6ada438b47db2d9f3cde07bdb9e9fc6440

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
      Filesize

      2.3MB

      MD5

      dac92bea30242e7e0f426eba58109bf6

      SHA1

      5fec099a4ecc1b8b17018ca44811f2df4d85f44c

      SHA256

      93b5f01ab4a031fa026905ac83921a4c6f26b37f83cc5ee70f401ad6d5e6a092

      SHA512

      6d7d7e60e0adcfcc09a812effa4511634b45a330b07b2717e375816531f2e94d2ed051bd174a29daf25ac672bc356c6ada438b47db2d9f3cde07bdb9e9fc6440

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\IPC.dll
      Filesize

      181KB

      MD5

      4d0ba5a365c9eeba314abc4fee6736e9

      SHA1

      060c0b6d1e8b9e0f036d8af7c758975125bd4d17

      SHA256

      c162b50f6bddd545d9945c8e94bbe1034b6f5266e6282a711896741232818260

      SHA512

      96e8bfbc512a15c54f97be72b6c71f3ddc3d145b0575cfb12a41a8d8a7ca8f4492a3e09cae3715c0976e4bd0eb0ec30d56f8e95931cc6ed08d12ea0f146d7562

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\cef.pak
      Filesize

      3.6MB

      MD5

      a3abcf5083faca2c384cd01e87f456f0

      SHA1

      5bb3025397003422b133481efe1af72e68cd8d6a

      SHA256

      ad36cfc656dfd45bb940b48c4d3d6f7ff43bf1d3466bf818785e9faed26521a1

      SHA512

      1c86d3ee298b90bee1cfa6319ed5a4621e9ac423869f560939ed6a2bb6543516ab6d11ee06ccfdd2fe53438ae6ae2650ee2262453d3eeba2e643967929378a8f

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\cef_100_percent.pak
      Filesize

      654KB

      MD5

      001bda7609bdbfde0327d66ffbcc92db

      SHA1

      7b40b2cf0ac65df43d447cf40e7dc96de38fbb54

      SHA256

      c6818de36b8e2d0d6e7d7bdf57cf04b45daf7f346f9b4cb2b244861bbc63d4a8

      SHA512

      76fd65f0f6fbd102b6f0403274ae5318eea2d052d322eef57222559c62912be2daf44dcbe216208be730a7252bde5d2ae0d2a48fbd70de5584da2d66a685763b

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\cef_200_percent.pak
      Filesize

      748KB

      MD5

      a1b33c52d35741f61ed6ca094562efbd

      SHA1

      4fae5a27b97eee2f2a9683865b3dcb8d42041d3a

      SHA256

      a647c4e260a8402b01abeab1f08c0c187c6a2d6abd3c1e6d1fa6d7b98f60526a

      SHA512

      c2c86ee9328f6aa1d47bf0f11c918869716ad7405ebfc94bdae7473e0223ac0c5114af9dc1dec5d77583ff1d67a3e6fc06ec6057f1091a9f9f52e443b5af295d

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\cef_extensions.pak
      Filesize

      1.7MB

      MD5

      79621312991e739364fb05a0673613e5

      SHA1

      237c3b017406d09c4eb57ffe9a9d51492297e9cf

      SHA256

      6704231fb9d9d9758bcc25570fbbecf7dd32f981fadc358df2187811b2e3a9f7

      SHA512

      78dd8ed94fa7d51d8ff72a8d600c48361fddc4b29d6a985c40aa46b6a10d89599461e43a3cc0a826e58b9c1830c4173ceda623997f79a1a292b58112d6e46c76

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\chrome_elf.dll
      Filesize

      530KB

      MD5

      763d5296e9600eb3d872cb7b9b1da751

      SHA1

      fc10ecb5934b989326d349f3e9d9cd0c6b9e5c87

      SHA256

      2735cc7fafc43e5bd1b8295340c4e72fab7510b767924953bd1b2c06cb76e986

      SHA512

      3bc22b24f8cf8ac823a53759da35175b9993f0db04fdc8b7c10029a7f9069ee3b93f14c51a8f39902d2e265c3baa361131c5d62a845944efba1db1e85eafc328

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log
      Filesize

      3KB

      MD5

      f78de6c03d70e7a0f1290b85f614d05d

      SHA1

      29c0905f28538ba994d62b8a5d46ede154e76210

      SHA256

      532aa61fe25e5bd820d4b99dd74ef3b0a8f591e99ef770b6bcc6669df6d81d92

      SHA512

      507d92fcf26f36ee10637a69c57fd75a5e63b138f01f113a07c3ce7675def6800b43c3c7047ba222519016957718903c002cd136e3f7a2724bc191f244d1d682

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\devtools_resources.pak
      Filesize

      5.5MB

      MD5

      c1102a6b7fa7532e5e6bff38b4b7df4e

      SHA1

      254e2eafa4732eb27c2aed87a77e40d357f1e7f9

      SHA256

      6c5e8407efc63668056ddf7ace4e957a077fdeea39d16284ec2991e0d2f56b80

      SHA512

      e16287e46d0ed6e2ef480e4d659602adb3942b3a4ba3d83ee77d17d51e13c2186d960bcf5811552db3e44c1bd6d2abf2f91d4dfbcb2d5dafe2f1592498f7cca7

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\icudtl.dat
      Filesize

      9.8MB

      MD5

      fbd34e3218fa3d1849ba97ef663a6a3b

      SHA1

      42450c3eddba817d05c39fa100a8498cdd1f11bc

      SHA256

      2634997f21e758d5961653a9fc71bf1f7bcca772a90100e1169b402cc6096230

      SHA512

      a927a19af40359412079e095ab14e85e1d57619c9e8886c0dca0d4888b8cb5db207b494ab35304cf872c4845418c678c1f0573040d4cc908b730b620c6b644c5

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\libcef.dll
      Filesize

      81.5MB

      MD5

      c304d658a555f36e9b7d03b2969a00ba

      SHA1

      ce2eae3550e1567217aa5262f7e7a7f92a423beb

      SHA256

      d8d55f42f8677d7343c508b6056477da6b92c953773178a2234824c250e43a7f

      SHA512

      b77265f1ee47867131ead9f9e1b430be36233f0bfc0b3f42756f9320be540c47350b349312d780020c2693b71ab01568026dccfabafb7d8cd55e80e05838697e

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\locales\en-US.pak
      Filesize

      173KB

      MD5

      eb16854dee504f27ffd656a8dce2637d

      SHA1

      1765f9fdffaa3f13403fad93fceef108ddeec66c

      SHA256

      beb029ece4e4cac1b1dc1809b653040877b6b5b457cdff91dc14e8d437c42922

      SHA512

      4d415308cd4295a3555f6d82f0145fcda0b97b9168c3d84650f8bbf36feb816623ddfec56ccb1d47778bfc54ee0d42235747bc469925ffbeab189cf9d2c13f58

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\natives_blob.bin
      Filesize

      173KB

      MD5

      1bbf6b26685ceb8417f08b250b0bb1bd

      SHA1

      75b4ce2290b97d2729d0b0abfea6e46d849741e0

      SHA256

      f695cdd98001f7cc061ebcf731886a957305b5cad75c375b62286be7a68419fd

      SHA512

      5f42d47a495aa11842491f48d6de48a5dedee10590751f3dc4df9c7d16bf42da09d8322284733a328f2e9eee6a4411298d842e4439b66536d2f872520f089430

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\v8_context_snapshot.bin
      Filesize

      1.5MB

      MD5

      4bf5a644ea8ac3d3bfa568ad03c7e6bf

      SHA1

      85423eda5582eccd36313a2435186f079c9e71e9

      SHA256

      8c6b71b0ad35ee98e4b7578a16dfa496e6756f06e7df29c090d20aee2283eed5

      SHA512

      1d583e2ea673c22495a5a56cd1cb3b8f618bb5051f3ebf377620a3d8dc0b6f29b51a468d3f3cff2b7e565343407773e3cc8ed8423460c7f0ba3d2e099d648f0f

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcade.ini
      Filesize

      65B

      MD5

      990973ec796302934588854d5401af64

      SHA1

      ae6732703c0b1e587e17b6ba0913e4171652b1b9

      SHA256

      d98ea9e706a7b62ff9771867186218202e2c0df3406f503cd6476e7331fc4982

      SHA512

      f72b6e58dd3189075281be9c1210af36ce5e681458b5a0354393658259722c66e098eba0d1730e7bf731f6e515b3d46d19ea15c95dce030d982ced3886988d79

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcade.xml
      Filesize

      13KB

      MD5

      ea9e825bf9e7043a76597bcb13dc786e

      SHA1

      93bd39a6ef5b74297afa4c39d98775fd7f52e1c1

      SHA256

      af826d9ccf135179514a069b81faa4f91c46e862a93b97846497ebfa97c7dd7e

      SHA512

      3b2c14fb2795465beac5258b6aa8fa5dce698a7cdba352954bfd5df7e1bbe780971efd435a5bf7980efb2667e4cada03304fa1cfcb5d912cc487ae846625f468

    • C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcadehelper.exe
      Filesize

      1.1MB

      MD5

      454c815fec365d71f936aefdfcadab5b

      SHA1

      b42e123d58bc39f31ef76d22d171f40d6e4467d4

      SHA256

      ce001baaef33ffcdca7e65804e10519ebc7e647dc51fe1fb26eb8bbbfccb9b85

      SHA512

      7a7527f3d425aa366c139a3a1be6894fcba58157ed249aefbbfdccd64978e69f748ee250a5f5ea4c236a53cc3c54d01d2ce6ad270a90fdc00805ff8d71de98cf

    • C:\Users\Admin\AppData\Local\Gtarcade\app\libcrypto-1_1.dll
      Filesize

      2.5MB

      MD5

      f5a82e5622b02ae298e24016ced64377

      SHA1

      dbe02b49411d6cf1a6722c418daedb09e786402c

      SHA256

      c6a3c3f9abe5782bdcc5fd1701c46cda99dcdac2744ac5109af53c2739b33c10

      SHA512

      515a7ecece60e25b1d10fb1c0cc667d1600f7fe77f3491090f9591cea700304ccb0e32803879628e5149b550c7aac1d79a8d100896d7de06dfcb99604c17dc56

    • C:\Users\Admin\AppData\Local\Gtarcade\app\libssl-1_1.dll
      Filesize

      875KB

      MD5

      a3189921701488c02cd6009b7b2ec3e1

      SHA1

      abdedbd2ecb45318277c616911d873cde1eca2cc

      SHA256

      b31dc95ba29143cd82d7fe7c404327ba2320fb21601ff3b61ed2175dd8607e16

      SHA512

      425e9a957b4c9382d5f171b659d9ff86574a9edc7d218a1f760d979b33042fa9476eaecb60b226dd4f96c9631916eadf723cb0c45dcd28db8bba60cca66b012b

    • C:\Users\Admin\AppData\Local\Gtarcade\app\log4cplus.dll
      Filesize

      554KB

      MD5

      d2fbe6c3830f2b6a771ad0a07d82b033

      SHA1

      1a4d680648a17f350a946b0d4e91bb699eade757

      SHA256

      e0fcc93411cffa9319dbc0d137c21c1432351d525b891048474e07eaaeee4e3e

      SHA512

      89b90712e352c44af888e18c8a86fa7172f972d476ad7093887465281f82d5303b861174a44f9a9ea445157ac511acc93b08ee68ddcc7352d7cedad23823412f

    • C:\Users\Admin\AppData\Local\Gtarcade\app\upload.log
      Filesize

      178B

      MD5

      21a44d6eb7abd133b54dfd6730f638df

      SHA1

      c2b5a400ba26cbd22275436cae17ad90c4c39630

      SHA256

      1cec1e59f0f25fa44c2d3a9fb553d876a2c3519b66b74d83e6f590b3d91ab5ea

      SHA512

      bde6bb8f797e2a3c86a5538eef68db36ce98bb92e7d3b951569c94e5e921334d50bc0213492558e55439036cc8ff3000085925f5c94a8095f5408f9e93a1fc22

    • C:\Users\Admin\AppData\Local\Gtarcade\config.ini
      Filesize

      74B

      MD5

      b043e813cb2f890ac8e46b634df591a0

      SHA1

      72e89556c96818f8acdb57c2758ca663ecce8792

      SHA256

      a57d42d0be7ee40fdcb12d842b86f89b905ab154a5411f9133404339b6d927cd

      SHA512

      2521bd28c5f390338e60caf0d6667779f26b38800f81c5dac33f2b483178d2fd9382eb24af78086c2fde1dfd06f4f19292962edd5b6c178b2fd8c84ef2c4c668

    • \Users\Admin\AppData\Local\Gtarcade\app\DuiLib.dll
      Filesize

      1.9MB

      MD5

      829590ea74f561afcac42328ac74f721

      SHA1

      b229bdc107d14fddfc6151dd74880933e656f039

      SHA256

      36922560e296125ff2d00b69ae697ced310078b29ffd8a4258bf0f738b69c72b

      SHA512

      31ac3786741fd5fe2398c4f28ed6fe593ec33a29f2863e031583eab2a0b134ffd43d210fd6b1ebb8f1ae7d2a33c2eda9af952286b6ee598c2dcf119be6141a01

    • \Users\Admin\AppData\Local\Gtarcade\app\GTaCrashHandler.exe
      Filesize

      871KB

      MD5

      4ac3c9da1047cf8138acb0d995061a3a

      SHA1

      e9ba33b9413002bab50183d26614fdccb334a907

      SHA256

      32e785e0bb311d45db06cd7a0bc4a343fd80e72e756a1b1a66b273948dadcc4b

      SHA512

      2761e7f7041fd83b6d3126eb673deb9b122481895f65a0b032b6fbe210341c736515a636b9caff7fcdcf23119b6408ef35dfd01a3a949b30275c9dee24d4d520

    • \Users\Admin\AppData\Local\Gtarcade\app\GTaCrashHandler.exe
      Filesize

      871KB

      MD5

      4ac3c9da1047cf8138acb0d995061a3a

      SHA1

      e9ba33b9413002bab50183d26614fdccb334a907

      SHA256

      32e785e0bb311d45db06cd7a0bc4a343fd80e72e756a1b1a66b273948dadcc4b

      SHA512

      2761e7f7041fd83b6d3126eb673deb9b122481895f65a0b032b6fbe210341c736515a636b9caff7fcdcf23119b6408ef35dfd01a3a949b30275c9dee24d4d520

    • \Users\Admin\AppData\Local\Gtarcade\app\GTaCrashHandler.exe
      Filesize

      871KB

      MD5

      4ac3c9da1047cf8138acb0d995061a3a

      SHA1

      e9ba33b9413002bab50183d26614fdccb334a907

      SHA256

      32e785e0bb311d45db06cd7a0bc4a343fd80e72e756a1b1a66b273948dadcc4b

      SHA512

      2761e7f7041fd83b6d3126eb673deb9b122481895f65a0b032b6fbe210341c736515a636b9caff7fcdcf23119b6408ef35dfd01a3a949b30275c9dee24d4d520

    • \Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
      Filesize

      2.3MB

      MD5

      ec8d9a9f772ec078df0b0e728524c0f0

      SHA1

      9db1ae3ff01ce20fdcc6ee5379935e79b877ff7f

      SHA256

      9a0d38e1176406e67c7535e6b4572da6d346227fe54fb39a33bb3604ca25725a

      SHA512

      f65629692cb799b5a819cb0d7172d467b9fb87ae4cf695a650fb6747ec8d7635236b3d78688f05b785015c6bcfe0a672d268d3150df2cd56cb67d07530cbdb32

    • \Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
      Filesize

      2.3MB

      MD5

      ec8d9a9f772ec078df0b0e728524c0f0

      SHA1

      9db1ae3ff01ce20fdcc6ee5379935e79b877ff7f

      SHA256

      9a0d38e1176406e67c7535e6b4572da6d346227fe54fb39a33bb3604ca25725a

      SHA512

      f65629692cb799b5a819cb0d7172d467b9fb87ae4cf695a650fb6747ec8d7635236b3d78688f05b785015c6bcfe0a672d268d3150df2cd56cb67d07530cbdb32

    • \Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
      Filesize

      2.3MB

      MD5

      ec8d9a9f772ec078df0b0e728524c0f0

      SHA1

      9db1ae3ff01ce20fdcc6ee5379935e79b877ff7f

      SHA256

      9a0d38e1176406e67c7535e6b4572da6d346227fe54fb39a33bb3604ca25725a

      SHA512

      f65629692cb799b5a819cb0d7172d467b9fb87ae4cf695a650fb6747ec8d7635236b3d78688f05b785015c6bcfe0a672d268d3150df2cd56cb67d07530cbdb32

    • \Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
      Filesize

      2.3MB

      MD5

      ec8d9a9f772ec078df0b0e728524c0f0

      SHA1

      9db1ae3ff01ce20fdcc6ee5379935e79b877ff7f

      SHA256

      9a0d38e1176406e67c7535e6b4572da6d346227fe54fb39a33bb3604ca25725a

      SHA512

      f65629692cb799b5a819cb0d7172d467b9fb87ae4cf695a650fb6747ec8d7635236b3d78688f05b785015c6bcfe0a672d268d3150df2cd56cb67d07530cbdb32

    • \Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
      Filesize

      2.3MB

      MD5

      ec8d9a9f772ec078df0b0e728524c0f0

      SHA1

      9db1ae3ff01ce20fdcc6ee5379935e79b877ff7f

      SHA256

      9a0d38e1176406e67c7535e6b4572da6d346227fe54fb39a33bb3604ca25725a

      SHA512

      f65629692cb799b5a819cb0d7172d467b9fb87ae4cf695a650fb6747ec8d7635236b3d78688f05b785015c6bcfe0a672d268d3150df2cd56cb67d07530cbdb32

    • \Users\Admin\AppData\Local\Gtarcade\app\GTarcadeHelper.exe
      Filesize

      1.1MB

      MD5

      454c815fec365d71f936aefdfcadab5b

      SHA1

      b42e123d58bc39f31ef76d22d171f40d6e4467d4

      SHA256

      ce001baaef33ffcdca7e65804e10519ebc7e647dc51fe1fb26eb8bbbfccb9b85

      SHA512

      7a7527f3d425aa366c139a3a1be6894fcba58157ed249aefbbfdccd64978e69f748ee250a5f5ea4c236a53cc3c54d01d2ce6ad270a90fdc00805ff8d71de98cf

    • \Users\Admin\AppData\Local\Gtarcade\app\GTarcadeHelper.exe
      Filesize

      1.1MB

      MD5

      454c815fec365d71f936aefdfcadab5b

      SHA1

      b42e123d58bc39f31ef76d22d171f40d6e4467d4

      SHA256

      ce001baaef33ffcdca7e65804e10519ebc7e647dc51fe1fb26eb8bbbfccb9b85

      SHA512

      7a7527f3d425aa366c139a3a1be6894fcba58157ed249aefbbfdccd64978e69f748ee250a5f5ea4c236a53cc3c54d01d2ce6ad270a90fdc00805ff8d71de98cf

    • \Users\Admin\AppData\Local\Gtarcade\app\GTarcadeHelper.exe
      Filesize

      1.1MB

      MD5

      454c815fec365d71f936aefdfcadab5b

      SHA1

      b42e123d58bc39f31ef76d22d171f40d6e4467d4

      SHA256

      ce001baaef33ffcdca7e65804e10519ebc7e647dc51fe1fb26eb8bbbfccb9b85

      SHA512

      7a7527f3d425aa366c139a3a1be6894fcba58157ed249aefbbfdccd64978e69f748ee250a5f5ea4c236a53cc3c54d01d2ce6ad270a90fdc00805ff8d71de98cf

    • \Users\Admin\AppData\Local\Gtarcade\app\Gtarcade.exe
      Filesize

      5.3MB

      MD5

      51374673837d6cceeb4f213ed27b2c13

      SHA1

      ec6584a4d7aa31aa2427841762f8b0f1a97fa71f

      SHA256

      66bf8a67aeb39becefdc602f97db2da384857506ee98fa59b806c03136c5bf19

      SHA512

      70a334deacb09a51f2ad57562e67ed25ab91ffa0c72c56f489a72ca1c8a44690dc91372e9b2427d676d9e98036e227a9a2e42b660d9e5c60c864cfa8ab430cf3

    • \Users\Admin\AppData\Local\Gtarcade\app\Gtarcade.exe
      Filesize

      5.3MB

      MD5

      51374673837d6cceeb4f213ed27b2c13

      SHA1

      ec6584a4d7aa31aa2427841762f8b0f1a97fa71f

      SHA256

      66bf8a67aeb39becefdc602f97db2da384857506ee98fa59b806c03136c5bf19

      SHA512

      70a334deacb09a51f2ad57562e67ed25ab91ffa0c72c56f489a72ca1c8a44690dc91372e9b2427d676d9e98036e227a9a2e42b660d9e5c60c864cfa8ab430cf3

    • \Users\Admin\AppData\Local\Gtarcade\app\Gtarcade.exe
      Filesize

      5.3MB

      MD5

      51374673837d6cceeb4f213ed27b2c13

      SHA1

      ec6584a4d7aa31aa2427841762f8b0f1a97fa71f

      SHA256

      66bf8a67aeb39becefdc602f97db2da384857506ee98fa59b806c03136c5bf19

      SHA512

      70a334deacb09a51f2ad57562e67ed25ab91ffa0c72c56f489a72ca1c8a44690dc91372e9b2427d676d9e98036e227a9a2e42b660d9e5c60c864cfa8ab430cf3

    • \Users\Admin\AppData\Local\Gtarcade\app\Gtarcade.exe
      Filesize

      5.3MB

      MD5

      51374673837d6cceeb4f213ed27b2c13

      SHA1

      ec6584a4d7aa31aa2427841762f8b0f1a97fa71f

      SHA256

      66bf8a67aeb39becefdc602f97db2da384857506ee98fa59b806c03136c5bf19

      SHA512

      70a334deacb09a51f2ad57562e67ed25ab91ffa0c72c56f489a72ca1c8a44690dc91372e9b2427d676d9e98036e227a9a2e42b660d9e5c60c864cfa8ab430cf3

    • \Users\Admin\AppData\Local\Gtarcade\app\IPC.dll
      Filesize

      197KB

      MD5

      39d0f6ec589fa04fed81f9be7adc266c

      SHA1

      d8610757ee5e47800723f136871598e0531a29c7

      SHA256

      175573c9405fabdeaec4941028b5eaa0c4242c8fcebbea2da34178c10e62a08e

      SHA512

      ee466d2cb38fc5229b7b62ce01a7db6de9abc381ac06c43b7ca0f89338e10448934fb28d92b9b64c8e28e0a4aaa1844efa356626fd4399f4bfaa68b3b1d9126e

    • \Users\Admin\AppData\Local\Gtarcade\app\IPC.dll
      Filesize

      197KB

      MD5

      39d0f6ec589fa04fed81f9be7adc266c

      SHA1

      d8610757ee5e47800723f136871598e0531a29c7

      SHA256

      175573c9405fabdeaec4941028b5eaa0c4242c8fcebbea2da34178c10e62a08e

      SHA512

      ee466d2cb38fc5229b7b62ce01a7db6de9abc381ac06c43b7ca0f89338e10448934fb28d92b9b64c8e28e0a4aaa1844efa356626fd4399f4bfaa68b3b1d9126e

    • \Users\Admin\AppData\Local\Gtarcade\app\IPC.dll
      Filesize

      197KB

      MD5

      39d0f6ec589fa04fed81f9be7adc266c

      SHA1

      d8610757ee5e47800723f136871598e0531a29c7

      SHA256

      175573c9405fabdeaec4941028b5eaa0c4242c8fcebbea2da34178c10e62a08e

      SHA512

      ee466d2cb38fc5229b7b62ce01a7db6de9abc381ac06c43b7ca0f89338e10448934fb28d92b9b64c8e28e0a4aaa1844efa356626fd4399f4bfaa68b3b1d9126e

    • \Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
      Filesize

      2.3MB

      MD5

      dac92bea30242e7e0f426eba58109bf6

      SHA1

      5fec099a4ecc1b8b17018ca44811f2df4d85f44c

      SHA256

      93b5f01ab4a031fa026905ac83921a4c6f26b37f83cc5ee70f401ad6d5e6a092

      SHA512

      6d7d7e60e0adcfcc09a812effa4511634b45a330b07b2717e375816531f2e94d2ed051bd174a29daf25ac672bc356c6ada438b47db2d9f3cde07bdb9e9fc6440

    • \Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
      Filesize

      2.3MB

      MD5

      dac92bea30242e7e0f426eba58109bf6

      SHA1

      5fec099a4ecc1b8b17018ca44811f2df4d85f44c

      SHA256

      93b5f01ab4a031fa026905ac83921a4c6f26b37f83cc5ee70f401ad6d5e6a092

      SHA512

      6d7d7e60e0adcfcc09a812effa4511634b45a330b07b2717e375816531f2e94d2ed051bd174a29daf25ac672bc356c6ada438b47db2d9f3cde07bdb9e9fc6440

    • \Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
      Filesize

      2.3MB

      MD5

      dac92bea30242e7e0f426eba58109bf6

      SHA1

      5fec099a4ecc1b8b17018ca44811f2df4d85f44c

      SHA256

      93b5f01ab4a031fa026905ac83921a4c6f26b37f83cc5ee70f401ad6d5e6a092

      SHA512

      6d7d7e60e0adcfcc09a812effa4511634b45a330b07b2717e375816531f2e94d2ed051bd174a29daf25ac672bc356c6ada438b47db2d9f3cde07bdb9e9fc6440

    • \Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
      Filesize

      2.3MB

      MD5

      dac92bea30242e7e0f426eba58109bf6

      SHA1

      5fec099a4ecc1b8b17018ca44811f2df4d85f44c

      SHA256

      93b5f01ab4a031fa026905ac83921a4c6f26b37f83cc5ee70f401ad6d5e6a092

      SHA512

      6d7d7e60e0adcfcc09a812effa4511634b45a330b07b2717e375816531f2e94d2ed051bd174a29daf25ac672bc356c6ada438b47db2d9f3cde07bdb9e9fc6440

    • \Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
      Filesize

      2.3MB

      MD5

      dac92bea30242e7e0f426eba58109bf6

      SHA1

      5fec099a4ecc1b8b17018ca44811f2df4d85f44c

      SHA256

      93b5f01ab4a031fa026905ac83921a4c6f26b37f83cc5ee70f401ad6d5e6a092

      SHA512

      6d7d7e60e0adcfcc09a812effa4511634b45a330b07b2717e375816531f2e94d2ed051bd174a29daf25ac672bc356c6ada438b47db2d9f3cde07bdb9e9fc6440

    • \Users\Admin\AppData\Local\Gtarcade\app\gamehall\IPC.dll
      Filesize

      181KB

      MD5

      4d0ba5a365c9eeba314abc4fee6736e9

      SHA1

      060c0b6d1e8b9e0f036d8af7c758975125bd4d17

      SHA256

      c162b50f6bddd545d9945c8e94bbe1034b6f5266e6282a711896741232818260

      SHA512

      96e8bfbc512a15c54f97be72b6c71f3ddc3d145b0575cfb12a41a8d8a7ca8f4492a3e09cae3715c0976e4bd0eb0ec30d56f8e95931cc6ed08d12ea0f146d7562

    • \Users\Admin\AppData\Local\Gtarcade\app\gamehall\chrome_elf.dll
      Filesize

      530KB

      MD5

      763d5296e9600eb3d872cb7b9b1da751

      SHA1

      fc10ecb5934b989326d349f3e9d9cd0c6b9e5c87

      SHA256

      2735cc7fafc43e5bd1b8295340c4e72fab7510b767924953bd1b2c06cb76e986

      SHA512

      3bc22b24f8cf8ac823a53759da35175b9993f0db04fdc8b7c10029a7f9069ee3b93f14c51a8f39902d2e265c3baa361131c5d62a845944efba1db1e85eafc328

    • \Users\Admin\AppData\Local\Gtarcade\app\gamehall\libcef.dll
      Filesize

      81.5MB

      MD5

      c304d658a555f36e9b7d03b2969a00ba

      SHA1

      ce2eae3550e1567217aa5262f7e7a7f92a423beb

      SHA256

      d8d55f42f8677d7343c508b6056477da6b92c953773178a2234824c250e43a7f

      SHA512

      b77265f1ee47867131ead9f9e1b430be36233f0bfc0b3f42756f9320be540c47350b349312d780020c2693b71ab01568026dccfabafb7d8cd55e80e05838697e

    • \Users\Admin\AppData\Local\Gtarcade\app\libcrypto-1_1.dll
      Filesize

      2.5MB

      MD5

      f5a82e5622b02ae298e24016ced64377

      SHA1

      dbe02b49411d6cf1a6722c418daedb09e786402c

      SHA256

      c6a3c3f9abe5782bdcc5fd1701c46cda99dcdac2744ac5109af53c2739b33c10

      SHA512

      515a7ecece60e25b1d10fb1c0cc667d1600f7fe77f3491090f9591cea700304ccb0e32803879628e5149b550c7aac1d79a8d100896d7de06dfcb99604c17dc56

    • \Users\Admin\AppData\Local\Gtarcade\app\libssl-1_1.dll
      Filesize

      875KB

      MD5

      a3189921701488c02cd6009b7b2ec3e1

      SHA1

      abdedbd2ecb45318277c616911d873cde1eca2cc

      SHA256

      b31dc95ba29143cd82d7fe7c404327ba2320fb21601ff3b61ed2175dd8607e16

      SHA512

      425e9a957b4c9382d5f171b659d9ff86574a9edc7d218a1f760d979b33042fa9476eaecb60b226dd4f96c9631916eadf723cb0c45dcd28db8bba60cca66b012b

    • \Users\Admin\AppData\Local\Gtarcade\app\log4cplus.dll
      Filesize

      554KB

      MD5

      d2fbe6c3830f2b6a771ad0a07d82b033

      SHA1

      1a4d680648a17f350a946b0d4e91bb699eade757

      SHA256

      e0fcc93411cffa9319dbc0d137c21c1432351d525b891048474e07eaaeee4e3e

      SHA512

      89b90712e352c44af888e18c8a86fa7172f972d476ad7093887465281f82d5303b861174a44f9a9ea445157ac511acc93b08ee68ddcc7352d7cedad23823412f

    • memory/436-77-0x0000000000000000-mapping.dmp
    • memory/1240-102-0x0000000000000000-mapping.dmp
    • memory/1280-161-0x0000000000000000-mapping.dmp
    • memory/1340-59-0x0000000000000000-mapping.dmp
    • memory/1540-113-0x0000000000000000-mapping.dmp
    • memory/1868-109-0x0000000000000000-mapping.dmp
    • memory/1884-54-0x0000000075191000-0x0000000075193000-memory.dmp
      Filesize

      8KB

    • memory/2024-89-0x0000000000000000-mapping.dmp