54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
Size

2.0MB
MD5

019c4a62d597ea5ed7e19ac822007ff4
SHA1

b60090812f2838bf622bf464c17d17b963b7537f
SHA256

54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70
SHA512

9937efc65247be8f60d61f1ac192623faaa6e196dac3b6d2cd39c887e5fc2b347ac7d1b8c0893dfab2708ebdc606463b20148a35bd0d5bc9d64edbb23fcbe727
SSDEEP

49152:FuXX9evCLqAyxF9GIVzAFCmPMYqWOZX6+kra:FudeE4GIVEFC5DxZKTra

Score

8^/10

evasion persistence trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3744	FlashGames.exe
5100	ie1.exe
528	softsetup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ie1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\hahagame\ImgCache\Thumbs.db	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ImgCache\www.go2000.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\怀旧木纹.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\chs.dll	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\QQMain.reg	FlashGames.exe
File created	C:\Program Files (x86)\hahagame\uninst.exe	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ImgCache\www.ioage.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\chis.ini	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\www.go2000.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\Office2007.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\Skins\金色年华.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\flash.mdb	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ImgCache\www.taobao.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\冬季恋歌.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\灰色轨迹.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\Skins\简约之美.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ClientUpdate.exe	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\www.2548.cn_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\FlashGames.exe	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\FlashGames.exe	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ImgCache\www.51.la_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\www.alimama.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ImgCache\www.hao123.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\Skins\Office2003.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\Office2003.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\flash.mdb	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\chs.dll	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\skin	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\青葱岁月.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\easyabc.95599.cn_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\www.51.la_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\www.google.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\PROGRA~2\hahagame\theworld.ac	ie1.exe
File created	C:\PROGRA~2\hahagame\twcache.ini	ie1.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220919074305.pma	setup.exe
File created	C:\Program Files (x86)\hahagame\ie1.ini	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ImgCache\easyabc.95599.cn_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\www.231wg.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ImgCache\www.ayxz.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\www.hao123.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\Skins\金属之美.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\reopen.dll	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ImgCache\www.google.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\www.taobao.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\www.tqqa.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\Skins\怀旧木纹.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\简约之美.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ImgCache\www.alimama.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\dailytips.ini	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\softsetup.exe	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\setup.dll	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ImgCache\www.tqqa.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\Skins\灰色轨迹.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\Skins\青葱岁月.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\金色年华.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ie1.ini	ie1.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\38984886-f2fb-4866-a86c-597d24660357.tmp	setup.exe
File created	C:\Program Files (x86)\hahagame\Skins\Office2007.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\ie1.exe	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File created	C:\Program Files (x86)\hahagame\reopen.dll	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\ImgCache\www.ioage.com_favicon.ico	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
File opened for modification	C:\Program Files (x86)\hahagame\Skins\金属之美.asz	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1428	528	WerFault.exe	88

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	ie1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\ie1.exe = "1"	ie1.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	ie1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	ie1.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ie1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ie1.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	ie1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\ie1.exe = "0"	ie1.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\??(&R)\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\??(&R)\Command	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\DefaultIcon	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\DefaultIcon\ = "c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\DefaultIcon	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\??(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)\Command	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\??(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\DefaultIcon\ = "c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\??(&R)	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\??(&R)	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\ShellFolder	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)\ = "????(&H)"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)\Command\ = "\"c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" http://www.on86.com/?18"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\ShellFolder\Attributes = "10"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\ShellFolder\Attributes = "10"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\ = "Internet Explorer"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)\Command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\ShellFolder	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\ = "Internet Explorer"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)\ = "????(&H)"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1948	regedit.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
2920	msedge.exe
2920	msedge.exe
5156	identity_helper.exe
5156	identity_helper.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3744	FlashGames.exe
528	softsetup.exe
528	softsetup.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe
5100	ie1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 3744	3424	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe	85
PID 3424 wrote to memory of 3744	3424	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe	85
PID 3424 wrote to memory of 3744	3424	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe	85
PID 3424 wrote to memory of 5100	3424	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe	86
PID 3424 wrote to memory of 5100	3424	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe	86
PID 3424 wrote to memory of 5100	3424	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe	86
PID 3424 wrote to memory of 2920	3424	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe	87
PID 3424 wrote to memory of 2920	3424	54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe	87
PID 3744 wrote to memory of 528	3744	FlashGames.exe	88
PID 3744 wrote to memory of 528	3744	FlashGames.exe	88
PID 3744 wrote to memory of 528	3744	FlashGames.exe	88
PID 2920 wrote to memory of 112	2920	msedge.exe	89
PID 2920 wrote to memory of 112	2920	msedge.exe	89
PID 3744 wrote to memory of 2948	3744	FlashGames.exe	90
PID 3744 wrote to memory of 2948	3744	FlashGames.exe	90
PID 3744 wrote to memory of 2948	3744	FlashGames.exe	90
PID 2948 wrote to memory of 1948	2948	cmd.exe	94
PID 2948 wrote to memory of 1948	2948	cmd.exe	94
PID 2948 wrote to memory of 1948	2948	cmd.exe	94
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 1160	2920	msedge.exe	99
PID 2920 wrote to memory of 912	2920	msedge.exe	100
PID 2920 wrote to memory of 912	2920	msedge.exe	100
PID 2920 wrote to memory of 2088	2920	msedge.exe	102
PID 2920 wrote to memory of 2088	2920	msedge.exe	102
PID 2920 wrote to memory of 2088	2920	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe
"C:\Users\Admin\AppData\Local\Temp\54da687acb6fad9328e6c7cd3ae06dceebf53bce74bb4653d8b8588e2d770c70.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\hahagame\FlashGames.exe
  "C:\Program Files (x86)\hahagame\FlashGames.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Program Files (x86)\hahagame\softsetup.exe
    "C:\Program Files (x86)\hahagame\softsetup.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 1340
      4⤵
      Program crash
      PID:1428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c regedit /s "C:\Program Files (x86)\hahagame\QQMain.reg"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s "C:\Program Files (x86)\hahagame\QQMain.reg"
      4⤵
      Modifies registry class
      Runs .reg file with regedit
      PID:1948
- C:\Program Files (x86)\hahagame\ie1.exe
  "C:\Program Files (x86)\hahagame\ie1.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files (x86)\hahagame\count.htm
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb865046f8,0x7ffb86504708,0x7ffb86504718
    3⤵
    PID:112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 /prefetch:2
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff66fa15460,0x7ff66fa15470,0x7ff66fa15480
      4⤵
      PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3348 /prefetch:8
    3⤵
    PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1328 /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2792 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,13353605379344100612,14075254394705353316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1680 /prefetch:8
    3⤵
    PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 528 -ip 528
1⤵
PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\hahagame\ImgCache\www.baidu.com_favicon.ico

Filesize
2KB

MD5
b255f54b7dcbffe1a8eb82ed120cdaf4

SHA1
426116e57da0be77adcf22bec824da3b6033ee26

SHA256
b60b3c0a4817699ded2370edabde4ee845b45766ab08e8c492d883235e395721

SHA512
fcd8fa312d09b94b8352600799c89669843a02d88f8615635a3accc1653062010222b002568a9cebd2081d66d9b5f20fe6e0ca97fa39be72c817c0dc044e0d8d

Download Submit
C:\PROGRA~2\hahagame\dailytips.ini

Filesize
26KB

MD5
436d326dc83bff4b69bc9abc3136ba3c

SHA1
4c53f487a7656cf6cf720e993b47855e49285e31

SHA256
ef24d78e219fbca0ea92baf999234ffa1430e9af303f8000aa02379f9f8ab915

SHA512
f29238f2ffcab9939baa81db664973cf0918d37e1b7ade5f25d885388a9eb12fc030cf73b7e1df46f03886011ee54ffc7c4082e769b6a25bb7ac15c8628e60a9

Download Submit
C:\PROGRA~2\hahagame\oem.ini

Filesize
309B

MD5
fba30dd1954dc39b0c20ed8037168323

SHA1
c771f2581ce351dad54073fca3bd38e4b56bb413

SHA256
d00153728e7dff40cadb33e9b8b026eb0379a2c04bfbaff7cc9c50a94e82071e

SHA512
b746f3b21b7feb4b26c05baa3b17112b0d119f2c3abc53ef57778f0fd52d9b5cde75204ff07e3fa3d6d4a1f895e5013438edd3d083ead98c8705567aeade2278

Download Submit
C:\Program Files (x86)\hahagame\FlashGames.exe

Filesize
40KB

MD5
ca4eaec0ea91240435451c0ba92b6f0e

SHA1
bd86265dd4aa094cd8497b5f08cf5ffe5c15631c

SHA256
934dae2a67ac80a7e4c0f01ce3a3514b4d51a84dd60aeb10a59c1666c2ae3c0c

SHA512
4f2d9849e78e6a7924627394509835838e76f28f48ae4c522323bd0c2bb12b54f5cd8fe1a8e652a8b034e19fb1683debb6339066f43a528f188146997fd25bb2

Download Submit
C:\Program Files (x86)\hahagame\FlashGames.exe

Filesize
40KB

MD5
ca4eaec0ea91240435451c0ba92b6f0e

SHA1
bd86265dd4aa094cd8497b5f08cf5ffe5c15631c

SHA256
934dae2a67ac80a7e4c0f01ce3a3514b4d51a84dd60aeb10a59c1666c2ae3c0c

SHA512
4f2d9849e78e6a7924627394509835838e76f28f48ae4c522323bd0c2bb12b54f5cd8fe1a8e652a8b034e19fb1683debb6339066f43a528f188146997fd25bb2

Download Submit
C:\Program Files (x86)\hahagame\QQMain.reg

Filesize
2KB

MD5
ef2e536c9692e1f23c80b7d0e5d245ce

SHA1
f874806fdba9c9bc443e0b938154103f89701f3f

SHA256
e30ac7ee658f28e905bf1477d95d9fb74bb62126b05a8cc4d4756f7d5a546c9d

SHA512
cecd2e6e2e80ee7b9880587e44eaf6cb216a5247591b6af4eee68e469ea14115042e8f997e09e66a2e33384166ae3ccc6f1df0cc02ee5d2beaea67f10e264e5a

Download Submit
C:\Program Files (x86)\hahagame\count.htm

Filesize
106B

MD5
d6a88958485169689293d30deabccded

SHA1
39c30a52ac4f4d911d3da4004b87a32c9e195d17

SHA256
67a4c1cb84fdb567df796f73d9fbf88bf0f2834a042f11d0d33b49ccc9ca10f8

SHA512
190af1892ea9d49057150e2136b5cb5eef9a3bdaa3db2b6cddce354baa7f8724b88da98961bb7761ad0c3b0003dd5df8ce0ebfefce35741028f84d634e9a6f8a

Download Submit
C:\Program Files (x86)\hahagame\ie1.exe

Filesize
1.1MB

MD5
331810e9f6de0679e9cd337aa026aab4

SHA1
88cbc6a80afcfdd2d5506d8f73ca889a669c5eed

SHA256
7c06daa6628997c39580b86e9601ee35c7e688efe0079d11517310f6433911cf

SHA512
5c82f7a497519d8a466d898701c210c27908d12ec9ff0dae56e121b574551648fcbb30d2af0c8e2bdb9b3fc1f86801bdea0fe23858b721a61905eeabcb59e55d

Download Submit
C:\Program Files (x86)\hahagame\ie1.exe

Filesize
1.1MB

MD5
331810e9f6de0679e9cd337aa026aab4

SHA1
88cbc6a80afcfdd2d5506d8f73ca889a669c5eed

SHA256
7c06daa6628997c39580b86e9601ee35c7e688efe0079d11517310f6433911cf

SHA512
5c82f7a497519d8a466d898701c210c27908d12ec9ff0dae56e121b574551648fcbb30d2af0c8e2bdb9b3fc1f86801bdea0fe23858b721a61905eeabcb59e55d

Download Submit
C:\Program Files (x86)\hahagame\ie1.ini

Filesize
15KB

MD5
0da6ac74dd42d741d3c317afca4c13b1

SHA1
843e5ca16a26e4b72713b351fc3b7864159a7206

SHA256
c1c719b60400852dee2b21369fb964636fb1182077014ff90ccddb90477f882f

SHA512
4a290aef891c0a07c197a59126cf92562f249419ff3fa19727ceeeac4bbdc0043acaaab861f60297c2ecae4c1339e044d8d0d1073cec3ea4104353603e1b0638

Download Submit
C:\Program Files (x86)\hahagame\softsetup.exe

Filesize
1.7MB

MD5
defb455a14e4fca645e1195726519ac4

SHA1
29cecb231f1ad4d3bc128b0270ec28463205ac69

SHA256
10f48a16005329c52189760add4b78a34f2e3e736417371bf5b9cfd85f44dc3e

SHA512
8bf879da722cccb9e7a9eec0e4efb52642431e1030e3e8c3bc5a9ed27bf7f8ab8b85271b952a87c79dbe5d3ba4fe402b706a293842386dacd486d3990916cba3

Download Submit
C:\Program Files (x86)\hahagame\softsetup.exe

Filesize
1.7MB

MD5
defb455a14e4fca645e1195726519ac4

SHA1
29cecb231f1ad4d3bc128b0270ec28463205ac69

SHA256
10f48a16005329c52189760add4b78a34f2e3e736417371bf5b9cfd85f44dc3e

SHA512
8bf879da722cccb9e7a9eec0e4efb52642431e1030e3e8c3bc5a9ed27bf7f8ab8b85271b952a87c79dbe5d3ba4fe402b706a293842386dacd486d3990916cba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
fcf99b92bccdcfb11aeba903efc0959e

SHA1
be04b02b479c1d6b1b279d4e0359cb0dee7ac0b5

SHA256
d41c41ccef044e90c69d99c15abf0811f61ba8611ff2e1e3c53ed3b39f15afda

SHA512
bad56dfaf41d525d8249fe980b13b2230f5d7f4ee4a3d212b419cd97ed5b9b20a1aa33fbb28a87fc84d05e4c931a1b5827fa822aa06c40cccec7f9c92d204623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
5a11c6099b9e5808dfb08c5c9570c92f

SHA1
e5dc219641146d1839557973f348037fa589fd18

SHA256
91291a5edc4e10a225d3c23265d236ecc74473d9893be5bd07e202d95b3fb172

SHA512
c2435b6619464a14c65ab116ab83a6e0568bdf7abc5e5a5e19f3deaf56c70a46360965da8b60e1256e9c8656aef9751adb9e762731bb8dbab145f1c8224ac8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
e391b7cb4e8eb98c27ccc3d7bc2e6bd1

SHA1
143f51a452623c562fbdde69d1cb61d8ed87fadb

SHA256
525d6a893355106cda7b2082cc8c3ba0f657f2e138eb9173c6cdadfd007f4613

SHA512
ad3bc7bdf97dad4eb6ba4426940b2270dc3c129558662566b8434cd76c078a062683d2ad6b51fd15ae1325cc735baa8783b50ea2a546e7ee7edce587cecd5642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
0ae88115b4b40612a06fa37f1ae1ebc8

SHA1
f342f816b693d43cf3808bcc12e9175021a2f870

SHA256
d716cf8a4e8feddaeff87ff9ce47837433124eb2df3e346bd126fa9f969afb9f

SHA512
9c35bc736b0f777d5304a7a345547b4c62ff51149486ef49a7d8ce2e5d46df2af8285eb7d2bf6f06c19abf67b9630f87259e290b26850f86f958413b6ddb862e

Download Submit