Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

4e48993846...10.exe

windows7-x64

8

4e48993846...10.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    133s
  • max time network
    54s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2022, 07:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4e48993846674996c85893ad5ff3597547218ad8a8d09c29bce8890bbfe64210.exe

  • Size

    602KB

  • MD5

    9eae9c61dcb70ec1980ef629f0f40207

  • SHA1

    7b854b52aec3ddae564b23d8ccddcdaef4488579

  • SHA256

    4e48993846674996c85893ad5ff3597547218ad8a8d09c29bce8890bbfe64210

  • SHA512

    60256df920debb097026a4c8ba0f02ff4a661447195e3e3f9e01336684a8ede1bbbb2d72fe47b893b23f13fb932b6f6cb98c4c622e9a76b4fdba563bce823d27

  • SSDEEP

    12288:2lh5LtbTJfgFQhkFkPNuWo/kMzL9yP7XixZBp9PJ4BSH:2l7Lt/J6+kF2Zo3zLA7XihPCBq

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e48993846674996c85893ad5ff3597547218ad8a8d09c29bce8890bbfe64210.exe
    "C:\Users\Admin\AppData\Local\Temp\4e48993846674996c85893ad5ff3597547218ad8a8d09c29bce8890bbfe64210.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\main.exe
      "C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\main.exe"
      2⤵
      • Executes dropped EXE
      PID:1696
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x560
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\1.bmp
    Filesize

    32KB

    MD5

    a8860dbde1654e384f235ccca3422157

    SHA1

    a15e256cb3faf36018f644adb3dcc0a8d7483ac1

    SHA256

    6c9d71f282cd019868c96608a6cd90e1a0385c69a49e6d094297f7b7f98d9816

    SHA512

    2d5d7d12361d0826ea4b85a9fd7aac7d548674e171b5c9dcf0636a963accfd97f4d683dc50722b9f557005b7e23a75b2242490b4d73ca8be60a98f93a0a46f5a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\1.rgn
    Filesize

    2KB

    MD5

    1b1325832a74a23b88001f51e0729009

    SHA1

    dea0bfdd97e3d9c6bfc080844fef71983e6835e1

    SHA256

    f283502822a7a89387a2306df6dc67307597d4d0d8767cff603bacda422b450f

    SHA512

    3437a5ed390c530d091a08e8c081997f4eb3b5a78c6109326b860433469da760d86ccccf5e19d02309639d073d74f0af2e8436f4211b28d865b533fd1a715e5f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\10.bmp
    Filesize

    32KB

    MD5

    1d601835d8418c9d034d4e94337e8708

    SHA1

    0cc2b0e3242f6fbe84d23265c3a4eb123773434a

    SHA256

    3e8119bc4858b909b653d6dd51c30a96e427101472ae38424de2d6caa9ff13da

    SHA512

    a3ba3ba1bdc884c9934a41bedc914be580360eaa5623a0fb44946c0035ba8249cdfc3bb745eac9453881e26529de88d335558a21a771ea374a0dc047710bbcbc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\10.rgn
    Filesize

    2KB

    MD5

    ce216f2201c67486bfe00cf9b66c0515

    SHA1

    48bcc971451c9cbefab404c9e5791e9f5c7ed0b3

    SHA256

    4c75ff6576a28a845aac6471c6e68e0af9380d4c44f23828ad7fd574457da8c3

    SHA512

    9b336cd80465b8e0a892924ffbf849f94498ddbd0b67785bf78cfee5c652eebca1243e0d9cd94a3d35f0840e45176f5dd20c33c0aecc4e0139917c3f883c6f9e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\11.bmp
    Filesize

    32KB

    MD5

    bc68cc1017ed16a9dc1915b435e95d4a

    SHA1

    b9b55b63db07780f14e37133fd375e713bf220ce

    SHA256

    10b87bc36f766ed034b3729d5c46f89763b4ccaf5cc91a847e0af71593cbf2ff

    SHA512

    1d9268c57e1bff29ce5cf0b4f76d3cc4b50df56ecd9ee33e868c64d2d52e7f933133d372e594b2a2c48604219bc58bcc28f75795c740a12ba15e97b36f9f4b9b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\11.rgn
    Filesize

    2KB

    MD5

    8f931257701b9937f6833972ce17ce10

    SHA1

    31e6b440ef427bc93455dc7563bf23e6e57ad800

    SHA256

    8cfd5c36b47ec103ba8490ef9dd3803b9764015a54ff8a6c282ce64abcbc3400

    SHA512

    e9f596b07631bd0f848839828111cf8f3a5a110791340bc61986123de4016ab21c33de38fe265b232da73d7497016be7c965a2e620f4179b4cc5ea85983ee162

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\12.bmp
    Filesize

    32KB

    MD5

    03fa177e7bdf60f00a232f301df43dbf

    SHA1

    706618ae8dd82534ef6d867a3c0b4f0c52bfd5d5

    SHA256

    b506da1def469800a205eb5e206c0f6bd5e5f97d7b55d6da737532efc98c96b0

    SHA512

    cd5eb3a15b596c85d06f24f1e2682ec593c320409a4e08f3f69c906660bd477197eccbde6488473cdaa1027d94cf093c8e94dd755bbe939a13bd1370f9771da2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\12.rgn
    Filesize

    2KB

    MD5

    40834c6782548d21c5c137f1d6f725a6

    SHA1

    e47f2d884abe5157a31ea379e0ddf4b402bfbbf2

    SHA256

    a3a0fe4d682b71315dfcf3c86980e3f144ecb331a7b159d5508c56f4c72dc507

    SHA512

    a2f3e47da917c9677d1b922e3bc3cf9527c5dd7433f2b55629d05c20d880ecdca7f060a4ec6d27e83ee1a49361f66dbc09d7e92175f617f9baf64bfed769b100

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\13.bmp
    Filesize

    32KB

    MD5

    c9a7abd5a0a2f2be85fdf9adcbf73f76

    SHA1

    238d269724a43a5ee091c201876fbf8d68b11091

    SHA256

    d9a7b08cae8b9dfb8c0d77f259e824ddc8b8c3c1ad35062c6506c4c0dc402ee5

    SHA512

    269749122547cd0064b1217120cab194975862508c87c01875cfa8e2a1f5f6f23bb025b48524c97df3c94c8206b7160faa3b6b60373f525b8eff6b86fcc0f33f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\13.rgn
    Filesize

    2KB

    MD5

    af2f4ece008ac8f67ddaea9e7c4c79a7

    SHA1

    b604b553e38915262c1e98d3161950cd5ae17394

    SHA256

    c12f0036849965a1282dd6dd637fb3ce247d8bc893fecbca6ec7d2a02cd4cb35

    SHA512

    9f8e783b98366decabff76dbf0896cec18b5c81aa73cbb3f5dde1e7a98ca4a7405f94d2a0bf6fb2ee1b0d7faa343cd6ec74b20ee7ef2c863502f52a6c25815e6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\14.bmp
    Filesize

    32KB

    MD5

    616e7c2f76aebc1bb091c6ae57be75a9

    SHA1

    7fae583d18639985c099dc6904c5f4e46d90203f

    SHA256

    20023f46c31ee99cc9c14b4e0afe975e63717150bea11215b0276b25a6c6ed7b

    SHA512

    b69c7287f4f461939454ee7d043b81d3c106836fa0579cf2608a52f783b9d98afcb2d1c25fdb5063bfee9fe4054a7c38d4d200cda63c28f27e670760540fa4d3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\14.rgn
    Filesize

    2KB

    MD5

    e21e6b2a2f36582af8a922b8eff79bc0

    SHA1

    76ac59a8ffc62b7c2ecea78481d123dd40a3b837

    SHA256

    3d66f19d55900702bf3ee8a7e7c39b97d927a04dc728650d31f7cde184727232

    SHA512

    0a5a7dae4faaa6cdee0ddf0bda4987ce2e12b77f6dbe7bce924767edfb799963ae77c29bbbd72fad6dba9ff4665bd2d05095997aadd3b5f335dbbf6e2db67aa2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\15.bmp
    Filesize

    32KB

    MD5

    3479498def33067c5a189effae48b5b9

    SHA1

    8d48934fb3640c335e1fae07f4bff1e884098acc

    SHA256

    1e3aceab4da21ab174c48c694dd6f952f2f9535191b6681f9908a9f021a90316

    SHA512

    9c533a098355d829bd2afefed2d0ef0a5b21a8188b3063f78e86f49812ef4dc2e622b3c90a2731ec80af3e65f44d63ea4236bd39b5afe68896ee1e7deb9c16b1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\15.rgn
    Filesize

    2KB

    MD5

    ab362557d45c1d18b142a95244d5e534

    SHA1

    6331b29554fe931e7c5f6e8a0c950f1911f1827c

    SHA256

    aff000dad7ed04bcbaf5015b1a6a85a019c6916b599ca27d8fb89ab45ce145a0

    SHA512

    f56d34a08f785351baf59aad349a7c4fd70f379f3c2a29042ad3661f41682a0dc49c4c80c530206d0fbbafdc42d53d5bc55efb702738c53444eb33e2dd68f774

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\16.bmp
    Filesize

    32KB

    MD5

    8a009b33870d7c96aa7ab6f89b6559f9

    SHA1

    240703160d47c6df6630921f28758b4eba5c0dc5

    SHA256

    bbf57216a0118ccaca2f87665d7e229507f43b176016248c4b41b642e0e92ea5

    SHA512

    56921c0e2f12925052110d179c235f74a9afacbd8ab4c77d734cc69f1d5c4f7e0901a034b579079976729119695fee8653d7fa332bae2861f7daa74da5ec0acb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\16.rgn
    Filesize

    2KB

    MD5

    4073934e48d2ab3711980853b55c69d0

    SHA1

    6e0e730bc2ac802f02d798365c57f504ab3397c1

    SHA256

    1b48b79d4ce65c9d2862c3a5df7f70fa37ce83ec62c07ffb18f383f23ecfea05

    SHA512

    40d83105d6d5b59a0dafb2e9a108570d96ff8763b04646210ed1f1a521fe8ce922ee5943899f861bd10d01701b036cced66905de659e8d7c30be708a0c1f9d21

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\17.bmp
    Filesize

    32KB

    MD5

    f83bc32c7305c56377d6ad2f2d9f5191

    SHA1

    bc2dc2f1c454b5624a88ff6fdef8e41315cd5750

    SHA256

    8909ee1e7ed0c1af5607336b812d3449a5d30b1246a3e99ba3a0865ff5bc5d58

    SHA512

    6bee5249e3531ce2580734406719351bf5b6960996880bfb552e6ea0cd7bfe33c488e7efa022861133de5133e52a273b10f12cd8af0639ad1d56f80e59f0b394

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\17.rgn
    Filesize

    1KB

    MD5

    6d7503637f5a3904b7047b9ffc65b791

    SHA1

    04b76a6223a141bf733a9df26696bbda1b1a9bb4

    SHA256

    67cd34c54af0e00a17f9eaa43a06f0c7d995f9663f60beb438e18b9b51810096

    SHA512

    38584c2205fb15d94cd4e1b6508c2ac422fb3f3ce9d9e5c43cf03f3cd3e2e9ad55b0476395b5156ebcf7f70433d47e77073ca8837f65fb31c1a1840ac66dfa86

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\18.bmp
    Filesize

    32KB

    MD5

    d6e5beb8e1d7a0ab0b47329d860a587b

    SHA1

    bda0d6407ff9a047a8629eb3da6465f9672e1b05

    SHA256

    7f60a099a7c099d5df82daacac574b103946b184830604967cfa82de8ce05c3a

    SHA512

    f0f40b9b7be7d788e5175d06cb387b57e5bbe9d98777bcf6bd3c6648143d458c2246e21b818418b78fa54eb917dea33246c4706f29a0f00720307f52c4a16c3b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\18.rgn
    Filesize

    1KB

    MD5

    f45542b73329771ac868953b614b1f4b

    SHA1

    6def5ec092547b3c6d6f70ed3e4472da8317a210

    SHA256

    d728a08a322ba4db53c4cb27111509f462f9fcd7f34785218d56c95b893d1f3c

    SHA512

    cb79ab28847b06d861b654f6a63c42b3d98dfb7818941c4778f05f2a3af19cb31af514ab02376d1e11524b96a816ed258adaf33c9a4c365d0f6931d8eab662da

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\19.bmp
    Filesize

    32KB

    MD5

    84f6592354c665a6017749648333d958

    SHA1

    28be8a488a9865ab9da983a2a6a7dca68d897fe4

    SHA256

    2415be1c7c1c722c630e5f38fdb3f86cf1800a2ed4cc586cc7e57d0a5a9687e9

    SHA512

    ceffec2db986430212a1d6cfb43c886dae9340d2cd2ce5e7c5edb982603c442a39b0b1662d5f46662b0c08e3b47856a954132ccc79a6eefa7188ffcfa251d458

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\19.rgn
    Filesize

    1KB

    MD5

    7971d7b46050fbda179f007bb556633d

    SHA1

    feb08cb0fe692a321e69e30a9be3e1ee84891026

    SHA256

    3d802f85244c163fbaa241228b9f2239d0855f527f83c21be87fa6a94d2484ac

    SHA512

    a469e2f094a6182102dd170ab164e2747c6ca7d0b00c7dae4f18762e306cc8d23e2615abefb4dc637ee43f86b41cf48901c3ac3bb91c2d197e303e1d9cbc248d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\2.bmp
    Filesize

    32KB

    MD5

    4fdaa9aff631fc2ed66b40f84639ef50

    SHA1

    12ef10b4dd4606e8bc35fb8e696648197a02e683

    SHA256

    0b3f864a9b073d764998f971de5bf2a605c1aace3e26b6edfdbfed9bca4ca394

    SHA512

    1215997d79691863b0c1230c9e0be071fc83f978c788372da0d56560556c9f2d25028654b671ca2363ebb892b64730c4b615e9154b23d3577ed8a910af35f26d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\2.rgn
    Filesize

    2KB

    MD5

    aea09fa6ad0b3f988cb5504e5ebe416c

    SHA1

    5d78430dc36061d8d6eefce8b821ff3d2f994a41

    SHA256

    040d79d804cb34dcc2d156560a4bfb83cc43bd9a9284bf8ed94186c7c58f72a4

    SHA512

    31cffc403f116743963294041cbdc3a824ea1aa40d88b90d35e6a4e9464fa3b9ab131c86187d6b617ca36904100fb2dfd319470fa9bcd2959fc880e558f250f0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\20.bmp
    Filesize

    32KB

    MD5

    af1fd14f24986e96a3e046467b35c77f

    SHA1

    f8e77cccd9ebc013df885147f25e17372e2f2ec0

    SHA256

    8b196e575ce05d96a332f710b8c0af3b51e02aa0b059c4f16804c854770ff40a

    SHA512

    e21cdcd3e5dee5850fcbff00bcd6e8b83a34288a881ae7927bce0f230ce6b3a025004b92f3cb184e17d173305237f3609a0f29980343ece173f5aac15dfc6904

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\20.rgn
    Filesize

    2KB

    MD5

    37d71d6492e17864063a5c853e313826

    SHA1

    7983a2ed9858fffa18d550332f92b76fc0d4c3ad

    SHA256

    a4f308c746275581acef27d806750075df2993cf6466c744e6d95095f3bb2588

    SHA512

    089736d5aecc84d0e454d65e064ba4fbad67454452a45eb2352677c879b624b4a41cd11384c7ea60b3d0cecd2139197330cf9eece6b569504350cdbc4c96f80d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\21.bmp
    Filesize

    32KB

    MD5

    e2f6a7e10655675923e08c132fa5f2e4

    SHA1

    a1347cab0e06ea64d3631676d1a5cbe9824089b3

    SHA256

    83fa66bb1d5e74dd6d09bdd78b7228462d6b22759b9c86c3744fd977407b0775

    SHA512

    392d2e3cf30693cee563c615d2b6d245192c1c74e507eb0c3b4f08ac236dcbfbe53916dd3d124dd4d10112480229b9eeffe0d83e6f9ccaf0fe0de7d9663cd308

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\21.rgn
    Filesize

    2KB

    MD5

    d0d8eb12f2667d5553ba699d11027c46

    SHA1

    b154673095f8594b26411ec827e51f02d2ceebf5

    SHA256

    13a8d9283cdb9ebc81c78e3ad3aeb1c6ed280a4d52226224bb6eed8d834c1fd9

    SHA512

    40fe70550673acee287529926aea4e2d09078ec67ef3423743a49d5e35ff5751365610afb800d3f26a4fc0b6ea9cabb23c067dd4830c536eb9f5ca6b36822649

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\22.bmp
    Filesize

    32KB

    MD5

    9059adb182064d655c67d61f7ec75d61

    SHA1

    63463439f4b0981584a941c820af92fb80f83028

    SHA256

    1ddd4ea209debffd785c440d3e0b3d0feaae6392d63ce4fef3ce775f591f10c7

    SHA512

    1532335da54b13104863a7e150e27db8a438ee723af135bc1f2202d0439e66f3df873554b4263d1337ef4228e84fad0f9e558ebb870cee51459164c0ef8e368f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\22.rgn
    Filesize

    2KB

    MD5

    4308e2bdbc566311922e3f041677b566

    SHA1

    d20c01f8073fafdff9b96e35e5dbb32504238951

    SHA256

    1ef0581a63f88968d5def54e5a3d168796b6dce50b98f10a8ebdb0a08b25cfb9

    SHA512

    b9d9e07c75669249b3f344a256c65ae1ba18d9af6254faf58a1180990fc23fd96eaa94c130f505c9d7de930b97482350b8e5d701be58b7ea55f3dbafce6b8e02

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\23.bmp
    Filesize

    32KB

    MD5

    e3cca26479962ff6dbe6180ceb2a575a

    SHA1

    0080d4e4281ae2cab35749caed783812bcbe7db3

    SHA256

    15fa17c53a43fbcaf889c6b0e331aec6132c46f748a8224c501cb06622c26e97

    SHA512

    123767b6c6e41d6ae78cbaad210c18a5a3c2ed34d62863e9e5a99180c182331bd3ff711104481b29fd97046f3051b280d634d40eef24488ea476440f509614f6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\23.rgn
    Filesize

    2KB

    MD5

    66bddb94f2d010331f8b486ae0f3db70

    SHA1

    2200c98e70a00be99453ffaf6f8eaf842b75db63

    SHA256

    7f88418083848645c92934cdd55d405c15b9b42036edfe094c6647a9474b5b17

    SHA512

    77e7d52b5c975b126e71aa351be5ace3d5e92ed184bf57ea64182cb09885134042f17ccac5c5055cbf9a938b4667bd2a96a38f54d431da887ccc1632f415c4cb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\24.bmp
    Filesize

    32KB

    MD5

    9f99a7abfc7db312965dfb1e9648088a

    SHA1

    da657e2fcca9792a53d90f9c020daa48a8d0a50c

    SHA256

    f7c4caade31c7954241897d0abbc5f282806378f7d8448a80b92f6b973d49e82

    SHA512

    625e51e39a854a92e4994a5aefee67412df8d91d1eb7e06396c0f173a039459f1caf806d86fe21f5e0d95f9abce21f41bdd8df5054db7181aa23ac295b7c604f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\24.rgn
    Filesize

    3KB

    MD5

    3657e95af84588266cb148f1ca61d66b

    SHA1

    a1a997b93b78e0c9b25a0fbba9abcf260237ac29

    SHA256

    af511ee85e432e86b15797cf78d903722694189bb92e152e66841fb1fc9eaf70

    SHA512

    cf29fb2fb87112a2b1b0553f1fe2bb86dd6b5d08a215d59b7034368b3ac779a0c064f07b0b21a9c9d6a2fc03a40cac7a437888ab339c0a70698c9e1af13929bf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\25.bmp
    Filesize

    32KB

    MD5

    ae6adf1a12b9c5f38b96835e9d47d7d0

    SHA1

    f04d2235f0a08f5f380988dbc6eff95483f2d2fa

    SHA256

    49c1399154554d0f47bf3c518816449e659dfb95c32a4f3461e2bdc4c55ac458

    SHA512

    cc2c2d5212313f0d51c69fba2ed7ae052390e55c34fc76ca4cbceeea7634cadddb8ee0249d5e5b65752cd70205ede5f94d446846e50fdca3e50b5a147217c3de

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\25.rgn
    Filesize

    2KB

    MD5

    841c407464a9e41714ef1ea24b8baeff

    SHA1

    173206bdc1774db077fff43d2a00c924cd066264

    SHA256

    5f64f18f7e9d16f97cc840cc239803c0d7e8bf108322e0c6e69d99ec41cd7f39

    SHA512

    dc1fff421aa8053ba14633f422c5e7edd2fde27b502358b3d89ae8ea4a17fd7f4851d6f6a0c76388d48a1aa6efdb7193b3e1c3a62636f9c44674aa8ac113f571

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\26.bmp
    Filesize

    32KB

    MD5

    bf8425362f64890b04408bcbfc8539bd

    SHA1

    1a64e7d2651b6d3a98140273c6f94c3b0248e471

    SHA256

    f88fbce58dfaea849dad8aa800e14962ad2d875018bfee4df6ab822152a51544

    SHA512

    ca4399ec9d4a07f93071bb5e3b180117721b3a3755270bfc7f72c7380f3d60f1af023cb6db5706d461ba42338fa20161b0b5752270e8918d7dc775ab4bee6a72

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\26.rgn
    Filesize

    2KB

    MD5

    a9995183e7f6981624b224b90457b04b

    SHA1

    ae3837209a3235346ce8c6776f7fba3db9362cfa

    SHA256

    c2312d500bef52d3d61f0687d454caea4c402f44648cb98b39a08f7f1291b1b6

    SHA512

    e55bd856b69cc6b51a4137764c4d956be83299aad4fd5efb4a9f18405f7ff5edcb7646a22429b6aede793eb0c50325818f4079587c31c418aff991bfef3cbd2b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\27.bmp
    Filesize

    32KB

    MD5

    33ff67b72f8438bc4c2b295c79b0945f

    SHA1

    fed1f0d698b8a7393fd177ac7e8beead75b96b0c

    SHA256

    355145d6e8c9a58823a8b0c59c49f8b415156f6623adc36c055a27d33d6f333b

    SHA512

    b4c39bb7748ae571ad23829a16ab78c7d2243019988c99de01379388ad777eac05fd66b8f9109611c8f4227e9412747452a6446669dd11f84fcab8e724dc7af4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\27.rgn
    Filesize

    2KB

    MD5

    2582aaf304b3413ee57802d88b0b8fd7

    SHA1

    41dd2cce8f8af882165a8d1d4eb7161de3b86d25

    SHA256

    84066891bf60f3c90d8807c55211aeb43abb55b7caadf309c69e206aa455a146

    SHA512

    c949a532e42c528576bd95be476c52440f5a0f16a56f4200848ac7f0cfed2f11d7682de0703368a5b1e4f090ae4f1d3842c1fc166aa7d8bce3fa68d288679ac9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\28.bmp
    Filesize

    32KB

    MD5

    34a77d7673cf17a741bd66ec565a45b4

    SHA1

    4f38255b4b9ff936928500a78ae3ba404b45b0a1

    SHA256

    b14973f2cb0f90aec1fedd0eb27c9ab9525b619f670b96ee4241e298da4d62aa

    SHA512

    5d102fef43ca26cb1a700eed8aeb0a9d3d339fa8f72a10af4305d4aa188f0cf36dfd78c489b057dfd4ef43d025b1eb8f7d1c553c050c62e5dc187bd1565baeea

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\28.rgn
    Filesize

    2KB

    MD5

    8b04c2816f50c4c83d9a89ff25c4cbc4

    SHA1

    a0ecf00dcf5c74655630bc519d32b2c3d80f182a

    SHA256

    fec2790c0a65457e163ba8f1001c87fe0b9e0caa6b1046cb99ff6d1bcce5db8d

    SHA512

    8a583a69cc2bf0039cd7da351e23695bf7efe5bc16b944a22f66aa493b317cd5ddbbf86ea580aa74e8d3b015efe6659aee39e9b3aec8672e1a579ebb13ce8ff2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\29.bmp
    Filesize

    32KB

    MD5

    70517b09ad438a0291fd931f2eba462e

    SHA1

    9573ae71128c4b2a256e32d8d6a352669b625177

    SHA256

    cfd92a7caa060dbe1fec29d2ba7f2aa5d340d7b10fd78ff3a44626951d29a248

    SHA512

    8801d006c96ed16dddb6ba71135d29caa9408b2c15c942faa3abd257a76a892d48e39fe9a47b4291f53c4dbca79f7eed941fb2420fbb5fd2ebdda0f581633b37

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\29.rgn
    Filesize

    1KB

    MD5

    b0e9c5fa388e381ba7024ae16f8244ea

    SHA1

    6435c3b9b0e4e89ff34a23d2c7b5819cab4b362f

    SHA256

    8b0662a0df0535882a99e9cf88ecbba4b34e7dddd15faea711e816aa2e18ca88

    SHA512

    f454372eb5457569864fe916a2d0b142aee52e93534bd3dd0cf3bcb53065da099a1b41f00e3cf24cb63389d59db924aec63c94b76df6935e96963c363d469c3d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\3.bmp
    Filesize

    32KB

    MD5

    ff13ac31201f351a59fb13f04dd9964c

    SHA1

    3b1c70756fb707039bbd1baaab562f9d847e6c86

    SHA256

    f4531a994dbcaaeaffc1548f8d887084828ebf76e9b58d3a55a4237ec4c54a8e

    SHA512

    e0caec70b3f5d4010d3a28aeeb83e54a2284a0a7abaf376d782fe348d5497361623a69e8acee636a1a7cf2e012c39977b26b33422c79bac0435c29887a3870cd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\3.rgn
    Filesize

    2KB

    MD5

    fa4cb41d472c04737b3befdd22aad236

    SHA1

    2285e6b3086fe612513b24928414c8da97fc58ea

    SHA256

    0f4fc8f78bb4afe0c07e9d5d3ccdc85c144b1411332f1a6bd71579fdbe477ed4

    SHA512

    02832d425335a8200832ac526d25ce0971b12bd97bb05f44b69bfe3b0e85a502216b92658982ee17a7ffd71d10050ba938476f76f5fb99e66ebe3af51afdde4d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\30.bmp
    Filesize

    32KB

    MD5

    851e1394497539256f566023c87d0f15

    SHA1

    8504d741ae94d61d3e4bbe328b80fb7d2cc1e3a9

    SHA256

    518a9208cc6bc2c64eb71e8d26e00811420da2f833634c1f71c2d9987751e120

    SHA512

    f15e180a91ebe4f82f461dbaa09a206e8f0febf27ea604395b2efaf80bc2e867bcb96518e8583f6c7eebffed15802131e26d91c382c99a55824114ed0fe4a73a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\4.bmp
    Filesize

    32KB

    MD5

    01789363aafe084235db154584c10411

    SHA1

    fb840ffb8761dad8808a0dad46e0acb0a77660bb

    SHA256

    5e7b2d8843687fb6eae4266699dd6e4423ce6d78e68df1dc8534eb3766b0393c

    SHA512

    829465848dc429646f92b079b2d1496015e7a0d461b678217bc81d08cde3e35e6f6d817f5b29113e471e74eb757f76497398861f34ae40d1386bf59703313e36

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\4.rgn
    Filesize

    2KB

    MD5

    533c10e81374f92b32c39389591ceafa

    SHA1

    7b2e808249fb5b7220aa187327a64f2616765a18

    SHA256

    1d8c90d546936f27badcc38e5866e3d7a984c0c1ccba521c2635d14dcdc2c9b3

    SHA512

    c2fd156d61623f3fdfaa06cd60825c7bd44887eb026eeaebdc67059a42a75617686ca430968476f0f070c4b25cc2290e18cba8b78c35a2b1a5993188df539172

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\5.bmp
    Filesize

    32KB

    MD5

    b79482c08f7a9aed145795618e955d80

    SHA1

    70faa8d4cb348a4f385519723de4b63f22da9f79

    SHA256

    0e2e6e50088273c08cef08e657014349fefae4c760ae7eda3efe3f0cd8aa68d3

    SHA512

    d63ee722944c6fc75365f07faca7d087dab23e335f55fb767d90db8dfa0750c7f1d2010ce63bd638efcc5279be6ec7bb7c3e7b39a7a1eeea01bb2e05cc8cd3f9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\5.rgn
    Filesize

    1KB

    MD5

    79a5d356f751d8ed7c577d376fee73ca

    SHA1

    1be8863fef223ee0e337d900dedd4fce54a43c5f

    SHA256

    97e1884ba8de9d7d5e126d07b8a50e3c6e3fd8d97a564ac5c8d2d5500598ef8c

    SHA512

    8e67a722cefca204647650ba468fc8adc419b3887ef6974677c837fdfc25cc4313d19f770233bf17457900822ef9851abea6767d06ce08772919bb635f64ffe4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\6.bmp
    Filesize

    32KB

    MD5

    8c9440032b485a10e84776c1a7053907

    SHA1

    00560df4e299c34c57da20c1d58849a726bd02ba

    SHA256

    5c55d400a691f2d824c500ae6790763204bdae000d6bdba2b1c95318a21c74ac

    SHA512

    4831cbc6aea52760c8fd4fcd91a5e7ed4667b6c5a0f43e61fbfa638cda982d15cbd49f4ac9ac32a9ba0e2e9a2b9331c735c5dffadb0193479be611be7b887055

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\6.rgn
    Filesize

    2KB

    MD5

    90f18b5f121ea75b1d37c671479233b4

    SHA1

    02364e471f6ba7375aff3dff21ac19dee9a228b3

    SHA256

    c4fc332f3f3b7c5e82be1e237865e71e1ace3f2b04e00c05d58de7a05e60e609

    SHA512

    2ad17bbb39c701c9663cc73b8915656c3cc60e5bc2f5c34618a89f12348bbf76a1e6b62781419c8e76a242f74a084e39988e5315e393c18ae815ab14d057341c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\7.bmp
    Filesize

    32KB

    MD5

    7bf1b59d82f8ff141df076cc9b19b4dd

    SHA1

    813ba74b7937f310a1eff6581c37be0bd728ee0b

    SHA256

    6669f8b6d97f679f67af13d190478fe22cc45f8a75f6c478d5c167c53c6105f7

    SHA512

    415b16cb75c1268adbfc3feb0487f6760e617ad7fee29b9c91c28d262a62dc6b8018e23b650d36ca41100c08261f83a671871896303bb3398d8f27d752d44f99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\7.rgn
    Filesize

    2KB

    MD5

    3bb8ce5394e49714e13d439c427e221b

    SHA1

    55ae94e0d3ab0a1032efd4b65d3d64aac49023fd

    SHA256

    c01c6041f30776bdb8a6eec379e48f68ea1467bee1603cf792ca53631fe93f64

    SHA512

    528d865e6ac6f0597ca09d1145429e2479af56aeb810d8758b0af27c5ba7d092b1ecda915548f1024c2e7066d75a9af60aa117df68834417966934adf7fb0816

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\8.bmp
    Filesize

    32KB

    MD5

    14ec1bacb8b446067ce31c2c65cf22aa

    SHA1

    ee7fa62f1e619ba9c49aa37d33fa0c2bd7eda7f4

    SHA256

    7be2da722ff596b734b0d0e49c02a5faa0d371c133c3eca31ec3719ba132b133

    SHA512

    68b46a431dbf2cc9fb0f38b02412c70512f862b50912b83f61bb1fbc11748b22e982765bd49cf2151eefb7f1acd57cbb60e235bcb037663020ead120c67c4c7c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\8.rgn
    Filesize

    2KB

    MD5

    c4cf1128917166830ed8da11b1ba108d

    SHA1

    5c0792e284cddd93e6f435084adbfd2b2b0dc4c8

    SHA256

    cca4505738157564f53c18880222142f1106bb465faa4f3f7128ebbc499fbcfa

    SHA512

    c7f714e3b24c0a91036a8811f76c6d13c7b6b31484512cc347b3eaa35557bce51923fdcc150a3f953959399d4a7a491a5b3dfcee62a203574a59b44164da1911

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\9.bmp
    Filesize

    32KB

    MD5

    aff06f0d4701c943b03211506a23a203

    SHA1

    d04084f9f828aab69ffde5d846bcfc3bb1a7ec78

    SHA256

    270a7e27899a73a198562c7e5fca0dd8710b8c668a8bdaa03786184a0d72f2c3

    SHA512

    14195bf97af1b001e2b0c40cc0672171d84ecbe696c03970ca60bd5e6eebd781677d9e81fa441a3e1fce468501267a3181f4cc12c388bb9cfdd10df3f531a554

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\9.rgn
    Filesize

    2KB

    MD5

    db7c1e26964a7199b6d2d3f4ec9462ef

    SHA1

    2cab2ba2ca1faee6c449af2c85d24b3642b2a1f9

    SHA256

    eba82c7a420f748889acc174f99d947509460387015a22171a496659bc25e7fa

    SHA512

    eeb925136123e614a38cf38bd195eace5aad12fca7d1f6d3e3b6693b950f06f8c9aeef22b35c50a0e865ada8924cda960fdbc2f3f4dfa02e8af693d4f582e2e6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\Bg.snd
    Filesize

    15KB

    MD5

    61c717579572742aa5e734241ba74e02

    SHA1

    331213b14a176005ca1c847e69b0896a613c9876

    SHA256

    a8954671d4df014958e661f5d60d56513cdf62e7bfc348ecd229478b116a582e

    SHA512

    dd6e8ae7adb06a299147631c617796e08311fe35a8c68a768d8b446bb5bfec8366b06c0516612fc5f9fdd99141534b5280587763a426346a00bf6a952acf90d2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\freq.pt
    Filesize

    8B

    MD5

    f00e0477f5040b2f6ad52ee83c8804f5

    SHA1

    47fe22f63a913fdcf37a4132a36a248c352c9c25

    SHA256

    0b650c25c8d531921f95f80cc06d3c51eaae9c7868a87ae911b0d78ef4a86a33

    SHA512

    c7b5459f178cb0cabddec1831a8a433a03d877641b867afa6dd2eecab8c1c358923e84aff1201f4d15b34129c94e610287ef4728f14f5e7164a303c7f3d5b29e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\liu26E3.tmp\main.exe
    Filesize

    32KB

    MD5

    9c7627ecc7cfff4ecdc1ed0ea01f467f

    SHA1

    a90998599b3b3dff3f4af03b347d7ef4546dc59b

    SHA256

    ea6d11b0bcd63c071e40b716290d2df30d1ca3d889abbb9cb742d77c6f43b5c4

    SHA512

    94c0a00c5bec562df0d8859a9c75794ae30ac9c36979914037a2468f16ceb08b024ead0d938472fb33a8c6df936fd65533dfab0a9807cece2ea453dbfd67ffbf

    Download Submit

  • \Users\Admin\AppData\Local\Temp\liu26E3.tmp\main.exe
    Filesize

    32KB

    MD5

    9c7627ecc7cfff4ecdc1ed0ea01f467f

    SHA1

    a90998599b3b3dff3f4af03b347d7ef4546dc59b

    SHA256

    ea6d11b0bcd63c071e40b716290d2df30d1ca3d889abbb9cb742d77c6f43b5c4

    SHA512

    94c0a00c5bec562df0d8859a9c75794ae30ac9c36979914037a2468f16ceb08b024ead0d938472fb33a8c6df936fd65533dfab0a9807cece2ea453dbfd67ffbf

    Download Submit

  • \Users\Admin\AppData\Local\Temp\liu26E3.tmp\main.exe
    Filesize

    32KB

    MD5

    9c7627ecc7cfff4ecdc1ed0ea01f467f

    SHA1

    a90998599b3b3dff3f4af03b347d7ef4546dc59b

    SHA256

    ea6d11b0bcd63c071e40b716290d2df30d1ca3d889abbb9cb742d77c6f43b5c4

    SHA512

    94c0a00c5bec562df0d8859a9c75794ae30ac9c36979914037a2468f16ceb08b024ead0d938472fb33a8c6df936fd65533dfab0a9807cece2ea453dbfd67ffbf

    Download Submit

  • memory/1368-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

    Filesize

    8KB

    Download