Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-03-2023 14:40

General

  • Target

    b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.exe

  • Size

    29.4MB

  • MD5

    992cb6d6a567d2ba4e625e8130be7fc3

  • SHA1

    627eebe02f4dfb7d7c0b958e3a15afad5bfd042a

  • SHA256

    b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794

  • SHA512

    f49d524ab142c514847d03cca5cbf53394d2be6950ef00252469fe4c96196b7091cd64d6b472deb1ab29e81e16ac9bbb685a99ef65e4ee5420f7dd43fe3cf474

  • SSDEEP

    786432:gHoURM0Ldpd6p5jXz/9RoQxqVTQyYGoO7IpbM9Mep:gnhp45Dz/92kyoO7MBs

Malware Config

Signatures

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

  • Babadeda Crypter 2 IoCs
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 28 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.exe
    "C:\Users\Admin\AppData\Local\Temp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Users\Admin\AppData\Local\Temp\is-P51FP.tmp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-P51FP.tmp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.tmp" /SL5="$D0160,29807461,830464,C:\Users\Admin\AppData\Local\Temp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Users\Admin\AppData\Local\Temp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.exe
        "C:\Users\Admin\AppData\Local\Temp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.exe" /VERYSILENT
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4208
        • C:\Users\Admin\AppData\Local\Temp\is-F3TUK.tmp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-F3TUK.tmp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.tmp" /SL5="$E0160,29807461,830464,C:\Users\Admin\AppData\Local\Temp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.exe" /VERYSILENT
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1404
          • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\SUMo.exe
            "C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\SUMo.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Maps connected drives based on registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:1780

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\Docs\Download Microsoft Installer Package.url
    Filesize

    140B

    MD5

    e4b92148e17b51a861fd39606b7cd093

    SHA1

    29acd371b0ce72df1f220c8ed4d9e76d8b246d9c

    SHA256

    a1b48ea5547e9fb008a3ad653b3d03a3ec528c137bd0a0fab030da0310f5b62d

    SHA512

    0e62305e8e6e0abd6f5a98513c6dc77cc6660a788723698d3e4c3d94ccde3ecad1daafb43cdb016f08189ea7bc700fa0bc0e0b6363c98bb7fdfd61ddf99effee

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\Docs\License.rtf
    Filesize

    3KB

    MD5

    f71d7c866af458c94ed87633b2c9096f

    SHA1

    1fe72e749ef0e9cc484867065f2fd36bc31b5d0e

    SHA256

    fd58f84212f2b2e9f44d9465ca89ba28a252d00f095d6f1a2945c921110ce38d

    SHA512

    a4f45e9a927c42dcf320995182b50d9c4e539e2fcef867e297305b9de19bd2f2c2502c3fd6f9da20f1450bd0256b25ddfcf30b3193602920ba4d7121b67a5922

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\Docs\Purchase the License Online.url
    Filesize

    139B

    MD5

    3d9be67b20871e9d5332aca5400ffda3

    SHA1

    b3a6c3efaa7784c26418a3ce2e37d493434e7ea0

    SHA256

    bb73158f3919309e5dce9e6254697931720a6ce3bd806aae3cada6e55c4f1c8d

    SHA512

    131f84951832ef6b9c47e0e1163674dbce4182712dcce37830ced975c29a61fa06e72d155dd3d3ef0472d37797b13d22efeb49d9e9eb7aedc62ef81dffed7afe

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\Docs\Purchase.rtf
    Filesize

    6KB

    MD5

    b392301580d0592a840bf0404db43822

    SHA1

    41d121708548252196158f4b4df20b43b9e7f505

    SHA256

    339a69c1321030931fbef876221254ea7febaafe627444f1ce7686e55f79c208

    SHA512

    6e979a29a6bc698baebb58f54a2c5ea1ad4c63e73d3892199725c01700b772003a7ca51be91a4e2da7687a4d801060455909a91ade24c32a465b384353650b64

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\Docs\ReadMe.rtf
    Filesize

    3KB

    MD5

    6e1b8492852580a08176dce9ded7b6c5

    SHA1

    f890743f1b264fd14a3014c3d4180805694911d8

    SHA256

    acf18aafed903e8b649f537d69c5f81a3762324f472c62740513346c07700402

    SHA512

    0b8554725ffa85ea4b6f93b8fa2285d76c6c12202e7ef9a689e266e5638555ccd0335bc4d1eacc95fccf84d8d939c3fc6673058bb059dfe0eb67ef36f5d8ad08

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\Languages\ChineseSimplified.lng
    Filesize

    37KB

    MD5

    e0826138c74a3f2b571bbc4e81ac6da0

    SHA1

    462393e5d24098a7618c8206f4dad0e0b4f6722e

    SHA256

    920dd99c4829a1a7892d665e8d99706f3aac36c1bf90430571d8af06cd114565

    SHA512

    3f71686b71d513e356a0e74f41933517a2aa236f828c37fcf40cc9e34a4ca6780fb7661eeb027ec943d9fc53325194e3bd39183a1fa90d3ba7ff85d6a7e67ac9

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\Languages\Turkish.lng
    Filesize

    51KB

    MD5

    72fae535f28eb9b6f41a842021139554

    SHA1

    c9391daf5471c56b82afbed88ca9235fa964fdfc

    SHA256

    5d6e1be09c4d43490443038848e08a0ecd5d54abb5de676615dc7c9eff06762d

    SHA512

    041325653b4e2b117f80610474dd605276216118d008a0deb99ca5fa661632f1700d8b4fc7948a924ea915c996c6229539a915ed32912975b67897384580fbba

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\MSVCP140.dll
    Filesize

    428KB

    MD5

    fdd04dbbcf321eee5f4dd67266f476b0

    SHA1

    65ffdfe2664a29a41fcf5039229ccecad5b825b9

    SHA256

    21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

    SHA512

    04cfc3097fbce6ee1b7bac7bd63c3cffe7dca16f0ec9cd8fe657d8b7ebd06dcba272ff472f98c6385c3cfb9b1ac3f47be8ca6d3ea80ab4aeed44a0e2ce3185dd

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\NSM.LIC
    Filesize

    258B

    MD5

    2f189eab3c35777e3b85d9da00a24069

    SHA1

    07ddb1e8598109b3a66177af391daed89d198580

    SHA256

    c1fafdee6d924e0520d851cb63d9ce8cdcb2b55bb495ea1b025ff2e143e7f447

    SHA512

    ffc1b8e7d3baf34bb93de8f7b9aa98a3502fc125ba1fd2a1471e466e8960855160607b49c8792d8e2c48de9b7b68f2afc70ba6d18966a614b36c4c6a28650ccd

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\NSM.ini
    Filesize

    5KB

    MD5

    99f493dce7fab330dc47f0cab8fe6172

    SHA1

    16906fb5988303bb462b65ff4ece23539a12f4b5

    SHA256

    e0ed36c897eaa5352fab181c20020b60df4c58986193d6aaf5bf3e3ecdc4c05d

    SHA512

    2c58171c30aec8ae131a7c32162856fce551b55f861d0d9fb0e27a91bd7084388df5860392f80cdbc6df6e64e97d8bf2cae587c3d6b7c142ce711ae8e240bb01

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\SUMo.exe
    Filesize

    2.1MB

    MD5

    85a5c9a3435594fb7e0d40d1289d4e5b

    SHA1

    d841701a46fa6fa9444501ff3774f808758924b4

    SHA256

    fa1e530b966af389f22bc95b0b45ebecf3975e29d4346fd9f3af7bd9e2b3f9e6

    SHA512

    74e65bf3b76ce36268ef432750280b95050a2512d047369d2cbb8d26f5cddbceb67cacc9043ab90238d2c8d2f65dded1c599425e96c4045c517709c83ff2ee6c

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\SUMo.exe
    Filesize

    2.1MB

    MD5

    85a5c9a3435594fb7e0d40d1289d4e5b

    SHA1

    d841701a46fa6fa9444501ff3774f808758924b4

    SHA256

    fa1e530b966af389f22bc95b0b45ebecf3975e29d4346fd9f3af7bd9e2b3f9e6

    SHA512

    74e65bf3b76ce36268ef432750280b95050a2512d047369d2cbb8d26f5cddbceb67cacc9043ab90238d2c8d2f65dded1c599425e96c4045c517709c83ff2ee6c

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\SUMo.exe
    Filesize

    2.1MB

    MD5

    85a5c9a3435594fb7e0d40d1289d4e5b

    SHA1

    d841701a46fa6fa9444501ff3774f808758924b4

    SHA256

    fa1e530b966af389f22bc95b0b45ebecf3975e29d4346fd9f3af7bd9e2b3f9e6

    SHA512

    74e65bf3b76ce36268ef432750280b95050a2512d047369d2cbb8d26f5cddbceb67cacc9043ab90238d2c8d2f65dded1c599425e96c4045c517709c83ff2ee6c

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\Sounds\Message.wav
    Filesize

    33KB

    MD5

    4ac92f57e55c531dfb376ef7f5e22648

    SHA1

    fe0cdfb931c99ba312051557a360f25b53ba6ce0

    SHA256

    961b34d05391ca12102de2687cdc22c71b32fca93b9000c6e0fade61fbb53071

    SHA512

    62573fd17af9442b285a734ca73773ef8049593ac70b5f976d1c4f951e82486deaeb722c16282102fe85a5f95c65e8d84e273fbe5640170521385b1b8f85267a

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\VCRUNTIME140.dll
    Filesize

    77KB

    MD5

    ba65db6bfef78a96aee7e29f1449bf8a

    SHA1

    06c7beb9fd1f33051b0e77087350903c652f4b77

    SHA256

    141690572594dbd3618a4984712e9e36fc09c9906bb845ce1a9531ac8f7ad493

    SHA512

    ca63eeac10ef55d7e2e55479b25cf394e58aef1422951f361f762ab667f72a3454f55afc04e967e8cdd20cf3eebe97083e0438ea941916a09e7d091818ea830e

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\archive.dll
    Filesize

    580KB

    MD5

    7b7f24a8128471195f967efb50c0ac50

    SHA1

    464e68a0766e3f8d52863327100664f09f33248c

    SHA256

    6bd8ad484fe5e0b2a757d39283de5bfa492a1ffb6aa0ed5c9b7987960ade1a4e

    SHA512

    ceedcf39126d1d4ec471ccdd0a166e533e1a2aab7307860757a6656488fa5b788d56061c2c7f3add7dfa8decf92dcfab23724270244715f35c003eaaba9a01fc

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\archive.dll
    Filesize

    580KB

    MD5

    7b7f24a8128471195f967efb50c0ac50

    SHA1

    464e68a0766e3f8d52863327100664f09f33248c

    SHA256

    6bd8ad484fe5e0b2a757d39283de5bfa492a1ffb6aa0ed5c9b7987960ade1a4e

    SHA512

    ceedcf39126d1d4ec471ccdd0a166e533e1a2aab7307860757a6656488fa5b788d56061c2c7f3add7dfa8decf92dcfab23724270244715f35c003eaaba9a01fc

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\bz2.dll
    Filesize

    63KB

    MD5

    bb1ea7cade180a0c012c2289c7d820cc

    SHA1

    67a17ae0aed053d8fb071450dff8f843a1255112

    SHA256

    30998439b2fbc620f3f87799f8a98e8519f26b227bf498877b11dfb52147b698

    SHA512

    3b10462ae03ea57bfad298c4d59da247b8ad971aeec0c9ad439a72b1756ee627fba23fe9044df9a8301b0fe1099bbb9988869ccce1102314052a49bf0cbdf317

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\bz2.dll
    Filesize

    63KB

    MD5

    bb1ea7cade180a0c012c2289c7d820cc

    SHA1

    67a17ae0aed053d8fb071450dff8f843a1255112

    SHA256

    30998439b2fbc620f3f87799f8a98e8519f26b227bf498877b11dfb52147b698

    SHA512

    3b10462ae03ea57bfad298c4d59da247b8ad971aeec0c9ad439a72b1756ee627fba23fe9044df9a8301b0fe1099bbb9988869ccce1102314052a49bf0cbdf317

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\client32.ini
    Filesize

    923B

    MD5

    f37bd9c7476eb71f5dc3c73c27ffdc35

    SHA1

    9f8ac70e60c713ae9f0eded7f36b13eaf2efa9b4

    SHA256

    4a1146a85504a0e99904f3c99c4708105960a01e8fdc16d0dcd18a7f171565ef

    SHA512

    22a8009a2f2f552a5ca5b6e0c4a4f0c3812b594f4837f21032db048e94f1de28166ce1c562ec1562a5eb708853b6a4974d9827d251cdd39584ceff9adb6c7dcf

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\createdb.dll
    Filesize

    58KB

    MD5

    ac3e0298184d76ad86730e5b89867fb4

    SHA1

    bbcfdc1732507ac17b812db102a25728d7d8c755

    SHA256

    f210b8d8e984df19b27fb6184ed0212467c219b418b94b01003d5e6c11efdef3

    SHA512

    68210ede444dfaea92edd57945cbe18a9e605a407aa7572fbc1d4bc61298789a1f8aa644d58e16c1f6df15eb395c3298847576cc3a33862d1c329fdd2ba91c99

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\createdb.dll
    Filesize

    58KB

    MD5

    ac3e0298184d76ad86730e5b89867fb4

    SHA1

    bbcfdc1732507ac17b812db102a25728d7d8c755

    SHA256

    f210b8d8e984df19b27fb6184ed0212467c219b418b94b01003d5e6c11efdef3

    SHA512

    68210ede444dfaea92edd57945cbe18a9e605a407aa7572fbc1d4bc61298789a1f8aa644d58e16c1f6df15eb395c3298847576cc3a33862d1c329fdd2ba91c99

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\gif.dll
    Filesize

    28KB

    MD5

    6ae328d3f4584597d87224568ef416b1

    SHA1

    87d29b395058ee0b852ccd0d7296edb8dd6e72a5

    SHA256

    22b993cb00c647debb7957b7ab8608b42928bcb1068fac57c54e70fe6fbbe0d3

    SHA512

    c2d847b96873fc6f5b731044c9fc570f4e25962728e7a14f1a3c3cbd3fb36fcce59fdd6ab2f2ace5a78e42c323839d1a14c07d389abe40766ac48f65f86d111b

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\gif.dll
    Filesize

    28KB

    MD5

    6ae328d3f4584597d87224568ef416b1

    SHA1

    87d29b395058ee0b852ccd0d7296edb8dd6e72a5

    SHA256

    22b993cb00c647debb7957b7ab8608b42928bcb1068fac57c54e70fe6fbbe0d3

    SHA512

    c2d847b96873fc6f5b731044c9fc570f4e25962728e7a14f1a3c3cbd3fb36fcce59fdd6ab2f2ace5a78e42c323839d1a14c07d389abe40766ac48f65f86d111b

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\infoware.dll
    Filesize

    1.4MB

    MD5

    72536dc4379ef32244e85e79aaca6bad

    SHA1

    15ef7dde5cf66cdd7805ebdbb12570de59be724b

    SHA256

    33367523ac36bffc608a35d2ff9f7cb8837f6a41c2b647aa1a3c10aa259e703c

    SHA512

    35bb838a9b3146d81087f21c9abc08191584f3da3b30c3e64c6fa11b60d922c20cb1c59bf3f3bca0b4fb309ee51b135e736af4009f565350cf9ff11fc78eb89f

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\infoware.dll
    Filesize

    1.4MB

    MD5

    72536dc4379ef32244e85e79aaca6bad

    SHA1

    15ef7dde5cf66cdd7805ebdbb12570de59be724b

    SHA256

    33367523ac36bffc608a35d2ff9f7cb8837f6a41c2b647aa1a3c10aa259e703c

    SHA512

    35bb838a9b3146d81087f21c9abc08191584f3da3b30c3e64c6fa11b60d922c20cb1c59bf3f3bca0b4fb309ee51b135e736af4009f565350cf9ff11fc78eb89f

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\jpeg62.dll
    Filesize

    538KB

    MD5

    dc9710e9bede8b3e02e356691dce2903

    SHA1

    8f92a58d6f49a1b7a5ab76b74bbc88d4cee02019

    SHA256

    ea85f913ac7f1472224ff9aacf07d72d65c39b0d79504259ccf678e97ac82819

    SHA512

    335bfd92b458377169399e45634f6af453bceed2313c1170fab3b263dbfd73d053296ed1b2ad5ea0548d90d9e3b224daa3e684c990552ba201d5894e5dc8d38c

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\jpeg62.dll
    Filesize

    538KB

    MD5

    dc9710e9bede8b3e02e356691dce2903

    SHA1

    8f92a58d6f49a1b7a5ab76b74bbc88d4cee02019

    SHA256

    ea85f913ac7f1472224ff9aacf07d72d65c39b0d79504259ccf678e97ac82819

    SHA512

    335bfd92b458377169399e45634f6af453bceed2313c1170fab3b263dbfd73d053296ed1b2ad5ea0548d90d9e3b224daa3e684c990552ba201d5894e5dc8d38c

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\ld
    Filesize

    1.8MB

    MD5

    9af9a3c729ae54c65bca2f6b195cd264

    SHA1

    66def2a81bd5c6fdfccbc1988a1932cea73f6c76

    SHA256

    1843f39639bcb3efac444f50026ea1a57cd96ec016ff4ac8c607e0649d22d99d

    SHA512

    d17ad63ca397e53ea5899ac6941877d5da5db0692d1e446e9087e062558ea379035dcde75e7f277dbcc100d7bb9dc81213566c199593bfde2f7edcc93400a46f

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\leptonica-1.82.0.dll
    Filesize

    2.0MB

    MD5

    b1b025f906d60a22d930dd9f17cdadd2

    SHA1

    dd9c06f7a21bbb779756665a895b54bd70aa9a10

    SHA256

    ec9bd9d0294330bb1ef614352126490763806d21aaf949263b64e86e41bba540

    SHA512

    d8ca56717dad265e5708d831909fee71b00c1739442c62735d21732b049768e532c43fe4dbbeb05adf2765f7b048b2316ce5864bb93e33b98a02ac90021780e6

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\leptonica-1.82.0.dll
    Filesize

    2.0MB

    MD5

    b1b025f906d60a22d930dd9f17cdadd2

    SHA1

    dd9c06f7a21bbb779756665a895b54bd70aa9a10

    SHA256

    ec9bd9d0294330bb1ef614352126490763806d21aaf949263b64e86e41bba540

    SHA512

    d8ca56717dad265e5708d831909fee71b00c1739442c62735d21732b049768e532c43fe4dbbeb05adf2765f7b048b2316ce5864bb93e33b98a02ac90021780e6

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libcrypto-3.dll
    Filesize

    2.7MB

    MD5

    5d27bfcbd2ef03041c284a31511e638e

    SHA1

    3c6e1dbd5adbe3bbb4a4ff4864ceb5e03d627333

    SHA256

    79cb81c74b994b2b2dd351bb567c82e64c666192e25b8d571d00caffd3fdef76

    SHA512

    b99a094b19ee6e71f33c3625ac3535826414c288c3ca5ff173d6b1be64bfb0180f6cb942821a59cc65729591bf48176f2f776150c6efd205710525f00012c3ee

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libcrypto-3.dll
    Filesize

    2.7MB

    MD5

    5d27bfcbd2ef03041c284a31511e638e

    SHA1

    3c6e1dbd5adbe3bbb4a4ff4864ceb5e03d627333

    SHA256

    79cb81c74b994b2b2dd351bb567c82e64c666192e25b8d571d00caffd3fdef76

    SHA512

    b99a094b19ee6e71f33c3625ac3535826414c288c3ca5ff173d6b1be64bfb0180f6cb942821a59cc65729591bf48176f2f776150c6efd205710525f00012c3ee

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libcurl.dll
    Filesize

    423KB

    MD5

    72a826e28e82a394aab487e3421d8436

    SHA1

    466757a94a1855b2a51390d333891c2a30b97434

    SHA256

    622d6094ea54d84865f8d27e33f165ee5329f35c7840381fce3277afbbca0a6a

    SHA512

    d26dfa8a54d176d3e710125cd3b6f3195381cff44f6f408f0dece84c8840e7e711ccb6568a2bd5d9c69b7641714fe2117713c1bfa1840fa8b7b6414f7ab2579a

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libcurl.dll
    Filesize

    423KB

    MD5

    72a826e28e82a394aab487e3421d8436

    SHA1

    466757a94a1855b2a51390d333891c2a30b97434

    SHA256

    622d6094ea54d84865f8d27e33f165ee5329f35c7840381fce3277afbbca0a6a

    SHA512

    d26dfa8a54d176d3e710125cd3b6f3195381cff44f6f408f0dece84c8840e7e711ccb6568a2bd5d9c69b7641714fe2117713c1bfa1840fa8b7b6414f7ab2579a

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\liblzma.dll
    Filesize

    129KB

    MD5

    c0433de8fa35793e62667f6e9bd7f2a1

    SHA1

    48e1205b590194b94dfef97897392ca355f78d5e

    SHA256

    f870e3df60826778baef972833c00068b345cf39a568d6f39a3e8dc92a28dfe5

    SHA512

    7bcb56f9ff7814e258bcc5945ddb535f355f269da8ad766614222d77f2f726a0a9169fa5ded74e73b0ecf63defec9f2530c61e4ce0ce2d1b4d0ccbc1870effc3

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\liblzma.dll
    Filesize

    129KB

    MD5

    c0433de8fa35793e62667f6e9bd7f2a1

    SHA1

    48e1205b590194b94dfef97897392ca355f78d5e

    SHA256

    f870e3df60826778baef972833c00068b345cf39a568d6f39a3e8dc92a28dfe5

    SHA512

    7bcb56f9ff7814e258bcc5945ddb535f355f269da8ad766614222d77f2f726a0a9169fa5ded74e73b0ecf63defec9f2530c61e4ce0ce2d1b4d0ccbc1870effc3

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libnl.dll
    Filesize

    5.7MB

    MD5

    71c9425b931174f36cf53b617256bb58

    SHA1

    567c1c118d6ea7a040b6cfe06afd5db30f0960f4

    SHA256

    4df4cd57dbe4c6cca7a032a0c45d0102696e2307548295ab7f62eea9c5ffbb85

    SHA512

    0939cb0158e4cdb6146fc19428e89250e811bb37c238878fbe41bd3b06336f6b36da94b24415520ffd99df790780bfb9e3ef416a621582fce17d9bafeb62b095

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libnl.dll
    Filesize

    5.7MB

    MD5

    71c9425b931174f36cf53b617256bb58

    SHA1

    567c1c118d6ea7a040b6cfe06afd5db30f0960f4

    SHA256

    4df4cd57dbe4c6cca7a032a0c45d0102696e2307548295ab7f62eea9c5ffbb85

    SHA512

    0939cb0158e4cdb6146fc19428e89250e811bb37c238878fbe41bd3b06336f6b36da94b24415520ffd99df790780bfb9e3ef416a621582fce17d9bafeb62b095

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libpng16.dll
    Filesize

    162KB

    MD5

    fc95df0925d9183a43c7f940094a8256

    SHA1

    3bb64b0c5bcfc5f3ec8aa1c396b9bb3f40984091

    SHA256

    95b74d8053cc88976911b289990c3f50a69e035a248f533c94c86bb29514a619

    SHA512

    c159c2cab06909526fdd292a3a3d615e9427eea20d8f93948b50078bf4220bb83f0200feba477aa25ee541faefa4bcc5487de5745a18c1077dad143b9ebbf85c

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libpng16.dll
    Filesize

    162KB

    MD5

    fc95df0925d9183a43c7f940094a8256

    SHA1

    3bb64b0c5bcfc5f3ec8aa1c396b9bb3f40984091

    SHA256

    95b74d8053cc88976911b289990c3f50a69e035a248f533c94c86bb29514a619

    SHA512

    c159c2cab06909526fdd292a3a3d615e9427eea20d8f93948b50078bf4220bb83f0200feba477aa25ee541faefa4bcc5487de5745a18c1077dad143b9ebbf85c

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libssl-3.dll
    Filesize

    769KB

    MD5

    6a92cec97792669dec4c1e06f957ed4e

    SHA1

    6789eb64b31fd5ab643cd91b2ba3afcfde22e7a2

    SHA256

    84b912710d6648269bfc96ded14c9f3fc98a45f4adab07a993e86c3defb1f65d

    SHA512

    bd185182334a423bec23e6931da62afd3a95bd2b93860b328f78ed2d02a811ac492f30178239d589fda0976ec3170d89b611cdccc190222bacbf1182b2ffd1d2

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libssl-3.dll
    Filesize

    769KB

    MD5

    6a92cec97792669dec4c1e06f957ed4e

    SHA1

    6789eb64b31fd5ab643cd91b2ba3afcfde22e7a2

    SHA256

    84b912710d6648269bfc96ded14c9f3fc98a45f4adab07a993e86c3defb1f65d

    SHA512

    bd185182334a423bec23e6931da62afd3a95bd2b93860b328f78ed2d02a811ac492f30178239d589fda0976ec3170d89b611cdccc190222bacbf1182b2ffd1d2

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libunmap.dll
    Filesize

    32KB

    MD5

    53634bc76f19ea065981ac1b02225df9

    SHA1

    7d1cb4ae535c30d2443c4b8f14927300c8449839

    SHA256

    e9053b628bf89440e0ad4874a5c234fe058539f20f9bf02d36c7492fed70857a

    SHA512

    3b46f34b4d370f44f219f0a404ae1f9a53897ddaabfb7665197dc16b538a13d9ee89af7053fd74998dc38321af8f076759f535d5a855f6ff5212d88704c79d3a

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\libunmap.dll
    Filesize

    32KB

    MD5

    53634bc76f19ea065981ac1b02225df9

    SHA1

    7d1cb4ae535c30d2443c4b8f14927300c8449839

    SHA256

    e9053b628bf89440e0ad4874a5c234fe058539f20f9bf02d36c7492fed70857a

    SHA512

    3b46f34b4d370f44f219f0a404ae1f9a53897ddaabfb7665197dc16b538a13d9ee89af7053fd74998dc38321af8f076759f535d5a855f6ff5212d88704c79d3a

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\msvcp140.dll
    Filesize

    428KB

    MD5

    fdd04dbbcf321eee5f4dd67266f476b0

    SHA1

    65ffdfe2664a29a41fcf5039229ccecad5b825b9

    SHA256

    21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

    SHA512

    04cfc3097fbce6ee1b7bac7bd63c3cffe7dca16f0ec9cd8fe657d8b7ebd06dcba272ff472f98c6385c3cfb9b1ac3f47be8ca6d3ea80ab4aeed44a0e2ce3185dd

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\nskbfltr.inf
    Filesize

    328B

    MD5

    26e28c01461f7e65c402bdf09923d435

    SHA1

    1d9b5cfcc30436112a7e31d5e4624f52e845c573

    SHA256

    d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368

    SHA512

    c30ec66fecb0a41e91a31804be3a8b6047fc3789306adc106c723b3e5b166127766670c7da38d77d3694d99a8cddb26bc266ee21dba60a148cdf4d6ee10d27d7

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\openjp2.dll
    Filesize

    304KB

    MD5

    0befbd26563d8ef2bc1f47384fd74e96

    SHA1

    547c90fad821505b2a72b8147cccacdbd70300e4

    SHA256

    7c4e95fb4ef2a251ffb397ca4342dcf55c65de54b6b1887a064e77501772ce9f

    SHA512

    a558f1d34cc25a0970bf264e6f47023f6d371090ae4f94b1444a4d216e7ee9f55a2c37704a5f35fbfdd96fa0ad028c5819dd90afaf77cc0bae97456f0278a8b2

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\openjp2.dll
    Filesize

    304KB

    MD5

    0befbd26563d8ef2bc1f47384fd74e96

    SHA1

    547c90fad821505b2a72b8147cccacdbd70300e4

    SHA256

    7c4e95fb4ef2a251ffb397ca4342dcf55c65de54b6b1887a064e77501772ce9f

    SHA512

    a558f1d34cc25a0970bf264e6f47023f6d371090ae4f94b1444a4d216e7ee9f55a2c37704a5f35fbfdd96fa0ad028c5819dd90afaf77cc0bae97456f0278a8b2

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\settings.ini
    Filesize

    505B

    MD5

    5a28072951d7f69bdea56a515bbde684

    SHA1

    90cf030b990eea1f721b3d51271bb55389af45bd

    SHA256

    fe3fa20956179b36138c44e6c271ff317f60462443f04ecbac002df3680a1f80

    SHA512

    8a3aaee43cdfdc86ffe27e368a9758f429aca533bd9659751ad24a830edf3a5744bbe7350b737a7198cb3dd5f9adf919263dcac67c938f2080a2e747d9d2f12f

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\tesseract52.dll
    Filesize

    2.2MB

    MD5

    fb01d25df4779f55ad1deea0ed3a8f2d

    SHA1

    ac023743506cc4a20b1e0cd5c47d7933313fab93

    SHA256

    93015a0a258424a2103b9520914faaabb98c7660b8387cd92d650f53260d5bf7

    SHA512

    ed1d39de0c4085493a8c6accd9780f932b8542d8e8613d8d77953b5067b93dda43adbd82c3923e0209d28f936e6078e48f9d7f7443fbb1c23fe8136562426a19

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\tesseract52.dll
    Filesize

    2.2MB

    MD5

    fb01d25df4779f55ad1deea0ed3a8f2d

    SHA1

    ac023743506cc4a20b1e0cd5c47d7933313fab93

    SHA256

    93015a0a258424a2103b9520914faaabb98c7660b8387cd92d650f53260d5bf7

    SHA512

    ed1d39de0c4085493a8c6accd9780f932b8542d8e8613d8d77953b5067b93dda43adbd82c3923e0209d28f936e6078e48f9d7f7443fbb1c23fe8136562426a19

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\tiff.dll
    Filesize

    394KB

    MD5

    74f1a9dd7e8d945cd555cfe5a24120a7

    SHA1

    642e3d2db14cc1b367e0c324e38883a201f3e766

    SHA256

    a630ef0230f081f9e512c72df1879b015d9ccac7f8447716d3379e7be561d88c

    SHA512

    27b4730bcccd094de96f9355c3d40b87e1e68ab94355ecc578e7618537bed42c25bbd232690eba61ae701f80c3e8fcb4d33584df3e606ba54372bcd13921e3ad

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\tiff.dll
    Filesize

    394KB

    MD5

    74f1a9dd7e8d945cd555cfe5a24120a7

    SHA1

    642e3d2db14cc1b367e0c324e38883a201f3e766

    SHA256

    a630ef0230f081f9e512c72df1879b015d9ccac7f8447716d3379e7be561d88c

    SHA512

    27b4730bcccd094de96f9355c3d40b87e1e68ab94355ecc578e7618537bed42c25bbd232690eba61ae701f80c3e8fcb4d33584df3e606ba54372bcd13921e3ad

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\vcruntime140.dll
    Filesize

    77KB

    MD5

    ba65db6bfef78a96aee7e29f1449bf8a

    SHA1

    06c7beb9fd1f33051b0e77087350903c652f4b77

    SHA256

    141690572594dbd3618a4984712e9e36fc09c9906bb845ce1a9531ac8f7ad493

    SHA512

    ca63eeac10ef55d7e2e55479b25cf394e58aef1422951f361f762ab667f72a3454f55afc04e967e8cdd20cf3eebe97083e0438ea941916a09e7d091818ea830e

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\webp.dll
    Filesize

    293KB

    MD5

    49a5a7951db2476d6242a858a0461fc4

    SHA1

    1696f8060aebff50af0ac4650893378bd5152285

    SHA256

    c7db9a648d5abaf0247b68c48e08e74220dc7757514710e6748b1f482d66c5b8

    SHA512

    e725704c004c47bc6b3c802ab626443cbfc02cc6563b85c25ff09d28382556e07e42b3a897d463828b20af10e1a189e81d0b759ed0043c03d35ebacdd3cae80d

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\webp.dll
    Filesize

    293KB

    MD5

    49a5a7951db2476d6242a858a0461fc4

    SHA1

    1696f8060aebff50af0ac4650893378bd5152285

    SHA256

    c7db9a648d5abaf0247b68c48e08e74220dc7757514710e6748b1f482d66c5b8

    SHA512

    e725704c004c47bc6b3c802ab626443cbfc02cc6563b85c25ff09d28382556e07e42b3a897d463828b20af10e1a189e81d0b759ed0043c03d35ebacdd3cae80d

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\webpmux.dll
    Filesize

    31KB

    MD5

    3ad28bf0e0b806e52709b052bb3bf59f

    SHA1

    38533b5a814be276266dac5abaa78ddf6f3ab721

    SHA256

    a6ca310783b9e829c28dc2b7b12fe79dbc3543a04c3a76af320dc65e3733296d

    SHA512

    d9e1494a3f9a51c410e7aedf5735f367b13b7ec9bb600db11f9977aaadbd14f71bba51c1eacff054012a34f37f6f30871a542f54d2ef08a575883934ea69593c

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\webpmux.dll
    Filesize

    31KB

    MD5

    3ad28bf0e0b806e52709b052bb3bf59f

    SHA1

    38533b5a814be276266dac5abaa78ddf6f3ab721

    SHA256

    a6ca310783b9e829c28dc2b7b12fe79dbc3543a04c3a76af320dc65e3733296d

    SHA512

    d9e1494a3f9a51c410e7aedf5735f367b13b7ec9bb600db11f9977aaadbd14f71bba51c1eacff054012a34f37f6f30871a542f54d2ef08a575883934ea69593c

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\zlib1.dll
    Filesize

    76KB

    MD5

    7cfdbfec8b16876767f5895fae94f6cd

    SHA1

    49644b75dc5ef3e1f6e122f8b6e5569b74b1e2a5

    SHA256

    322062f0287317d3f41180bf79e54c4ddf4646a08fcd55263fd05ad56b8e1cba

    SHA512

    02a10c91098b79cf4b53dfeb595283cd0bcd5b70ddc803f401600d321a54d3ce51ec24962473a47b9679b573a2223ff7f02be57866bfd961cea3f1a81bcea683

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\zlib1.dll
    Filesize

    76KB

    MD5

    7cfdbfec8b16876767f5895fae94f6cd

    SHA1

    49644b75dc5ef3e1f6e122f8b6e5569b74b1e2a5

    SHA256

    322062f0287317d3f41180bf79e54c4ddf4646a08fcd55263fd05ad56b8e1cba

    SHA512

    02a10c91098b79cf4b53dfeb595283cd0bcd5b70ddc803f401600d321a54d3ce51ec24962473a47b9679b573a2223ff7f02be57866bfd961cea3f1a81bcea683

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\zstd.dll
    Filesize

    499KB

    MD5

    03ece33189fd8dc46ce2175ee18e46a9

    SHA1

    f027f3a0485b0b771249bb749c1fac3ec7c46888

    SHA256

    8a25f1678e5133273ac073fa8c0e7cf1e4ebd3d945e2176052152da4f117eeb4

    SHA512

    85e3d736e420fed1f26c560ccd97537f3ed3560d341d7add76921cb6c96e0f8116bb82b6c1d12f97fc13f436f91ca3d426e0fded2e4fcbb52574846a83aec42c

  • C:\Users\Admin\AppData\Local\Softros Systems\Softros LAN Messenger\zstd.dll
    Filesize

    499KB

    MD5

    03ece33189fd8dc46ce2175ee18e46a9

    SHA1

    f027f3a0485b0b771249bb749c1fac3ec7c46888

    SHA256

    8a25f1678e5133273ac073fa8c0e7cf1e4ebd3d945e2176052152da4f117eeb4

    SHA512

    85e3d736e420fed1f26c560ccd97537f3ed3560d341d7add76921cb6c96e0f8116bb82b6c1d12f97fc13f436f91ca3d426e0fded2e4fcbb52574846a83aec42c

  • C:\Users\Admin\AppData\Local\Temp\is-F3TUK.tmp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.tmp
    Filesize

    3.0MB

    MD5

    2f19061194ae27c87b8b6f8eff0a2ca9

    SHA1

    ed3e04874f4ed4db839020a786d8ff49038c23d4

    SHA256

    fe614f6d3edb6f259cf91c93b2fc551ff2950eb8bbe7c879b9df5e4d722bfc5e

    SHA512

    2180b33b649da3c4a708faa276e3c167b749c654101c9d0ebbe7e673f7d415bbd6d7c1545b75244a3a8c00706e0d99e8320ab9d5c33f1b9776c0a314cb1f7033

  • C:\Users\Admin\AppData\Local\Temp\is-P51FP.tmp\b715f22a9e37049d09b06c26ca899c4be3c6c21386f70d6d357b3bd481ee1794.tmp
    Filesize

    3.0MB

    MD5

    2f19061194ae27c87b8b6f8eff0a2ca9

    SHA1

    ed3e04874f4ed4db839020a786d8ff49038c23d4

    SHA256

    fe614f6d3edb6f259cf91c93b2fc551ff2950eb8bbe7c879b9df5e4d722bfc5e

    SHA512

    2180b33b649da3c4a708faa276e3c167b749c654101c9d0ebbe7e673f7d415bbd6d7c1545b75244a3a8c00706e0d99e8320ab9d5c33f1b9776c0a314cb1f7033

  • memory/1404-150-0x00000000008C0000-0x00000000008C1000-memory.dmp
    Filesize

    4KB

  • memory/1404-396-0x0000000000400000-0x0000000000713000-memory.dmp
    Filesize

    3.1MB

  • memory/1436-139-0x00000000027F0000-0x00000000027F1000-memory.dmp
    Filesize

    4KB

  • memory/1436-143-0x0000000000400000-0x0000000000713000-memory.dmp
    Filesize

    3.1MB

  • memory/1780-394-0x0000000002670000-0x0000000002671000-memory.dmp
    Filesize

    4KB

  • memory/1780-483-0x0000000010000000-0x00000000105DF000-memory.dmp
    Filesize

    5.9MB

  • memory/1780-474-0x0000000006240000-0x00000000062FC000-memory.dmp
    Filesize

    752KB

  • memory/1780-476-0x0000000000360000-0x0000000000588000-memory.dmp
    Filesize

    2.2MB

  • memory/1780-500-0x0000000006240000-0x00000000062FC000-memory.dmp
    Filesize

    752KB

  • memory/1780-470-0x0000000006240000-0x00000000062FC000-memory.dmp
    Filesize

    752KB

  • memory/1780-488-0x0000000002670000-0x0000000002671000-memory.dmp
    Filesize

    4KB

  • memory/1780-486-0x0000000004610000-0x000000000462C000-memory.dmp
    Filesize

    112KB

  • memory/1780-452-0x0000000006240000-0x00000000062FC000-memory.dmp
    Filesize

    752KB

  • memory/1780-471-0x0000000006240000-0x00000000062FC000-memory.dmp
    Filesize

    752KB

  • memory/1780-479-0x0000000006240000-0x00000000062FC000-memory.dmp
    Filesize

    752KB

  • memory/1780-477-0x0000000006240000-0x00000000062FC000-memory.dmp
    Filesize

    752KB

  • memory/1780-480-0x0000000006240000-0x00000000062FC000-memory.dmp
    Filesize

    752KB

  • memory/3872-133-0x0000000000400000-0x00000000004D8000-memory.dmp
    Filesize

    864KB

  • memory/3872-145-0x0000000000400000-0x00000000004D8000-memory.dmp
    Filesize

    864KB

  • memory/4208-141-0x0000000000400000-0x00000000004D8000-memory.dmp
    Filesize

    864KB

  • memory/4208-398-0x0000000000400000-0x00000000004D8000-memory.dmp
    Filesize

    864KB