Analysis

  • max time kernel
    122s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    15/08/2023, 18:47

General

  • Target

    Soar Installer.exe

  • Size

    53.1MB

  • MD5

    331c5db4b79ffceedb352c6b49d0ac66

  • SHA1

    e8aa7ba6e27a04d77370976cb6866e9ac1371234

  • SHA256

    f3f8d21ef3d5c0988e10623016d6313c06d7b27cee556f4582641d3f3f6060f9

  • SHA512

    dbecbe64c4c27da8345d54224d86e47c882f94db2a30ab3d0655b510936dcfc4b9dcdaded69fafa3098399a1fe15e6bf6724c178cadce6cf58d2fd00c2fa9959

  • SSDEEP

    786432:ugiUxhx6xEawQDCqZ0Em1q1bz+LsUwk5w0RG65vTCzP6tVraUH8tQqs1gyq:uZUxhYxrN6Em1q1HkMGwbyTCzivOtLv/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 33 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Soar Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Soar Installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\is-5NPJE.tmp\Soar Installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-5NPJE.tmp\Soar Installer.tmp" /SL5="$80120,54705823,832512,C:\Users\Admin\AppData\Local\Temp\Soar Installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Users\Admin\AppData\Local\.soarclient\Soar Client.exe
        "C:\Users\Admin\AppData\Local\.soarclient\Soar Client.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:572
        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\java.exe
          "C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\java.exe" -jar "C:\Users\Admin\AppData\Local\.soarclient\Bootstrap.jar"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1012
          • C:\Windows\system32\icacls.exe
            C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
            5⤵
            • Modifies file permissions
            PID:1608

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\.soarclient\Bootstrap.jar

          Filesize

          465KB

          MD5

          008a7a9dbf352fae5e358e85397ff9c8

          SHA1

          7e219dab0bb078eb2af35545e9c7861c56abd1e0

          SHA256

          6c1a734a0d463f257475b6cfc7e50cc876b8ac78e348640d14abab5b36f6d51b

          SHA512

          6d43c732d69657d4e91a3b107762d1625947233d628f843d0de339f49807bc42d1ebbea0216305e8af7334027121e3542c87313bb449fd5bc7d1c4e46950ebf5

        • C:\Users\Admin\AppData\Local\.soarclient\Soar Client.exe

          Filesize

          310KB

          MD5

          a96885592aed55d1c77590b8e480a7d5

          SHA1

          37cf27b61630991c8a06648713179ef0d43ddf8f

          SHA256

          20c5aef99f121b02c625731d1df5d10a42e605e123f381ab848ab291b43f16a5

          SHA512

          06bc41c5f0b686ab00de1899d1b07898f611a6087ef3ea97ee66bd62cc8fc3081d69916ee25b2a0484aa594d63565e4f3cd387ce3dc73095aa452699cae8301b

        • C:\Users\Admin\AppData\Local\.soarclient\Soar Client.exe

          Filesize

          310KB

          MD5

          a96885592aed55d1c77590b8e480a7d5

          SHA1

          37cf27b61630991c8a06648713179ef0d43ddf8f

          SHA256

          20c5aef99f121b02c625731d1df5d10a42e605e123f381ab848ab291b43f16a5

          SHA512

          06bc41c5f0b686ab00de1899d1b07898f611a6087ef3ea97ee66bd62cc8fc3081d69916ee25b2a0484aa594d63565e4f3cd387ce3dc73095aa452699cae8301b

        • C:\Users\Admin\AppData\Local\.soarclient\Soar Client.exe

          Filesize

          310KB

          MD5

          a96885592aed55d1c77590b8e480a7d5

          SHA1

          37cf27b61630991c8a06648713179ef0d43ddf8f

          SHA256

          20c5aef99f121b02c625731d1df5d10a42e605e123f381ab848ab291b43f16a5

          SHA512

          06bc41c5f0b686ab00de1899d1b07898f611a6087ef3ea97ee66bd62cc8fc3081d69916ee25b2a0484aa594d63565e4f3cd387ce3dc73095aa452699cae8301b

        • C:\Users\Admin\AppData\Local\.soarclient\Soar Client.exe.config

          Filesize

          189B

          MD5

          9dbad5517b46f41dbb0d8780b20ab87e

          SHA1

          ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

          SHA256

          47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

          SHA512

          43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-core-file-l1-2-0.dll

          Filesize

          11KB

          MD5

          5a72a803df2b425d5aaff21f0f064011

          SHA1

          4b31963d981c07a7ab2a0d1a706067c539c55ec5

          SHA256

          629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086

          SHA512

          bf44997c405c2ba80100eb0f2ff7304938fc69e4d7ae3eac52b3c236c3188e80c9f18bda226b5f4fde0112320e74c198ad985f9ffd7cea99aca22980c39c7f69

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-core-file-l2-1-0.dll

          Filesize

          11KB

          MD5

          721b60b85094851c06d572f0bd5d88cd

          SHA1

          4d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7

          SHA256

          dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf

          SHA512

          430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-core-localization-l1-2-0.dll

          Filesize

          14KB

          MD5

          1ed0b196ab58edb58fcf84e1739c63ce

          SHA1

          ac7d6c77629bdee1df7e380cc9559e09d51d75b7

          SHA256

          8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2

          SHA512

          e1fa7f14f39c97aaa3104f3e13098626b5f7cfd665ba52dcb2312a329639aaf5083a9177e4686d11c4213e28acc40e2c027988074b6cc13c5016d5c5e9ef897b

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-core-processthreads-l1-1-1.dll

          Filesize

          11KB

          MD5

          7e8b61d27a9d04e28d4dae0bfa0902ed

          SHA1

          861a7b31022915f26fb49c79ac357c65782c9f4b

          SHA256

          1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c

          SHA512

          1c5b35026937b45beb76cb8d79334a306342c57a8e36cc15d633458582fc8f7d9ab70ace7a92144288c6c017f33ecfc20477a04432619b40a21c9cda8d249f6d

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-core-timezone-l1-1-0.dll

          Filesize

          11KB

          MD5

          91a2ae3c4eb79cf748e15a58108409ad

          SHA1

          d402b9df99723ea26a141bfc640d78eaf0b0111b

          SHA256

          b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34

          SHA512

          8527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-convert-l1-1-0.dll

          Filesize

          15KB

          MD5

          4ec4790281017e616af632da1dc624e1

          SHA1

          342b15c5d3e34ab4ac0b9904b95d0d5b074447b7

          SHA256

          5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639

          SHA512

          80c4e20d37eff29c7577b2d0ed67539a9c2c228edb48ab05d72648a6ed38f5ff537715c130342beb0e3ef16eb11179b9b484303354a026bda3a86d5414d24e69

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-environment-l1-1-0.dll

          Filesize

          11KB

          MD5

          7a859e91fdcf78a584ac93aa85371bc9

          SHA1

          1fa9d9cad7cc26808e697373c1f5f32aaf59d6b7

          SHA256

          b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607

          SHA512

          a368f21eca765afca86e03d59cf953500770f4a5bff8b86b2ac53f1b5174c627e061ce9a1f781dc56506774e0d0b09725e9698d4dc2d3a59e93da7ef3d900887

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-filesystem-l1-1-0.dll

          Filesize

          13KB

          MD5

          972544ade7e32bfdeb28b39bc734cdee

          SHA1

          87816f4afabbdec0ec2cfeb417748398505c5aa9

          SHA256

          7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86

          SHA512

          5e1131b405e0c7a255b1c51073aff99e2d5c0d28fd3e55cabc04d463758a575a954008ea1ba5b4e2b345b49af448b93ad21dfc4a01573b3cb6e7256d9ecceef1

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-heap-l1-1-0.dll

          Filesize

          12KB

          MD5

          8906279245f7385b189a6b0b67df2d7c

          SHA1

          fcf03d9043a2daafe8e28dee0b130513677227e4

          SHA256

          f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f

          SHA512

          67cac89ae58cc715976107f3bdf279b1e78945afd07e6f657e076d78e92ee1a98e3e7b8feae295af5ce35e00c804f3f53a890895badb1eed32377d85c21672b9

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-locale-l1-1-0.dll

          Filesize

          11KB

          MD5

          dd8176e132eedea3322443046ac35ca2

          SHA1

          d13587c7cc52b2c6fbcaa548c8ed2c771a260769

          SHA256

          2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e

          SHA512

          77cb8c44c8cc8dd29997fba4424407579ac91176482db3cf7bc37e1f9f6aa4c4f5ba14862d2f3a9c05d1fdd7ca5a043b5f566bd0e9a9e1ed837da9c11803b253

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-math-l1-1-0.dll

          Filesize

          20KB

          MD5

          a6a3d6d11d623e16866f38185853facd

          SHA1

          fbeadd1e9016908ecce5753de1d435d6fcf3d0b5

          SHA256

          a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0

          SHA512

          abbf32ceb35e5ec6c1562f9f3b2652b96b7dbd97bfc08d918f987c0ec0503e8390dd697476b2a2389f0172cd8cf16029fd2ec5f32a9ba3688bf2ebeefb081b2c

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-runtime-l1-1-0.dll

          Filesize

          15KB

          MD5

          f1a23c251fcbb7041496352ec9bcffbe

          SHA1

          be4a00642ec82465bc7b3d0cc07d4e8df72094e8

          SHA256

          d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198

          SHA512

          31f8c5cd3b6e153073e2e2edf0ca8072d0f787784f1611a57219349c1d57d6798a3adbd6942b0f16cef781634dd8691a5ec0b506df21b24cb70aee5523a03fd9

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-stdio-l1-1-0.dll

          Filesize

          17KB

          MD5

          55b2eb7f17f82b2096e94bca9d2db901

          SHA1

          44d85f1b1134ee7a609165e9c142188c0f0b17e0

          SHA256

          f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb

          SHA512

          0cf0770f5965a83f546253decfa967d8f85c340b5f6ea220d3caa14245f3cdb37c53bf8d3da6c35297b22a3fa88e7621202634f6b3649d7d9c166a221d3456a5

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-string-l1-1-0.dll

          Filesize

          17KB

          MD5

          9b79965f06fd756a5efde11e8d373108

          SHA1

          3b9de8bf6b912f19f7742ad34a875cbe2b5ffa50

          SHA256

          1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6

          SHA512

          7d4155c00d65c3554e90575178a80d20dc7c80d543c4b5c4c3f508f0811482515638fe513e291b82f958b4d7a63c9876be4e368557b07ff062961197ed4286fb

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-time-l1-1-0.dll

          Filesize

          13KB

          MD5

          1d48a3189a55b632798f0e859628b0fb

          SHA1

          61569a8e4f37adc353986d83efc90dc043cdc673

          SHA256

          b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0

          SHA512

          47f329102b703bfbb1ebaeb5203d1c8404a0c912019193c93d150a95bb0c5ba8dc101ac56d3283285f9f91239fc64a66a5357afe428a919b0be7194bada1f64f

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-utility-l1-1-0.dll

          Filesize

          11KB

          MD5

          dbc27d384679916ba76316fb5e972ea6

          SHA1

          fb9f021f2220c852f6ff4ea94e8577368f0616a4

          SHA256

          dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1

          SHA512

          cc0d8c56749ccb9d007b6d3f5c4a8f1d4e368bb81446ebcd7cc7b40399bbd56d0acaba588ca172ecb7472a8cbddbd4c366ffa38094a832f6d7e343b813ba565e

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\java.dll

          Filesize

          162KB

          MD5

          4e6dfd5867f4cea96dad1d59a0ca43fe

          SHA1

          6a08abc0b5a2cab00eb6d7543c661aa6620890a1

          SHA256

          179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54

          SHA512

          2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\java.exe

          Filesize

          285KB

          MD5

          dafb5fbb0614c19eccdab9bef8f89c22

          SHA1

          91ab91eb4a90f02c4950c3e5da80f3eb24bddb52

          SHA256

          af62c3850cd7a84db64bbaf68533e2769da619a8a4bccf0ac4836d2ec86e4b5e

          SHA512

          81cf8e04b595052e67db73454a67e2098e1df9353e2c3cc842b8ab2a9fa837b90a2101d5a097a6b0af0030869e788de1aa73ebb958f1428a3952ce0464db3e93

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\msvcp140.dll

          Filesize

          558KB

          MD5

          bf78c15068d6671693dfcdfa5770d705

          SHA1

          4418c03c3161706a4349dfe3f97278e7a5d8962a

          SHA256

          a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

          SHA512

          5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\server\jvm.dll

          Filesize

          8.5MB

          MD5

          dceeb4fb6af9bb2ea7a2eed1d921afb5

          SHA1

          af1463a499f7d6eed5efcb9c9515e82335e9c1b6

          SHA256

          6707043f0b609a0b3677cd11f6526d8ecfcbeab079a394019d648c9039e7da21

          SHA512

          e4688d2264dda88e90beeb394adc48064012ed458ab9015ecef744a86ab76b4f65845f77a3d02b131aa5c342e6a572f79f471b5dc8df178b2d7483c04b1f4763

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\ucrtbase.DLL

          Filesize

          1011KB

          MD5

          849959a003fa63c5a42ae87929fcd18b

          SHA1

          d1b80b3265e31a2b5d8d7da6183146bbd5fb791b

          SHA256

          6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232

          SHA512

          64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\vcruntime140.dll

          Filesize

          95KB

          MD5

          7415c1cc63a0c46983e2a32581daefee

          SHA1

          5f8534d79c84ac45ad09b5a702c8c5c288eae240

          SHA256

          475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

          SHA512

          3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\vcruntime140_1.dll

          Filesize

          36KB

          MD5

          fcda37abd3d9e9d8170cd1cd15bf9d3f

          SHA1

          b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2

          SHA256

          0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6

          SHA512

          de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\verify.dll

          Filesize

          55KB

          MD5

          82bb3a2292372acbf8bb25e30a3e169c

          SHA1

          c09c134561213cd67c670f60a2c52cf947e51a74

          SHA256

          9c99e6591c73eda0dfd6bb9a55d0a175cf5bdb583115477cedc627fd793c3deb

          SHA512

          db4802fe0e3a6dc1678765af559e9c1f6e8639dd5c7c8f18f08296b1b4d15cfe748e391459253a3dde0ca2bda74c6772af262e5b194c78c6bdefbcc2c5377db7

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\zip.dll

          Filesize

          87KB

          MD5

          0d56a7ff632826362768b3edd5e5174f

          SHA1

          8b96856f8fe3175039d1a7cf3ac0910467844a08

          SHA256

          27cf17beab60d7f9a62aac7622eefa06eee78796db585f9ae5d3a5b5022d56a9

          SHA512

          b4fe51874b9ba7a2325ae3c0b96f32065f7cee7c846a9028495070f1f91cedd9445cb91248acd1ec134a72b2c07e49afcaef01b58af1dfb0ff417033c2d0e595

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\lib\amd64\jvm.cfg

          Filesize

          634B

          MD5

          499f2a4e0a25a41c1ff80df2d073e4fd

          SHA1

          e2469cbe07e92d817637be4e889ebb74c3c46253

          SHA256

          80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb

          SHA512

          7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d

        • C:\Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\lib\images\cursors\is-5JV59.tmp

          Filesize

          153B

          MD5

          1e9d8f133a442da6b0c74d49bc84a341

          SHA1

          259edc45b4569427e8319895a444f4295d54348f

          SHA256

          1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

          SHA512

          63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

        • C:\Users\Admin\AppData\Local\Temp\is-5NPJE.tmp\Soar Installer.tmp

          Filesize

          3.1MB

          MD5

          c7ff15e1725048e7650f873cd9d9f530

          SHA1

          008d4f3fea7318b50fd27337cfd335eac27f307a

          SHA256

          22de764c66e6bc53e7dc380d483027fba1ef44cb9133e231127bed4d49a4f657

          SHA512

          faaf142a52a03d4a43627e4a31b80ecd6b3c64c64ef62fb6c5eab7916d8f0025aeb2e5b960a0e437f6b68a0e82cc44baab316d3aa621f333d105bf410c98c530

        • C:\Users\Admin\AppData\Local\Temp\is-5NPJE.tmp\Soar Installer.tmp

          Filesize

          3.1MB

          MD5

          c7ff15e1725048e7650f873cd9d9f530

          SHA1

          008d4f3fea7318b50fd27337cfd335eac27f307a

          SHA256

          22de764c66e6bc53e7dc380d483027fba1ef44cb9133e231127bed4d49a4f657

          SHA512

          faaf142a52a03d4a43627e4a31b80ecd6b3c64c64ef62fb6c5eab7916d8f0025aeb2e5b960a0e437f6b68a0e82cc44baab316d3aa621f333d105bf410c98c530

        • \Users\Admin\AppData\Local\.soarclient\Soar Client.exe

          Filesize

          310KB

          MD5

          a96885592aed55d1c77590b8e480a7d5

          SHA1

          37cf27b61630991c8a06648713179ef0d43ddf8f

          SHA256

          20c5aef99f121b02c625731d1df5d10a42e605e123f381ab848ab291b43f16a5

          SHA512

          06bc41c5f0b686ab00de1899d1b07898f611a6087ef3ea97ee66bd62cc8fc3081d69916ee25b2a0484aa594d63565e4f3cd387ce3dc73095aa452699cae8301b

        • \Users\Admin\AppData\Local\.soarclient\Soar Client.exe

          Filesize

          310KB

          MD5

          a96885592aed55d1c77590b8e480a7d5

          SHA1

          37cf27b61630991c8a06648713179ef0d43ddf8f

          SHA256

          20c5aef99f121b02c625731d1df5d10a42e605e123f381ab848ab291b43f16a5

          SHA512

          06bc41c5f0b686ab00de1899d1b07898f611a6087ef3ea97ee66bd62cc8fc3081d69916ee25b2a0484aa594d63565e4f3cd387ce3dc73095aa452699cae8301b

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-core-file-l1-2-0.dll

          Filesize

          11KB

          MD5

          5a72a803df2b425d5aaff21f0f064011

          SHA1

          4b31963d981c07a7ab2a0d1a706067c539c55ec5

          SHA256

          629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086

          SHA512

          bf44997c405c2ba80100eb0f2ff7304938fc69e4d7ae3eac52b3c236c3188e80c9f18bda226b5f4fde0112320e74c198ad985f9ffd7cea99aca22980c39c7f69

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-core-file-l2-1-0.dll

          Filesize

          11KB

          MD5

          721b60b85094851c06d572f0bd5d88cd

          SHA1

          4d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7

          SHA256

          dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf

          SHA512

          430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-core-localization-l1-2-0.dll

          Filesize

          14KB

          MD5

          1ed0b196ab58edb58fcf84e1739c63ce

          SHA1

          ac7d6c77629bdee1df7e380cc9559e09d51d75b7

          SHA256

          8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2

          SHA512

          e1fa7f14f39c97aaa3104f3e13098626b5f7cfd665ba52dcb2312a329639aaf5083a9177e4686d11c4213e28acc40e2c027988074b6cc13c5016d5c5e9ef897b

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-core-processthreads-l1-1-1.dll

          Filesize

          11KB

          MD5

          7e8b61d27a9d04e28d4dae0bfa0902ed

          SHA1

          861a7b31022915f26fb49c79ac357c65782c9f4b

          SHA256

          1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c

          SHA512

          1c5b35026937b45beb76cb8d79334a306342c57a8e36cc15d633458582fc8f7d9ab70ace7a92144288c6c017f33ecfc20477a04432619b40a21c9cda8d249f6d

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-core-timezone-l1-1-0.dll

          Filesize

          11KB

          MD5

          91a2ae3c4eb79cf748e15a58108409ad

          SHA1

          d402b9df99723ea26a141bfc640d78eaf0b0111b

          SHA256

          b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34

          SHA512

          8527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-convert-l1-1-0.dll

          Filesize

          15KB

          MD5

          4ec4790281017e616af632da1dc624e1

          SHA1

          342b15c5d3e34ab4ac0b9904b95d0d5b074447b7

          SHA256

          5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639

          SHA512

          80c4e20d37eff29c7577b2d0ed67539a9c2c228edb48ab05d72648a6ed38f5ff537715c130342beb0e3ef16eb11179b9b484303354a026bda3a86d5414d24e69

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-environment-l1-1-0.dll

          Filesize

          11KB

          MD5

          7a859e91fdcf78a584ac93aa85371bc9

          SHA1

          1fa9d9cad7cc26808e697373c1f5f32aaf59d6b7

          SHA256

          b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607

          SHA512

          a368f21eca765afca86e03d59cf953500770f4a5bff8b86b2ac53f1b5174c627e061ce9a1f781dc56506774e0d0b09725e9698d4dc2d3a59e93da7ef3d900887

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-filesystem-l1-1-0.dll

          Filesize

          13KB

          MD5

          972544ade7e32bfdeb28b39bc734cdee

          SHA1

          87816f4afabbdec0ec2cfeb417748398505c5aa9

          SHA256

          7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86

          SHA512

          5e1131b405e0c7a255b1c51073aff99e2d5c0d28fd3e55cabc04d463758a575a954008ea1ba5b4e2b345b49af448b93ad21dfc4a01573b3cb6e7256d9ecceef1

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-heap-l1-1-0.dll

          Filesize

          12KB

          MD5

          8906279245f7385b189a6b0b67df2d7c

          SHA1

          fcf03d9043a2daafe8e28dee0b130513677227e4

          SHA256

          f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f

          SHA512

          67cac89ae58cc715976107f3bdf279b1e78945afd07e6f657e076d78e92ee1a98e3e7b8feae295af5ce35e00c804f3f53a890895badb1eed32377d85c21672b9

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-locale-l1-1-0.dll

          Filesize

          11KB

          MD5

          dd8176e132eedea3322443046ac35ca2

          SHA1

          d13587c7cc52b2c6fbcaa548c8ed2c771a260769

          SHA256

          2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e

          SHA512

          77cb8c44c8cc8dd29997fba4424407579ac91176482db3cf7bc37e1f9f6aa4c4f5ba14862d2f3a9c05d1fdd7ca5a043b5f566bd0e9a9e1ed837da9c11803b253

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-math-l1-1-0.dll

          Filesize

          20KB

          MD5

          a6a3d6d11d623e16866f38185853facd

          SHA1

          fbeadd1e9016908ecce5753de1d435d6fcf3d0b5

          SHA256

          a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0

          SHA512

          abbf32ceb35e5ec6c1562f9f3b2652b96b7dbd97bfc08d918f987c0ec0503e8390dd697476b2a2389f0172cd8cf16029fd2ec5f32a9ba3688bf2ebeefb081b2c

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-runtime-l1-1-0.dll

          Filesize

          15KB

          MD5

          f1a23c251fcbb7041496352ec9bcffbe

          SHA1

          be4a00642ec82465bc7b3d0cc07d4e8df72094e8

          SHA256

          d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198

          SHA512

          31f8c5cd3b6e153073e2e2edf0ca8072d0f787784f1611a57219349c1d57d6798a3adbd6942b0f16cef781634dd8691a5ec0b506df21b24cb70aee5523a03fd9

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-stdio-l1-1-0.dll

          Filesize

          17KB

          MD5

          55b2eb7f17f82b2096e94bca9d2db901

          SHA1

          44d85f1b1134ee7a609165e9c142188c0f0b17e0

          SHA256

          f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb

          SHA512

          0cf0770f5965a83f546253decfa967d8f85c340b5f6ea220d3caa14245f3cdb37c53bf8d3da6c35297b22a3fa88e7621202634f6b3649d7d9c166a221d3456a5

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-string-l1-1-0.dll

          Filesize

          17KB

          MD5

          9b79965f06fd756a5efde11e8d373108

          SHA1

          3b9de8bf6b912f19f7742ad34a875cbe2b5ffa50

          SHA256

          1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6

          SHA512

          7d4155c00d65c3554e90575178a80d20dc7c80d543c4b5c4c3f508f0811482515638fe513e291b82f958b4d7a63c9876be4e368557b07ff062961197ed4286fb

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-time-l1-1-0.dll

          Filesize

          13KB

          MD5

          1d48a3189a55b632798f0e859628b0fb

          SHA1

          61569a8e4f37adc353986d83efc90dc043cdc673

          SHA256

          b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0

          SHA512

          47f329102b703bfbb1ebaeb5203d1c8404a0c912019193c93d150a95bb0c5ba8dc101ac56d3283285f9f91239fc64a66a5357afe428a919b0be7194bada1f64f

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\api-ms-win-crt-utility-l1-1-0.dll

          Filesize

          11KB

          MD5

          dbc27d384679916ba76316fb5e972ea6

          SHA1

          fb9f021f2220c852f6ff4ea94e8577368f0616a4

          SHA256

          dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1

          SHA512

          cc0d8c56749ccb9d007b6d3f5c4a8f1d4e368bb81446ebcd7cc7b40399bbd56d0acaba588ca172ecb7472a8cbddbd4c366ffa38094a832f6d7e343b813ba565e

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\java.dll

          Filesize

          162KB

          MD5

          4e6dfd5867f4cea96dad1d59a0ca43fe

          SHA1

          6a08abc0b5a2cab00eb6d7543c661aa6620890a1

          SHA256

          179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54

          SHA512

          2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\java.dll

          Filesize

          162KB

          MD5

          4e6dfd5867f4cea96dad1d59a0ca43fe

          SHA1

          6a08abc0b5a2cab00eb6d7543c661aa6620890a1

          SHA256

          179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54

          SHA512

          2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\java.dll

          Filesize

          162KB

          MD5

          4e6dfd5867f4cea96dad1d59a0ca43fe

          SHA1

          6a08abc0b5a2cab00eb6d7543c661aa6620890a1

          SHA256

          179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54

          SHA512

          2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\java.dll

          Filesize

          162KB

          MD5

          4e6dfd5867f4cea96dad1d59a0ca43fe

          SHA1

          6a08abc0b5a2cab00eb6d7543c661aa6620890a1

          SHA256

          179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54

          SHA512

          2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\java.dll

          Filesize

          162KB

          MD5

          4e6dfd5867f4cea96dad1d59a0ca43fe

          SHA1

          6a08abc0b5a2cab00eb6d7543c661aa6620890a1

          SHA256

          179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54

          SHA512

          2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\java.exe

          Filesize

          285KB

          MD5

          dafb5fbb0614c19eccdab9bef8f89c22

          SHA1

          91ab91eb4a90f02c4950c3e5da80f3eb24bddb52

          SHA256

          af62c3850cd7a84db64bbaf68533e2769da619a8a4bccf0ac4836d2ec86e4b5e

          SHA512

          81cf8e04b595052e67db73454a67e2098e1df9353e2c3cc842b8ab2a9fa837b90a2101d5a097a6b0af0030869e788de1aa73ebb958f1428a3952ce0464db3e93

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\msvcp140.dll

          Filesize

          558KB

          MD5

          bf78c15068d6671693dfcdfa5770d705

          SHA1

          4418c03c3161706a4349dfe3f97278e7a5d8962a

          SHA256

          a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

          SHA512

          5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\server\jvm.dll

          Filesize

          8.5MB

          MD5

          dceeb4fb6af9bb2ea7a2eed1d921afb5

          SHA1

          af1463a499f7d6eed5efcb9c9515e82335e9c1b6

          SHA256

          6707043f0b609a0b3677cd11f6526d8ecfcbeab079a394019d648c9039e7da21

          SHA512

          e4688d2264dda88e90beeb394adc48064012ed458ab9015ecef744a86ab76b4f65845f77a3d02b131aa5c342e6a572f79f471b5dc8df178b2d7483c04b1f4763

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\ucrtbase.dll

          Filesize

          1011KB

          MD5

          849959a003fa63c5a42ae87929fcd18b

          SHA1

          d1b80b3265e31a2b5d8d7da6183146bbd5fb791b

          SHA256

          6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232

          SHA512

          64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\vcruntime140.dll

          Filesize

          95KB

          MD5

          7415c1cc63a0c46983e2a32581daefee

          SHA1

          5f8534d79c84ac45ad09b5a702c8c5c288eae240

          SHA256

          475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

          SHA512

          3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\vcruntime140_1.dll

          Filesize

          36KB

          MD5

          fcda37abd3d9e9d8170cd1cd15bf9d3f

          SHA1

          b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2

          SHA256

          0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6

          SHA512

          de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\verify.dll

          Filesize

          55KB

          MD5

          82bb3a2292372acbf8bb25e30a3e169c

          SHA1

          c09c134561213cd67c670f60a2c52cf947e51a74

          SHA256

          9c99e6591c73eda0dfd6bb9a55d0a175cf5bdb583115477cedc627fd793c3deb

          SHA512

          db4802fe0e3a6dc1678765af559e9c1f6e8639dd5c7c8f18f08296b1b4d15cfe748e391459253a3dde0ca2bda74c6772af262e5b194c78c6bdefbcc2c5377db7

        • \Users\Admin\AppData\Local\.soarclient\jre-1.8.0_381\bin\zip.dll

          Filesize

          87KB

          MD5

          0d56a7ff632826362768b3edd5e5174f

          SHA1

          8b96856f8fe3175039d1a7cf3ac0910467844a08

          SHA256

          27cf17beab60d7f9a62aac7622eefa06eee78796db585f9ae5d3a5b5022d56a9

          SHA512

          b4fe51874b9ba7a2325ae3c0b96f32065f7cee7c846a9028495070f1f91cedd9445cb91248acd1ec134a72b2c07e49afcaef01b58af1dfb0ff417033c2d0e595

        • \Users\Admin\AppData\Local\Temp\is-5NPJE.tmp\Soar Installer.tmp

          Filesize

          3.1MB

          MD5

          c7ff15e1725048e7650f873cd9d9f530

          SHA1

          008d4f3fea7318b50fd27337cfd335eac27f307a

          SHA256

          22de764c66e6bc53e7dc380d483027fba1ef44cb9133e231127bed4d49a4f657

          SHA512

          faaf142a52a03d4a43627e4a31b80ecd6b3c64c64ef62fb6c5eab7916d8f0025aeb2e5b960a0e437f6b68a0e82cc44baab316d3aa621f333d105bf410c98c530

        • memory/572-663-0x0000000000E80000-0x0000000000ED4000-memory.dmp

          Filesize

          336KB

        • memory/572-676-0x0000000074440000-0x0000000074B2E000-memory.dmp

          Filesize

          6.9MB

        • memory/572-664-0x0000000074440000-0x0000000074B2E000-memory.dmp

          Filesize

          6.9MB

        • memory/1012-738-0x0000000002260000-0x0000000003260000-memory.dmp

          Filesize

          16.0MB

        • memory/1012-737-0x00000000001B0000-0x00000000001B1000-memory.dmp

          Filesize

          4KB

        • memory/1012-729-0x0000000002260000-0x0000000003260000-memory.dmp

          Filesize

          16.0MB

        • memory/2300-63-0x0000000000400000-0x00000000004D8000-memory.dmp

          Filesize

          864KB

        • memory/2300-54-0x0000000000400000-0x00000000004D8000-memory.dmp

          Filesize

          864KB

        • memory/2300-667-0x0000000000400000-0x00000000004D8000-memory.dmp

          Filesize

          864KB

        • memory/2368-176-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB

        • memory/2368-666-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB

        • memory/2368-658-0x0000000000400000-0x000000000071C000-memory.dmp

          Filesize

          3.1MB

        • memory/2368-185-0x0000000000250000-0x0000000000251000-memory.dmp

          Filesize

          4KB

        • memory/2368-61-0x0000000000250000-0x0000000000251000-memory.dmp

          Filesize

          4KB