300fe6224578b1254a43444f7e1783dd608a6c065d4e6089e7560e719fc787b2

Analysis

max time kernel
150s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sogoutb_setup_pp365sosoft08mini.exe
Size

278KB
MD5

92b357a9f68dfa0258054e456abbc7d9
SHA1

c73faf7d44f0ffc916822d6f5f31b2c83805a46a
SHA256

c131b74cb45585d0cd4fceee3ac98f7a0a5ac1679da9f38e6723d8915ea5ae26
SHA512

06330dc13a4ebcb6d0560ca81c53767e36a79d4f43be18d0175d201fd4c866d4f856b7afcedac30f1516717427f02c5633ebeac1a94a96ab7da02d4ec3ffce52
SSDEEP

6144:fPC9FFCLep04dvAg3BF0N0xi2Gm09w+uTK4wai/KmgHxaoHjgOA:XC/uemsVLOWnGeVmcagMOA

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2564	p2psvr.exe
2544	p2psvr.exe
1844	p2psvr.exe
1796	skinpacker.exe

Loads dropped DLL 22 IoCs

pid	Process
2228	sogoutb_setup_pp365sosoft08mini.exe
2228	sogoutb_setup_pp365sosoft08mini.exe
2228	sogoutb_setup_pp365sosoft08mini.exe
2228	sogoutb_setup_pp365sosoft08mini.exe
2228	sogoutb_setup_pp365sosoft08mini.exe
2564	p2psvr.exe
2564	p2psvr.exe
2564	p2psvr.exe
2228	sogoutb_setup_pp365sosoft08mini.exe
2544	p2psvr.exe
2544	p2psvr.exe
2228	sogoutb_setup_pp365sosoft08mini.exe
2228	sogoutb_setup_pp365sosoft08mini.exe
1844	p2psvr.exe
1844	p2psvr.exe
1844	p2psvr.exe
2228	sogoutb_setup_pp365sosoft08mini.exe
2228	sogoutb_setup_pp365sosoft08mini.exe
1796	skinpacker.exe
1796	skinpacker.exe
1796	skinpacker.exe
1796	skinpacker.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral31/memory/2228-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral31/memory/2228-382-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	p2psvr.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\ec3dbd81-fe29-4312-83ab-2af6a79ca3f1.ico	skinpacker.exe
File created	C:\Program Files (x86)\P4P\PLUGINS\85190a08-7b40-46d1-ab1f-0436c6e906e2.ico	skinpacker.exe
File opened for modification	C:\Program Files (x86)\P4P\ToolbarTMP.DLL	sogoutb_setup_pp365sosoft08mini.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\2.bmp	skinpacker.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\3.ini	skinpacker.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\8b57e939-74f3-4168-9281-67796df3a410.ico	skinpacker.exe
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\1.bmp	skinpacker.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\85190a08-7b40-46d1-ab1f-0436c6e906e2.ico	skinpacker.exe
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\theme.xml	skinpacker.exe
File created	C:\Program Files (x86)\P4P\Uninstall.exe	sogoutb_setup_pp365sosoft08mini.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\1.ini	skinpacker.exe
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\2.ini	skinpacker.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\theme.xml	skinpacker.exe
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\8b57e939-74f3-4168-9281-67796df3a410.ico	skinpacker.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\c1ba2e53-3bfa-4426-9765-00459c0b8a25.ico	skinpacker.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\ec3dbd81-fe29-4312-83ab-2af6a79ca3f1.ico	skinpacker.exe
File created	C:\Program Files (x86)\P4P\PLUGINS\c1ba2e53-3bfa-4426-9765-00459c0b8a25.ico	skinpacker.exe
File created	C:\Program Files (x86)\P4P\skinpacker.exe	sogoutb_setup_pp365sosoft08mini.exe
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\1.ini	skinpacker.exe
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\4.ini	skinpacker.exe
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\85190a08-7b40-46d1-ab1f-0436c6e906e2.ico	skinpacker.exe
File created	C:\Program Files (x86)\P4P\p2psvr.exe	sogoutb_setup_pp365sosoft08mini.exe
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\c1ba2e53-3bfa-4426-9765-00459c0b8a25.ico	skinpacker.exe
File opened for modification	C:\Program Files (x86)\P4P\PLUGINS\ec3dbd81-fe29-4312-83ab-2af6a79ca3f1.ico	skinpacker.exe
File created	C:\Program Files (x86)\P4P\PLUGINS\8b57e939-74f3-4168-9281-67796df3a410.ico	skinpacker.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\4.ini	skinpacker.exe
File created	C:\Program Files (x86)\P4P\00000000-0000-0000-0000-000000000000.zip	sogoutb_setup_pp365sosoft08mini.exe
File created	C:\Program Files (x86)\P4P\ToolbarTMP.DLL	sogoutb_setup_pp365sosoft08mini.exe
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\2.bmp	skinpacker.exe
File created	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\3.ini	skinpacker.exe
File created	C:\Program Files (x86)\P4P\ToolBar.dll	sogoutb_setup_pp365sosoft08mini.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\1.bmp	skinpacker.exe
File opened for modification	C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\2.ini	skinpacker.exe
File created	C:\Program Files (x86)\P4P\PLUGINS\ec3dbd81-fe29-4312-83ab-2af6a79ca3f1.ico	skinpacker.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C}	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C01DFB1-BBA7-11EE-A8F8-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412365531"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	p2psvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	p2psvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F7AA591-7DF8-4AD5-A55C-95E1BF8D6C47}\WpadDecisionReason = "1"	p2psvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	p2psvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	p2psvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	p2psvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	p2psvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	p2psvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	p2psvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	p2psvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	p2psvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	p2psvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F7AA591-7DF8-4AD5-A55C-95E1BF8D6C47}\16-6d-0b-90-f2-10	p2psvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-6d-0b-90-f2-10\WpadDecisionTime = 908de1d0b34fda01	p2psvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-6d-0b-90-f2-10\WpadDecision = "0"	p2psvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	p2psvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	p2psvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F7AA591-7DF8-4AD5-A55C-95E1BF8D6C47}	p2psvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F7AA591-7DF8-4AD5-A55C-95E1BF8D6C47}\WpadDecisionTime = 908de1d0b34fda01	p2psvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-6d-0b-90-f2-10	p2psvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	p2psvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F7AA591-7DF8-4AD5-A55C-95E1BF8D6C47}\WpadDecision = "0"	p2psvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F7AA591-7DF8-4AD5-A55C-95E1BF8D6C47}\WpadNetworkName = "Network 3"	p2psvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-6d-0b-90-f2-10\WpadDecisionReason = "1"	p2psvr.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C}	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C}\InprocServer32	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.IEPluginEB\CLSID	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08B13A8E-EB71-4421-B417-4EC0995D5BFC}	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08B13A8E-EB71-4421-B417-4EC0995D5BFC}\Programmable	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.WBHost.1\CLSID	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AA23B9D-99C0-4A41-A25D-58E806766680}\VersionIndependentProgID	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F0B68791-936D-490E-8CD9-A31022B55B35}\ = "IIEPluginTB"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09DE17B0-A527-4EEE-9C6E-2D7C2E9B505F}\ = "IDetector"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08B13A8E-EB71-4421-B417-4EC0995D5BFC}\Implemented Categories	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.WBHost\ = "WBHost Class"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D977D6A9-BE13-496D-9BE4-175DFAC12628}\VersionIndependentProgID	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D977D6A9-BE13-496D-9BE4-175DFAC12628}\TypeLib\ = "{4FFB0262-EB74-461F-BBC8-7818DF633687}"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4FFB0262-EB74-461F-BBC8-7818DF633687}\1.0\0	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90FD4B8B-CE76-48B8-909E-E4D3844727AB}	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23E150C2-00C7-46E6-A968-724D41B051D6}\TypeLib	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sogoutb.Detector.1	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.WBHost.1	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D977D6A9-BE13-496D-9BE4-175DFAC12628}\InprocServer32\ThreadingModel = "Apartment"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08B13A8E-EB71-4421-B417-4EC0995D5BFC}\ = "’È¹·Ö±Í¨³µ"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.WBExtension\ = "WBExtension Class"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D977D6A9-BE13-496D-9BE4-175DFAC12628}\InprocServer32\ = "C:\\Program Files (x86)\\P4P\\ToolBar.dll"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4FFB0262-EB74-461F-BBC8-7818DF633687}\1.0\FLAGS	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0B68791-936D-490E-8CD9-A31022B55B35}\TypeLib	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09DE17B0-A527-4EEE-9C6E-2D7C2E9B505F}\TypeLib\ = "{4FFB0262-EB74-461F-BBC8-7818DF633687}"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.IEPluginTB.1	sogoutb_setup_pp365sosoft08mini.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C}\ProgID	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D977D6A9-BE13-496D-9BE4-175DFAC12628}\ProgID\ = "Toolbar.WBExtension.1"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4FFB0262-EB74-461F-BBC8-7818DF633687}	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F0B68791-936D-490E-8CD9-A31022B55B35}\TypeLib\Version = "1.0"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90FD4B8B-CE76-48B8-909E-E4D3844727AB}\ = "IWBExtension"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sogoutb.Detector\CurVer	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.WBHost.1\CLSID\ = "{5AA23B9D-99C0-4A41-A25D-58E806766680}"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90FD4B8B-CE76-48B8-909E-E4D3844727AB}\TypeLib\ = "{4FFB0262-EB74-461F-BBC8-7818DF633687}"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23E150C2-00C7-46E6-A968-724D41B051D6}\ProxyStubClsid32	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C}\AppID	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.WBExtension.1\CLSID	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D9A6231-1550-4652-A353-48E2C9194B19}\ProxyStubClsid32	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D9A6231-1550-4652-A353-48E2C9194B19}\TypeLib\Version = "1.0"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{90FD4B8B-CE76-48B8-909E-E4D3844727AB}\ = "IWBExtension"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.IEPluginTB.1\ = "Sohu Toolbar"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.IEPluginTB\CLSID\ = "{DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C}"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.IEPluginEB.1\CLSID	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D9A6231-1550-4652-A353-48E2C9194B19}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09DE17B0-A527-4EEE-9C6E-2D7C2E9B505F}\ProxyStubClsid32	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DEEE7FE9-3E06-43EE-B04D-18866CD0AD9C}\AppID	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D977D6A9-BE13-496D-9BE4-175DFAC12628}\ProgID	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0B68791-936D-490E-8CD9-A31022B55B35}\TypeLib\ = "{4FFB0262-EB74-461F-BBC8-7818DF633687}"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23E150C2-00C7-46E6-A968-724D41B051D6}\TypeLib\ = "{4FFB0262-EB74-461F-BBC8-7818DF633687}"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sogoutb.Detector\ = "Detector Class"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D977D6A9-BE13-496D-9BE4-175DFAC12628}\VersionIndependentProgID\ = "Toolbar.WBExtension"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{09DE17B0-A527-4EEE-9C6E-2D7C2E9B505F}\TypeLib\Version = "1.0"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09DE17B0-A527-4EEE-9C6E-2D7C2E9B505F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.IEPluginEB.1\CLSID\ = "{08B13A8E-EB71-4421-B417-4EC0995D5BFC}"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08B13A8E-EB71-4421-B417-4EC0995D5BFC}\VersionIndependentProgID	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.WBHost\CLSID\ = "{5AA23B9D-99C0-4A41-A25D-58E806766680}"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AA23B9D-99C0-4A41-A25D-58E806766680}\ProgID	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AA23B9D-99C0-4A41-A25D-58E806766680}\AppID	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D977D6A9-BE13-496D-9BE4-175DFAC12628}\ = "WBExtension Class"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4FFB0262-EB74-461F-BBC8-7818DF633687}\1.0\0\win32\ = "C:\\Program Files (x86)\\P4P\\ToolBar.dll"	sogoutb_setup_pp365sosoft08mini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23E150C2-00C7-46E6-A968-724D41B051D6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{09DE17B0-A527-4EEE-9C6E-2D7C2E9B505F}\TypeLib	sogoutb_setup_pp365sosoft08mini.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C}\VersionIndependentProgID	sogoutb_setup_pp365sosoft08mini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar.WBHost\CurVer	sogoutb_setup_pp365sosoft08mini.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2228	sogoutb_setup_pp365sosoft08mini.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2228	sogoutb_setup_pp365sosoft08mini.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1796	skinpacker.exe
Token: SeBackupPrivilege	1796	skinpacker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2680	2672	iexplore.exe	29
PID 2672 wrote to memory of 2680	2672	iexplore.exe	29
PID 2672 wrote to memory of 2680	2672	iexplore.exe	29
PID 2672 wrote to memory of 2680	2672	iexplore.exe	29
PID 2672 wrote to memory of 2680	2672	iexplore.exe	29
PID 2672 wrote to memory of 2680	2672	iexplore.exe	29
PID 2672 wrote to memory of 2680	2672	iexplore.exe	29
PID 2228 wrote to memory of 2564	2228	sogoutb_setup_pp365sosoft08mini.exe	30
PID 2228 wrote to memory of 2564	2228	sogoutb_setup_pp365sosoft08mini.exe	30
PID 2228 wrote to memory of 2564	2228	sogoutb_setup_pp365sosoft08mini.exe	30
PID 2228 wrote to memory of 2564	2228	sogoutb_setup_pp365sosoft08mini.exe	30
PID 2228 wrote to memory of 2564	2228	sogoutb_setup_pp365sosoft08mini.exe	30
PID 2228 wrote to memory of 2564	2228	sogoutb_setup_pp365sosoft08mini.exe	30
PID 2228 wrote to memory of 2564	2228	sogoutb_setup_pp365sosoft08mini.exe	30
PID 2228 wrote to memory of 1844	2228	sogoutb_setup_pp365sosoft08mini.exe	32
PID 2228 wrote to memory of 1844	2228	sogoutb_setup_pp365sosoft08mini.exe	32
PID 2228 wrote to memory of 1844	2228	sogoutb_setup_pp365sosoft08mini.exe	32
PID 2228 wrote to memory of 1844	2228	sogoutb_setup_pp365sosoft08mini.exe	32
PID 2228 wrote to memory of 1844	2228	sogoutb_setup_pp365sosoft08mini.exe	32
PID 2228 wrote to memory of 1844	2228	sogoutb_setup_pp365sosoft08mini.exe	32
PID 2228 wrote to memory of 1844	2228	sogoutb_setup_pp365sosoft08mini.exe	32
PID 2228 wrote to memory of 1796	2228	sogoutb_setup_pp365sosoft08mini.exe	33
PID 2228 wrote to memory of 1796	2228	sogoutb_setup_pp365sosoft08mini.exe	33
PID 2228 wrote to memory of 1796	2228	sogoutb_setup_pp365sosoft08mini.exe	33
PID 2228 wrote to memory of 1796	2228	sogoutb_setup_pp365sosoft08mini.exe	33
PID 2228 wrote to memory of 1796	2228	sogoutb_setup_pp365sosoft08mini.exe	33
PID 2228 wrote to memory of 1796	2228	sogoutb_setup_pp365sosoft08mini.exe	33
PID 2228 wrote to memory of 1796	2228	sogoutb_setup_pp365sosoft08mini.exe	33

C:\Users\Admin\AppData\Local\Temp\sogoutb_setup_pp365sosoft08mini.exe
"C:\Users\Admin\AppData\Local\Temp\sogoutb_setup_pp365sosoft08mini.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\P4P\p2psvr.exe
  "C:\Program Files (x86)\P4P\p2psvr.exe" -i
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2564
- C:\Program Files (x86)\P4P\p2psvr.exe
  "C:\Program Files (x86)\P4P\p2psvr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1844
- C:\Program Files (x86)\P4P\skinpacker.exe
  "C:\Program Files (x86)\P4P\skinpacker.exe" -g 00000000-0000-0000-0000-000000000000 -x
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1796

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

C:\Program Files (x86)\P4P\p2psvr.exe
"C:\Program Files (x86)\P4P\p2psvr.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\P4P\00000000-0000-0000-0000-000000000000.zip

Filesize
8KB

MD5
3741bd383ef59274a868180fde3f5396

SHA1
be5abeb24d75dc5bc2121ba6b3ac01e809867822

SHA256
d1daef358e080e7cc93e59bf0ea650da71817dca658690704f5ed5a42910ce32

SHA512
a63208b120adb1030c6815dba758904623de1820589e649810608330a00dd89958a2efc726bd7bb7a5698ac7f5ad09d28313f7992342b9c1189687f8ed8e6765

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\1.bmp

Filesize
852B

MD5
cd17af59183b795f5b7c62506df9c07b

SHA1
0ddf98505dc3d2168136bf515eed48577a2fa8dd

SHA256
4f9aa334d45c23933cbaa167d6b26860f800f0a15bbf1b3051df86058fd23899

SHA512
47626025f0d92ef66433d6a3c8d2700c320be7b5619bad397df6083a5601c563438c22fc0d436183fcf8f738f0893fcf6e937c93c17c04b17115480d617cf834

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\2.bmp

Filesize
5KB

MD5
a647055a592d648769c9ba8507120202

SHA1
9c49f94d1f8ca4287f84061231363b8abfd03590

SHA256
ca5dadc746f3680b7cf464e72297fe62d1b9e72ca6751f8ff85bb52ea234bb4e

SHA512
c8c85cd73a98e9728bd7e61304c6645855b2bc678d5324945096022ad843c25b702f0975230762d7c10c3893417eee7e730148b901a0cb75b692e686cef1db48

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\1.ini

Filesize
564B

MD5
3067a2a1a50fad9dec2f9656a55247fc

SHA1
861e6a85ea81eb803ab6d17d35e6029a204a1aa6

SHA256
27a0f338157f9fdfb624fda51fcaffb9650be990cdcfdce6781f947e04a8cedc

SHA512
c68b7fd2bc33146252bfcba31a9c76b994d9d5271a72c54c1b0cf756b454b5a94bba67f1f33b19f40206e326da46b651ed7c87fc122826c03c0bc8d9b1e7a97b

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\2.ini

Filesize
590B

MD5
62e03e40eccfcc56babf554ee4c5f5cc

SHA1
3bf7d3fc3bfc90a777fb22467f7b5baf46638aab

SHA256
8ebbb2ee0cb8c26ccc4b74d2d6f0230c7e4e609dbf216a36fc651a0f4444a0cb

SHA512
0fb81a4603325bfc64d6d17797643ca4f63fa671b0a9b72039365f30e40e0d65e8c189f91585a42699aa846fd15805ea2487e7ec02b90d4c630c1b730c25ef0d

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\3.ini

Filesize
446B

MD5
bf6e47dcf5bc9abb96239b5b778b4f6f

SHA1
78fa7761752ff321bd30bb39fac223a506324bcf

SHA256
22bafe56038fe4adb2f9457721702787f0cb171124676d43fdc62d30338975f7

SHA512
25e2f7d3664928e9d9ab064c89410c7a3ceee2ad70f88ed021e07edfd11a804e9b1932952f5b67588e9403bb0fd889794bf8dc65433fa83ef3720289f663bdfb

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\4.ini

Filesize
452B

MD5
89860f4006026169278cfe36dc745b67

SHA1
5f3bf88632a6c0507efcd0f65d525b5edc5b60a3

SHA256
95a21642ed26d8e4412b18a660915a1ec47eb5ac2f1979e02cf043f1c159ff08

SHA512
f94432a716aebee7987d1474550401404c822639fd349537bb285c66516892df64b2588a9e9b13a800e6caa637a4490d69b64dbb963ccfbbf70728d4241cf40c

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\85190a08-7b40-46d1-ab1f-0436c6e906e2.ico

Filesize
1KB

MD5
3bd6a747b310effffd7aa8e7d5fba48f

SHA1
cb08b8a43ece74cc6d86dce2ba78bebe1322c456

SHA256
227422a09a262080194b031e2ca0691056c9bbe977003b78f8357420a1651705

SHA512
0e29c30931a5bb9777689a249476a1ddb79db2e431918f89599c0967a404d0c81bdc1a44caf4577292d95e16f41d02bc7faafcff762ab39a1a0516e037981730

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\8b57e939-74f3-4168-9281-67796df3a410.ico

Filesize
1KB

MD5
b68a9f21e3b45ed05f093c327ab4892a

SHA1
173fe1fd9c436ae81a45bd6a37bfa5fed315d0e2

SHA256
b446f849d73776508b015b925ecc1b04af5e3f04c0e95c9086f1abc8f15eadbb

SHA512
892ae348b441ffcfd5c925a7ebf0ad19168acb876e82939fa2ef65eeaf1538298d28a487c07cb05ab69067dd43bfe3a2dcf2868d0a22d2324351e272365c3038

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\c1ba2e53-3bfa-4426-9765-00459c0b8a25.ico

Filesize
1KB

MD5
b18f780f7347300cb95c0ae89b125cc6

SHA1
e6c7f08697a9efa45d4bc08ce13a3b1a6169b7e5

SHA256
a5a57de5e5cab4adcc945fa34d5c23c0dd350d7615b73ccf21ffc806209b933a

SHA512
d51584c4dbca10f464283886cc4b8b42b18851810b0f59265ba72f02f7e2f0c858d61db42ab81fec6b67b71525ce976e24b7da6d38703362027aec8be5a568ad

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\Plugins\ec3dbd81-fe29-4312-83ab-2af6a79ca3f1.ico

Filesize
1KB

MD5
6c8360ea81447da8fa1524f445d8eb4b

SHA1
f4870a577bb016e29bd9271a9551024244a2d451

SHA256
68b79c5eaa057c7a5e6f8be86c81495e773482a67708e0c9540aaa1078c2acfc

SHA512
d24240ca6f66d98f09783d4a13d033c80d7718bcc06e7207116613829fe99cbe046b0f9e2b22908d5a743ed657275d7ee52be43d8bcd923416d266b439b259de

Download Submit
C:\Program Files (x86)\P4P\theme\00000000-0000-0000-0000-000000000000\theme.xml

Filesize
882B

MD5
77b7208d2e9aed3881206a1b81cefb34

SHA1
5580bb1c8d7b5a1f193da3f7442dc943aa8db9e9

SHA256
0d818d48686cce4760c5059f85d3c09c207c2c4239e0ac3708162f37e20acf9b

SHA512
f19c88c2facd68a266b2476b76397a71fcb38b4d831ec6f55fe239c192700ade34ddb8bcba80c4f71eb1720441f016b12938f244645c9d0efe3379a0245209e3

Download Submit
C:\Program Files (x86)\P4P\toolbar.dll

Filesize
192KB

MD5
a8411f65aa2e3dac7fd76aa89b184893

SHA1
c983222f4c260e5f9aee7ca70545102fad92e925

SHA256
92cb047fd38bde2cbc36848bf968646d4927f395e043a84de303301bf2f1bba9

SHA512
7c0bc971db4f22a6a944f7e0fd963a3f2afe7c8adf18fd2c342932bf7386cf34bc113413a88406d521a630a439185b933c381d2a4aa7223092bca4aef698507d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
150b704629a775805140f4b8116e0700

SHA1
286f3e0bb779b7f05e8803005f314a7cc6ed1b5b

SHA256
b979188522680161b1330175edd21e480908a24f209426b6284b5145631bdd59

SHA512
f03ee42d8054fcc87fc91970b8264651a7752072407ec34384673a0ff1867be33c27fc8d7ca8a795715d3a504ad655dbb33f03bbc05c7911dc9948c889ae845f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a854094ee3ae0be74c35c36cd8da206

SHA1
feaa2fe5c00936ad8ad39bb7693a4a1897af3635

SHA256
255a5f39057e268647d32629255c6a97dde43b6a7e1f5e3d1aab8c2f44e9a8cc

SHA512
5b89b0fd180c01c2866324f736e581717e04167c9e1313a9eda4ad0e2a2ff4189870d1ae1908be925b2c8f17aa74e54f4f443fcebe73583a900e4b938769ee31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dac966e3f7c185cca689a3ed949fba87

SHA1
e934a0bceb265dec9acd72670edc0d9018547708

SHA256
ddcfbd74f5670b0b9236bc0dc642893a043b5a2bf0ea395ed6268582da6d9a00

SHA512
da2b3c50d796026d72177bdb43364451ed886ec77f85565d5f85bbfb5b19419123690aed928a3181828ef927a82bf83423273f038f5704dbab9bbaa46fc4cbf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3890501d5d11abbd0efc44d593ed355b

SHA1
c0b089c334169e17827dae4a27f6ef366b061e23

SHA256
2baa8eef7eb91a48a975adb199ac09b9ebcbce5182d3bd46a032ffeade01eb56

SHA512
8a1ddb297e1083a29ea2b68a368246e7868165c36634b15b6c68dd18644a26174e6cc7612f59deb34ef5312a7c4e821e947ad5554aacfa3aa3a307d09e9fc82a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
831312afdc962e4952d12783989dec70

SHA1
5b0464429dd9e823deb3d6a64f3d7b57072eccc3

SHA256
6a5f42755e24699e558203d900a73a81dd44fbe1f22dfc7a0b925d9cd88aeb61

SHA512
704ca2e5397e36b111994c0d251c43925035d5f6d228a5f9583e0eead7a57069f97a4f5ef44de33b0bbb255395986f947b4c8ab061ded5bee59f3ba8221f5990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8619dbff34b1d6a825de2a4d61c220f4

SHA1
f16b413f2031052b3333b0f3650934d14633aa91

SHA256
222f02530fd0f0da8df179683c2191ee3d8e65b11e762240ad7ad37b78eb3574

SHA512
13293a4fa1587102b5b8087488398439fab5463f8b360d21cde167fd5ace96817da5cb2fd2bfac04bfce1e15a8c05ead21022e67c1f3c6b73c03c8234140e2a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7475fe3409fb19e1601adab8bc47a4cb

SHA1
fcb7ffbdbbcb62c6061430ab37518d5a2a560c52

SHA256
86252080981b56118d878fa66c2c7f631054ba11766f742e797879e66c86ea6c

SHA512
8179adc6f7146c840e2255ffffb1522b7f686ddb1cd06be4bba7562219a602704991a00d352711e31ff0969c5d2cae1462a71ed52378fd2a119dcc9f2b03a835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bf75c24d467127c963ed08994f9317d

SHA1
314c1d2259d8250bdd9bee589b4b4d0e23eeceb5

SHA256
28cc326fc5e0485fde5f8131007584d8d51f1fe8e4e13cce907469fad2b7d1e5

SHA512
83aa9038b2014a2ad6c3f3e4081015a547336bcde1eb17aafddface6470971f7d8010d2361c2f6f8f0c197863f1d01e84e9e3fc227a89a9c4d027072f00a38a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff81c401fa32a6fcaabb1d7ff6bc99d4

SHA1
b2d5bb345843fcf4dbee3e3b4d0cc55af31e8942

SHA256
6df4c3653a96c0b3197b2a391c5d60ef27723f876c98528071818a6946a9ece5

SHA512
c6d686cbaecbe5fd4845dc1ece46b429192e1eb76da6846876d91eafeb739fae5d8ebfceefff1c2b85d05a29fab31edee560246ad22d4a9a07674e33aa84874d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4FC7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5037.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Program Files (x86)\P4P\ToolBar.dll

Filesize
368KB

MD5
ecd46f74c062a44f2d1a891b3a232bd3

SHA1
69a1b6919dfc959624fbbf20ab941e5b1c78c26a

SHA256
465e5736d0883d293beadf51fc1f76b8f63f28a1048230db76618fa95925c825

SHA512
285a94542a620d57b7131e641d46594b8897971d080bbbdbc9f4fc8ee09ec66e2676fead46e6fba6b9e20179181033d5a6c47237b71aed3079351efe0a027e31

Download Submit
\Program Files (x86)\P4P\ToolBar.dll

Filesize
165KB

MD5
46265c95920739b1143b1a99ecfe6b07

SHA1
bbd418e9a26d3372552497e9b26273571f636f9a

SHA256
c8649e64f73c3c3e54f7ecd3ea862ce34bb12484cf8b7a30b303f9d5c31dd2d1

SHA512
9d5725d625f2421e3090a8ea35cff743ceecb1d8b5adbae3c02766797bb649b309441aad9e6ccc080c44fbef1ca3db1e6e6eac8e50f3a4e40ae26f6f75e9a387

Download Submit
\Program Files (x86)\P4P\ToolBar.dll

Filesize
118KB

MD5
7d8c8e6afc80161858034d645eb0cc26

SHA1
9098b31eb747a8ed20d3a386808093a37d510c06

SHA256
e29ddfc40bbdbbba108905fc489ce1f29e34e610431ff1a17c9619ce01540679

SHA512
8bd8ee9be1c3c0b7d8c0f15d2d6705c5727171708267a4b10ee37855e11eea39ddbe99049a591533a328e8bfae3ed8f90c3cbe5f103f9467d551d04b1d2d23a8

Download Submit
\Program Files (x86)\P4P\p2psvr.exe

Filesize
88KB

MD5
0d179cdd9880a200a8b173be60e6cd83

SHA1
166a298fcbba0498013084668a74991f29d7e895

SHA256
feb33749950db4435f243c14b9c2764eb60d1db73f77dc8c9eee94151b577854

SHA512
07be3e9eade2b5f7f6ea96273b8efc5eac3617f9c29ea16a0f34cd15fb4161d1be36ed50263ac3b4a152fc16a8fceb33695880e2b96175d5795d7e27e557768e

Download Submit
\Program Files (x86)\P4P\skinpacker.exe

Filesize
80KB

MD5
1dcc2e157e33c273a0dd0baa2e31a5b8

SHA1
2467bb699e58a3b8f625e608611401a44617f249

SHA256
e4a8aea075037aa152190c9ac65e619aac505745566594363ae7d030685b6a4d

SHA512
2b5b33f7fc56f461564b903ac674a4dd1109035d021effb5a04fbf4254f6f873cfdc71c45275b60e8999dc0035eab9ff03cae86685edd1802b869f95fabe0ed5

Download Submit
\Users\Admin\AppData\Local\Temp\nsy4DD4.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
\Users\Admin\AppData\Local\Temp\nsy4DD4.tmp\nsSCM.dll

Filesize
5KB

MD5
96c2f66086aff56cb2b4d3acced2f378

SHA1
36e27b9df1e1b02b90be2dfe302520a78b2f96d5

SHA256
2f19ca93b60542fa814d41238f1b79ad450bf935fc0f45127c5a403283790dc4

SHA512
ac616cdd2e6c59cf088891a9b450f4d5607747b2ca5184f191d4ff81a19e87dadd4185ca16533165f0dc255aae6e19c17e0670ceed5bcce8271746809d7ceacd

Download Submit
memory/2228-18-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/2228-384-0x0000000000240000-0x0000000000274000-memory.dmp

Filesize
208KB

Download
memory/2228-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2228-1-0x0000000000240000-0x0000000000274000-memory.dmp

Filesize
208KB

Download
memory/2228-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download