9f330b9235b7e96e57ffc3aebbb08573f2824e895889a96a650de9316a959f0d

Analysis

max time kernel
149s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UgPhone_install_1.1.23.exe
Size

79.6MB
MD5

8fe50abc9f6a05586be2253d9814d564
SHA1

63ffb05f2d98403920e5a9b1846c47711a5583d3
SHA256

9f330b9235b7e96e57ffc3aebbb08573f2824e895889a96a650de9316a959f0d
SHA512

2027dd167a715c9b54163a8396ad8a2a882fb71b4d6cc4baa4ecc14d1c965edb9a2268c1f9dda61071230ff3b59e0f97cf5afe5f69a136446ad3a5180f56b441
SSDEEP

1572864:Liqs0X+0qrRboEWrLjZ+x2/9unv0JL0KZ8KVZ532yKdisTKuRuqAh:Liqs0XxqrRkE26k8v6feKV+yKAs2uXAh

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UgPhone.exeUgPhone.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	UgPhone.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	UgPhone.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 5 IoCs

Processes:

UgPhone.exeUgPhone.exeUgPhone.exeUgPhone.exeUgPhone.exe

pid process

2112 UgPhone.exe
1584 UgPhone.exe
2996 UgPhone.exe
3536 UgPhone.exe
3044 UgPhone.exe

pid	process
2112	UgPhone.exe
1584	UgPhone.exe
2996	UgPhone.exe
3536	UgPhone.exe
3044	UgPhone.exe

Loads dropped DLL 15 IoCs

Processes:

UgPhone_install_1.1.23.exeUgPhone.exeUgPhone.exeUgPhone.exeUgPhone.exeUgPhone.exe

pid	process
3688	UgPhone_install_1.1.23.exe
3688	UgPhone_install_1.1.23.exe
3688	UgPhone_install_1.1.23.exe
3688	UgPhone_install_1.1.23.exe
3688	UgPhone_install_1.1.23.exe
3688	UgPhone_install_1.1.23.exe
3688	UgPhone_install_1.1.23.exe
2112	UgPhone.exe
1584	UgPhone.exe
1584	UgPhone.exe
1584	UgPhone.exe
1584	UgPhone.exe
2996	UgPhone.exe
3536	UgPhone.exe
3044	UgPhone.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2884 tasklist.exe

pid	process
2884	tasklist.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

UgPhone_install_1.1.23.exetasklist.exeUgPhone.exeUgPhone.exe

pid	process
3688	UgPhone_install_1.1.23.exe
3688	UgPhone_install_1.1.23.exe
2884	tasklist.exe
2884	tasklist.exe
2996	UgPhone.exe
2996	UgPhone.exe
3044	UgPhone.exe
3044	UgPhone.exe
3044	UgPhone.exe
3044	UgPhone.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tasklist.exeUgPhone_install_1.1.23.exe

description pid process

Token: SeDebugPrivilege 2884 tasklist.exe
Token: SeSecurityPrivilege 3688 UgPhone_install_1.1.23.exe

description	pid	process
Token: SeDebugPrivilege	2884	tasklist.exe
Token: SeSecurityPrivilege	3688	UgPhone_install_1.1.23.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

UgPhone_install_1.1.23.execmd.exeUgPhone.exe

description	pid	process	target process
PID 3688 wrote to memory of 2712	3688	UgPhone_install_1.1.23.exe	cmd.exe
PID 3688 wrote to memory of 2712	3688	UgPhone_install_1.1.23.exe	cmd.exe
PID 3688 wrote to memory of 2712	3688	UgPhone_install_1.1.23.exe	cmd.exe
PID 2712 wrote to memory of 2884	2712	cmd.exe	tasklist.exe
PID 2712 wrote to memory of 2884	2712	cmd.exe	tasklist.exe
PID 2712 wrote to memory of 2884	2712	cmd.exe	tasklist.exe
PID 2712 wrote to memory of 2696	2712	cmd.exe	find.exe
PID 2712 wrote to memory of 2696	2712	cmd.exe	find.exe
PID 2712 wrote to memory of 2696	2712	cmd.exe	find.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 1584	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2996	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 2996	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 3536	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 3536	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 3044	2112	UgPhone.exe	UgPhone.exe
PID 2112 wrote to memory of 3044	2112	UgPhone.exe	UgPhone.exe

C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe
"C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq UgPhone.exe" | find "UgPhone.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq UgPhone.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\Windows\SysWOW64\find.exe
    find "UgPhone.exe"
    3⤵
    PID:2696

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
  "C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1620,13061260878991712084,8577989614005303757,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1628 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1584
- C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
  "C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=renderer --field-trial-handle=1620,13061260878991712084,8577989614005303757,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2996
- C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
  "C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,13061260878991712084,8577989614005303757,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3536
- C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
  "C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1620,13061260878991712084,8577989614005303757,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1448 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_100_percent.pak

Filesize
138KB

MD5
03aaa4f8525ba4b3e30d2a02cb40ab7a

SHA1
dd9ae5f8b56d317c71d0a0a738f5d4a320a02085

SHA256
c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7

SHA512
c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_200_percent.pak

Filesize
202KB

MD5
7d4f330a5443eadf32e041c63e7e70ad

SHA1
26ce6fb98c0f28f508d7b88cf94a442b81e80c88

SHA256
b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d

SHA512
f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\d3dcompiler_47.dll

Filesize
4.3MB

MD5
7641e39b7da4077084d2afe7c31032e0

SHA1
2256644f69435ff2fee76deb04d918083960d1eb

SHA256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

SHA512
8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\ffmpeg.dll

Filesize
2.6MB

MD5
c42523771879bdd3f754fbcf2f5d787a

SHA1
55f9496131ba56a00526d92fce1c8b8d669b08c8

SHA256
ce52b08fffbaa142e6c7a376333991086ad5b37a5c1ed7cfcc8ff5c851b3d200

SHA512
ad980e459a86a8d7773cfd19b3b96ecc030a612463e534b2ba250cd15534ecbcea8af0038896dc65069fc66dfcd2b3a7df1471189f448267073a3bba2287116e

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\icudtl.dat

Filesize
9.9MB

MD5
80a7528515595d8b0bf99a477a7eff0d

SHA1
fde9a195fc5a6a23ec82b8594f958cfcf3159437

SHA256
6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b

SHA512
c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\libEGL.dll

Filesize
429KB

MD5
f3c8fea015b42bac6bdc0ddd3eb0b313

SHA1
176d3bfd15d22835e6bdecb7c39f13e4a29676a4

SHA256
b2d3d398331aee75646b12d94a1a1d383babce09c3c6a3303dd226944c8883d1

SHA512
30072eafd2c3f4a905c40d29cc755b6f50a9357d934f327c0479b15987736699bf443280fc0f6838ad147e2f23c1fbb123e2055756fce7402fdbd11b32a1f7bd

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\libGLESv2.dll

Filesize
7.6MB

MD5
7969ee5f940eb49840749fbbd4358c44

SHA1
12d827c416ad82f5f622e67683f2f7df65e809e4

SHA256
d8e62dd81dab676139e9e8d7a3ec32bfb07fd5ea66a3ac510c70b5d5d98033b4

SHA512
e0a398d7c7aa44fb01fe39ced317e4706806d3b45fbfa127491e27843efa0093870ea9d82874aec3a9896a6400ce8f40902376069cfa1ee9b130e74d90124395

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\locales\en-US.pak

Filesize
88KB

MD5
af5c77e1d94dc4f772cb641bd310bc87

SHA1
0ceeb456e2601e22d873250bcc713bab573f2247

SHA256
781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4

SHA512
8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources.pak

Filesize
4.9MB

MD5
1f95be6a00b153fd2ba5b149c21e3c25

SHA1
d955b861c86e1d3de73024b3383aa11264c87ba4

SHA256
f4ea4113a0da76d70f72bbef82374c4eb7e63936e3f6931cc56b27a7300f9715

SHA512
9bc4ee4344bcbcfca1f6e84606fd730b21e58adbdceb1e47ba23931ff59abdff67db368c912f63c51823a864b91e53699469d52ad9ad33301050d369e79d215e

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\v8_context_snapshot.bin

Filesize
161KB

MD5
8783eb563bab1d720f60f64d38f6ab69

SHA1
41c84e5f448969db07ce505aacad4fe574c9eb8e

SHA256
b53b12b15dbc62c6b1f7884ffacc97a261dfd12cbc5f447ffe270097847b418c

SHA512
f22ecdddf46a2c03f5b122f06a0a760e40b231df0b680b16a4555ec50be436e5921a77b4a15b67b0785aadbb39312fdd361c91f6ee9c47aaa7412b799a003fce

Download Submit
C:\Users\Admin\AppData\Local\Temp\39cf6da1-29e8-434b-ac85-0589f77a8fe2.tmp.ico

Filesize
264KB

MD5
95869702267b1748d648dc6cb57bcf3c

SHA1
89804bd5f6a8b38863e552d0844e21a6fae30b56

SHA256
6c9331e79dabb563d694eaed56450f5b095bf71297d2f5f957b15f2fa729c02d

SHA512
387b9ca64d80a3abacc0c329f9fc5bd071b6479d880e273e6f7fddbc48186c7227ed6285dc0ebce17f8e7d7b7f3933bffe62462a95676e6b8af0578d7814ab1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk539F.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
memory/1584-236-0x00007FFA47B50000-0x00007FFA47B51000-memory.dmp

Filesize
4KB

Download
memory/1584-317-0x0000020F716A0000-0x0000020F71DDF000-memory.dmp

Filesize
7.2MB

Download