Analysis

  • max time kernel
    145s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    03-08-2024 12:00

General

  • Target

    VDeck Setup.exe

  • Size

    47.5MB

  • MD5

    2a63e2054769d84b26710bc65f378dbb

  • SHA1

    8b8eed631cdce7d1b3784d8b27bcea3e1835f4a8

  • SHA256

    c2a75fb224674bd4825034ecb647cb1d83f451bf5f3907e4465f7f73d97c6ad8

  • SHA512

    e3e6a9d88ab303abd745e5be4bc64f3f0b07c62eac4e408657dbe81fa635ce9e2bea87716edd34fdb32590a21803e865b48740985038503b4e6ff248900e5be8

  • SSDEEP

    786432:w05Iws7+lUI4i5PwrRJswginBlsGcuOE3W/4wfpwu94euy8XosV8q23yvjMEgn:w0Xzp4iirRJ1gB+OE3WAq594etE239Tn

Malware Config

Extracted

Family

stealc

Botnet

cloregod2

C2

http://45.156.27.196

Attributes
  • url_path

    /4c7ef30d4540070f.php

Signatures

  • Detects HijackLoader (aka IDAT Loader) 2 IoCs
  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 62 IoCs
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VDeck Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\VDeck Setup.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Program Files (x86)\VDeck\VDeck.exe
      "C:\Program Files (x86)\VDeck\VDeck.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2700
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2624
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2608
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2172
      • C:\Users\Admin\AppData\Local\Temp\f3b280c6-4b2f-47ff-a703-53ed70f3850f\snss1.exe
        "C:\Users\Admin\AppData\Local\Temp\f3b280c6-4b2f-47ff-a703-53ed70f3850f\snss1.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:612
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2388
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1892
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "" & del "C:\ProgramData\*.dll"" & exit
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3056
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 5
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:2384
      • C:\Users\Admin\AppData\Local\Temp\f3b280c6-4b2f-47ff-a703-53ed70f3850f\snss2.exe
        "C:\Users\Admin\AppData\Local\Temp\f3b280c6-4b2f-47ff-a703-53ed70f3850f\snss2.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2284
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\VDeck\Accessibility.dll

    Filesize

    20KB

    MD5

    fb554f9fe0b91f135d26ac6459cfd6f2

    SHA1

    b1269a2c28bded872b14fe70b69484631ef3a65d

    SHA256

    929ea150ad45b7c7dd5427461fbec44d43b67c08081f59b42b6abf570feae271

    SHA512

    8dffde6cddfc59ec380111fd36048126559e1f1e080c081ca0d09021bb23d6888e93e1659c7b3a8fa46f76602b03cf3e638ec1a80fba79e51648dcb32362e10c

  • C:\Program Files (x86)\VDeck\Microsoft.Win32.Primitives.dll

    Filesize

    15KB

    MD5

    300c95ff95b52e8a02fec6bfcfa58225

    SHA1

    b646f89fcd463ad5c19889b4fea40540568b780c

    SHA256

    f1b40565e5c4c41da810aee5b7d2272a0906e88f796812435aa5ed712bcac40c

    SHA512

    9bfe0eb6eea98b2d35aa42986a273ec82424143965e173b32bb4b7e5537580a027940a6952a45fc54f0b665e871deb2a95651106c2f24c7de3b3d3cd2dec7e89

  • C:\Program Files (x86)\VDeck\System.ComponentModel.EventBasedAsync.dll

    Filesize

    46KB

    MD5

    333639248121fb67d18323613a8203ea

    SHA1

    0cee5f7d46596239b833b3b30dccde27b0136959

    SHA256

    4c97d7bc0742faaa52ba86018b040aac44ddfc88a5835f9e6a659e03b4558999

    SHA512

    714fcb7299abcb26100b5f4103834c11c58f535ee9853fca2bcb22f43a3d1e7608d6ccae2dcc93d1687a4f1c8b521afe683d537f70f858681e62fff2d79c4acb

  • C:\Program Files (x86)\VDeck\System.ComponentModel.Primitives.dll

    Filesize

    78KB

    MD5

    1c59c00ab0850af4b4d2bafd6be47db3

    SHA1

    4c6185b2f42987e25a5fdf2aa30cf4150de25d5b

    SHA256

    133ec34432ab8fa4f63ade636193864b6a62a089a0c98d746f5532c8a52f437b

    SHA512

    8425c02c4afb274e862e4ed5dd1c766ebfa1bcf5bf59018d86238014a52603331a8b7c1e233f5a1f22171e90132ddd585db0d2561ff2cd287d703397afdff4b1

  • C:\Program Files (x86)\VDeck\System.ComponentModel.TypeConverter.dll

    Filesize

    726KB

    MD5

    f6f78df8a3ef64639ac0cb7de24ed66b

    SHA1

    384422c0ceb6bb6870c4f7d9074e9c78d33e4c0c

    SHA256

    88129c110d748f7c8ef8a923f68cd26d39e0505b49bf5cc10cbd23b92f1a00a3

    SHA512

    ed63f75e3477196b5308c42f259c0294a29ef5edf6eb0df4f8268be3f0495b9cfd8ca3467bc1574db142571c368940468bb84d14c26aaccacd6eee66ddd98403

  • C:\Program Files (x86)\VDeck\System.Diagnostics.FileVersionInfo.dll

    Filesize

    46KB

    MD5

    1daf75cc369569182bbdb664eb8cb4c7

    SHA1

    ec0ff43694f0027a469d31221b591bff2ef29d69

    SHA256

    92ae8401342fd8484e749c65a7726a0f5bff69346ad4e96026bfa063ff567b8b

    SHA512

    9d0ee9b59354f721136a1631e46d395b763f755b212e44daea5c62a91b4c5edfd218587c8aa56db27f7efc7b9678c59ea822964f279a7837aa5e12f46be4e79b

  • C:\Program Files (x86)\VDeck\System.Diagnostics.StackTrace.dll

    Filesize

    46KB

    MD5

    70c0d0120a96a30c980414f44bfe9d5e

    SHA1

    ad158543ae92c9b47e6290bab86b4cb5511b7029

    SHA256

    318eb3af0fda576d8094404185690b9570d576ea56e85c47251769c09de8035c

    SHA512

    42e9e048668b491a7fce4d5da6a2690f386c9d4d847b7ce0b2c70f743f615dc9917eafa5cc3d94f4e5803abe65d892c4f89d88ce8531b7d3c2b8c536d7d224da

  • C:\Program Files (x86)\VDeck\System.Diagnostics.TraceSource.dll

    Filesize

    142KB

    MD5

    fe6a4b96e144131788108c8396a849eb

    SHA1

    40e6e5d03cfe036645ae854d5a2262faec6bed32

    SHA256

    22365ee4e3ba3c991d495e41f92e29bf6ddb38a48c44f55651271b80ee62b6d1

    SHA512

    61644c0e970dd6a6ff697b110bf99962931dd94deda5a966ea0fded3d23cba7433b802656295e04f1a95421774ea3c838f0a642d26b5e46ae6c05becb52eb7f1

  • C:\Program Files (x86)\VDeck\System.Drawing.Common.dll

    Filesize

    1.5MB

    MD5

    e4715322db624dc52947a42ac67757ab

    SHA1

    ba0b0850142ecc3910927d6f2e5781b896d7d442

    SHA256

    75b1e772a4355145364121af00e5b5cf06c7212aa53d662fdc996bc11e8092a9

    SHA512

    3c86d44eb209a3a1f2001968a2b139e532a0513fd2decff04aa1bf8b30b6202c70fc0e7ac8b22ace563023671259cd74cf65062132e7f1b97d3580621686b05a

  • C:\Program Files (x86)\VDeck\System.Drawing.Primitives.dll

    Filesize

    130KB

    MD5

    b5ca10a41cc865048491f617678722a9

    SHA1

    afe171d9d676b78983b802e18ef8e00927073c64

    SHA256

    cbe9fbb1d1e4850460854474ffd8c01ddcc756dcb33a86d1674c0cb2e2a0b026

    SHA512

    2afdce56b7eec6deb82f8b2d5ec3029b5a0ee1e8bbf2e0ff9a0a5310bf265ddcdf63660546b4dbcc3c5fb0cba3cbb94f2408fe5cb4d14dbe0e74aba6dd5a2192

  • C:\Program Files (x86)\VDeck\System.Numerics.Vectors.dll

    Filesize

    15KB

    MD5

    b7adf99da15738c602df256e8a1aac4a

    SHA1

    ff98005dfcf40f876b618a599f227397f36915df

    SHA256

    2466f7df763b191a6b4a536eae1016394d81e175fc53cefe56b8ce27459412af

    SHA512

    8eb34d00f8149d688bd5efe2ffdc834f669fa8c30d4c265814647de78a55502805104ccc3682010b246d26d805004b188ab19ad59fc2e866103bbe191e2225ad

  • C:\Program Files (x86)\VDeck\System.Runtime.dll

    Filesize

    42KB

    MD5

    53501b2f33c210123a1a08a977d16b25

    SHA1

    354e358d7cf2a655e80c4e4a645733c3db0e7e4d

    SHA256

    1fc86ada2ec543a85b8a06a9470a7b5aaa91eb03cfe497a32cd52a1e043ea100

    SHA512

    9ef3b47ddd275de9dfb5ded34a69a74af2689ebcb34911f0e4ffef9e2faf409e2395c7730bce364b5668b2b3b3e05a7b5998586563fb15e22c223859b2e77796

  • C:\Program Files (x86)\VDeck\System.Security.Cryptography.Csp.dll

    Filesize

    15KB

    MD5

    c7f55dbc6f5090194c5907054779e982

    SHA1

    efa17e697b8cfd607c728608a3926eda7cd88238

    SHA256

    16bc1f72938d96deca5ce031a29a43552385674c83f07e4f91d387f5f01b8d0a

    SHA512

    ae0164273b04afdec2257ae30126a8b44d80ee52725009cc917d28d09fcfb19dfbbb3a817423e98af36f773015768fed9964331d992ad1830f6797b854c0c355

  • C:\Program Files (x86)\VDeck\System.Threading.Thread.dll

    Filesize

    15KB

    MD5

    72d839e793c4f3200d4c5a6d4aa28d20

    SHA1

    fbc25dd97b031a6faddd7e33bc500719e8eead19

    SHA256

    84c9a95609878542f00fe7da658f62d1a6943a43e6346af80d26bcff069a4dbd

    SHA512

    a414cd9d7cf6a04709f3bdbef0295349b845a8301171ed6394e97b9993f35816383b958736c814f91c359a783cca86ee04802856486d4b4e0ab90a45da39db1d

  • C:\Program Files (x86)\VDeck\System.Threading.dll

    Filesize

    82KB

    MD5

    32aa6e809d0ddb57806c6c23b584440e

    SHA1

    6bd651b9456f88a28f7054af475031afe52b7b64

    SHA256

    e8d1f5c422ee0ba3b235b22028ab92dc77c1ff9774edc0b940cad7224a30ba7d

    SHA512

    fe43b3d6ed5c37d59a44636d3c7522a88d83e6ec074bf69d3cbb6e5454fdd8f0523ea10fdf6fd452cbd0e2fc159cf9d03dfad6b30e80e400e7f1773b5a2e8632

  • C:\Program Files (x86)\VDeck\hostfxr.dll

    Filesize

    342KB

    MD5

    16532d13721ba4eac3ca60c29eefb16d

    SHA1

    f058d96f8e93b5291c07afdc1d891a8cc3edc9a0

    SHA256

    5aa15c6119b971742a7f824609739198a3c7c499370ed8b8df5a5942f69d9303

    SHA512

    9da30d469b4faed86a4bc62617b309f34e6bda66a3021b4a27d197d4bcb361f859c1a7c0aa2d16f0867ad93524b62a5f4e5ae5cf082da47fece87fc3d32ab100

  • C:\Program Files (x86)\VDeck\hostpolicy.dll

    Filesize

    388KB

    MD5

    a7e9ed205cf16318d90734d184f220d0

    SHA1

    10de2d33e05728e409e254441e864590b77e9637

    SHA256

    02c8dbe7bf1999352fc561cb35b51c6a88c881a4223c478c91768fdaf8e47b62

    SHA512

    3ecbaf20946e27d924a38c5a2bf11bac7b678b8c4ebf6f436c923ea935982500e97f91d0e934b7fd6b1fc2a2fd34e7d7b31dbbe91314a218724b3b2fd64c4052

  • C:\Program Files (x86)\VDeck\mscorrc.dll

    Filesize

    133KB

    MD5

    53e03d5e3bffa02fbc7fb1420ac8e858

    SHA1

    36c44c9ff39815aa167f341c286c5cd1514f771f

    SHA256

    23a433398be5135222ee14bb1de6334e7b22bad1a38664a83f1cf19dfbddd960

    SHA512

    f6aca16b90f6b4efa413dc9a8f1d05e83c1e3791b2cb988f9bce69d5272a0077c1edcae4111a494d166b5e3ab4e25956dead4e93ee1e43417c2b7bb082292170

  • C:\Users\Admin\AppData\Local\Temp\Cab4F2B.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar4F9B.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\nsjB50F.tmp\ioSpecial.ini

    Filesize

    1KB

    MD5

    e0de4d9de73cd6ff8527aa9ff477b931

    SHA1

    ba6a17379672a0d5e798250c0e4526c2e6381ec5

    SHA256

    f490e9734fb12828d8364d8b4f70fb4840096772470abfc4fc82c4766656c09a

    SHA512

    3cfd321c4601d62150efa0b6ac81380e453b84beb260c178c6226281e7f2d0dba9d83949d38cf6856f3d7bb1c1eeb965db0d03aa0bc4e02bfe31d641e2bfd85e

  • C:\Users\Admin\AppData\Local\Temp\nsjB50F.tmp\ioSpecial.ini

    Filesize

    1KB

    MD5

    b742b6e02e1d3f0a5eaa9926d251390a

    SHA1

    fd30c816c82407ec9c8dc091f2216a6795a539c7

    SHA256

    16aee8e6e92de6c37a7d8cc2d16bb6468c52f1d7ca4dba2819af7b7b4e2513b7

    SHA512

    54ac576a9b0f2bcd081cc972766a8fd046764601c94d78cc292b0ef29fcca3fca63de3cd591f4d7d25db872d19015e353c80b2987a3857798548d55b4787aa9b

  • C:\Users\Admin\AppData\Local\Temp\nsjB50F.tmp\ioSpecial.ini

    Filesize

    1KB

    MD5

    56e8712e71eb3d2067bf95292b890032

    SHA1

    3c350a14aaf8721e9b92a4572ad8a9f79660aee9

    SHA256

    b272254f085286a54d815ed2457b0d8e8dafc288904c9363a898703d500abb1a

    SHA512

    90e8b94f856994bf4fdd55f8ef716e496796be47c7c8b112881d21848526e51ae9ca7b13dae801f983991b90e9bf302876fdf961a0ba4fc2cb46efd8ba7a58b5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0W62G3YHDR7H2M1YG7M9.temp

    Filesize

    7KB

    MD5

    b78956894046d5a2addf91e359572ecf

    SHA1

    bea6c9cfb2952eb56ed780fa66539b4423029327

    SHA256

    061cb077dc9479e517d53afa3ef96d85be58a725b21949cb3bc55dd961f9255c

    SHA512

    04cf7eaaa7d6b38f1e04561b7c7755d8da0afeda9916dc9383cf093e75451c767c823efe7e88c71abaaa8ee143e52f4f8384b48b95234f89003b79942db052ac

  • \Program Files (x86)\VDeck\System.Collections.Specialized.dll

    Filesize

    102KB

    MD5

    cc26e9e30ffab763a1e54c0ef3713382

    SHA1

    c3be6646b7a4576ebd7729dbf4dccbd1fc159d51

    SHA256

    0cbabb81eae22f4c07c6c846054d207ae3f25da15649eb7fa29e4e2cecd24db4

    SHA512

    c8e57fb70cfa7667f9a5484c99eedd0bf34004ee26e9642e99a6b90624caa804af571d8aaafa7e9b121550af58205f8ed197b4ddb928210d394ff0b4c1897149

  • \Program Files (x86)\VDeck\System.Collections.dll

    Filesize

    254KB

    MD5

    92063926c04f2e4bf5b5fde16542831d

    SHA1

    e7be34eaff2d3d8796911d21f1fdbb93bf231dec

    SHA256

    9193aaef3ea8f19408f88c25fcaf5880e7836d1c35028d7e4077f6090b083541

    SHA512

    e855ee37980d1da2d143ee39133b05fff81937e529cffe74433e73088549daabd3abadbf05f3765bf3ffffd50313f0ed966efec0eb244d7363241affd73cc29f

  • \Program Files (x86)\VDeck\System.IO.Compression.Brotli.dll

    Filesize

    82KB

    MD5

    4cde4fcd6f41f0d6d400c1d66f391538

    SHA1

    7c4a13f37c8d20fbe60c5b612107bd0242b68e26

    SHA256

    51bc8800f8579a14d1edf0f650c9a5d828ef9d96532d7dd304a4394fa9cfd641

    SHA512

    d7b444ec7f230c3104fdd98c60af9de998a85e622e0c8ce3471a3809d9ba8bb368d7827800fb177ac97f0ce3feb3ad2292a77d41b8c36bc99b2df1263feb8735

  • \Program Files (x86)\VDeck\System.Memory.dll

    Filesize

    154KB

    MD5

    7e999da530c21a292cec8a642127b8c8

    SHA1

    6585d0260ae98bab2ad1eaba0f9cfe8ebb8a0b3f

    SHA256

    3af25e0c81c1462d0db86f55c4e5fd8c048c70685f9a566d29d499bc46935fb4

    SHA512

    a18b6649b5c2f9f96bf639863df9faad436759200a64f91fb2d955f33c71ce4b2d5798be982f692a247ac864d8acb63fb731b31c06333e5c7d9a9c895ecd6451

  • \Program Files (x86)\VDeck\System.Private.CoreLib.dll

    Filesize

    12.6MB

    MD5

    805cf170e27dd31219a6b873c17dce88

    SHA1

    ac90fa4690a8b54b6248dcb4c41a2c9a74547667

    SHA256

    ba7e61a00e7a4634b5c5a79b83126f75580ceec235c613000c3efbc01826cad0

    SHA512

    fa946aae906b66cb5570155a1c77340f2b6d4efb9be16068da03a8f1c5b5f37ad847d65cd1416017db19375dc6a72670300da4c766e6d9bb1a00374f492bd866

  • \Program Files (x86)\VDeck\System.Runtime.InteropServices.dll

    Filesize

    94KB

    MD5

    49c86e36b713e2b7daeb7547cede45fb

    SHA1

    75fe38864362226d2cce32b2c25432b1fd18ba37

    SHA256

    756de3f5f2e07b478ac046a0ac976b992ef6bc653a1be2bb1e28524a4ff8d67d

    SHA512

    a9bd42b626158c540be04f8d392620daba544a55b7438d6caefe93b9df10ec2219f28959c4e0d706a86b92008275de94dfdf19de730787cdacf46d99fc45e3a9

  • \Program Files (x86)\VDeck\System.Security.Cryptography.dll

    Filesize

    2.0MB

    MD5

    75f18d3666eb009dd86fab998bb98710

    SHA1

    b273f135e289d528c0cfffad5613a272437b1f77

    SHA256

    4582f67764410785714a30fa05ffaaad78fe1bc8d4689889a43c2af825b2002e

    SHA512

    9e110e87e00f42c228729e649903ad649b962ae28900d486ee8f96c47acca094dbace608f9504745abf7e69597cdef3c6b544b5194703882a0a7f27b011fa8d5

  • \Program Files (x86)\VDeck\System.Windows.Forms.Primitives.dll

    Filesize

    2.9MB

    MD5

    8129c2d72bcba8b50576e7c43e558832

    SHA1

    f4892f78d2496f3a2e1fa2380ff68fbeb62e2dca

    SHA256

    5794a3996a0b4ab9cb13f3de0f87d50462615a7d0eb1d243d9324a682c1b58cb

    SHA512

    40fafbf9590d2b2c8f487f44708e9e97ddce03b1487be5c7cb3d4c92bdb7100a98aebada379f63003f0dd9d447ee2b0b9dfa0b057320ac05f7f77b31c5ffa97d

  • \Program Files (x86)\VDeck\System.Windows.Forms.dll

    Filesize

    12.9MB

    MD5

    a51632facb386d55cc3bc1f0822e4222

    SHA1

    59144c26183277304933fd8bb5da7d363fcc11fa

    SHA256

    efc52dbbef5202d9ff424d7adc6e2249b66450a5fd5414891776fc617b00123e

    SHA512

    2a8d8e2ee8168e6f79476616385320f463ebc161c7393db2b18a7d35ca0111c5100b83954c5eabfe32b12cac3dbfdc514271dde4cc4468dd26235eb7020d9c14

  • \Program Files (x86)\VDeck\VDeck.dll

    Filesize

    547KB

    MD5

    e40435c83bd20baceaf366715681802a

    SHA1

    44b58c1df66799c3e03d95c43bd98cac672c1b44

    SHA256

    59f0ddfd450a4280f7f0b63f5c9d2b92bc40680762d9390bb94786ca2ca7ab27

    SHA512

    caacb3c9a3990fb3d339250ba90e89168966f0fa645fe5bd09297fb44016f8c81edff2419ca8804f7f27250f764dc75fd6ff4f6adc4e505a4a7538d36382be36

  • \Program Files (x86)\VDeck\VDeck.exe

    Filesize

    337KB

    MD5

    b49848e297488ef03b44c4c4b197472d

    SHA1

    440255ca9282f7e2667a7bd0b27b8d2bdc4c1db3

    SHA256

    35be11ddfa4f1d776f0b6b814a325f50189100222fe04436a50563c89c2a02bd

    SHA512

    3515e6775862b0d66a206c24fa4916b2de208fe3cd0c7aec4e24d6d940a391f9d32a489642a32efafaa9c87b15fbbd4c462320797693705db50a85a2f523f655

  • \Program Files (x86)\VDeck\clrjit.dll

    Filesize

    1.7MB

    MD5

    8b81a3f0521b10e9de59507fe8efd685

    SHA1

    0516ff331e09fbd88817d265ff9dd0b647f31acb

    SHA256

    0759c8129bc761fe039e1cacb92c643606591cb8149a2ed33ee16babc9768dcb

    SHA512

    ea11c04b92a76957dcebe9667bef1881fc9afa0f8c1547e23ada8125aa9e40d36e0efaf5749da346ba40c66da439cbd15bf98453e1f8dab4fe1efd5618fdc176

  • \Program Files (x86)\VDeck\coreclr.dll

    Filesize

    4.8MB

    MD5

    9369162a572d150dca56c7ebcbb19285

    SHA1

    81ce4faeecbd9ba219411a6e61d3510aa90d971d

    SHA256

    871949a2ec19c183ccdacdea54c7b3e43c590eaf445e1b58817ee1cb3ce366d5

    SHA512

    1eb5eb2d90e3dd38023a3ae461f717837ce50c2f9fc5e882b0593ab81dae1748bdbb7b9b0c832451dfe3c1529f5e1894a451365b8c872a8c0a185b521dbcd16b

  • \Users\Admin\AppData\Local\Temp\nsjB50F.tmp\InstallOptions.dll

    Filesize

    15KB

    MD5

    d095b082b7c5ba4665d40d9c5042af6d

    SHA1

    2220277304af105ca6c56219f56f04e894b28d27

    SHA256

    b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

    SHA512

    61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

  • \Users\Admin\AppData\Local\Temp\nsjB50F.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    50016010fb0d8db2bc4cd258ceb43be5

    SHA1

    44ba95ee12e69da72478cf358c93533a9c7a01dc

    SHA256

    32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

    SHA512

    ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

  • \Users\Admin\AppData\Local\Temp\nsjB50F.tmp\System.dll

    Filesize

    12KB

    MD5

    4add245d4ba34b04f213409bfe504c07

    SHA1

    ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    SHA256

    9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    SHA512

    1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

  • memory/612-759-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/612-757-0x0000000000400000-0x0000000000565000-memory.dmp

    Filesize

    1.4MB

  • memory/612-758-0x0000000074130000-0x00000000742A4000-memory.dmp

    Filesize

    1.5MB

  • memory/612-792-0x0000000074130000-0x00000000742A4000-memory.dmp

    Filesize

    1.5MB

  • memory/860-684-0x000007FEF5A6A000-0x000007FEF5A6B000-memory.dmp

    Filesize

    4KB

  • memory/1892-798-0x0000000000400000-0x0000000000645000-memory.dmp

    Filesize

    2.3MB

  • memory/1892-856-0x0000000000400000-0x0000000000645000-memory.dmp

    Filesize

    2.3MB

  • memory/1892-825-0x0000000000400000-0x0000000000645000-memory.dmp

    Filesize

    2.3MB

  • memory/1892-802-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

  • memory/1892-800-0x0000000000400000-0x0000000000645000-memory.dmp

    Filesize

    2.3MB

  • memory/1892-799-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/2088-862-0x0000000073DC0000-0x0000000073F34000-memory.dmp

    Filesize

    1.5MB

  • memory/2088-859-0x0000000000400000-0x0000000000BFC000-memory.dmp

    Filesize

    8.0MB

  • memory/2088-861-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/2088-860-0x0000000073DC0000-0x0000000073F34000-memory.dmp

    Filesize

    1.5MB

  • memory/2284-866-0x0000000073DC0000-0x0000000073F34000-memory.dmp

    Filesize

    1.5MB

  • memory/2284-865-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/2388-796-0x0000000074130000-0x00000000742A4000-memory.dmp

    Filesize

    1.5MB

  • memory/2388-795-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/2608-747-0x000000001B710000-0x000000001B9F2000-memory.dmp

    Filesize

    2.9MB

  • memory/2608-748-0x00000000020F0000-0x00000000020F8000-memory.dmp

    Filesize

    32KB

  • memory/2624-741-0x000000001B6B0000-0x000000001B992000-memory.dmp

    Filesize

    2.9MB

  • memory/2624-742-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

    Filesize

    32KB

  • memory/2700-736-0x0000000001D90000-0x0000000001D98000-memory.dmp

    Filesize

    32KB

  • memory/2700-735-0x000000001B690000-0x000000001B972000-memory.dmp

    Filesize

    2.9MB

  • memory/2740-868-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2740-869-0x0000000076E50000-0x0000000076FF9000-memory.dmp

    Filesize

    1.7MB

  • memory/2740-870-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2740-872-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB