gh0strat | f2de7f0a7eb198a2b892c97d07225ecd9830778e3e904989c998225a21004de9

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sogou_pinyin_guanwang.exe
Size

181.3MB
MD5

6c77c94d2978dd56518397023e426a22
SHA1

d239c58cbe6d33612c2742203c20a447f592e9ea
SHA256

f2de7f0a7eb198a2b892c97d07225ecd9830778e3e904989c998225a21004de9
SHA512

1a14c72444c4f84367b429d7be13a8a0a7dc25bd01779553f847ded13847a7974b5b6ddb54f1f63f1b0a5bbc7a4281831a18d4d6efe3742e3bd616c9b6be1ea9
SSDEEP

3145728:U/kfnZZRUWXNShZNxlb3oeUFRGp/K3GgUCoQKAQ6h398AWXNOQ14BDndvdXmT3Ot:nnTLXwXNf4eUSJK39U8KAQ6hN8AW9H1U

Score

10^/10

gh0strat purplefox discovery rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 2 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/904-82265-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit
behavioral2/memory/904-95229-0x0000000000400000-0x0000000001F8A000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/904-82265-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat
behavioral2/memory/904-95229-0x0000000000400000-0x0000000001F8A000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	sogou_pinyin_guanwang.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	sogou_pinyin_guanwang.exe

Executes dropped EXE 2 IoCs

pid	Process
904	wngeyvw.exe
4576	wngeyvw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sogou_pinyin_guanwang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sogou_pinyin_guanwang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sogou_pinyin_guanwang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wngeyvw.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
24056	cmd.exe
39308	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
39308	PING.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 904	4968	sogou_pinyin_guanwang.exe	82
PID 4968 wrote to memory of 904	4968	sogou_pinyin_guanwang.exe	82
PID 4968 wrote to memory of 904	4968	sogou_pinyin_guanwang.exe	82
PID 4968 wrote to memory of 748	4968	sogou_pinyin_guanwang.exe	84
PID 4968 wrote to memory of 748	4968	sogou_pinyin_guanwang.exe	84
PID 4968 wrote to memory of 748	4968	sogou_pinyin_guanwang.exe	84
PID 748 wrote to memory of 4576	748	sogou_pinyin_guanwang.exe	85
PID 748 wrote to memory of 4576	748	sogou_pinyin_guanwang.exe	85
PID 748 wrote to memory of 4576	748	sogou_pinyin_guanwang.exe	85
PID 748 wrote to memory of 1048	748	sogou_pinyin_guanwang.exe	86
PID 748 wrote to memory of 1048	748	sogou_pinyin_guanwang.exe	86
PID 748 wrote to memory of 1048	748	sogou_pinyin_guanwang.exe	86

C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
  "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe > nul
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:24056
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:39308
- C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
  "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
    "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
    3⤵
    - Executes dropped EXE
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
    "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
      "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
      4⤵
      PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
      "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
      4⤵
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        5⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        5⤵
        
        PID:24392
      - C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        6⤵
        
        PID:37860
      - C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        6⤵
        
        PID:40944
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        7⤵
        
        PID:39212
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        7⤵
        
        PID:42820
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        8⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        8⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        9⤵
        
        PID:31752
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        9⤵
        
        PID:32488
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        10⤵
        
        PID:33440
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        10⤵
        
        PID:33096
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        11⤵
        
        PID:18980
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        11⤵
        
        PID:32040
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        12⤵
        
        PID:19500
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        12⤵
        
        PID:38328
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        13⤵
        
        PID:31712
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        13⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        14⤵
        
        PID:32760
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        14⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        15⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        15⤵
        
        PID:27028
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        16⤵
        
        PID:39372
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        16⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        17⤵
        
        PID:18968
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        17⤵
        
        PID:46800
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        18⤵
        
        PID:21040
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        18⤵
        
        PID:37116
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        19⤵
        
        PID:33144
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        19⤵
        
        PID:39516
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        20⤵
        
        PID:40064
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        20⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        21⤵
        
        PID:35468
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        21⤵
        
        PID:25792
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        22⤵
        
        PID:38776
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        22⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        23⤵
        
        PID:46168
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        23⤵
        
        PID:42484
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        24⤵
        
        PID:24164
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        24⤵
        
        PID:24476
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        25⤵
        
        PID:21444
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        25⤵
        
        PID:23136
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        26⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        26⤵
        
        PID:19796
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        27⤵
        
        PID:33020
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        27⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        28⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        28⤵
        
        PID:34964
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        29⤵
        
        PID:29548
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        29⤵
        
        PID:47940
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        30⤵
        
        PID:27388
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        30⤵
        
        PID:42736
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        31⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        31⤵
        
        PID:36400
        
        C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe"
        32⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe
        
        "C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"
        32⤵
        
        PID:29308

C:\Windows\SysWOW64\Dtldt.exe
C:\Windows\SysWOW64\Dtldt.exe -auto
1⤵
PID:31708

C:\Windows\SysWOW64\Dtldt.exe
C:\Windows\SysWOW64\Dtldt.exe -auto
1⤵
PID:48108

C:\Windows\SysWOW64\Dtldt.exe
C:\Windows\SysWOW64\Dtldt.exe -auto
1⤵
PID:39956

C:\Windows\SysWOW64\Dtldt.exe
C:\Windows\SysWOW64\Dtldt.exe -auto
1⤵
PID:45152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QFhUimF0.exe

Filesize
1.4MB

MD5
acbb38ad7a5080f946f2b52c557ddb8d

SHA1
1bb5c2feb9dcfbeabe95a08b53eeb17596abe596

SHA256
38a43887ce091509b3bcc588912c49a5692b4329e5024fff1491177d362b8d76

SHA512
4c05bfc02b9a3e7bef4a8658b4987aaba617ec92c3f758b4a0bdfeb1ce873868d0a7957764efa8da241c66a08e2e19e84f3b0556c0d0b0ff8adeee7456cab35a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
27.5MB

MD5
533d850489f356c37abd269c47e57d1d

SHA1
59697ad75f1ee2758b62f9707f7e2bd2586a1356

SHA256
1a03e49c1d3e121d435402e3925e2bc334ca6b49d09dfefc6df6b9f8e876858b

SHA512
4196096d126b87343c606dba6fcb0a3b9535e9e1e3b1209aa821fec66e81be2d99cc91603b71bcbc387c14eca5074e576f22a563067e716d084f5f0d3a199563

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
17.8MB

MD5
d157c5b27d413fca0f1814f7cb3176c5

SHA1
e432c8df1e1b97f7744c68dca025b2739c875090

SHA256
e2c39725ced40d96e553819db6ce705ddfefc0b54074371d0a1db69380ef5d78

SHA512
50bb6ba8f49a30d3e3bab369780f46f9403a99629f86f2fd36961f6c529dd7f1cccabb97de4e163b5d60a34b1931c365bbf79337b82923544983d20af68800e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
17.1MB

MD5
e8a8ca1c24e30a62f108974857c27043

SHA1
d77f24d72fc541a8c2d5a44d6ed0d2d387f9e696

SHA256
38f70abe638ffe778868b5cd5ed1abb3ce04c00f7d705b297746828dd923d861

SHA512
4926fb8313d59c186d9d1f6509b0150415e0c31be40c2065a0570a5cb21598e903870e05c1b64a959ef0fdfea58ecb3ab98756ca83a813fb0bc99c1f7c5d7ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
15.9MB

MD5
c18837710f653ecfcd48fc9a35542825

SHA1
5065f24b0af9df8b8497160f90fb251b587b76ce

SHA256
f1d3ea70afb6175311f4690dbc56fbbf52f759f9237ce69fec1c0b8ec1a5f7e4

SHA512
1544b4aace9d075bce7645c6aa1bff9addd2b456da1b3086139c0077e118d962219e166b98a3668645aa424874c56c8eb7d580182754b6ed9ecb2ddbd20e6378

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
13.1MB

MD5
40bcbd438af3fe7fa4b0b5ff2395692f

SHA1
30e75ef0e3de4c3b7b8c733547c44b0b625a7cdf

SHA256
14674f53f118025c7118ba5791fed694d04ffdca34e1fa1c8caf4d410b7721f3

SHA512
f6609b7bc829fd2399fa2ec58872cf84ceb74cb2f09191237f4db2c1accfde12ff09d58f453ed0b2d5dd1493ee44a16345a15f947a4a856a0d4f7031e7917d7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
12.1MB

MD5
3e1e53c0c2a9ff2865d11e38e8bf7d4a

SHA1
bbf4d18c2c2c8113257d1139f4a2b8102f068074

SHA256
40999fda55c10559d18f4af9f0cdacdf020a673a8985a0b02266e4dc336935c8

SHA512
10cee37cb321ede372b4557b15018a2784e2cfa55e02a505dc68b9df8879f5875c414bddd4e699014ba3ca49e3af2a38fcbf76ac49c44341cce2f3df823a2b02

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
12.8MB

MD5
ea238dd9ee656f64d47a3f7bca8e8aa2

SHA1
46d549628b5025b81e7ae7635cc805d2197651ed

SHA256
dd23f0e91c7ede83ab736362b61f6210b95be56583c411b72832b8872448875b

SHA512
b6302ce5a172821e36df3d7947bbe343da9e564e95ff0f2b6e3a20aa79888bf679ee1bda85ad3202bbe59cb05718a064076d55fb5f9f332a9197502f48322077

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
10.8MB

MD5
57ae8d8715c0efa1eb633202428a2216

SHA1
f97acb318284cd14b194a5e7164dfcfbb9ade369

SHA256
61823711ed2e2a3680d053485d9d3edd51bf82e9b1858d6daa0c942fb6fd71d1

SHA512
e979dc93b0d16d0f704ff5a593e89916d458b4cd98ee9c06e098a68374762d4afca8694dcdbb498216cb39e9164104b47e5c9cd472ddd81231fea8834b9a45ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
10.7MB

MD5
13aa4b6b5a7698e41109a973c8381ba2

SHA1
6c65b989b27c784e57ddd7268e6fc281cde71c83

SHA256
42ed3cb264bb0842703fba19ba893a8d25f96dff1b62a53a3b82099e05a5fff1

SHA512
901ad4e74cdce973bf9c3fbd4c74c1f69421bda56e65c4c7d8b7ac9eedf8d90a14e848e1d6a6cc76e4e363f78b28f0232f6fdb048ada1205c2cc838d8ca07512

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
13.1MB

MD5
ee956ab6cc626317beed2aecd5b20d7f

SHA1
cd247e4f1fa12fb2e56d1353910f362b8c314e74

SHA256
098967c6ba868a68098b02f1efe1c40482165b23359e77f9239d305cbded357c

SHA512
f5cad3227c5b4a4092409c6a17e36b93ea8ad9d6cee0937a3013c3dd7ff376a7700c91c8b3c22bd114cd6eeb7266cd6a6c8e1c1459bff4ad9bbef6793aa51927

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
9.4MB

MD5
4ac719cd6e7f18fbbdb656d5fe9afcb9

SHA1
09772429266c86443dc22c816a249c623a2aab24

SHA256
f0f54aec2d2dbfd9b1002692b0e4f9a6355741cbcac834d1998c620bf5b3e76b

SHA512
7005e8e147f9bc5892313b6d5e29120b7c54b7c27dfbe189ff062a713ca420a0046824ef98e36a0992f7371040a4d5708755feaf0fdbd83985d11a9026f1c412

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
7.1MB

MD5
6c84d65a2dd3f106ea31e65d3da49593

SHA1
f11a7f6d470319e57457149937d6ff48ae1aaa34

SHA256
f0cecd46acbd2ee37a30429954240c625f97bd7fb47efa21e687f50132730042

SHA512
f17f703a78ef59f3e9498685b8fae79d02e476049a1f9d826d867017a8947aa5949c88f1757452de18a0dcd4fe9e182ddb505980f788bbff33a8a52359f9f9fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
6.5MB

MD5
6e7fc322efa7ad806646321e8ff5b830

SHA1
641141f33f165217822ddc1982148060044fbe34

SHA256
4ca5a3e1f5becc4c353cb97d4c2c4bfb12dab98453d82e8eee0529187a2655cd

SHA512
b6e1893c77ee4c920402e2fea29a4dd7219479dca9cd9f61cfca61cdfc6aad3798830bc85d0af4fe662e2a74bfb624c6f92ad56632bd930e776ae623b1efbef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
7.0MB

MD5
6bbc1e9c03c43e0040e91518b155ef9b

SHA1
b7afb5c7f2c332f9b668bbc5a0fdde3ed319988a

SHA256
417c377ce831ac8d7864f3debb1fc94affcc6e4a98c8207856c72b68160ec723

SHA512
909b28903f7a3e871d106964e25be35086ee1d1728ff9136857620227aff031773d164912b5cabb0c31df1f02c48ad9da3c61a56cbe34305b40015757857a24b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
6.0MB

MD5
b3780bc2c991dd9bc90f8168d6b03d2d

SHA1
8e48ea475cc7f81ea69ab426ad49c499d08cfd6b

SHA256
693742bfa45162055b05761102e6cdbb9fa1054406f4337881d19688534719c9

SHA512
e9f57839765cd2b8837da8c7c1976012e6c69e326141ff3dbc9acd7e0aefd2f6191046ed57fa0abe5457d22316513997f9de20324fea90d7d52fc7bef6893174

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
4.8MB

MD5
b9d486f9e5a342fe89fc54af31d23349

SHA1
9bc87c4334b3fc364520a7c59fdfae1f4a747885

SHA256
6442d6a53bde944a36eb62e70ec4d14b5353170f992fb9fdfd09d80d7cf4f9f4

SHA512
14d8bcb796bca1c39808b1608585fe6fc732450e6cebc96163b11881322b8fb78fa3e9ef177d215a4e86288613837c8981f821a84ab972ba6816fabe8de56ea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
3.2MB

MD5
e6f1ff89b507a18c107a09c6d234a7bf

SHA1
ea436c39ead314d416d9bfc72f9d9f3c3ca9aa5c

SHA256
f718fb231fb69eef9df52773acdc0bf60d0a088f9bd111eae63eae95f0228985

SHA512
81621b07236b6a09025c3df24839dedfd5a8c0f0f44ccf803bcfe6f0dad0c72abe6d108f0e0d722fd14189d7409d5a6cb536c613b378ec20558b25f518c0f605

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
704KB

MD5
01213a891141c7b8b60432333821c53d

SHA1
5283ce1a540547aed750ef27c1182106713a4950

SHA256
7bb450f8e9159ee165dd3a971fb409351a0344020f04d3d5172d83564c9baee4

SHA512
b83ed0aa7ccd6ffed45eb21bee8dd567880ab3835df023c166a9b2b64d130f1b345dacc95fa091ed0f3a550da6a9943608f37608af8f6ec142eaf532edd91ea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\wngeyvw.exe

Filesize
896KB

MD5
d0796381a28872523248cb151ae65591

SHA1
b717358580f4700be864bc1dddc1f414592a6bc8

SHA256
d53ecb9166dcf5d947ae29f4e7843c0b2940c2d4905e592b8424caaa90d47809

SHA512
7eaa5b02962858c146780813dc84e245f5092ceab8000aa49271fdb49b003ed6a76dc6c3d0a8b801283968558090cf908b43af0f2e1172294a5708699b0671f6

Download Submit
C:\Windows\SysWOW64\Dtldt.exe

Filesize
19.1MB

MD5
a32d5d944ad43142c70c9c0bf1d5d9ab

SHA1
f1546a2cec8ecbd2a839c869dff4047241f08935

SHA256
b9da1628608fe50de129e79440d954e77665064c91e7b6fbb988d530a65765a0

SHA512
102a3dff23dde74ccf23c98c34486252acbd4ae8734dab093939f5ca163baafa9cbe56afd17ac84e8f2d3a598099a3416b6b0d4bdbe4450a85903cb16cb16c74

Download Submit
C:\Windows\SysWOW64\Dtldt.exe

Filesize
9.5MB

MD5
a5645ea056ab4701c723065ebc839cf8

SHA1
e20837a89b23933fcd9183c0989aaa49e2c5763f

SHA256
0b21db31f4b33eec7c93c61237b7156948699f34f37dc8f41e1d7dba9d5283f1

SHA512
f2ae5baead84698a651564be379b233236139e7a5915064d757ef713b926c8189929e9b6c4a8d8dd6a085feb76ca459fe0446372acaa1183fa890bc93350248d

Download Submit
C:\Windows\SysWOW64\Dtldt.exe

Filesize
5.0MB

MD5
b8a87ba6a2315a212039969606f346ed

SHA1
23987fa8388f491efad4bc236254ae074f1980a1

SHA256
04a4abfaffbad075284eae709be0a6b43bc512da11ed8860efe4164c370ab001

SHA512
516bec8d23627cb4a1b9bfe971db31035916cb72fc05bc0ecf6fdf1290b47c1caeea3850b4d510c9d5cdc2a5ddf6de53b4ea5c0377e3d339db7fa69d9a38c849

Download Submit
C:\Windows\SysWOW64\Dtldt.exe

Filesize
22.8MB

MD5
8569b0fdc69505a5a3ded13e4711b80d

SHA1
c870ba4cdb3d365b0f7ac3e6f9eba11de0845cd9

SHA256
9389662d0b4a82c0146271cb2af5fffcc2de1af6db286a38c47e56d492a52df1

SHA512
e6e5844db0f6a90333117a9b6597af6e335c0638805a70081d0f165bc47f13adfcaad7ab2b05679ae76bc0a3d7b61d93102662801281a0e0a3c7a1707a569345

Download Submit
C:\Windows\SysWOW64\Dtldt.exe

Filesize
24.8MB

MD5
035f111528f578e7ab53b65ad432fe7e

SHA1
6cb2d4e02f69bea731db6438aef5154017767315

SHA256
c06f62b9550c334c1e42de34871d16a484d06ca3554cfc4c0c8e66a89ae2a024

SHA512
415d200b7fb85b7dc107a3a0903fa19824e35fbf8d325ec25b2ca50e26175db209d5ed8c850d0413b8491dc3d7d7a944464625f5b7de00db5237271009186ef2

Download Submit
memory/904-49063-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/904-37678-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/904-73551-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/904-73552-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/904-82265-0x0000000010000000-0x000000001019F000-memory.dmp

Filesize
1.6MB

Download
memory/904-74059-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/904-95229-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/904-73550-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/904-15-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/904-72532-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/904-17-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download
memory/904-10178-0x0000000075700000-0x000000007577A000-memory.dmp

Filesize
488KB

Download
memory/904-5711-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/2284-34123-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download
memory/2284-43100-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/2284-84898-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/2284-48985-0x0000000075700000-0x000000007577A000-memory.dmp

Filesize
488KB

Download
memory/4576-82152-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/4576-78484-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/4576-78485-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/4576-1410-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download
memory/4576-14712-0x0000000075700000-0x000000007577A000-memory.dmp

Filesize
488KB

Download
memory/4576-9775-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/4576-43099-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/4576-80304-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/4576-52486-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/4576-74058-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/4620-87503-0x0000000075700000-0x000000007577A000-memory.dmp

Filesize
488KB

Download
memory/4620-83724-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/4620-73784-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download
memory/5700-90448-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/5700-88342-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/5700-88343-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/5700-10072-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download
memory/5700-22798-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/5700-89525-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/5700-71979-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/5700-30631-0x0000000075700000-0x000000007577A000-memory.dmp

Filesize
488KB

Download
memory/5700-45519-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/31752-94958-0x0000000075700000-0x000000007577A000-memory.dmp

Filesize
488KB

Download
memory/31752-82271-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download
memory/31752-90449-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/33440-91305-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download
memory/37860-52809-0x0000000075700000-0x000000007577A000-memory.dmp

Filesize
488KB

Download
memory/37860-43350-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download
memory/37860-49878-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/37860-72533-0x0000000000400000-0x0000000001F8A000-memory.dmp

Filesize
27.5MB

Download
memory/39212-54617-0x0000000075EF0000-0x0000000076105000-memory.dmp

Filesize
2.1MB

Download
memory/39212-63514-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/39212-69395-0x0000000075700000-0x000000007577A000-memory.dmp

Filesize
488KB

Download