a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
Size 4.9MB
Sample261027-e5fsrsav7w
SHA256 a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028
MD5 5aa7ed2d1b386bbda2a4a69b3a4fe432
SHA1 8ebdf2754bcdc0467efb02bbc69583946074fe64
SHA512 6da5226e6f7d747981bfda6e1767d4d8643529137e50924d6ef26533a269660321810a02f91e1d91819c9889778d49259f5444f5e025bb6fbd676367022cc116
SSDEEP 98304:9QieREYGnl05yEEMvkB3DAq76svA4h4e9OR2:+tRM3DAqu
TLSH
T1BB36AF10B647C277ED510570653DBAAF542A7E140B6888D3E3C82F2E59B4AD32A33F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\2345SafeCenterSvc\ImagePath = "\"C:\\Program Files (x86)\\2345Soft\\2345SafeCenter\\7.9.1.11484\\2345SafeCenterSvc.exe\""	2345SafeCenterInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\2345SafeSvc\ImagePath = "\"C:\\Program Files (x86)\\2345Soft\\2345PCSafe\\7.9.1.13920\\2345SafeSvc.exe\""	2345ShellPro.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c00000001c6a4-1687.dat	acprotect

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 20 IoCs

pid	Process
6092	2345pcsafe_v7.9.1.13920.exe
4688	2345ShellPro.exe
3348	2345SafeCenterInstaller.exe
5008	2345SafeCenterSvc.exe
1328	2345RTProtect.exe
2792	2345SafeCenterCrashReport.exe
4108	2345SafeCenterInstaller.exe
4544	2345SoftMgr.exe
3608	2345SafeSvc.exe
4104	2345ExtShell64.exe
5944	2345ShellPro.exe
2884	2345SFGuard64.exe
1728	2345RTProtect.exe
5716	2345SafeTray.exe
2388	2345ShellPro.exe
1308	2345SafeUpdate.exe
904	2345RTProtect.exe
4500	2345NightMode.exe
2324	2345ManuUpdate.exe
4616	2345SoftMgrShell64.exe

Loads dropped DLL 64 IoCs

pid	Process
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe

Modifies system executable filetype association 2 TTPs 6 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345SoftMgr	2345SoftMgrShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345PCSafe	2345ExtShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345PCSafe\ = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"	2345ExtShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345PCSafe	2345ExtShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345SoftMgr	2345SoftMgrShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345SoftMgr\ = "{6B3BA4A8-EC7E-4714-9ECF-EB33995B3384}"	2345SoftMgrShell64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2345SafeTray.exe

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\ = "SafeBHO"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\ = "SafeBHO"	regsvr32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1328	2345RTProtect.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c6a4-1687.dat	upx
behavioral2/memory/3348-1699-0x000000006C320000-0x000000006CA25000-memory.dmp	upx
behavioral2/memory/3348-1711-0x000000006C320000-0x000000006CA25000-memory.dmp	upx
behavioral2/memory/3348-1717-0x000000006C320000-0x000000006CA25000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\DJ01.data	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeBho.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-stdio-l1-1-0.dll	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SdAntiVCloud.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\api-ms-win-crt-locale-l1-1-0.dll	2345pcsafe_v7.9.1.13920.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\coral_extract.dll	2345pcsafe_v7.9.1.13920.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Lua	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeCenterUpdate.exe	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-utility-l1-1-0.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SdAntiVCloud.dll	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\vcruntime140.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ExtShell.exe	2345pcsafe_v7.9.1.13920.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\DG01.data	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345Extract.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SdHipsDefProtect.dll	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-sysinfo-l1-1-0.dll	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\Recover\64_2345SafeCenterSvc.data	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\BAY01.data	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\BZ01.data	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\SettingCenter	2345ShellPro.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\FileShreUI.dll	2345pcsafe_v7.9.1.13920.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\BBI01.data	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-datetime-l1-1-0.dll	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SdConfigCenter.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345SafeCenter\2345Extract.dll	2345pcsafe_v7.9.1.13920.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-processenvironment-l1-1-0.dll	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\ProtectApi64.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-processenvironment-l1-1-0.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\BM01.data	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345RtProtectCenter.exe	2345pcsafe_v7.9.1.13920.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\courgette_dll.dll	2345pcsafe_v7.9.1.13920.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SdTrojaneEngine.dll	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SFGuard.exe	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-conio-l1-1-0.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-locale-l1-1-0.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\api-ms-win-core-interlocked-l1-1-0.dll	2345pcsafe_v7.9.1.13920.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\Data\AT01.data	2345pcsafe_v7.9.1.13920.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\BN01.data	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\DF01.data	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\DR01.data	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\msvcr120.dll	2345pcsafe_v7.9.1.13920.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\api-ms-win-core-errorhandling-l1-1-0.dll	2345pcsafe_v7.9.1.13920.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\DP01.data	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-debug-l1-1-0.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SafeWebMon.dll	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SdRTPLog.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SdRTProtectUI.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SdRTProtectUICtrl.dll	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ShortcutArrow.exe	2345pcsafe_v7.9.1.13920.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\concrt140.dll	2345pcsafe_v7.9.1.13920.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\Data\AS01.data	2345pcsafe_v7.9.1.13920.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\BAV01.data	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\DU01.data	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SafeCenterUpdate.dll	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\SdUIList.dll	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\advertprotect_user_config-journal	2345RTProtect.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\BG01.data	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\Recover\86_2345Prot.data	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345InstDll.exe	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeCenterUpdate.exe	2345SafeCenterInstaller.exe
File created	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345VirusScan.exe	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\SettingCenter	2345SafeCenterInstaller.exe
File opened for modification	C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\DL01.data	2345RTProtect.exe
File created	C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\Data\AC01.data	2345pcsafe_v7.9.1.13920.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2345RTProtect.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2345SoftMgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2345SafeTray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2345SafeCenterInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2345RTProtect.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2345SoftMgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2345ShellPro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2345ShellPro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2345SafeTray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2345SafeCenterInstaller.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345SafeCenterCrashReport.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345SafeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345RTProtect.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345SafeCenterInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345SoftMgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345NightMode.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345pcsafe_v7.9.1.13920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345ShellPro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345RTProtect.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345SafeTray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345ShellPro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345ManuUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345SafeCenterInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345SafeCenterSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345RTProtect.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345SafeSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345ShellPro.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2104	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	2345RTProtect.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	2345RTProtect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	2345RTProtect.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Approved Extensions	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A} = 51667a6c4c1d3b1bc6978e2575b5df0cb002b18a803cd591	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main	2345RTProtect.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg\command\DelegateExecute	2345SafeCenterInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg\command	2345RTProtect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345SoftMgr\ = "{6B3BA4A8-EC7E-4714-9ECF-EB33995B3384}"	2345SoftMgrShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\ = "SafeBho Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\TypeLib\ = "{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\command\DelegateExecute	2345RTProtect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell	2345RTProtect.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\2345PCSafe	2345ExtShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}\1.0\ = "My2345SafeBhoLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E933ACC2-E24A-4714-B75F-C757283F1EC7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command\ = "\"C:\\Program Files (x86)\\2345Soft\\2345PCSafe\\7.9.1.13920\\2345SafeCenter\\2345Associate.exe\" \"open\" \"%1\""	2345SafeCenterInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}\InprocServer32	2345ExtShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345PCSafe\ = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"	2345ExtShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\2345PCSafe\ = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"	2345ExtShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\2345PCSafe	2345ExtShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345SoftMgr	2345SoftMgrShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg\command\ = "\"C:\\Program Files (x86)\\2345Soft\\2345PCSafe\\7.9.1.13920\\2345SafeCenter\\2345Associate.exe\" \"openas\" \"%1\""	2345SafeCenterInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg\command\DelegateExecute	2345RTProtect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}\ = "2345 PC Safe Shell Extension"	2345ExtShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\2345PCSafe	2345ExtShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\2345PCSafe	2345ExtShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345PCSafe	2345ExtShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\2345SoftMgr	2345SoftMgrShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}\1.0\0\win64	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\2345PCSafe	2345ExtShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\2345PCSafe\ = "{C4F75DB1-B9F4-425A-9F5B-778911BCF176}"	2345ExtShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\2345PCSafe	2345ExtShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg	2345SafeCenterInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\opendlg\command\ = "\"C:\\Program Files (x86)\\2345Soft\\2345SafeCenter\\7.9.1.11484\\2345Associate.exe\" \"openas\" \"%1\""	2345RTProtect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\command	2345RTProtect.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}\InprocServer32\ThreadingModel = "Apartment"	2345ExtShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell	2345SafeCenterInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\TypeLib\ = "{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}\1.0\0\win32\ = "C:\\Program Files (x86)\\2345Soft\\2345SafeCenter\\7.9.1.11484\\2345SafeBho.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E933ACC2-E24A-4714-B75F-C757283F1EC7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E933ACC2-E24A-4714-B75F-C757283F1EC7}\TypeLib\ = "{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\command\DelegateExecute	2345SafeCenterInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command\DelegateExecute	2345RTProtect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E933ACC2-E24A-4714-B75F-C757283F1EC7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E933ACC2-E24A-4714-B75F-C757283F1EC7}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D11EEEC6-AB76-42E9-B36E-E11B0EB9A38E}\1.0\0\win64\ = "C:\\Program Files (x86)\\2345Soft\\2345SafeCenter\\7.9.1.11484\\2345SafeBho64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command	2345SafeCenterInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4F75DB1-B9F4-425A-9F5B-778911BCF176}	2345ExtShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D9B8BD6-E646-44B4-AA01-F4CA817E928A}\InprocServer32\ = "C:\\Program Files (x86)\\2345Soft\\2345SafeCenter\\7.9.1.11484\\2345SafeBho.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\command\ = "\"C:\\Program Files (x86)\\2345Soft\\2345SafeCenter\\7.9.1.11484\\2345Associate.exe\" \"openas\" \"%1\""	2345RTProtect.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\2345PCSafe	2345ExtShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6B3BA4A8-EC7E-4714-9ECF-EB33995B3384}	2345SoftMgrShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6B3BA4A8-EC7E-4714-9ECF-EB33995B3384}\ = "2345SoftMgr Shell Extension"	2345SoftMgrShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6B3BA4A8-EC7E-4714-9ECF-EB33995B3384}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\SoftMgr_2345\\Application\\7.0.2.3786\\SoftMgrMenu64.dll"	2345SoftMgrShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E933ACC2-E24A-4714-B75F-C757283F1EC7}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
6092	2345pcsafe_v7.9.1.13920.exe
4688	2345ShellPro.exe
4688	2345ShellPro.exe
4688	2345ShellPro.exe
4688	2345ShellPro.exe
3348	2345SafeCenterInstaller.exe
3348	2345SafeCenterInstaller.exe
3348	2345SafeCenterInstaller.exe
3348	2345SafeCenterInstaller.exe
3348	2345SafeCenterInstaller.exe
3348	2345SafeCenterInstaller.exe
1880	regsvr32.exe
1880	regsvr32.exe
5008	2345SafeCenterSvc.exe
5008	2345SafeCenterSvc.exe
5008	2345SafeCenterSvc.exe
5008	2345SafeCenterSvc.exe
5008	2345SafeCenterSvc.exe
5008	2345SafeCenterSvc.exe
3348	2345SafeCenterInstaller.exe
3348	2345SafeCenterInstaller.exe
3348	2345SafeCenterInstaller.exe
3348	2345SafeCenterInstaller.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1324	Process not Found

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found
Token: SeShutdownPrivilege	1324	Process not Found
Token: SeCreatePagefilePrivilege	1324	Process not Found

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
5716	2345SafeTray.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
5716	2345SafeTray.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
5716	2345SafeTray.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
5716	2345SafeTray.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe
1328	2345RTProtect.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe
5716	2345SafeTray.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 6092	996	a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe	91
PID 6092 wrote to memory of 4688	6092	2345pcsafe_v7.9.1.13920.exe	92
PID 4688 wrote to memory of 3348	4688	2345ShellPro.exe	93
PID 3348 wrote to memory of 1704	3348	2345SafeCenterInstaller.exe	95
PID 3348 wrote to memory of 1880	3348	2345SafeCenterInstaller.exe	96
PID 1704 wrote to memory of 5268	1704	regsvr32.exe	97
PID 5008 wrote to memory of 1328	5008	2345SafeCenterSvc.exe	99
PID 1328 wrote to memory of 2792	1328	2345RTProtect.exe	100
PID 1328 wrote to memory of 4108	1328	2345RTProtect.exe	101
PID 1328 wrote to memory of 2104	1328	2345RTProtect.exe	102
PID 4688 wrote to memory of 4544	4688	2345ShellPro.exe	104
PID 6092 wrote to memory of 4104	6092	2345pcsafe_v7.9.1.13920.exe	106
PID 6092 wrote to memory of 5944	6092	2345pcsafe_v7.9.1.13920.exe	107
PID 1328 wrote to memory of 2884	1328	2345RTProtect.exe	109
PID 3608 wrote to memory of 1728	3608	2345SafeSvc.exe	110
PID 3608 wrote to memory of 5716	3608	2345SafeSvc.exe	111
PID 5716 wrote to memory of 2388	5716	2345SafeTray.exe	112
PID 2388 wrote to memory of 1308	2388	2345ShellPro.exe	113
PID 5716 wrote to memory of 904	5716	2345SafeTray.exe	114
PID 5716 wrote to memory of 4500	5716	2345SafeTray.exe	115
PID 5716 wrote to memory of 2324	5716	2345SafeTray.exe	116
PID 4544 wrote to memory of 4616	4544	2345SoftMgr.exe	117

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "221"	2345ShellPro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	2345ShellPro.exe

C:\Users\Admin\AppData\Local\Temp\a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe
"C:\Users\Admin\AppData\Local\Temp\a21732fbaccda7875df93741168dc51c9a5c290a3920560e7c8f4fe448890028.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Roaming\2345PCSafe\Download\2345pcsafe_v7.9.1.13920.exe
  "C:\Users\Admin\AppData\Roaming\2345PCSafe\Download\2345pcsafe_v7.9.1.13920.exe" /S /LOCK3HP=1 /LOCKIEHP=1 /LOCKBROWSER=1 /LOCKENGINE=1 /AUTOLAUNCH=0 /AUTOLAUNCHPARAM= /LOCKNEWTAB=1 /DSAFELNK=1 /D=C:\Program Files (x86)\2345Soft\2345PCSafe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ShellPro.exe
    "C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ShellPro.exe" --type=install --installtype=new --lockIEState=1 --lock3rdState=1 --lockBrowserState=1 --lockBrowserType=2 --lockEngineState=1 --locknewtab=1 --silent=1
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4688
  - - C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345SafeCenter\2345SafeCenterInstaller.exe
      "C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345SafeCenter\2345SafeCenterInstaller.exe" --type=install --invoke_product=1 --path="C:\Program Files (x86)\2345Soft\" --lockExplorerKB=0 --lockIEState=1 --lock3rdState=1 --locknewtab=1 --lockBrowserState=1 --lockBrowserType=2 --lockEngineState=1 --safe_override=0
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3348
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeBho64.dll"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1704
      - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeBho64.dll"
        6⤵
        Installs/modifies Browser Helper Object
        Modifies registry class
        
        PID:5268
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeBho.dll"
        5⤵
        Installs/modifies Browser Helper Object
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1880
  - - C:\Users\Admin\AppData\Roaming\SoftMgr_2345\2345SoftMgr.exe
      "C:\Users\Admin\AppData\Roaming\SoftMgr_2345\2345SoftMgr.exe" --shortcut=notify --from=s --entry=12 --package="C:\Users\Admin\AppData\Roaming\SoftMgr_2345\2345softmgr_v7.0.2.3786.7z" --nwinst=1
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4544
    - - C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\2345SoftMgrShell64.exe
        
        "C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\2345SoftMgrShell64.exe" --install=SoftMgrMenu64.dll
        5⤵
        Executes dropped EXE
        Modifies system executable filetype association
        Modifies registry class
        
        PID:4616
- - C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ExtShell64.exe
    "C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ExtShell64.exe" --install=AvShellExt64.dll
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Modifies registry class
    PID:4104
- - C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ShellPro.exe
    "C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ShellPro.exe" --type=installstatic --installtype=new --usertype=GF --silent=1 --preversion=0.0.0.0
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:5944

C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeCenterSvc.exe
"C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeCenterSvc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345RTProtect.exe
  "C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345RTProtect.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeCenterCrashReport.exe
    "C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeCenterCrashReport.exe" --crashtype=Driver
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2792
- - C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeCenterInstaller.exe
    "C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SafeCenterInstaller.exe" --type=after_upgrade --invoke_product=6
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4108
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2104
- - C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SFGuard64.exe
    "C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345SFGuard64.exe" /notify_guard
    3⤵
    - Executes dropped EXE
    PID:2884

C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345SafeSvc.exe
"C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345SafeSvc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345RTProtect.exe
  "C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345RTProtect.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1728
- C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345SafeTray.exe
  "C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345SafeTray.exe" --type=logonauto --sf=1
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ShellPro.exe
    "C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ShellPro.exe" --type=repair
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345SafeUpdate.exe
      "C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345SafeUpdate.exe" --type=repairfiles --target=normally
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1308
- - C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345RTProtect.exe
    "C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345RTProtect.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:904
- - C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345NightMode.exe
    "C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345NightMode.exe" --type=silent --switch=enable
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4500
- - C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ManuUpdate.exe
    "C:\Program Files (x86)\2345Soft\2345PCSafe\7.9.1.13920\2345ManuUpdate.exe" --type=manusaferepair
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2345RTProtect.exe

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\2345RTProtect.exe
Size 2.3MB
SHA256 72ce3134cbc1370f280bff1d682438310912a3797e6fac8ea04ff24b0ee71e66
MD5 9600db57d9769ad5df8059ff3e56db17
SHA1 387c972ce614351928b0b19f59063245fbddd093
SHA512 f22babe54cfc3d1b04a0a07196dba831437cc3afb112a982226b5250e5e6aae062f77bf3470dbfee4d111dbaf33e2ae89c4cb5ac698cfb898b9f658ef2cf7bd7
SSDEEP 49152:YdbEA3PRR6fPXofFOPmQiEX8EqR//uLhdQ4Go2Tr8Fx96w8F3Ct2I1z:q3PXIeFKpiEX8FR//uLs4GoZ96wEa
TLSH
T1C9B53B203746C63AFBC211B6596CEE5F5059BE540F6150CBE3C82B2EA9B4AE31633D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BQ01.data

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\BQ01.data
Size 3KB
SHA256 4370f764cb85700e242e8d3cb3d51b1d5a21f13777880e62db03c33c86a4b750
MD5 41a89e160941b6e9f5f734bac27f9465
SHA1 59ca0489e07256064dea1dec4d3444f10bcf7e45
SHA512 a4006a3846ffae8686163e0c8566ac5aa400c4a4a578799711f3f1bb0cdc317731020a1de5722e8cf5b82a974a3b7ee6bdffc99ca81fe049594cfea5eb2c6229
TLSH
T1EA813F675D5DEACDA1382B6D469A72608AC4D819F973BCB240473C45F90A0B32E42F2F
MD5 SHA1 SHA512 TLSH

Submit Download

64_2345SafeCenterSvc.data

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\Data\Recover\64_2345SafeCenterSvc.data
Size 8KB
SHA256 4c2716f23cdcb5de619a1a34f08fd596782b32339a2380ac614c912bc713386e
MD5 672a4fd5344635a5b56752497d81f343
SHA1 5b44f12353ff4ac60096083e55c3e89ab9d53689
SHA512 ed591366e4d04a5d82612dbe340bd31216992a390ad0fd66b208701c11366c28b359894dc2516af303af3bf703e4a51205f453e4033505b85d4f779dbe41d578
SSDEEP 12:7/ykXL2vVodSnV09YEeQHekgua90MHRG+3+XvWKamCraH1GrJI6TLMjUdOzjov9i:b1TSVvzQw3n3LmEaVAxLMqKjov9CEe
TLSH
T10FF16D417F80E783D4CA0A35CD6B4F547B60F6A24F25D107B2A4130E8EE3F546E66E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriverApi.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\DriverApi.dll
Size 765KB
SHA256 7da984552020a080d7fe319baf8112e2ce7fff157e5e8a6aee0abaa72e9a57bf
MD5 8a8757e05693e2b2bec48c4c6ea9ce0b
SHA1 54040b923ef02ca46567f0815d107acf1a249176
SHA512 756720a1c379d43734c2bacd0220619b44ace821f6fd0e8f400e8d08cf1312536535710c6d6c17f3727fdaef0cfae78c4f741cf136ad668f2b2e8c3a8271379d
SSDEEP 12288:yYZM2KmP9pohWTPLsToBDyVdNUDM9SKhFkg2CA4orK+LuH/bPOX0GlkYWzv:yYZMOFFPL8QDybMg0g2CA4CNLQbPOX07
TLSH
T108F45D20778DC23EE57D09F1593AAE9FD87D694D0BB084C793A57E6E88315C20B31A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriverInstall.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\DriverInstall.dll
Size 7.0MB
SHA256 7562f909ad5864bb70c0925eaaf78390cb12ef1ef0deda8c1a6425ef2efe24c7
MD5 89036567308b79702bbc209f4d93d55f
SHA1 54326c1808c0795f6e106be3cd5a1275de83fbec
SHA512 3022827f501f29cfc6632fc00f7fd7846284b56f0a0b9c601238019ffb72366ca4ffe05fdad12b538d2b340be23f91db3c65c51ff6b6528e6d624f1a92e12ce3
SSDEEP 98304:AhumgfmZrqrK1HFmkjFmgBDzDLwkPZkVExaie:O1H9jQ
TLSH
T154768D11E29148F1D9F7E1F4879EB236B97CB441071197CB43804BE99F62BC1AE3879A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NsProtectApi.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\NsProtectApi.dll
Size 67KB
SHA256 c9131a384d4eda8ceba30b38bc9286663d913d462f3d2564a1a097f8c2647793
MD5 436d581334d99a879448b00e58ce57b4
SHA1 b6e7d066b79f0fb2dd0bdcb65db5d0225a16233f
SHA512 c116736d5fcb7b446286a201b530efcf840e5324842a17c47c8e96455ddd35b896adf506df666c025b07ad3331d35b4436e91f3481c053fb448b53c9c9068fec
SSDEEP 768:Yco/H20vX1iictgGT3ER9u0MRhg7/jbPuNFYC45QvvozicjblfD3hAQ:Ag0G3ER9RMRhg7bbGNqC45igGCb3hAQ
TLSH
T1D5637C00BE1565B7DF89863174F8EB4E5869B9450FE4A0C7F7AA0B9A0C747C33A7160B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectLogistics.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\ProtectLogistics.dll
Size 1.9MB
SHA256 afdcf071642136b4c02e96601fb9e69a78e7a5b69a12257afcf08f51cf6bba3b
MD5 d0e6180c44d56f40c8561873e86c19fd
SHA1 7c6fae64eae8d8a4059656da6413cf5bf29f0bdf
SHA512 931e518c734d63e2f0fbf6f8713bf09542741b49e3cd1ff964dca70c641145f58cd67c8b0f90df40064b6e4adb751b0c969b9faf0cfbfb5383a284aa45c5dfc1
SSDEEP 49152:UDD8Fe7C6ceAmQmR0dC3Mhlf1oTkOFFjjYR3VwlaQuyOUa:eD1CeQhhlKg
TLSH
T1B09518117A46C236D26942F02A7DEE9A80ADBD7C9FB045CBB7C00F6A91319D36531F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TkNitrome.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\TkNitrome.dll
Size 1.9MB
SHA256 161bc9031a67e5cb36c6612943bcf845a66d4b72c734dff13c108cebe5402d63
MD5 4ee4279f7b9645faac89203f34db5400
SHA1 b49c556ad11b90507834934c1b810dc5a18d5b8d
SHA512 891d8dc0ae55c43eb02ec86dc39724f74c90e704a0292cfce524ad1184db1ef4920d31ec688a8eb4e8f5db64a31a8d557df0be328933d1de05dc642c8f53adb5
SSDEEP 49152:uBLS/2Hyc+arMl2nOe5MhHeG8475LcZAuAzII6ep3ndIMIwwg:uBLSuHyc+H2nlqHnPduAtdIM5wg
TLSH
T19E9533F393C97C71D979803B329C8684359CE21A89D6C6C1D5CFE9C1273A6E4A0D89E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebProtect.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\WebProtect.dll
Size 5.7MB
SHA256 b8a37512e41dbf31da7175077926b5b0cc456af9ab7b30aacd112555aa97ba17
MD5 40a6c3deadea6d15b13637765e3744e4
SHA1 b9bbb59c8ac37e79c12bec39e970d9a7589133d0
SHA512 a435cf0cc5d55d7d60e54054f822d712674237f2dc17cbe35cc3b9af9cf0f415e7682e87835bc6119210145baf286ac5acaf2e034cd12fdc352c05704c68d202
SSDEEP 98304:Cj4uhFsfMuwdv2vte/Ph8eH1SFlF96DdAVFu:Vtf9g4EZtH1SFlF94AVw
TLSH
T16A568E607BC7C77EE68E11B9577EDB6F00996F4087B485EBC3891A5EA9301D22633903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-console-l1-1-0.dll
Size 18KB
SHA256 24b07028c1e38b9ca2f197750654a0dfb7d33c2e52c9dd67100609499e8028db
MD5 aabbb38c4110cc0bf7203a567734a7e7
SHA1 5df8d0cdd3e1977ffacca08faf8b1c92c13c6d48
SHA512 c66c98d2669d7a180510c57bab707d1e224c12ab7e2b08994eb5fd5be2f3dee3dbdb934bcb9db168845e4d726114bce317045027215419d3f13dcfa0f143d713
SSDEEP 192:aBgW1hWi7u7jCjdks/nGfe4pBjSYpP4W5RKTt3E2sVWQ4GWc6CT7yqnaj/6g6dyh:dW1hWLam0GftpBjhFm3S4xltZEU
TLSH
T10E821A969EFC9543ECC2ADB017A8EA837D3DDBC31821905510AAF1ED28D33E1DB1462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-datetime-l1-1-0.dll
Size 17KB
SHA256 c64b7c6400e9bacc1a4f1baed6374bfbce9a3f8cf20c2d03f81ef18262f89c60
MD5 8894176af3ea65a09ae5cf4c0e6ff50f
SHA1 46858ea9029d7fc57318d27ca14e011327502910
SHA512 64b31f9b180c2e4e692643d0ccd08c3499cae87211da6b2b737f67b5719f018ebcacc2476d487a0aeb91fea1666e6dbbf4ca7b08bb4ab5a031655bf9e02cea9a
SSDEEP 192:fW1hWiH+49Cjdks/nGfe4pBjSY285a+W5RKTt3E2sVWQ4GW2TwE9qnajuZDAJaaj:fW1hWZ4wm0GftpBj8m3SLwwlUKTf
TLSH
T1C98209829ABC9143EDC3AE7063A8DE977D3C97C75D10801610A9F5E928C77D1EB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-debug-l1-1-0.dll
Size 17KB
SHA256 7e4cba620b87189278b5631536cdad9bfda6e12abd8e4eb647cb85369a204fe8
MD5 879920c7fa905036856bcb10875121d9
SHA1 a82787ea553eefa0e7c3bb3aedb2f2c60e39459a
SHA512 06650248ddbc68529ef51c8b3bc3185a22cf1685c5fa9904aee766a24e12d8a2a359b1efd7f49cc2f91471015e7c1516c71ba9d6961850553d424fa400b7ea91
SSDEEP 384:uW1hWcFm0GftpBjOQElEm3SQalndaYhppz:llVijElEXj
TLSH
T15982298A9FBCE483E9C2AD7052E4DE877C3C97C32D21816615A9F5982C837D1DB14A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-errorhandling-l1-1-0.dll
Size 17KB
SHA256 f8e3b45fd3e22866006f16a9e73e28b5e357f31f3c275b517692a5f16918b492
MD5 d91bf81cf5178d47d1a588b0df98eb24
SHA1 75f9f2da06aa2735906b1c572dd556a3c30e7717
SHA512 93d1b0d226e94235f1b32d42f6c1b95fadfaf103b8c1782423d2c5a4836102084fb53f871e3c434b85f0288e47f44345138de54ea5f982ca3e8bbf2d2bea0706
SSDEEP 192:cnmxD3jW1hWiRcvHCjdks/nGfe4pBjSYrteMMPiW5RKTt3E2sVWQ4GWCxMfqnaj9:cn4W1hWiQim0GftpBj9eXm3SR6lPp/
TLSH
T19D822BC69ABC9583EDC2AE705398DA837C3D97C75D2081561099F5E92CC33D2EB14A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-file-l1-1-0.dll
Size 21KB
SHA256 1d1c11fc1ad1febf9308225c4ccf0431606a4ab08680ba04494d276cb310bf15
MD5 eefe86b5a3ab256beed8621a05210df2
SHA1 90c1623a85c519adbc5ef67b63354f881507b8a7
SHA512 c326a2ca190db24e8e96c43d1df58a4859a32eb64b0363f9778a8902f1ac0307dca585be04f831a66bc32df54499681ad952ce654d607f5fdb93e9b4504d653f
SSDEEP 384:Y6PvVX7W1hWC1m0GftpBj4xm3SBvlmTwhsH:jPvVXeTVic1i
TLSH
T146A22943DAB8E247FDCBAE7111A5D9837C3883C34820449616D9E3AD3CD73C6E798969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-file-l1-2-0.dll
Size 17KB
SHA256 9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613
MD5 79ee4a2fcbe24e9a65106de834ccda4a
SHA1 fd1ba674371af7116ea06ad42886185f98ba137b
SHA512 6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c
SSDEEP 192:Y+W1hWifcvHCjdks/nGfe4pBjSYA89sX5W5RKTt3E2sVWQ4GWFuLOgVqnaj6uDp6:Y+W1hWoQim0GftpBj7sIm3SFOslD16hP
TLSH
T1AF821A928AFC9543EDC26D7063E8DA877C3C97C71D21805614AAF5E92C833E5DB2493D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-file-l2-1-0.dll
Size 17KB
SHA256 ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357
MD5 3f224766fe9b090333fdb43d5a22f9ea
SHA1 548d1bb707ae7a3dfccc0c2d99908561a305f57b
SHA512 c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca
SSDEEP 192:FZkW1hWiecvHCjdks/nGfe4pBjSYo3Vq34W5RKTt3E2sVWQ4GW2rOqnajd2siD+k:MW1hWdQim0GftpBj4VuFm3SWlg+0mw
TLSH
T1BE8228C59ABCA543FDC3AD7053E8DA877D3C97C31921816A04A9F6A82C833D1EB1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-handle-l1-1-0.dll
Size 17KB
SHA256 dba84e704ffe5fcd42548856258109dc77c6a46fd0b784119a3548ec47e5644b
MD5 18fd51821d0a6f3e94e3fa71db6de3af
SHA1 7d9700e98ef2d93fdbf8f27592678194b740f4e0
SHA512 4009b4d50e3cb17197009ac7e41a2351de980b2c5b79c0b440c7fe4c1c3c4e18f1089c6f43216eaa262062c395423f3ad92ca494f664636ff7592c540c5ef89d
SSDEEP 384:4W1hWypFm0GftpBjTnom3S4tOlDCEY5kD:zvViFoUtQ1Y5kD
TLSH
T1D1821986CEBC9583EED7AD705394DA837C3D97C31C2080660469F6A92CC73D1EB14A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-heap-l1-1-0.dll
Size 17KB
SHA256 535e9d20f00a2f1a62f843a4a26cfb763138d5dfe358b0126d33996fba9ca4d1
MD5 ff8026dab5d3dabca8f72b6fa7d258fa
SHA1 075c8719e226a34d7b883fd62b2d7f8823d70f1a
SHA512 9c56ff11d5843ba09cd29e3bc6c6b9396926c6a588194193ba220cfa784b770ab6756076f16f18cfea75b51a8184a1063ef47f63804839530382f8d39d5cf006
SSDEEP 384:nEleW1hW59XRm0GftpBjywVpm3SJflndaYhp6a:uADVig69F3
TLSH
T1518219C98EBCA543ED87AE706398D9877C3C97C31D21406A05A9F5D92CC37E1DB24A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-interlocked-l1-1-0.dll
Size 18KB
SHA256 4997fda5d0e90b8a0ab7da314cb56f25d1450b366701c45c294d8dd3254de483
MD5 cfe87d58f973daeda4ee7d2cf4ae521d
SHA1 fd0aa97b7cb6e50c6d5d2bf2d21d757040b5204a
SHA512 40eb68deb940bbe1b835954183eea711994c434de0abbdea0b1a51db6233a12e07827ad4a8639ae0baf46dd26c168a775ffe606c82cbe47bae655c7f28ab730b
SSDEEP 384:l5iYsFqW1hWfsngm0GftpBjWfshFIvgCcm3SHlg+0Ix:loZngViwfsh6gxfx
TLSH
T131821A859AFCA083FDD69D7097A8DD877C3C97C31920812605A9F5AD2CC73D1EB14A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-libraryloader-l1-1-0.dll
Size 18KB
SHA256 2dd4ebaa12cbba142b5d61a0ebf84a14d0d1bb8826ba42b63e303fe6721408df
MD5 0c48220a4485f36feed84ef5dd0a5e9c
SHA1 1e7d4038c2765cffa6d4255737a2a8aa86b5551c
SHA512 e09951785b09f535340e1e6c256df1919485b4dad302b30d90126411cc49a13807b580fa2fcd0d6f7b64aac4f5b5ea3e250b66035a0e2f664d865408c9b43d48
SSDEEP 384:b+g4vuBL3BmW1hWZ1m0GftpBjLOoZm3SNvVlgCopp3y:b+YBL3BdOViUyRv4Hn3y
TLSH
T1F4821CD6DABCA183E9C2AD7052A4DD877C3C97C35D21846A04A9F2DC1CD33D1EB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-localization-l1-2-0.dll
Size 20KB
SHA256 a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41
MD5 23bd405a6cfd1e38c74c5150eec28d0a
SHA1 1d3be98e7dfe565e297e837a7085731ecd368c7b
SHA512 c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21
SSDEEP 384:9OMw3zdp3bwjGjue9/0jCRrndb5W1hW54wm0GftpBjvTNvwm3SBMltZ2m:9OMwBprwjGjue9/0jCRrndboUFViZ2Vu
TLSH
T1AB922A91DAFCE247F88EED703269D9877C3C97C64821945502F6FAA828D33D5EB5062C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-memory-l1-1-0.dll
Size 18KB
SHA256 ec573431338371504b7b9e57b2d91382b856aabf25d2b4ad96486efb794c198e
MD5 3940167ffb4383992e73f9a10e4b8b1e
SHA1 53541c824003b0f90b236eda83b06bec5e1acbf5
SHA512 9732acaa4db773f4f99f423d9feaebb35c197bbd468922348e0ad086f7131d83f6d9714dc7d375183e7cb8920cfe37f3da19b0041a9063cc60abe183375b1929
SSDEEP 384:tbtW1hWwDzDm0GftpBjQxY8m3SSlPpT2R:OzViiDqp2R
TLSH
T182822A8A8ABCA543EDC2ADB05394DE877C3D97C34C61C15611A9F5E92CC33D6EB10A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-namedpipe-l1-1-0.dll
Size 17KB
SHA256 dbd788b1c5694d65fa6f6e2202bfabb30adf77eb1973ceb9a737efb16e9edae2
MD5 990ac84ae2d83eeb532a28fe29602827
SHA1 0916f85cc6cc1f01dc08bdf71517a1dc1b8eaf78
SHA512 f0e4705a6890b4f81b7d46f66ca6b8ee82f647e163bce9ecad11d0bbd69caf4ff3c4f15e0d3f829c048b6849b99a7641861e6caf319904d4d61a6084f10da353
SSDEEP 192:DW1hWBuI2WksSrCjdks/nGfe4pBjSY7ecjkUA/W5RKTt3E2sVWQ4GWZ0MVqnaj6f:DW1hWQ3szm0GftpBjH2Wm3SPAlD16h9
TLSH
T17E822B918ABC9183ED87AEB053D8DE877C3D97C71D11805511AAF9D92C833E1EB24A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-processenvironment-l1-1-0.dll
Size 18KB
SHA256 9f1f26794fd664e0a8b6fbd53bfca33dcf7b0dc37faf3eb7782bc38dff62cd8c
MD5 0c700b07c3497df4863c3f2fe37cd526
SHA1 f835118244d02304de9eb3a355420ba9d0bd9c13
SHA512 8042dbd9e80e33e41993887b0289e143e967544389500ada9296b89bda37bb26918e4f370f8a1bdab8faacc4e0a6980794d6a3b5320e170ad4ef751384c9f0a8
SSDEEP 192:qHW1hWinluZCCjdks/nGfe4pBjSYUe0DFtct2W5RKTt3E2sVWQ4GWMZ6k8xL9qnP:qHW1hWRFm0GftpBjqt2m3Sn6R5lUKT4
TLSH
T1E5823BC5E9BCA143E9C7AD705398EAA73C3D87D31D108065016AFAA83CD73D1EB14A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-processthreads-l1-1-0.dll
Size 19KB
SHA256 4f187f1b4b14763360c325df6b04d3ec3cc6d2cecc9b796bc52a6c7196b0b2cc
MD5 1dda9cb13449ce2c6bb670598fc09dc8
SHA1 0a91fe11b9a8321ca369f665a623270e5ac23176
SHA512 4e106c8a52033352c91b65cf65ec459de764c125136333a2f4ba026efdde65f3f71b1f6f11e4c580150ac8a9779825ba5e2af0e14df999a198cfe244e522c28d
SSDEEP 384:Sfk1JzNcKSIdW1hWuQim0GftpBjuksUm3SlSlDCE4E:pcKS1/fVi4Uy14E
TLSH
T139921ADA8ABCD683E9C6AD706254E9533D3EC7C21C25806205E9F2E93DDB3D1E72452C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-processthreads-l1-1-1.dll
Size 18KB
SHA256 ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1
MD5 95c5b49af7f2c7d3cd0bc14b1e9efacb
SHA1 c400205c81140e60dffa8811c1906ce87c58971e
SHA512 f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3
SSDEEP 384:NS8DfIelW1hWu4wm0GftpBjBFm3SzlJrI:NSLecfFViRTs
TLSH
T15C822AC29ABC9543E9D36E7062E8E9877C3DD7C31D21802510A9F6AC19C73D1EB1463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-profile-l1-1-0.dll
Size 17KB
SHA256 f941c232964d01e4680e54ab04955ec6264058011b03889fe29db86509511eba
MD5 cedefd460bc1e36ae111668f3b658052
SHA1 9bd529fe189e0b214b9e0e51717bdf62f1da44ea
SHA512 2c845642b054bc12c2911bfe2b850f06fecafef022180c22f6ffd670f821e84fcad041c4d81ddadb781ddb36cb3e98dfe4eb75ec02b88306ef1d410cbb021454
SSDEEP 192:DgW1hWiIOuDz7eCjdks/nGfe4pBjSYpRrW5RKTt3E2sVWQ4GWN/VWkqnajTWOwCd:DgW1hW7DzDm0GftpBjem3SShlgCopp2
TLSH
T19D823A968BBC9483E9C3AE7053A8DA877C3DD7C31D21905510AAF5E92CC73D1EB14A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 17KB
SHA256 966a38ed7034f8d355e1e8772dfc92f23fb3c8a669780ed4ac3b075625d09744
MD5 65fc0b6c2ceff31336983e33b84a9313
SHA1 980de034cc3a36021fd8bafff3846b0731b7068e
SHA512 f4ebc7a6d12ae6afa5b96c06413a3438e1678b276b1517da07d33912818fc863b4d35cb46280f12cf90e37bc93e3ab5e44ea6f75767a314c59222b7d397e5b6a
SSDEEP 384:A6uGZW1hWZ4wm0GftpBjfNDm3S3xlgCoppl8uOf7:wGIQFVi3DsHnlVOf7
TLSH
T123821A96CABC9543E9C3AE7053A8EA877C3CD7C31D20916614A9F6E81CC73D1AB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-string-l1-1-0.dll
Size 17KB
SHA256 339966ae75675a03f628c4ddd5d3218abb36cbcf6ddce83b88c07336d732b8ae
MD5 e7a266dd3a2a1e03d8716f92bede582d
SHA1 d4b97ce87c96de1f39fea97cca3992d292b2c14e
SHA512 31168663fd71b901b1b9152ff288d4e1567003e5fcd1f1c9dfe36d26d2eb16b0932ec8cd34833dab25531f768a01de45c2483f92d4e79f92a89389c02bc05156
SSDEEP 384:EyMvlW1hWBYBm0GftpBjnmm3SC1lDCE9xt:EyMvcNViYm19xt
TLSH
T124821A86DEBCA543EDC36E701394DA877C3C97C31D60916600A9F6E92CC37E1AB2462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-synch-l1-1-0.dll
Size 19KB
SHA256 cc76a4e82e0e0cd08df3bb8f5ad57142305e0f666cc32599d76e363d0b43efcb
MD5 c1dcdb0fabc8ae671a7c7a94f42fb79a
SHA1 99355912d7a7d622753b2a855cae4f5a4e50146f
SHA512 6d92e7520aeebfe60aab43d6616b76a2dd385edcaa217db60003a0c0cbcb0e367063d240e38a19d0b8bee2f2e7d4b982c4f08c8e9ccf34c7f670cb49f6561fff
SSDEEP 384:rdv3V0dfpkXc0vVa7W1hWf1m0GftpBjum3Su5TlD16ho:rdv3VqpkXc0vVaewVi4a5l
TLSH
T153922B86DAFCE583F98BED705299C9837C3887C75D20842610AAE5AD3DD33D4EB1852D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-synch-l1-2-0.dll
Size 18KB
SHA256 758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893
MD5 6e704280d632c2f8f2cadefcae25ad85
SHA1 699c5a1c553d64d7ff3cf4fe57da72bb151caede
SHA512 ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6
SSDEEP 384:DtZ3UW1hWxDzDm0GftpBjEILkm3ScrlPpU9:n0ViIQxi
TLSH
T1318239D69BBCA643EDC2ADB053E4D9877C3C97C30D10945610AAF6A92CC73D1EB14A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-sysinfo-l1-1-0.dll
Size 18KB
SHA256 f94210b39cdc812beb7342a47e68673ea2116d0ad9266fcf8d7cedaa9561fc38
MD5 887995a73bc7dde7b764afabce57efe7
SHA1 363fd4e7ad4a57224e8410154697df5e8629f526
SHA512 d088eb1c6958774e20f0e2884136b4e2b978efd16f557dbc55e64011abbce0768054f7e6d881c110182824143a39101fdae273ed614738aa7ba5c727b27f6677
SSDEEP 192:4Lv12KIMFAW1hWBATVCEmCjdks/nGfe4pBjSYeXwfFzW5RKTt3E2sVWQ4GWURDPV:4LN2NW1hWavm0GftpBjtfFam3SvrlJrV
TLSH
T1418218969ABCA543F8C6AE7062E4DA837C3C97C31D11811901EDE7A82DD33D6EB1463D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-timezone-l1-1-0.dll
Size 18KB
SHA256 b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b
MD5 c9a55de62e53d747c5a7fddedef874f9
SHA1 c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad
SHA512 adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb
SSDEEP 384:rWW1hWv4wm0GftpBjgpm3SSP9lndaYhpwe/:ReFVi02vZ
TLSH
T1D08229D6DBBCA443ECC75E7053E8E9837D3C97D71C20805600AAE99928C73D1DB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-core-util-l1-1-0.dll
Size 17KB
SHA256 34c5dee6d566252c0ceb7d9a21e24d5f297af2b26c32e0c7808bbd088aa9a6a9
MD5 29e1922b32e5312a948e6d8b1b34e2d9
SHA1 912f54be8438f45e1562a47294091d522cd89356
SHA512 837cd03ee0195dc94bab0662ff3b8cd1be2dedd8a3254318d25dfea6e88d07211186fa367f41ab864560e10a22220deb3ed05ccf82d60ac80c71dfed08afbea3
SSDEEP 384:dW1hWxDzDm0GftpBjDNtfm3SXl4aRGW6acyjR:0oVitL2GjR
TLSH
T199822986DABC9443E9C3AD702398DA877C3C97C31D61905614AEF5A82DC73E1EB14A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-conio-l1-1-0.dll
Size 18KB
SHA256 a95b1af74623d6d5d892760166b9bfac8926929571301921f1e62458e6d1a503
MD5 a668c5ee307457729203ae00edebb6b3
SHA1 2114d84cf3ec576785ebbe6b2184b0d634b86d71
SHA512 73dc1a1c2ceb98ca6d9ddc7611fc44753184be00cfba07c4947d675f0b154a09e6013e1ef54ac7576e661fc51b4bc54fdd96a0c046ab4ee58282e711b1854730
SSDEEP 384:tW1hWv4wm0GftpBjp+m3S1ZXlndaYhpt1:k+FVib+ZvN
TLSH
T127821B869AFCA543E9839E3063F8DEC3BD3D97C32D205066446AF59828C37D5AB1462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-convert-l1-1-0.dll
Size 21KB
SHA256 b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5
MD5 9ddea3cc96e0fdd3443cc60d649931b3
SHA1 af3cb7036318a8427f20b8561079e279119dca0e
SHA512 1427193b31b64715f5712db9c431593bdc56ef512fe353147ddb7544c1c39ded4371cd72055d82818e965aff0441b7cbe0b811d828efb0ece28471716659e162
SSDEEP 384:FuyhW1hWF4wm0GftpBjErIm3StlndaYhpFeD:4cFViUIbi
TLSH
T17EA20887A6E87F52E9CB1B7122FDDBD32D384782195042B48217E59C38837D1BE66C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a
MD5 39325e5f023eb564c87d30f7e06dff23
SHA1 03dd79a7fbe3de1a29359b94ba2d554776bdd3fe
SHA512 087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085
SSDEEP 192:4rW1hWiSu7jCjdks/nGfe4pBjSYC69poCxW5RKTt3E2sVWQ4GWmEsSC9qnajuZDW:AW1hW6am0GftpBjtBQm3SzSKlUKTT
TLSH
T125821A869ABC9543EDC3AE7053F8DA877D3D97C75D10512A016AF5982CC33D1EB20A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-filesystem-l1-1-0.dll
Size 19KB
SHA256 ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065
MD5 228c6bbe1bce84315e4927392a3baee5
SHA1 ba274aa567ad1ec663a2f9284af2e3cb232698fb
SHA512 37a60cce69e81f68ef62c58bba8f2843e99e8ba1b87df9a5b561d358309e672ae5e3434a10a3dde01ae624d1638da226d42c64316f72f3d63b08015b43c56cab
SSDEEP 384:Cq6nWm5CZW1hW9YBm0GftpBjVem3SuPvlg+0Pd:T6nWm5CIhViDeKPmd
TLSH
T1049208879AECAD43ED835F7112F8DBC73E3D97C2095291668066E1A839C33C0BF15969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-heap-l1-1-0.dll
Size 18KB
SHA256 675b1b82dd485cc8c8a099272db9241d0d2a7f45424901f35231b79186ec47ee
MD5 1776a2b85378b27825cf5e5a3a132d9a
SHA1 626f0e7f2f18f31ec304fe7a7af1a87cbbebb1df
SHA512 541a5dd997fc5fec31c17b4f95f03c3a52e106d6fb590cb46bdf5adad23ed4a895853768229f3fbb9049f614d9bae031e6c43cec43fb38c89f13163721bb8348
SSDEEP 384:XY3eBW1hWqvm0GftpBjtzsxm3SKulndaYhp6s:zQzViATv
TLSH
T1A8822B869ABCA543ED83AE7062E8DAC73D3D97C36D118066406EF5D92CC33D4AF1462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-locale-l1-1-0.dll
Size 18KB
SHA256 8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65
MD5 034379bcea45eb99db8cdfeacbc5e281
SHA1 bbf93d82e7e306e827efeb9612e8eab2b760e2b7
SHA512 7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256
SSDEEP 192:lW1hWi6+49Cjdks/nGfe4pBjSY38yMsW5RKTt3E2sVWQ4GWbGBfqnajE49dRX3tK:lW1hWa4wm0GftpBjlWm3S7dlPptZA
TLSH
T11B823D86D6BCA583EDC35EB056E8DA877D3D97C319118066109AF5E82CC33D5EB10A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-math-l1-1-0.dll
Size 28KB
SHA256 39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672
MD5 8da414c3524a869e5679c0678d1640c1
SHA1 60cf28792c68e9894878c31b323e68feb4676865
SHA512 6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa
SSDEEP 384:jOTEmbM4Oe5grykfIgTmLmW1hWSsngm0GftpBjGm3SAlD16hX:lEMq5grxfIndCngVis5
TLSH
T159D2D74789ECFF63D9CB5FB711F4CBCA69385B9254E1A4B0C89BA18834927C03E47919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-multibyte-l1-1-0.dll
Size 25KB
SHA256 a6b83b764555d517216e0e34c4945f7a7501c1b7a25308d8f85551fe353f9c15
MD5 19d7f2d6424c98c45702489a375d9e17
SHA1 310bc4ed49492383e7c669ac9145bda2956c7564
SHA512 01c09edef90c60c9e6cdabff918f15afc9b728d6671947898ce8848e3d102f300f3fb4246af0ac9c6f57b3b85b24832d7b40452358636125b61eb89567d3b17e
SSDEEP 384:2y+Kr6aLPmIHJI6/CpG3t2G3t4odXLNW1hWOXRm0GftpBjVm3SKlDCEIy:2ZKrZPmIHJI6abVi/Q1Iy
TLSH
T18EC2746B8EB82E52D58BD7F3B5F1C7C73A354F8104C06375A16B95883841BE9BE12E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-private-l1-1-0.dll
Size 71KB
SHA256 dc25a882ac454a0071e4815b0e939dc161ba73b5c207b84afd96203c343b99c7
MD5 3d139f57ed79d2c788e422ca26950446
SHA1 788e4fb5d1f46b0f1802761d0ae3addb8611c238
SHA512 12ed9216f44aa5f245c707fe39aed08dc18ea675f5a707098f1a1da42b348a649846bc919fd318de7954ea9097c01f22be76a5d85d664ef030381e7759840765
SSDEEP 1536:g0DjXDe5c4bFE2Jy2cvxXWpD9d3334BkZnVPL9VG:XjDe5c4bFE2Jy2cvxXWpD9d3334BkZnI
TLSH
T11C632ADB89E93F22E58FF7A367FB17C91B253B4408806174E9CB956B3485399BC13A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-process-l1-1-0.dll
Size 18KB
SHA256 707c9a384440d0b2d067fc0335273f8851b02c3114842e17df9c54127910d7fb
MD5 9d3d6f938c8672a12aea03f85d5330de
SHA1 6a7d6e84527eaf54d6f78dd1a5f20503e766a66c
SHA512 0e1681b16cd9af116bcc5c6b4284c1203b33febb197d1d4ab8a649962c0e807af9258bde91c86727910624196948e976741411843dd841616337ea93a27de7cb
SSDEEP 192:hRQqjd7hW1hWif+49Cjdks/nGfe4pBjSYr+c24QLW5RKTt3E2sVWQ4GWw899qnaP:hKwW1hWZ4wm0GftpBjh24Jm3SwlUKTw2
TLSH
T12D8229C7DAFC9583DA936E7052B8DBC7BE3E97C35C109125806AE09D38833D5AB2052D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-runtime-l1-1-0.dll
Size 22KB
SHA256 1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df
MD5 fb0ca6cbfff46be87ad729a1c4fde138
SHA1 2c302d1c535d5c40f31c3a75393118b40e1b2af9
SHA512 99144c67c33e89b8283c5b39b8bf68d55638daa6acc2715a2ac8c5dba4170dd12299d3a2dffb39ae38ef0872c2c68a64d7cdc6ceba5e660a53942761cb9eca83
SSDEEP 384:Lb7hrKkW1hW54wm0GftpBjGOm3SdWlmTwhctW:LbNrKn8FVinhZW
TLSH
T185A2098396FC7F53E9872F7222F8DBC76E399782191041768497E0D828C37C1BE1661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-stdio-l1-1-0.dll
Size 23KB
SHA256 7bcab4ca00fb1f85fea29dd3375f709317b984a6f3b9ba12b8cf1952f97beee5
MD5 d5166ab3034f0e1aa679bfa1907e5844
SHA1 851dd640cb34177c43b5f47b218a686c09fa6b4c
SHA512 8f2d7442191de22457c1b8402faad594af2fe0c38280aaafc876c797ca79f7f4b6860e557e37c3dbe084fe7262a85c358e3eeaf91e16855a91b7535cb0ac832e
SSDEEP 384:/ZpFVhHW1hWxgYBm0GftpBjMm3SNlndaYhpn3p:boEVi6DBp
TLSH
T1B3B2078796EC7E03E6C78B322AF9EBDB1A3487C3281461798017E5D835C63D8BE17519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-string-l1-1-0.dll
Size 23KB
SHA256 73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa
MD5 ad99c2362f64cde7756b16f9a016a60f
SHA1 07c9a78ee658bfa81db61dab039cffc9145cc6cb
SHA512 9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7
SSDEEP 384:jiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWS4wm0GftpBjwwO5m3S9lJrm:j6S5yguNvZ5VQgx3SbwA71IkFhbFViWs
TLSH
T198B2D64386F83F42D9CB5BB256F9CBC72E388F82164052759077E5D838827D2BE27919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-time-l1-1-0.dll
Size 20KB
SHA256 4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138
MD5 9b79fda359a269c63dcac69b2c81caa4
SHA1 a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb
SHA512 e69d275c5ec5eae5c95b0596f0cc681b7d287b3e2f9c78a9b5e658949e6244f754f96ad7d40214d22ed28d64e4e8bd507363cdf99999fea93cfe319078c1f541
SSDEEP 384:iUW1hWQ4wm0GftpBjddQxm3SLDlD16h1S:eRFViexn1
TLSH
T11D92F9838AF8A647E9C75F7112FCDBDB7F3857C2199160664166E4983A833D0FE2242D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\api-ms-win-crt-utility-l1-1-0.dll
Size 18KB
SHA256 7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95
MD5 70e9104e743069b573ca12a3cd87ec33
SHA1 4290755b6a49212b2e969200e7a088d1713b84a2
SHA512 e979f28451d271f405b780fc2025707c8a29dcb4c28980ca42e33d4033666de0e4a4644defec6c1d5d4bdd3c73d405fafcffe3320c60134681f62805c965bfd9
SSDEEP 192:UfHQdurW1hWiSuDz7eCjdks/nGfe4pBjSYp2VZGW5RKTt3E2sVWQ4GWO3uDVqna9:UfVW1hWKDzDm0GftpBjYLm3Sy5lD16hC
TLSH
T1F7822A868AFCA643EDC76E7053E8DAC77C3D97C319218165406AF5D928837D1EF2052D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\concrt140.dll
Size 243KB
SHA256 b721897db5542d5b0c970ec624440442ed9ae781e55147feb9ff264f70f66cde
MD5 8651e6272e310d5c64d0c91ca975b029
SHA1 0e2433c8771ac420b5684c79e96eb7e206350757
SHA512 d99d049b9ae9f7bcf9e6737b26a90f544a08ff49e06fdc39617b869eb97676024e18ba42e680db255a8a04f323de494dd8e7b706007e9b961c78a64cdf078ff6
SSDEEP 6144:vGh9nrxRw13UyU2G8g1QYYZTDt3n2x+Bdv5zsSiBsTYrPlUEYD/QzkRWAFcUv12W:4InTDtXF15zsSiyZ/0UkzcP
TLSH
T113345EA1394084B7F79F0732852CDA6B60FEA74027F981D71F6CDA5A2EA09C1ED31563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl_x86.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\libcurl_x86.dll
Size 2.1MB
SHA256 aa65b590b535eda30e42baa4eac59860ce7414cbce396968e8818faa4df79fc0
MD5 f59fe0dac40e078cc7af8eb665cef3db
SHA1 33e2823fc6b45f03aec0e48a5750642558559496
SHA512 90bd3e940a278298f2eee528467db9b7e0beed53b0d5fde7c354ccb81a049270610136c61c2698aee921dd8414ff7e719ac4f5e1596e3c2d8cf99067d90c4a49
SSDEEP 49152:5GUR9r6hl8IXBPZ68L20v/SU8Y7NriOPquwgtJIpk:5GUR9r6b8IbBLjv/SUp7NriSP
TLSH
T1EBA5AE02FB8195B2E6DB427862FA677F8E3A55205328C9D3C79138749D201D2773E78E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp120.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\msvcp120.dll
Size 444KB
SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
MD5 fd5cabbe52272bd76007b68186ebaf00
SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
TLSH
T11AA45B237B864CF2D19E53B231C9531557FAFC6441B1F343ABEEE1692FA6282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\msvcp140.dll
Size 438KB
SHA256 2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01
MD5 1fb93933fd087215a3c7b0800e6bb703
SHA1 a78232c352ed06cedd7ca5cd5cb60e61ef8d86fb
SHA512 79cd448e44b5607863b3cd0f9c8e1310f7e340559495589c428a24a4ac49beb06502d787824097bb959a1c9cb80672630dac19a405468a0b64db5ebd6493590e
SSDEEP 12288:UEPa9C9VbL+3Omy5CvyOvzeOKaqhUgiW6QR7t5s03Ooc8dHkC2esGgW8g:UEPa90Vbky5CvyUeOKg03Ooc8dHkC2ed
TLSH
T1B9A43922BB464DF2E59E53B671C5531287F5FC250360E3C393EAE0296F662C2A733691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr120.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\msvcr120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
TLSH
T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rcrs.data

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\rcrs.data
Size 21KB
SHA256 3cd31e8153516f5036daae481ace74a043aa6a85b76b8d23f59d0e334f544fe4
MD5 eb1a6c7eda1081c406b5e53c409c51ae
SHA1 05dc0cb2ab2595b09818e4959f5373a2ac82c253
SHA512 d8ad6e8281fbb17678a3b8708ccb72f06f87e1436c363cdc8a27e2101fe14f1e9235d4349a5d18877ff287658edba8d7e746815296e09d6f60550cc851c9b423
SSDEEP 192:HaH81ccQ7FpDBUhcboMSwYeMEcVAick3Ke0v3or1Nag+vZxUFji+iHqerp5ap+VS:6X/alKBxV2vBxkfjhnqndn
TLSH
T19FA28EED309A5DCE0F499EDF8A1FDF26789A2B17AA54181701F38F81F99702705E01E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\ucrtbase.dll
Size 1.1MB
SHA256 6f8f05993b8a25cadf5e301e58194c4d23402e467229b12e40956e4f128588b3
MD5 6343ff7874ba03f78bb0dfe20b45f817
SHA1 82221a9ac1c1b8006f3f5e8539e74e3308f10bcb
SHA512 63c3d3207577d4761103daf3f9901dd0a0ae8a89694ad1128fd7e054627cdd930d1020049317c5a898411735e2f75e2103ae303e7e514b6387a3c8463a4fb994
SSDEEP 24576:Os974wcfeCepgb9qqu+XMO4nXIzvQVbe1SmcvIZPoy4/ZBVX:b96WghMOqI8Vbe1GZBVX
TLSH
T1FB455B22B71AD2B3DC6931782359B93216BCB5410F20A8D3BFC237E9B9301D176366D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\7.9.1.11484\vcruntime140.dll
Size 78KB
SHA256 9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c
MD5 1b171f9a428c44acf85f89989007c328
SHA1 6f25a874d6cbf8158cb7c491dcedaa81ceaebbae
SHA512 99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1
SSDEEP 1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv
TLSH
T12773AE22F0D180BFC566857452BAEA036B3D9A510FE18EDB6F986D841F79BC1E730217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HipsGlobal

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\HipsGlobal
Size 29B
SHA256 5313e624a817ebcb34675027d12b87465de4fc4fdddfdd74d244490c4911b8e4
MD5 99fb8e84b8aa92889349054a60e1f359
SHA1 1b3dd1afb4fe4533ca16db4dd3e7845c13b0e1c5
SHA512 2a99095109445c3ca1b9fad5c87fdfed331641401ca8d19d3ab4d109e18b9dc5feb739485f14f390bd3bcfa3a4325e3b1278fe1bb8690dd8df16edb9af52faac
MD5 SHA1 SHA512

Submit Download

PopupsMutex

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\PopupsMutex
Size 145B
SHA256 8fe9d532514672d7299987b89e83bfc835064e0b6bce808669537519dfea1ed8
MD5 6b75638c22f41234bb31bc1ac3ac8285
SHA1 5463bdfd5c65a92d4de0efdb3dccf7b743e6d407
SHA512 38732460ec22a9c8582ce9dc78692eb625bf6783f414b6143461b8f5f266efa314e9ff4d432a46bb9a7e79767de18065cde5c4e67458a69149d07959e77a6f27
TLSH
T15FC09B537B752903DA29097C00F60300773D65413571D717516431174E13A84AD75167
MD5 SHA1 SHA512 TLSH

Submit Download

SCWebSilAct

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\SCWebSilAct
Size 321B
SHA256 ed6bccf6dfbbfbeb1ecdb7fb4a3ee9ca6c71fba54eac55decfbeaa3fb5012a49
MD5 a9f421e631d75972e66c332b8ca2e6f3
SHA1 9a77e044d8c1eff4cd4e7cf4fb02a2d5c72cb97f
SHA512 9faae84ec53c18d1cb77f298e337100ed8abf58611b23ec90e23fc35e68ed2549cd3bbad04b11308c7043e8846a422776c6d0794e3e10f43d0909207e36360b0
TLSH
T118E05B5667E04583FDA927B115761B24253F7CF73500D1CF0061349E9D637465C11337
MD5 SHA1 SHA512 TLSH

Submit Download

SettingCenter

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\SettingCenter
Size 273B
SHA256 c24c8950c0d9f611308b6d34e083d68e8fa200c97f103e019e6508fc9cf4980f
MD5 26ccda86515aa5b9400acb34b7c95a3f
SHA1 c5e478ceb406953ec89fba0f91c49df252b21f72
SHA512 fad9debe23b3d4b9b03aee24ff0680db30093faab47828fb70a295c2b0f0ea5d36c4fe26efcfc89385d3119265ee700dfe213283b50b08baf7ed6253a8c90e43
TLSH
T1C7D0A78577D5420BF8B71F7E587E13507A10F4329911FF9F0569308D0C579C15D14A1B
MD5 SHA1 SHA512 TLSH

Submit Download

SettingCenter

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\SettingCenter
Size 977B
SHA256 2775ee0a9b6b7478f8cd6f64aa63106a1bc1651175370eb847c2c276f27463ad
MD5 9e34ecab3c8aee537698505916082429
SHA1 d46ac881ef3d9e7a2335d330170185d47a2e9495
SHA512 ba683706aa62a97b823c594b26c32411c7fe4dae5f116c205c6d17f7bfcccf37bfae55823528868aefdd04eebb2db4a9ae1006cfa7a611d7f012c360decc8753
TLSH
T13B118B9677D50106B8FB2F2D9E7E07106E17FC722A11D86F4416304E4E37AC59D242BB
MD5 SHA1 SHA512 TLSH

Submit Download

SettingCenter

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\SettingCenter
Size 1KB
SHA256 bcad861e0ca7e27c6442a8242e1a75836725465aaa99036e059af56a8e547efb
MD5 2367dace47f4483644fe2ef909ace394
SHA1 617c7958b1562d818805cead6222609560955258
SHA512 d583946f7f26ce616d81b161771cd707cc80f49518fe24a85fdb0cf14c916fe128ac6fbcd97d3b3aa1db3b4816abe24029486db9c8423128d3f9a0ae5f3b22d0
TLSH
T1C331F195BBE8020BB9BB6F398A7E47117E66F8251A11C96F4042314D4C379C1AC242BF
MD5 SHA1 SHA512 TLSH

Submit Download

SettingCenter

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\SettingCenter
Size 1KB
SHA256 410d176f22b8df782f6fb01b5c4ff6a726d415eca073ffe9a2e3cc73364d515a
MD5 3a6cf03d3a7822e94de22557d6853c6b
SHA1 bdf9b85466ac088c67058680ec911fcd13bda0fc
SHA512 b5b736780a008734fe1d7a2b125fcae11d44810c955fd3a1869dd6d322eadaa4ac30c87e97ac0d2771a6c6455583cba2707f7af151beef2a2eeb125c73efe725
TLSH
T1413135907BE80107B9BF2F388ABE47117D6AF8211A11C95F0042304E4C379C1AC246BF
MD5 SHA1 SHA512 TLSH

Submit Download

SuspectRecordConf

Path C:\Program Files (x86)\2345Soft\2345SafeCenter\CommonFiles\Config\SuspectRecordConf
Size 217B
SHA256 ff70678d81da4dd8a3a993d561c5d3b9e721fa1237ad3625d8dd31b3c0b6d011
MD5 ab4fd3cfbcce89b115fa474dce507fe7
SHA1 f9666734098af345fbc65750d2130d2779dd9a0e
SHA512 70b3f3ca466018b316bc393d8f3d9733ae7ade399a4f71046f20b9945ca9a9aff345fa82b3d8d80588be73534907e05095f5359b495f8accef0299e102b9f080
TLSH
T1E9D012427FEA4605BD79093435F943D47B62FD021E0AD94F0080610B2C239980E147A1
MD5 SHA1 SHA512 TLSH

Submit Download

FileInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nso7BFA.tmp\FileInfo.dll
Size 1.1MB
SHA256 2d6d9fdecfc5c4a658d728b9c9aae0e17c506fb8bbdcb8e94c665ba64d51c3ad
MD5 a0eb2cd1942c333ca12a14d2c8723ae7
SHA1 11311e5c2119d7e37a95781dcd7524ff2bfc0d79
SHA512 d3a9ac448f06c5121fa150c36c5f29735cb5fc979ce67f954e0aa234d8b900e92db3adab22b9101a4a045cdcad7ea1f38d6b457991f5ac8de7fc5b8e6fb23344
SSDEEP 24576:mbrJ1PR6FaCTdvB+eKZM5Zghr/Y3mdbS3UQOcT6587Ea4MUksGTo:MRoaCTdu6Zghr/Y3SuOcT65K4MUksGTo
TLSH
T1C1357D21B642C432E99E01B0253CDABA546C79711BB580C7F3D46F6EE9B05D3E232E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCWidgetPlugin.dll

Path C:\Users\Admin\AppData\Local\Temp\nso7BFA.tmp\RCWidgetPlugin.dll
Size 3.3MB
SHA256 90354234bef3cf24d9813b1d55cb034c2fec541e26a91a02088c52d820c35cce
MD5 080f672cf2a058d9a19c93da12c3a572
SHA1 65597999619c66e056d060010079a3f90ab84cd4
SHA512 0056124af6d2465038fcf2d08df28ee63247542387fadad41d55e0e4ece52bcf0114fb69225afd6ff0ca72d4408e03ea50b30eecd46fc1027ff379a3e5dc1326
SSDEEP 49152:Ro0Z39HDI+EM696SOwd8ny6k+48RIZnA9rS8l5DTIgyPgTQPNIfDCr2l9:RL3BDBvkfoo8RIZA9rS8DLQ8
TLSH
T161F59D20B792C076EA4E01B2156D9BAB58783F584B6194CBD3C83E7BAD311E23737917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso7BFA.tmp\System.dll
Size 27KB
SHA256 0b399864057723bd388f8924baca252f8ca582287f5862460d042bfb8d2f11bc
MD5 219b2454333b6a78e6a365bbaab66321
SHA1 44224f5bea0d9b1d39da783273277e2750c81444
SHA512 5e87a00c7dd23d26c7287c5d082721d37893a6408adcd9dda272499143e5cbe84177d62c611131f7b4e242693510d658630ebb3721007758cc9eb348d5282e39
SSDEEP 384:HxoXlBT3SaMINWf52+4kb1VYnYPLYZJzk/holCZsHL0Fu8JN77hh1nY:HypSvIWb3J2iClfC3hbY
TLSH
T144D25C42AB651CF2FAD68E3930E4F52B5D30B7D067D1C8E756A9C4406FC17D229B818E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl_x86.dll

Path C:\Users\Admin\AppData\Local\Temp\nso7BFA.tmp\libcurl_x86.dll
Size 2.1MB
SHA256 97b88d15406bdd99e4b2c89d1e366a400bc96d31dd4987c8fa02733c6296ff83
MD5 d2ca43a21ec1681e36bf5fc79a4d2b78
SHA1 1900808917de89cf3ceef7a50f33c24e0041294a
SHA512 3086da224b6886448b802c66eaaf909b236343bdb3a25a7a187a92a287068519703e23fd8c79e8b831c868374f59613d28560e0d706912bfc96be39875f89526
SSDEEP 49152:XGUR9r6hl8IXBPZ68L20v/SU8Y7NriOPquwgtJIpT:XGUR9r6b8IbBLjv/SUp7NriSo
TLSH
T1AAA5AE02FB8185B2E6DB427862FA677F8E3A55205328C9D3C79138749D201D2773E79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2345MonCfg

Path C:\Users\Admin\AppData\Roaming\2345AvScan\2345MonCfg
Size 1KB
SHA256 c4757f69efc5e9f2786609f82f234ca9019d93e439cfbb9980c91916109e33cc
MD5 9512e60e86621d5fe28b4f666c4f9801
SHA1 5373bd46fb5747fe8955ee8018d2353e5dcc4b5d
SHA512 8a6dea824bc84794373ceab39af244e8e3af93ac289e8978dff8e5d904a89a084ecbae64b4281708afe08b499de71e979aa615119c2b7a3d278116bdcde64c07
TLSH
T1AB115283B7F8A9A6F8892B34887EA7056776BCE40026C49F015A302E4D37EC40D013F7
MD5 SHA1 SHA512 TLSH

Submit Download

SafeTray

Path C:\Users\Admin\AppData\Roaming\2345PCSafe\Config\SafeTray
Size 233B
SHA256 e5d4cf4c2fb0e8edc4f6622357a5a1a1336bb03856225392d32a68c33f9de22f
MD5 6ce12ae78355a0e44a5d93b967d18b6e
SHA1 86198f72c0fb1989132cc5dfc5e3c883c57bf857
SHA512 d9a325dd5623a5b03bbf23b7fa8efceeccc27a87c15c6f86f5fea52059df13799735359e23313d5fa3fc7df70b32b3478ae0b6b77986421ece1f1a1dfa2a16bf
TLSH
T173D0220D97C4030FCFBE2F3082AE0B2AB1DC78000810D99FA20232AF8C17840EDD21A6
MD5 SHA1 SHA512 TLSH

Submit Download

fppcycfg

Path C:\Users\Admin\AppData\Roaming\2345PCSafe\Config\fppcycfg
Size 249B
SHA256 4296bbd9dcbaeae2a87e1b3b0459404ee8fb453c56208e4f6b54407a9472f88f
MD5 a50cac197ac75cfcc0b039fb2c8fbe95
SHA1 65fdc5d42a4d6aae1bbc698e6206a82ada165f5f
SHA512 553450decc7a2382016721dd5670ceee02457f28a71ddbd49cf796249d6b2e04c6a64491959318d4574a8d9c6874c43fcab73da073c7c87d06bef0e852433ebf
TLSH
T127D0A7982B626037F5F90A3014D90316782CA4860202C24E40C2348C8D362857C1412E
MD5 SHA1 SHA512 TLSH

Submit Download

SafeDownloader.lock

Path C:\Users\Admin\AppData\Roaming\2345PCSafe\Data\SafeDownloader.lock
Size 4B
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Submit Download

UserLabelStatSwitch

Path C:\Users\Admin\AppData\Roaming\2345SafeCenter\Data\UserLabelStatSwitch
Size 233B
SHA256 da71decaf4a28aa1396cf5fd1f496336a81867d862e4bc720e0612ecad3ef7b4
MD5 da65159864b62405edb4caeb9a4ef935
SHA1 2c9db9d53bd2ee136a17cde8110e02a6002a8789
SHA512 c7d1bef4bf2a4699c289a99fb805223c46e11bcb90d3d59c74776a9e931996d614a84b23c3e4e7ed2e4d757a92a2539043468fe21e294224eca08b6867233174
TLSH
T19FD012A0B7E41063F5BE2B38417E07817B2EFC40182AE13F9026252D0D32FD89D90776
MD5 SHA1 SHA512 TLSH

Submit Download

InsTmpCfgData.dat

Path C:\Users\Admin\AppData\Roaming\InsLogicCfg\InsTmpCfgData.dat
Size 217B
SHA256 7aa5a4162cbf6d6e055b8fb79013d1814fed779b3fd699ad6b7f86ff6fe4f250
MD5 753de8050e4c7ec4c62fdcb3d6cd0e30
SHA1 836bcf9370937ca5015c94556b7d35a246f95369
SHA512 3d1a131604bbaf7d6d87f9af791a462dee10a8f6f3c536ea45740d8fc106a2e362279dbbbeb1d079e479d096c3941e8c9aa991c178ae6bdeb772b8561e15e07a
TLSH
T156D012408FC4DD07E96D56F515F91305F961B9541980E50F728039098DA3094BCE016A
MD5 SHA1 SHA512 TLSH

Submit Download

2345MiniUI.dll

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\2345MiniUI.dll
Size 3.6MB
SHA256 14e9351fca41e261ba9f32032d6f716064f62a873a5db576833d05b630bdddb4
MD5 764a04095c39729502e903d5f4159522
SHA1 8c4fca6daa906e6588358c97370a0f9246a41840
SHA512 549ffc737688084ba361955b812a93f44a7c1b7984e19a26b0191713437bf853f335a2d68b0dd8035322a636ce5edef60262c42531e47d12b13cce39db4120c3
SSDEEP 49152:r53t0EpuDWO3479qxzjzF0/TgGYrfDHfwH/U:ttG6O347WFXrLH5
TLSH
T151068D207A67C6B6D58923F434AEB96F91E8674C0B3804D792D81D69E4783E31EB31D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2345SoftMgrShell64.exe

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\2345SoftMgrShell64.exe
Size 621KB
SHA256 be898f77a4d55fd08ad5e3554769d7fbd55aa0b52f1a854d3114ca464888a9e4
MD5 41ee948ba0b50a6a4d1fa9a383e552fa
SHA1 ce37a90bb4db95f885b7eaa3d7a2f08373f45245
SHA512 bdb0d72752c67967ec6fe3440fb26773d9e17f9f9f277525716dafdeadb636f9e4850cf5c0c7aee61ad38c3082d6a3e99c8f7001a02a6f4b218db57bb9bc11ed
SSDEEP 12288:AQQghIMHXLEE5Ye789nQCtJSSwfLItoKcKaGP:AQQrMH7EE5Ye789nQCtJS7fLuoKBae
TLSH
T171D44A593B9541B5C13BD13DC6928A16FAB374015F319ACF03A9936A9F332E15F3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoftUninstall.ico

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\2345Soft\icon\SoftUninstall.ico
Size 5KB
SHA256 2ce7d429e468e0306bf7c2b7d75a0cf859fcf0db9ded7d8e8236dc34d22a33b6
MD5 76226deaca8b41a4dc5bd45657fefe68
SHA1 6aade9aaca587eb1d5e74893819c0b0c56e0927d
SHA512 657c0fb9cfc7369bf2c669bc62255c516f57d05984f28a1072bde870058ca2eb6e7e1032d50ecd7e7deb03a6034b918efae623b04323244419691f936bffeb88
SSDEEP 96:ikChRoHHrhsE03rl+rH3JbZR4eve6LLn5nS/yWQWB76SaQy:iRRUHrO7hE7eoL5QQVky
TLSH
T19AB195C79FCA1450D0503834BD7E26417A1C2CEBAAB62BE9298CFD0438B302B5655FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoftUpdateRemind.ico

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\2345Soft\icon\SoftUpdateRemind.ico
Size 57KB
SHA256 b94b43d9dc696f4e668d341394bbde177fbc5bf128e422cd93abef3016223b63
MD5 726ca80539d1212d4dce33ee6ce54dd5
SHA1 250075be3cdd375cb37ef9a88268105fbe928da5
SHA512 5bf4ec00b2366b102c0b9fa37682f4e05016fc686e0b92c45ce1b5e4c05c7cea94e3e54947cbea3a165a2b49a7b2df3759b144757a0f22f596c25a8f38d49a74
SSDEEP 768:WrxQSE/e7PTC6XN4Sfa7NzS+o9LOaJQALKNRkc6r/DlIpiGpL04I:i2O3XfCRS+UveibpDuNI
TLSH
T11443B27D02595593E07AB035C423A67F18735F6E4CC17B20187AADABAE713F05AF2463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoftDataCenter.dll

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\SoftDataCenter.dll
Size 1.9MB
SHA256 6101c46b8a01071b61718d281343022981eeaa9ca8c80c811f661b8556517860
MD5 9af7024e5dab217d4d455e9a64c69043
SHA1 a7544180ecb87c756832dea5227c39e00b90541a
SHA512 de7edf3e5065cf40a7766ea8f1124b78c58640db547d5d883cdd27bfaad5e1be04b4c2ff821785c538c09dd539c7c5299f9d10c4a5ffe38d740035af6daa4de3
SSDEEP 49152:9BJB4Z+9fJxziGOclb8H7e/jzB17cK+u1:RmExzTEbE
TLSH
T1AA958E707F87C57BEBCD02B555BDAAAF086966080B3444D7D2C81A6F58B48D32B32E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoftMgr.dll

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\SoftMgr.dll
Size 3.4MB
SHA256 d253c3dfd4fd67b67de579bbc3bec2b107b9a033d448c4bbcd88d45b170da709
MD5 b157c510014a00f764b492123219dad7
SHA1 ba52e663bcb63a7dccfbe58450eefc6d0940e7aa
SHA512 88a876b97b51f05b2719146ae8e5582064b715a66264fbf2d71f3017efde68817b5520b54666ee5926f0e1b1e84e3673189ebb33217b1f9cd8a7189103e05bb5
SSDEEP 49152:Pwu9HyolMfeL0BIGAve6oHKF3dz0MbBddNp8F9RkRrOuoquX86SVgGtZT7vqIdm+:fJoBLHKJrTODWZx9VgG9m+
TLSH
T124F53A203AA7C53EE6DD06B2597CD99F505E2A880F7440C7D2D86F2F98795C30A32E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoftMgrMain.dll

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\SoftMgrMain.dll
Size 855KB
SHA256 06e0f7a7f2404efe66d1063bc91687555d3124dd5a81ed28b8f406e862a69926
MD5 21051f618010937253ff1f13ffa2881b
SHA1 7101ab211dd6021648d2e6abca1c32ee250ff48b
SHA512 7bb4e7ae6d31aa2fd8ad4284b28a62d7fc5ad09bacc40eeb771ed8a66f903e78dc0a690bd0197874cc94078b9ba23b3611def8a063ff8ae7b008c7dfa702cd6e
SSDEEP 24576:jK+RYmesT07mhhvhDr0qXX4sNVdpTUS90KYC10:jnpvFz4sNVjTUSuC10
TLSH
T1BD1529603A5AC236D6BE52F1177D9F5F8079795C8FB009CB93C40E6AA8309D32539E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoftMgrUI.dll

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\SoftMgrUI.dll
Size 1.3MB
SHA256 f521400ae528638cd20359451ecbe05ffdf5447996d8721eaf2f97b792cbd06c
MD5 31885523beaa93d5d4ab03bdc351d117
SHA1 696a03bad11f5bf7f936839f0580d9d5759a33d3
SHA512 7ff077eb86cb96895d5ab8fa50a143a7b5a7df6765831954d97334024dc1405bb7f79fb03fa810b384f177872308fe7e28c85e81f8acd9ee31731c8bc7417dd2
SSDEEP 24576:06jxUn6AruOZiVjJ89MVFOhKExa815/vaeqD3jZ/7cnLKj/Aa263+TJIbyFurW43:0K1ArYN0jKEzfae9uj463rOFKhS+8j+
TLSH
T12355DF15D3945833E2258130B6A2942BDA72AE636AD5DE6530DFB00F0B63FB04C7BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SoftNotify.dll

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\SoftNotify.dll
Size 1.4MB
SHA256 39d93ce9f7d095ae976ce127184d04ba4c3e1620b7702e86e9d6b56e87eb1851
MD5 449ba3ef6fff8616447498a1fc0dfe1e
SHA1 5efe180fb1c2149693d26b1c6f797b8e88c69dc8
SHA512 7ce34214875e1d13a341314141747fbff42a44cbbfd8bdd740bb503dd9aae9363d361470fbdb72134896ad385d7c43ea53d8aa4ac49d81fd120a45327a1c469f
SSDEEP 24576:U5ArHBc3klilI0q0y4QKY0gmZxcpWyBaFoEhiesjTDt9vwwt1SOPjU9kZQYS:brBNlOTQKYpmz0BatAe4TDtQOPjU9kZm
TLSH
T188653960365AC236D59D13B06B3CDA9F605979740BB044CBB3D81F2EA8B29C36631F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl_x86.dll

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\7.0.2.3786\libcurl_x86.dll
Size 2.1MB
SHA256 07a41d74c2698eca2d80335a69f3a9e8323d430ace499b76fa69106a40b6f384
MD5 1b91b3bfab7385649519e20c179d5531
SHA1 885255d00548213b4a41aef8933616238ab599b5
SHA512 a5bbb0e4b9aeefb1a74de157cf460442b4e6f81bf89ae1025daffd7517de0ecd7692095d1fe7e5abaa818616b852670970eb6837cdfe937fbf6715f05b46346a
SSDEEP 49152:/GUR9r6hl8IXBPZ68L20v/SU8Y7NriOPquwgtJIpC:/GUR9r6b8IbBLjv/SUp7NriSF
TLSH
T1E4A5AE02FB8195B2E6DB427862FA677F8E3A55205328C9D3C79138749D201D2773E78E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Roaming\SoftMgr_2345\Application\config.ini
Size 50B
SHA256 4c0caaf2878925f600959f0f7e079ff5c4c66149921a451da70dd79f0ad9d802
MD5 5ceac1d63740ffe51067d29785e36c6c
SHA1 a898cfc2996bfe5a93639f151b9085f98483d547
SHA512 506fc24b3b3c083a1d04c59ca03e40b2062984afe59112afd13573ec186545e050b68ddfe5c346e8010586cfdb79113f4be21957f9d72255eb040b6caa381aab
TLSH
T1CA900245081493F11098419C511AC6C1DA6861470EDC6410525223054240645300E11A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1328-1720-0x000000006CA30000-0x000000006DA30000-memory.dmp

Download

memory/1328-1719-0x000000000C0D0000-0x000000000C0D1000-memory.dmp

Download

memory/1328-1718-0x000000000C0C0000-0x000000000C0C1000-memory.dmp

Download

memory/1328-1575-0x0000000037070000-0x0000000037080000-memory.dmp

Download

memory/3348-1717-0x000000006C320000-0x000000006CA25000-memory.dmp

Download

memory/3348-1711-0x000000006C320000-0x000000006CA25000-memory.dmp

Download

memory/3348-1699-0x000000006C320000-0x000000006CA25000-memory.dmp

Download

memory/5716-2070-0x0000000035930000-0x0000000035940000-memory.dmp

Download