9f330b9235b7e96e57ffc3aebbb08573f2824e895889a96a650de9316a959f0d

Analysis

max time kernel
140s
max time network
144s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UgPhone_install_1.1.23.exe
Size

79.6MB
MD5

8fe50abc9f6a05586be2253d9814d564
SHA1

63ffb05f2d98403920e5a9b1846c47711a5583d3
SHA256

9f330b9235b7e96e57ffc3aebbb08573f2824e895889a96a650de9316a959f0d
SHA512

2027dd167a715c9b54163a8396ad8a2a882fb71b4d6cc4baa4ecc14d1c965edb9a2268c1f9dda61071230ff3b59e0f97cf5afe5f69a136446ad3a5180f56b441
SSDEEP

1572864:Liqs0X+0qrRboEWrLjZ+x2/9unv0JL0KZ8KVZ532yKdisTKuRuqAh:Liqs0XxqrRkE26k8v6feKV+yKAs2uXAh

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UgPhone.exeUgPhone.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation	UgPhone.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation	UgPhone.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 5 IoCs

Processes:

UgPhone.exeUgPhone.exeUgPhone.exeUgPhone.exeUgPhone.exe

pid process

3040 UgPhone.exe
916 UgPhone.exe
1640 UgPhone.exe
2688 UgPhone.exe
812 UgPhone.exe

pid	process
3040	UgPhone.exe
916	UgPhone.exe
1640	UgPhone.exe
2688	UgPhone.exe
812	UgPhone.exe

Loads dropped DLL 28 IoCs

Processes:

UgPhone_install_1.1.23.exeUgPhone.exeUgPhone.exeUgPhone.exeUgPhone.exeUgPhone.exe

pid	process
1892	UgPhone_install_1.1.23.exe
1892	UgPhone_install_1.1.23.exe
1892	UgPhone_install_1.1.23.exe
1892	UgPhone_install_1.1.23.exe
1892	UgPhone_install_1.1.23.exe
1892	UgPhone_install_1.1.23.exe
1892	UgPhone_install_1.1.23.exe
1892	UgPhone_install_1.1.23.exe
1892	UgPhone_install_1.1.23.exe
1892	UgPhone_install_1.1.23.exe
1892	UgPhone_install_1.1.23.exe
1072
3040	UgPhone.exe
1072
1072
1072
1072
916	UgPhone.exe
916	UgPhone.exe
1640	UgPhone.exe
2688	UgPhone.exe
916	UgPhone.exe
916	UgPhone.exe
812	UgPhone.exe
812	UgPhone.exe
812	UgPhone.exe
812	UgPhone.exe
1072

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2540 tasklist.exe

pid	process
2540	tasklist.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

UgPhone.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	UgPhone.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	UgPhone.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

UgPhone_install_1.1.23.exetasklist.exeUgPhone.exeUgPhone.exeUgPhone.exe

pid process

1892 UgPhone_install_1.1.23.exe
2540 tasklist.exe
2540 tasklist.exe
1640 UgPhone.exe
2688 UgPhone.exe
3040 UgPhone.exe
3040 UgPhone.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tasklist.exeUgPhone_install_1.1.23.exe

description pid process

Token: SeDebugPrivilege 2540 tasklist.exe
Token: SeSecurityPrivilege 1892 UgPhone_install_1.1.23.exe

description	pid	process
Token: SeDebugPrivilege	2540	tasklist.exe
Token: SeSecurityPrivilege	1892	UgPhone_install_1.1.23.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

UgPhone_install_1.1.23.execmd.exeUgPhone.exe

description	pid	process	target process
PID 1892 wrote to memory of 2604	1892	UgPhone_install_1.1.23.exe	cmd.exe
PID 1892 wrote to memory of 2604	1892	UgPhone_install_1.1.23.exe	cmd.exe
PID 1892 wrote to memory of 2604	1892	UgPhone_install_1.1.23.exe	cmd.exe
PID 1892 wrote to memory of 2604	1892	UgPhone_install_1.1.23.exe	cmd.exe
PID 2604 wrote to memory of 2540	2604	cmd.exe	tasklist.exe
PID 2604 wrote to memory of 2540	2604	cmd.exe	tasklist.exe
PID 2604 wrote to memory of 2540	2604	cmd.exe	tasklist.exe
PID 2604 wrote to memory of 2540	2604	cmd.exe	tasklist.exe
PID 2604 wrote to memory of 2536	2604	cmd.exe	find.exe
PID 2604 wrote to memory of 2536	2604	cmd.exe	find.exe
PID 2604 wrote to memory of 2536	2604	cmd.exe	find.exe
PID 2604 wrote to memory of 2536	2604	cmd.exe	find.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 916	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 1640	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 1640	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 1640	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 2688	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 2688	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 2688	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 812	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 812	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 812	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 812	3040	UgPhone.exe	UgPhone.exe
PID 3040 wrote to memory of 812	3040	UgPhone.exe	UgPhone.exe

C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe
"C:\Users\Admin\AppData\Local\Temp\UgPhone_install_1.1.23.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq UgPhone.exe" | find "UgPhone.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq UgPhone.exe"
3⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\SysWOW64\find.exe
find "UgPhone.exe"
3⤵
PID:2536

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1048,9958129328922710201,3056061707102026518,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1056 /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1048,9958129328922710201,3056061707102026518,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --mojo-platform-channel-handle=1304 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1640

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=renderer --field-trial-handle=1048,9958129328922710201,3056061707102026518,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1404 /prefetch:1
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2688

C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe
"C:\Users\Admin\AppData\Local\Programs\UgPhone1\UgPhone.exe" --type=gpu-process --field-trial-handle=1048,9958129328922710201,3056061707102026518,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1056 /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_100_percent.pak
Filesize
138KB

MD5
03aaa4f8525ba4b3e30d2a02cb40ab7a

SHA1
dd9ae5f8b56d317c71d0a0a738f5d4a320a02085

SHA256
c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7

SHA512
c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\chrome_200_percent.pak
Filesize
202KB

MD5
7d4f330a5443eadf32e041c63e7e70ad

SHA1
26ce6fb98c0f28f508d7b88cf94a442b81e80c88

SHA256
b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d

SHA512
f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\icudtl.dat
Filesize
9.9MB

MD5
80a7528515595d8b0bf99a477a7eff0d

SHA1
fde9a195fc5a6a23ec82b8594f958cfcf3159437

SHA256
6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b

SHA512
c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\locales\en-US.pak
Filesize
88KB

MD5
af5c77e1d94dc4f772cb641bd310bc87

SHA1
0ceeb456e2601e22d873250bcc713bab573f2247

SHA256
781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4

SHA512
8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\resources.pak
Filesize
4.9MB

MD5
1f95be6a00b153fd2ba5b149c21e3c25

SHA1
d955b861c86e1d3de73024b3383aa11264c87ba4

SHA256
f4ea4113a0da76d70f72bbef82374c4eb7e63936e3f6931cc56b27a7300f9715

SHA512
9bc4ee4344bcbcfca1f6e84606fd730b21e58adbdceb1e47ba23931ff59abdff67db368c912f63c51823a864b91e53699469d52ad9ad33301050d369e79d215e

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\swiftshader\libegl.dll
Filesize
448KB

MD5
58124da1da5854be80f519f563cdb331

SHA1
353fa846229bc2c2f3479d774d84aebb66ef3eb7

SHA256
a03a044ea9775d372c4fe7fd82e64ab18e052bcdbc9381c2030ca475bc2ef1d1

SHA512
7f1af1e2237f6fe1eca1c4de4f3319979a6526c1938aadd48d7ee55834b7479de152868288f32084fb3004d3a420affca51091e83bcb4c4840a727664b69ee23

Download Submit
C:\Users\Admin\AppData\Local\Programs\UgPhone1\v8_context_snapshot.bin
Filesize
161KB

MD5
8783eb563bab1d720f60f64d38f6ab69

SHA1
41c84e5f448969db07ce505aacad4fe574c9eb8e

SHA256
b53b12b15dbc62c6b1f7884ffacc97a261dfd12cbc5f447ffe270097847b418c

SHA512
f22ecdddf46a2c03f5b122f06a0a760e40b231df0b680b16a4555ec50be436e5921a77b4a15b67b0785aadbb39312fdd361c91f6ee9c47aaa7412b799a003fce

Download Submit
C:\Users\Admin\AppData\Local\Temp\dbf305c0-5a64-47b7-9ea4-1c746a4a9357.tmp.ico
Filesize
264KB

MD5
95869702267b1748d648dc6cb57bcf3c

SHA1
89804bd5f6a8b38863e552d0844e21a6fae30b56

SHA256
6c9331e79dabb563d694eaed56450f5b095bf71297d2f5f957b15f2fa729c02d

SHA512
387b9ca64d80a3abacc0c329f9fc5bd071b6479d880e273e6f7fddbc48186c7227ed6285dc0ebce17f8e7d7b7f3933bffe62462a95676e6b8af0578d7814ab1f

Download Submit
C:\Users\Admin\AppData\Roaming\UgPhone1\Session Storage\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
\Users\Admin\AppData\Local\Programs\UgPhone1\d3dcompiler_47.dll
Filesize
4.3MB

MD5
7641e39b7da4077084d2afe7c31032e0

SHA1
2256644f69435ff2fee76deb04d918083960d1eb

SHA256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

SHA512
8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

Download Submit
\Users\Admin\AppData\Local\Programs\UgPhone1\ffmpeg.dll
Filesize
2.6MB

MD5
c42523771879bdd3f754fbcf2f5d787a

SHA1
55f9496131ba56a00526d92fce1c8b8d669b08c8

SHA256
ce52b08fffbaa142e6c7a376333991086ad5b37a5c1ed7cfcc8ff5c851b3d200

SHA512
ad980e459a86a8d7773cfd19b3b96ecc030a612463e534b2ba250cd15534ecbcea8af0038896dc65069fc66dfcd2b3a7df1471189f448267073a3bba2287116e

Download Submit
\Users\Admin\AppData\Local\Programs\UgPhone1\libEGL.dll
Filesize
429KB

MD5
f3c8fea015b42bac6bdc0ddd3eb0b313

SHA1
176d3bfd15d22835e6bdecb7c39f13e4a29676a4

SHA256
b2d3d398331aee75646b12d94a1a1d383babce09c3c6a3303dd226944c8883d1

SHA512
30072eafd2c3f4a905c40d29cc755b6f50a9357d934f327c0479b15987736699bf443280fc0f6838ad147e2f23c1fbb123e2055756fce7402fdbd11b32a1f7bd

Download Submit
\Users\Admin\AppData\Local\Programs\UgPhone1\libGLESv2.dll
Filesize
7.6MB

MD5
7969ee5f940eb49840749fbbd4358c44

SHA1
12d827c416ad82f5f622e67683f2f7df65e809e4

SHA256
d8e62dd81dab676139e9e8d7a3ec32bfb07fd5ea66a3ac510c70b5d5d98033b4

SHA512
e0a398d7c7aa44fb01fe39ced317e4706806d3b45fbfa127491e27843efa0093870ea9d82874aec3a9896a6400ce8f40902376069cfa1ee9b130e74d90124395

Download Submit
\Users\Admin\AppData\Local\Programs\UgPhone1\swiftshader\libGLESv2.dll
Filesize
3.1MB

MD5
fc99fc1d991f1404ca20cc8178b86486

SHA1
15f67bc1d25a0af8ae24dcdf542dbcbfc3b67317

SHA256
7ad5bc738ebc7b58afc31dde170157fb9d0eb40819b12c08e1190669da998310

SHA512
48c1f78d0d002a07bdc76c8d88f8ee76200999d3cdfeba88de49314094da233d5ea9373cd23909189aed29f512d6f322d8c62ef470cfe4a6362310f56019d1e4

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\SpiderBanner.dll
Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\StdUtils.dll
Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\System.dll
Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\WinShell.dll
Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\nsExec.dll
Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1FA2.tmp\nsis7z.dll
Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/916-251-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/916-284-0x00000000774B0000-0x00000000774B1000-memory.dmp

Filesize
4KB

Download
memory/1892-233-0x0000000004130000-0x0000000004132000-memory.dmp

Filesize
8KB

Download