Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
11-09-2020 10:36
Static task
static1
Behavioral task
behavioral1
Sample
14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe
Resource
win10v200722
General
-
Target
14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe
-
Size
14.6MB
-
MD5
18067be70aad9ca5d329663e35ed5cde
-
SHA1
8655fc0484f35513527268f7313334dc2c2d5953
-
SHA256
14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f
-
SHA512
8b071bbe15118e69873a600e2bdb15125f8c6ae1ab133b1951fbbf52b4dddd65734088dd51f84de716f9c2cbb22bcda40c83d129d8594fbb839a3975355277ed
Malware Config
Extracted
metasploit
windows/download_exec
http://39.101.174.221:12358/LWbW
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALCJS)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Registers COM server for autorun 1 TTPs
-
Drops file in Drivers directory 3 IoCs
Processes:
DrvInst.exedescription ioc process File opened for modification C:\Windows\system32\DRIVERS\SETE975.tmp DrvInst.exe File created C:\Windows\system32\DRIVERS\SETE975.tmp DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\SangforVnic.sys DrvInst.exe -
Executes dropped EXE 35 IoCs
Processes:
TaskServer.exeEasyConnectInstaller_.exeUninstall.exeSangforCSClientInstaller.exeTcpDriverInstaller.exeRemove.exeInstall.exeDnsDriverInstaller.exeRemove.exeInstall.exeSuperExeInstaller.exeSangforServiceClientInstaller.exeVC2010RedistX86UInstaller.exeHTPInstaller.exeSJobberInstaller.exeSangforUpdateInstaller.exeSangforRAppInstaller.exeInstallControl.exeVNICInstaller_X64.exendiscleanup.x64.exevacon.exeSetIPTime.exeComHelperX64.exeComHelperX64.exeECBaseInstaller.exeECAgentInstaller.exeECAgent.exeSuperServiceInstaller.exeSangforPromoteService.exeSangforPromoteService.exeSangforPromoteService.exeECAgent.exeECAgent.exeECAgent.exeECAgent.exepid process 1920 TaskServer.exe 1968 EasyConnectInstaller_.exe 864 Uninstall.exe 1980 SangforCSClientInstaller.exe 1260 TcpDriverInstaller.exe 1904 Remove.exe 268 Install.exe 568 DnsDriverInstaller.exe 800 Remove.exe 796 Install.exe 1120 SuperExeInstaller.exe 900 SangforServiceClientInstaller.exe 1824 VC2010RedistX86UInstaller.exe 1992 HTPInstaller.exe 932 SJobberInstaller.exe 360 SangforUpdateInstaller.exe 996 SangforRAppInstaller.exe 604 InstallControl.exe 1016 VNICInstaller_X64.exe 1200 ndiscleanup.x64.exe 1136 vacon.exe 1380 SetIPTime.exe 980 ComHelperX64.exe 268 ComHelperX64.exe 1256 ECBaseInstaller.exe 1724 ECAgentInstaller.exe 996 ECAgent.exe 1192 SuperServiceInstaller.exe 1012 SangforPromoteService.exe 1764 SangforPromoteService.exe 1256 SangforPromoteService.exe 1856 ECAgent.exe 1984 ECAgent.exe 1924 ECAgent.exe 1792 ECAgent.exe -
Loads dropped DLL 190 IoCs
Processes:
14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exeEasyConnectInstaller_.exeUninstall.exeSangforCSClientInstaller.exeTcpDriverInstaller.exeRemove.exeInstall.exeDnsDriverInstaller.exeRemove.exeInstall.exepid process 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 864 Uninstall.exe 864 Uninstall.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1968 EasyConnectInstaller_.exe 1980 SangforCSClientInstaller.exe 1980 SangforCSClientInstaller.exe 1980 SangforCSClientInstaller.exe 1980 SangforCSClientInstaller.exe 1980 SangforCSClientInstaller.exe 1980 SangforCSClientInstaller.exe 1980 SangforCSClientInstaller.exe 1980 SangforCSClientInstaller.exe 1980 SangforCSClientInstaller.exe 1980 SangforCSClientInstaller.exe 1968 EasyConnectInstaller_.exe 1260 TcpDriverInstaller.exe 1260 TcpDriverInstaller.exe 1260 TcpDriverInstaller.exe 1260 TcpDriverInstaller.exe 1260 TcpDriverInstaller.exe 1904 Remove.exe 1904 Remove.exe 1904 Remove.exe 1260 TcpDriverInstaller.exe 1260 TcpDriverInstaller.exe 1260 TcpDriverInstaller.exe 268 Install.exe 268 Install.exe 268 Install.exe 1968 EasyConnectInstaller_.exe 568 DnsDriverInstaller.exe 568 DnsDriverInstaller.exe 568 DnsDriverInstaller.exe 568 DnsDriverInstaller.exe 568 DnsDriverInstaller.exe 800 Remove.exe 800 Remove.exe 800 Remove.exe 568 DnsDriverInstaller.exe 568 DnsDriverInstaller.exe 796 Install.exe 796 Install.exe 796 Install.exe 1968 EasyConnectInstaller_.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
JavaScript code in executable 21 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\TaskServer.exe js C:\Users\Admin\AppData\Local\Temp\TaskServer.exe js C:\Users\Admin\AppData\Local\Temp\TaskServer.exe js \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js C:\Program Files (x86)\Sangfor\SSL\ECAgent\SANGFORVPNLIBEAY32.dll js \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll js C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll js C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll js C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe js \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll js \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll js -
Drops file in System32 directory 32 IoCs
Processes:
DrvInst.exevacon.exeECAgent.exeVC2010RedistX86UInstaller.exeSangforCSClientInstaller.exeDrvInst.exeEasyConnectInstaller_.exeECAgent.exedescription ioc process File created C:\Windows\System32\DriverStore\INFCACHE.0 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{617ead07-84a0-19b2-6296-c13abddeef05}\SETB0AB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{617ead07-84a0-19b2-6296-c13abddeef05} DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt vacon.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Sangfor\SSL\Log\ECAgent_20200911.log ECAgent.exe File created C:\Windows\System32\DriverStore\Temp\{617ead07-84a0-19b2-6296-c13abddeef05}\SETB09A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{617ead07-84a0-19b2-6296-c13abddeef05}\SETB09B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{617ead07-84a0-19b2-6296-c13abddeef05}\SETB09B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat vacon.exe File created C:\Windows\SysWOW64\mfc100chs.dll VC2010RedistX86UInstaller.exe File created C:\Windows\SysWOW64\mfc100u.dll VC2010RedistX86UInstaller.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{617ead07-84a0-19b2-6296-c13abddeef05}\SangforVnic.cat DrvInst.exe File created C:\Windows\SysWOW64\SangforVpnSsleay32.dll SangforCSClientInstaller.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{617ead07-84a0-19b2-6296-c13abddeef05}\sangforvnic.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{617ead07-84a0-19b2-6296-c13abddeef05}\SangforVnic.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\sangforvnic.inf_amd64_neutral_9183b83f3b2f3cd1\sangforvnic.PNF DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File created C:\Windows\SysWOW64\atl100.dll VC2010RedistX86UInstaller.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{617ead07-84a0-19b2-6296-c13abddeef05}\SETB09A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\sangforvnic.inf_amd64_neutral_9183b83f3b2f3cd1\sangforvnic.PNF DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstor.dat DrvInst.exe File opened for modification C:\Windows\SysWOW64\SangforInstallHelper.dll EasyConnectInstaller_.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Sangfor\SSL\Log\ECAgent_20200911.log ECAgent.exe File created C:\Windows\SysWOW64\SangforVpnLibeay32.dll SangforCSClientInstaller.exe File created C:\Windows\SysWOW64\msvcp100.dll VC2010RedistX86UInstaller.exe File created C:\Windows\SysWOW64\msvcr100.dll VC2010RedistX86UInstaller.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat vacon.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File created C:\Windows\SysWOW64\SangforInstallHelper.dll EasyConnectInstaller_.exe File created C:\Windows\System32\DriverStore\Temp\{617ead07-84a0-19b2-6296-c13abddeef05}\SETB0AB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe -
Modifies service 2 TTPs 849 IoCs
Processes:
DrvInst.exenetsh.exeComHelperX64.exeEasyConnectInstaller_.exeComHelperX64.exevssvc.exevacon.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Linkage\Export = 5c004400650076006900630065005c00540063007000690070005f007b00380044003800370030003100410035002d0042004100450037002d0034004500410038002d0038003700320039002d004100380042004300390038003200410030004400320036007d0000005c004400650076006900630065005c00540063007000690070005f007b00330038003500320038003700360030002d0033004500350041002d0034003000300045002d0039003000410042002d003100460032003500430045004400330037003500310046007d0000000000 DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000002\DisplayString = "@%SystemRoot%\\system32\\napinsp.dll,-1000" ComHelperX64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Adapters\{8D8701A5-BAE7-4EA8-8729-A8BC982A0D26} DrvInst.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters\Interfaces\Tcpip_{8D8701A5-BAE7-4EA8-8729-A8BC982A0D26}\NetbiosOptions = "0" DrvInst.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000007 EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NetBT\Parameters\Interfaces\Tcpip_{38528760-3E5A-400E-90AB-1F25CED3751F} DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000007\ProviderId = 7ebda25532bbd311916601a5c9b76901 ComHelperX64.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000008\PackedCatalogItem = 2553797374656d526f6f74255c73797374656d33325c6d7377736f636b2e646c6c005c436c69656e74436f6d706f6e656e745c53616e67666f725463705836342e646c6c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090602000000000000000000000000000c000000a01a0fe78babcf118ca300805f48a192eb0300000100000000000000000000000000000000000000000000000000000000000000020000000200000010000000100000000300000000000000ff0000000000000000000000008000000000000040002500530079007300740065006d0052006f006f00740025005c00530079007300740065006d00330032005c00770073006800740063007000690070002e0064006c006c002c002d00360030003100300032000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000001\LibraryPath = "%SystemRoot%\\system32\\NLAapi.dll" ComHelperX64.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014 EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2 DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000001 ComHelperX64.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000005\ProviderInfo ComHelperX64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014 EasyConnectInstaller_.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\0000002C ComHelperX64.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BKGND_FREEZE_THREAD (Enter) = 4800000000000000d09280f52788d601ec04000050070000fc0300000100000003000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\UseDomainNameDevolution = "1" DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\{38528760-3E5A-400E-90AB-1F25CED3751F}\Parameters\Tcpip\DefaultGateway = 310030002e0037002e0030002e00310000000000 DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000003\ProviderId = ce89fe036d767649b9c1bb9bc42c7b4d ComHelperX64.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW_KTM (Enter) = 480000000000000070aa4ff62788d601ec04000040070000f40300000100000000000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\THAW (Enter) = 4800000000000000f02f59f62788d601ec040000cc030000f20300000100000003000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000009 ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000003\LibraryPath = "%SystemRoot%\\system32\\pnrpnsp.dll" ComHelperX64.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_RM (Leave) = 48000000000000007073f0f52788d601ec04000040070000ef0300000000000000000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000005\DisplayString = "@%SystemRoot%\\system32\\pnrpnsp.dll,-1001" ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\InterfaceName = "{8D8701A5-BAE7-4EA8-8729-A8BC982A0D26}" DrvInst.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{8D8701A5-BAE7-4EA8-8729-A8BC982A0D26}\TCPWindowSize = "64239" vacon.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\Version = "0" EasyConnectInstaller_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Next_Catalog_Entry_ID = "1013" EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000001\ProtocolName = "SangforLSP_x64_def over [MSAFD Tcpip [TCP/IP]]" ComHelperX64.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\GETSTATE (Enter) = 4800000000000000d0cc29f42788d601ec0400009c060000f90300000100000001000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW (Enter) = 480000000000000070aa4ff62788d601ec04000040070000f20300000100000000000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 480000000000000030a4b3f62788d601ec040000bc070000050000000100000004000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\0000002B ComHelperX64.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{c3411424-cd08-11ea-9b22-806e6f6e6963}_)\OPEN_VOLUME_HANDLE (Leave) = 4800000000000000709f3cf62788d601ec040000e4050000fd0300000000000000000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{c3411424-cd08-11ea-9b22-806e6f6e6963}_)\IOCTL_RELEASE (Enter) = 480000000000000010494df62788d601ec040000e4050000ff0300000100000000000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\InterfaceName = "Internal" DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000002\PackedCatalogItem = 433a5c50726f6772616d2046696c65732028783836295c53616e67666f725c53534c5c436c69656e74436f6d706f6e656e745c53616e67666f725463705836342e646c6c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000906020000000000000000000000000008000000b4dead4f873ec443bf80db7cd25fd5cffb03000002000000f9030000ea0300000000000000000000000000000000000000000000020000000200000010000000100000000200000011000000000000000000000000000000f7ff000000000000530061006e00670066006f0072004c00530050005f007800360034005f0064006500660020006f0076006500720020005b004d00530041004600440020005400630070006900700020005b005500440050002f00490050005d005d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000006\ProtocolName = "@%SystemRoot%\\System32\\wship6.dll,-60102" ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000009\ProtocolName = "@%SystemRoot%\\System32\\wshqos.dll,-102" ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000008\ProtocolName = "@%SystemRoot%\\System32\\wshtcpip.dll,-60102" ComHelperX64.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Serial_Access_Num = "11" EasyConnectInstaller_.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\GETSTATE (Leave) = 4800000000000000d0cc29f42788d601ec0400009c060000f90300000000000001000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ipv6\ProtocolId = "87" DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BACKUPSHUTDOWN (Leave) = 4800000000000000703947f72788d601ec0400005c020000fb0300000000000005000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\SupportedNameSpace = "12" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007 EasyConnectInstaller_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\3\Type = "3" DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{38528760-3E5A-400E-90AB-1F25CED3751F} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000016\ProtocolName = "SangforLSP_x64_def" ComHelperX64.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\ProviderId = ce89fe036d767649b9c1bb9bc42c7b4d EasyConnectInstaller_.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\0\Ip\InterfaceInfo = 0100000068000000030000000500ffff4800000000000000400000000400ffff0400000001000000400000000700ffff1000000001000000480000000000000001000000000000005802c20108070000000000000000000000000000000000000000000000000000 DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Ip DrvInst.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Serial_Access_Num = "16" ComHelperX64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006 EasyConnectInstaller_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Num_Catalog_Entries = "12" EasyConnectInstaller_.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\FREEZE (Leave) = 4800000000000000d09280f52788d601ec04000034040000eb0300000000000002000000000000002212df44da9bbd4aa02a11bc736c5e3100000000000000000000000000000000 vssvc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\1\Type = "4" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000002\DisplayString = "@%SystemRoot%\\system32\\nlasvc.dll,-1000" ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\ProtocolName = "@%SystemRoot%\\System32\\wshtcpip.dll,-60100" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RemoteAccess\Interfaces\2\Ip\InterfaceInfo = 0100000068000000030000000500ffff4800000000000000400000000400ffff0400000001000000400000000700ffff1000000001000000480000000000000001000000000000005802c20108070000000000000000000000000000000000000000000000000000 DrvInst.exe -
Drops file in Program Files directory 149 IoCs
Processes:
SangforCSClientInstaller.exeSangforServiceClientInstaller.exeSangforRAppInstaller.exeEasyConnectInstaller_.exeTcpDriverInstaller.exeexpand.exeInstallControl.exeVNICInstaller_X64.exeDnsDriverInstaller.exeHTPInstaller.exeSuperExeInstaller.exeexpand.exeSuperServiceInstaller.exeSJobberInstaller.exeSangforUpdateInstaller.exedescription ioc process File created C:\Program Files (x86)\Sangfor\SSL\SangforCSClient\Offline.ico SangforCSClientInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClient.CAB SangforServiceClientInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\RemoteAppClient\SRAPSession.exe SangforRAppInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNspX64.dll EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\TcpDriver\WfpDrv.sys TcpDriverInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.exe expand.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Nddkey\FT_ND_API.dll InstallControl.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\UrlWarrent.dll EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforDKeyMonitor.exe SangforCSClientInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\Promote\$dpx$.tmp\35673f25c844f441a7c082e5877ac175.tmp expand.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\nd_dkey_v2_win8.CAB EasyConnectInstaller_.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\nd_dkey_v2.CAB EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforL3Vpn.dll EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\RemoteAppClient\mstscax.dll SangforRAppInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforVnic.inf VNICInstaller_X64.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe EasyConnectInstaller_.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe DnsDriverInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClientUninstaller.exe SangforServiceClientInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe EasyConnectInstaller_.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCore.dll EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforCSClient\EasyConnect.ico SangforCSClientInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforCSClient\FT_ND_API.dll SangforCSClientInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\HTP\netbase.dll HTPInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\DnsDriver\DnsDrvx64.sys DnsDriverInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.CAB SuperExeInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\HTP\uninst.exe HTPInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe EasyConnectInstaller_.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe EasyConnectInstaller_.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClient.exe expand.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe SuperServiceInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforBHO.dll EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.CAB SuperExeInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\Promote\PromoteUninstall.exe SuperExeInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\RemoteAppClient\SfRemoteAppSession.exe SangforRAppInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforCSClient\LogoutTimeOut.exe SangforCSClientInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\TcpDriver\WfpDrv.sys TcpDriverInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\HTP\htp.conf HTPInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\SvpnJobber\SvpnJobber.exe SJobberInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforVnic2003.inf VNICInstaller_X64.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\CSClientManagerPrj.dll EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\DnsDriver\DnsDrv.sys DnsDriverInstaller.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe EasyConnectInstaller_.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient\$dpx$.tmp expand.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient\$dpx$.tmp\job.xml expand.exe File created C:\Program Files (x86)\Sangfor\SSL\SangforUpdate\Uninstaller.exe SangforUpdateInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Nddkey\FT_ND_FULL.dll InstallControl.exe File created C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforVnic2003.cat VNICInstaller_X64.exe File opened for modification C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\TcpDriver\WfpDrv_win7.sys TcpDriverInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\HTP\htpd.exe HTPInstaller.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforSddn.dll EasyConnectInstaller_.exe File created C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe EasyConnectInstaller_.exe -
Drops file in Windows directory 17 IoCs
Processes:
expand.exevacon.exeDrvInst.exeDrvInst.exeDrvInst.exeexpand.exedescription ioc process File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\INF\setupapi.app.log vacon.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev2 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\oem2.inf DrvInst.exe File created C:\Windows\INF\oem2.PNF DrvInst.exe File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe File opened for modification C:\Windows\INF\setupapi.dev.log vacon.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe -
NSIS installer 91 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClientUninstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe nsis_installer_2 \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe nsis_installer_2 C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe nsis_installer_2 -
Processes:
SangforCSClientInstaller.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000\Software\Microsoft\Internet Explorer\Main SangforCSClientInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000\Software\Microsoft\Internet Explorer\Main\Isolation = "PMIL" SangforCSClientInstaller.exe -
Modifies data under HKEY_USERS 199 IoCs
Processes:
DrvInst.exeSangforPromoteService.exeDrvInst.exeDrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24\52C64B7E\@%SystemRoot%\system32\tcpipcfg.dll,-50001 = "Transmission Control Protocol/Internet Protocol. The default wide area network protocol that provides communication across diverse interconnected networks." DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24\52C64B7E\@%systemroot%\system32\sstpsvc.dll,-203 = "Allows you to securely connect to a private network using the Internet." DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24\52C64B7E\@%systemroot%\system32\rascfg.dll,-32009 = "Allows you to securely connect to a private network using the Internet." DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24\52C64B7E\@%SystemRoot%\System32\drivers\pacer.sys,-100 = "Quality of Service Packet Scheduler. This component provides network traffic control, including rate-of-flow and prioritization services." DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs SangforPromoteService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe -
Modifies registry class 381 IoCs
Processes:
EasyConnectInstaller_.exeSangforCSClientInstaller.exeComHelperX64.exeComHelperX64.exeInstallControl.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforSddn.Sddn.1 EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sslvpn\DefaultIcon SangforCSClientInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F257CF85-8E97-4C9B-8407-459B28007500}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SangforBHO.SangforIEBHO\CLSID\ = "{FFD2FD1F-C991-4A2F-8557-CDB11E277500}" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sslvpn\Shell\Open\command SangforCSClientInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ProxyIE_X64.CSProxy\CLSID\ = "{BC6E9AA5-FDE9-4959-8809-CA4261CD6200}" ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A47855F-8D41-43D0-BF75-CC3F15097100}\InprocServer32\ = "C:\\Program Files (x86)\\Sangfor\\SSL\\ClientComponent\\SangforNspX64.dll" ComHelperX64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSOClientPrj.Web2Client\CurVer EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6316651-CC1B-4FB9-A985-4796DC6B7110}\TypeLib\ EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforL3Vpn.L3Vpn\CurVer EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforCDC.Server\CLSID EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FT_ND_SC.ePsM8SC\ = "ePsM8SC Class" InstallControl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4A90D77-027F-4096-8D94-8FA4A4E1F235}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Sangfor\\SSL\\ClientComponent\\Nddkey" InstallControl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SangforNspX64.1\CurVer\ = "SangforNspX64.1" ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CSClientManagerPrj.CSClientManager.1\ = "CSClientManager Class" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforBHO.SangforHelper EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ClientNSPPrj.ClientNSP EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{964865DB-CC7E-4F11-88BA-1445A7947102}\Programmable EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CSClientManagerPrj.CSClientManager\ = "CSClientManager Class" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F257CF85-8E97-4C9B-8407-459B28007500}\Programmable EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFD2FD1F-C991-4A2F-8557-CDB11E277500}\InprocServer32\ThreadingModel = "Apartment" EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2A39CB63-CC0C-4EDD-82D0-4559C5087110}\InprocServer32\ThreadingModel = "Apartment" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6316651-CC1B-4FB9-A985-4796DC6B7110}\TypeLib EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CSClientManagerPrj.CSClientManager.1 EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SangforL3Vpn.L3Vpn\CLSID\ = "{964865DB-CC7E-4F11-88BA-1445A7947102}" EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{013B354E-96FF-4675-8942-B6CB50889543}\InprocServer32\ThreadingModel = "Apartment" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforBHO.SangforIEBHO\CLSID EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ProxyIE.CSProxy EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforL3Vpn.L3Vpn\CLSID EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{964865DB-CC7E-4F11-88BA-1445A7947102}\ProgID EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4A90D77-027F-4096-8D94-8FA4A4E1F235}\1.0\0 InstallControl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforNspX64.1 ComHelperX64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A47855F-8D41-43D0-BF75-CC3F15097100}\Implemented Categories ComHelperX64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D37E99E3-20EB-4838-8BDF-89D0D35FF043}\ProgID EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{964865DB-CC7E-4F11-88BA-1445A7947102}\VersionIndependentProgID EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ProxyIE_X64.CSProxy\CurVer\ = "ProxyIE_X64.CSProxy.1" ComHelperX64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC6E9AA5-FDE9-4959-8809-CA4261CD6200}\InprocServer32 ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4A90D77-027F-4096-8D94-8FA4A4E1F235}\1.0\0\win32\ = "C:\\Program Files (x86)\\Sangfor\\SSL\\ClientComponent\\Nddkey\\FT_ND_SC.dll" InstallControl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CSClientManagerPrj.CSClientManager\CurVer EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F257CF85-8E97-4C9B-8407-459B28007500}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92AFA1EA-8651-4152-9D42-7A417A327100}\VersionIndependentProgID EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SangforBHO.SangforHelper\CLSID EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SangforBHO.SangforHelper.1\ = "SangforHelper Class" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D37E99E3-20EB-4838-8BDF-89D0D35FF043}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{013B354E-96FF-4675-8942-B6CB50889543}\ProgID\ = "SangforSddn.Sddn.1" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ProxyIE_X64.CSProxy ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A47855F-8D41-43D0-BF75-CC3F15097100}\TypeLib\ ComHelperX64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F4A90D77-027F-4096-8D94-8FA4A4E1F235} InstallControl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F257CF85-8E97-4C9B-8407-459B28007500}\InprocServer32\ThreadingModel = "Apartment" EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SangforBHO.SangforIEBHO\ = "SangforIEBHO Class" EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFD2FD1F-C991-4A2F-8557-CDB11E277500}\ = "SangforHelper Class" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E39B98A8-34A7-4D92-A979-920C48817110}\Programmable EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ClientNSPPrj.ClientNSP\CLSID EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C5BC3F7A-3F33-4CA1-B5AF-4540987C7100}\ = "CDCServer Class" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C5BC3F7A-3F33-4CA1-B5AF-4540987C7100}\VersionIndependentProgID EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC6E9AA5-FDE9-4959-8809-CA4261CD6200} ComHelperX64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CSClientManagerPrj.CSClientManager.1\CLSID\ = "{F257CF85-8E97-4C9B-8407-459B28007500}" EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFD2FD1F-C991-4A2F-8557-CDB11E277500}\InprocServer32\ = "C:\\Program Files (x86)\\Sangfor\\SSL\\ClientComponent\\SangforBHO.dll" EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SSOClientPrj.SSOHtmlElementEvent\CurVer\ = "SSOClientPrj.SSOHtmlElementEvent.1" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ProxyIE.CSProxy\CLSID EasyConnectInstaller_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FT_ND_SC.ePsM8SC.1\CLSID\ = "{0272DA76-96FB-449E-8298-178876E0EA89}" InstallControl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SSOClientPrj.SSOClientBHO.1\CLSID\ = "{E39B98A8-34A7-4D92-A979-920C48817110}" EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SSOClientPrj.Web2Client\CLSID EasyConnectInstaller_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6316651-CC1B-4FB9-A985-4796DC6B7110}\Programmable EasyConnectInstaller_.exe -
Processes:
vacon.exeECAgent.exeSangforPromoteService.exeECAgent.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a vacon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0 ECAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5CEA91B309BE5E0A5EE4DA8FD8C162847787B3CA vacon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a vacon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0\Blob = 0f00000001000000200000009507653c8a7f2132efc2c772644a70ecbed4e7fc75d3ac32e56ad7462a1bc22f030000000100000014000000a9062c5c1721ff87ebcbd89df03719755560e7a02000000001000000640400003082046030820348a003020102020900dea4d5fa33cf9e9e300d06092a864886f70d01010b0500307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e3020170d3137303432373135323731395a180f32313137303430333135323731395a307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e848962dfef81aecd6d6739d91455b9173452578cc0496b410a05f70b12be3aa7cc0d1bb8d5de7e11b4158e9db43f0b8864ef4ece0df801c96240d2da076b915bc6165a10ff83dd7958961c60f70470d8dc1438995491cc69693cb98652c3c8fa07c1d20238fcf0e565159ce77d0f791dc1031f476dbb80f13b7ea967c8901b1bf137e976c5a37754cee287442dde53f5f7b7ed9a464b82874634e7bf9fba9504cf297111530973aa8bfc0a2d4850efb59f04f8875bdcde82763632d96f93fb3f0668acbf981b4483d90cb920f4f2403de422eaa8641ecf3db8dfedae5b658bfb4adb9c51ac494092bfe3d91900ed83835ca3c723d17962fc2b63c4fad1087c30203010001a381e23081df301d0603551d0e04160414ddc4d59401f87b754557a8be5eb3ac461bb8bab33081af0603551d230481a73081a48014ddc4d59401f87b754557a8be5eb3ac461bb8bab3a18180a47e307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e820900dea4d5fa33cf9e9e300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010093d5660dced1b9c499adf1de074577b2f0e782dc7c878889fbd1e69f4cdf410b664008dcc4b8cf4add5f353a5fc753a6fc32335db370cbf53d0143d1af33605ad6eadaee20ba545e2389d681dfb6fdcdd28f96791a792601a683f60fbe5bc24e2c19c0cfffdc5c777c0a340078713e1ade978178c8ab55298656ad27110b8f39e7de7b8be4388f33450d0a985bdadc5308fa0c7785fed2cdd84f2ac099bbcde6aa9c45cb2bc39c3137e0b8305d25ed1c4ebbcb68c9348ce37a659f94ee36f98631f7bcac85e98955cd8b6fae8eba1edf02b2fe909da19d1bbdd4129bb18efc6f0bf2e31409be6ff0ecf440eade5136900d36db6f004db5e918d7dbce4e96dc32 SangforPromoteService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0 ECAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\2EFD69CD8052055D6DC5EAC7631A27A45E102A8B\Blob = 0f0000000100000014000000bd79887230d23e34ccfd318a9038e04491b2f31e0300000001000000140000002efd69cd8052055d6dc5eac7631a27a45e102a8b200000000100000058050000308205543082043ca0030201020210121876db06e834da35c19890e6e650d0300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3135303731373030303030305a170d3138303931343233353935395a3081b0310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31253023060355040a141c53616e67666f7220546563686e6f6c6f6769657320436f2e2c4c7464312c302a060355040b1423726573656172636820616e6420646576656c6f706d656e74206465706172746d656e74312530230603550403141c53616e67666f7220546563686e6f6c6f6769657320436f2e2c4c746430820122300d06092a864886f70d01010105000382010f003082010a0282010100acc852ff226c28a5c22858d7793d2e147777fab1d2a477d63d912937d5a3ae8d3c24d77cbc98eebbcb7150852bde889a3b27995e26718a734a6b0d27dee19a86469dec07b3cfffcb9eba39673d95a7aed3f546bf5dd1aa7c863d2cbcc66e8facfcfd20b464ce07c8a17074c650c55ab2ba97c32c3689fed66d63dd9ac553aa4f54a3d117c57b63451c03cae6048139d05b53e3a512daa778c30ae5e1c2940e6f4769bac48808f1e39d8b0c703dc3592d5b1a8384d7882ab0e879721e609d259b6aaa07de8fe17b7e8418d545f67ba982c72331fcb7083ccf5c6938879c3f4c094bce1ead3a17315f12d20da73045e7b0434ceacecd610f19d51ab2b2e0c26e230203010001a38201623082015e30090603551d1304023000300e0603551d0f0101ff040403020780302b0603551d1f042430223020a01ea01c861a687474703a2f2f73662e73796d63622e636f6d2f73662e63726c30660603551d20045f305d305b060b6086480186f84501071703304c302306082b06010505070201161768747470733a2f2f642e73796d63622e636f6d2f637073302506082b0601050507020230190c1768747470733a2f2f642e73796d63622e636f6d2f72706130130603551d25040c300a06082b06010505070303305706082b06010505070101044b3049301f06082b060105050730018613687474703a2f2f73662e73796d63642e636f6d302606082b06010505073002861a687474703a2f2f73662e73796d63622e636f6d2f73662e637274301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301d0603551d0e041604148b9a352c7884797b474f0d042581fd6f3527b8e5300d06092a864886f70d010105050003820101009e02c33ef7badd9b9f8870fb759774d90a4c7f9d9d013d147bafb25ca723c7cc60f858743fcbc6fa4a3d4d37c5caa3613f6c955ddacfe9f8bff184d1e529835b2c474382a2b809f33e571769c9610f72340fd4eda76a4557dd75fd2b8865bac936085ac66715ca26a70132d7fcf0761b1e191b0cc706ea2c3efcb537b56272f4337e4d14798a0a6852f285065b62bdecb93fff7ca4a4dce93d9623250ea9791c0e7a7a4df215616936dc4adb45ab6ea923e77e071fd13ff3515a93b297dc1af597e59ab8588c3672ba8e51c535710f3bbbc5c981525c5e6fea977a8e77a67f495974030e0fd9330a812d1fad546be3ffa0a756fbccf5d9b29af6d437500b27c3 vacon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0\Blob = 030000000100000014000000a9062c5c1721ff87ebcbd89df03719755560e7a02000000001000000640400003082046030820348a003020102020900dea4d5fa33cf9e9e300d06092a864886f70d01010b0500307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e3020170d3137303432373135323731395a180f32313137303430333135323731395a307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e848962dfef81aecd6d6739d91455b9173452578cc0496b410a05f70b12be3aa7cc0d1bb8d5de7e11b4158e9db43f0b8864ef4ece0df801c96240d2da076b915bc6165a10ff83dd7958961c60f70470d8dc1438995491cc69693cb98652c3c8fa07c1d20238fcf0e565159ce77d0f791dc1031f476dbb80f13b7ea967c8901b1bf137e976c5a37754cee287442dde53f5f7b7ed9a464b82874634e7bf9fba9504cf297111530973aa8bfc0a2d4850efb59f04f8875bdcde82763632d96f93fb3f0668acbf981b4483d90cb920f4f2403de422eaa8641ecf3db8dfedae5b658bfb4adb9c51ac494092bfe3d91900ed83835ca3c723d17962fc2b63c4fad1087c30203010001a381e23081df301d0603551d0e04160414ddc4d59401f87b754557a8be5eb3ac461bb8bab33081af0603551d230481a73081a48014ddc4d59401f87b754557a8be5eb3ac461bb8bab3a18180a47e307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e820900dea4d5fa33cf9e9e300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010093d5660dced1b9c499adf1de074577b2f0e782dc7c878889fbd1e69f4cdf410b664008dcc4b8cf4add5f353a5fc753a6fc32335db370cbf53d0143d1af33605ad6eadaee20ba545e2389d681dfb6fdcdd28f96791a792601a683f60fbe5bc24e2c19c0cfffdc5c777c0a340078713e1ade978178c8ab55298656ad27110b8f39e7de7b8be4388f33450d0a985bdadc5308fa0c7785fed2cdd84f2ac099bbcde6aa9c45cb2bc39c3137e0b8305d25ed1c4ebbcb68c9348ce37a659f94ee36f98631f7bcac85e98955cd8b6fae8eba1edf02b2fe909da19d1bbdd4129bb18efc6f0bf2e31409be6ff0ecf440eade5136900d36db6f004db5e918d7dbce4e96dc32 ECAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0\Blob = 190000000100000010000000236fca1bac00c7070f1dffccfd8e0468040000000100000010000000ef4bcf7680c4aadaf9c44228bba20fd1030000000100000014000000a9062c5c1721ff87ebcbd89df03719755560e7a00f00000001000000200000009507653c8a7f2132efc2c772644a70ecbed4e7fc75d3ac32e56ad7462a1bc22f140000000100000014000000ddc4d59401f87b754557a8be5eb3ac461bb8bab32000000001000000640400003082046030820348a003020102020900dea4d5fa33cf9e9e300d06092a864886f70d01010b0500307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e3020170d3137303432373135323731395a180f32313137303430333135323731395a307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e848962dfef81aecd6d6739d91455b9173452578cc0496b410a05f70b12be3aa7cc0d1bb8d5de7e11b4158e9db43f0b8864ef4ece0df801c96240d2da076b915bc6165a10ff83dd7958961c60f70470d8dc1438995491cc69693cb98652c3c8fa07c1d20238fcf0e565159ce77d0f791dc1031f476dbb80f13b7ea967c8901b1bf137e976c5a37754cee287442dde53f5f7b7ed9a464b82874634e7bf9fba9504cf297111530973aa8bfc0a2d4850efb59f04f8875bdcde82763632d96f93fb3f0668acbf981b4483d90cb920f4f2403de422eaa8641ecf3db8dfedae5b658bfb4adb9c51ac494092bfe3d91900ed83835ca3c723d17962fc2b63c4fad1087c30203010001a381e23081df301d0603551d0e04160414ddc4d59401f87b754557a8be5eb3ac461bb8bab33081af0603551d230481a73081a48014ddc4d59401f87b754557a8be5eb3ac461bb8bab3a18180a47e307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e820900dea4d5fa33cf9e9e300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010093d5660dced1b9c499adf1de074577b2f0e782dc7c878889fbd1e69f4cdf410b664008dcc4b8cf4add5f353a5fc753a6fc32335db370cbf53d0143d1af33605ad6eadaee20ba545e2389d681dfb6fdcdd28f96791a792601a683f60fbe5bc24e2c19c0cfffdc5c777c0a340078713e1ade978178c8ab55298656ad27110b8f39e7de7b8be4388f33450d0a985bdadc5308fa0c7785fed2cdd84f2ac099bbcde6aa9c45cb2bc39c3137e0b8305d25ed1c4ebbcb68c9348ce37a659f94ee36f98631f7bcac85e98955cd8b6fae8eba1edf02b2fe909da19d1bbdd4129bb18efc6f0bf2e31409be6ff0ecf440eade5136900d36db6f004db5e918d7dbce4e96dc32 SangforPromoteService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0\Blob = 030000000100000014000000a9062c5c1721ff87ebcbd89df03719755560e7a02000000001000000640400003082046030820348a003020102020900dea4d5fa33cf9e9e300d06092a864886f70d01010b0500307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e3020170d3137303432373135323731395a180f32313137303430333135323731395a307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e848962dfef81aecd6d6739d91455b9173452578cc0496b410a05f70b12be3aa7cc0d1bb8d5de7e11b4158e9db43f0b8864ef4ece0df801c96240d2da076b915bc6165a10ff83dd7958961c60f70470d8dc1438995491cc69693cb98652c3c8fa07c1d20238fcf0e565159ce77d0f791dc1031f476dbb80f13b7ea967c8901b1bf137e976c5a37754cee287442dde53f5f7b7ed9a464b82874634e7bf9fba9504cf297111530973aa8bfc0a2d4850efb59f04f8875bdcde82763632d96f93fb3f0668acbf981b4483d90cb920f4f2403de422eaa8641ecf3db8dfedae5b658bfb4adb9c51ac494092bfe3d91900ed83835ca3c723d17962fc2b63c4fad1087c30203010001a381e23081df301d0603551d0e04160414ddc4d59401f87b754557a8be5eb3ac461bb8bab33081af0603551d230481a73081a48014ddc4d59401f87b754557a8be5eb3ac461bb8bab3a18180a47e307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e820900dea4d5fa33cf9e9e300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010093d5660dced1b9c499adf1de074577b2f0e782dc7c878889fbd1e69f4cdf410b664008dcc4b8cf4add5f353a5fc753a6fc32335db370cbf53d0143d1af33605ad6eadaee20ba545e2389d681dfb6fdcdd28f96791a792601a683f60fbe5bc24e2c19c0cfffdc5c777c0a340078713e1ade978178c8ab55298656ad27110b8f39e7de7b8be4388f33450d0a985bdadc5308fa0c7785fed2cdd84f2ac099bbcde6aa9c45cb2bc39c3137e0b8305d25ed1c4ebbcb68c9348ce37a659f94ee36f98631f7bcac85e98955cd8b6fae8eba1edf02b2fe909da19d1bbdd4129bb18efc6f0bf2e31409be6ff0ecf440eade5136900d36db6f004db5e918d7dbce4e96dc32 ECAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0\Blob = 030000000100000014000000a9062c5c1721ff87ebcbd89df03719755560e7a02000000001000000640400003082046030820348a003020102020900dea4d5fa33cf9e9e300d06092a864886f70d01010b0500307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e3020170d3137303432373135323731395a180f32313137303430333135323731395a307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e848962dfef81aecd6d6739d91455b9173452578cc0496b410a05f70b12be3aa7cc0d1bb8d5de7e11b4158e9db43f0b8864ef4ece0df801c96240d2da076b915bc6165a10ff83dd7958961c60f70470d8dc1438995491cc69693cb98652c3c8fa07c1d20238fcf0e565159ce77d0f791dc1031f476dbb80f13b7ea967c8901b1bf137e976c5a37754cee287442dde53f5f7b7ed9a464b82874634e7bf9fba9504cf297111530973aa8bfc0a2d4850efb59f04f8875bdcde82763632d96f93fb3f0668acbf981b4483d90cb920f4f2403de422eaa8641ecf3db8dfedae5b658bfb4adb9c51ac494092bfe3d91900ed83835ca3c723d17962fc2b63c4fad1087c30203010001a381e23081df301d0603551d0e04160414ddc4d59401f87b754557a8be5eb3ac461bb8bab33081af0603551d230481a73081a48014ddc4d59401f87b754557a8be5eb3ac461bb8bab3a18180a47e307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e820900dea4d5fa33cf9e9e300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010093d5660dced1b9c499adf1de074577b2f0e782dc7c878889fbd1e69f4cdf410b664008dcc4b8cf4add5f353a5fc753a6fc32335db370cbf53d0143d1af33605ad6eadaee20ba545e2389d681dfb6fdcdd28f96791a792601a683f60fbe5bc24e2c19c0cfffdc5c777c0a340078713e1ade978178c8ab55298656ad27110b8f39e7de7b8be4388f33450d0a985bdadc5308fa0c7785fed2cdd84f2ac099bbcde6aa9c45cb2bc39c3137e0b8305d25ed1c4ebbcb68c9348ce37a659f94ee36f98631f7bcac85e98955cd8b6fae8eba1edf02b2fe909da19d1bbdd4129bb18efc6f0bf2e31409be6ff0ecf440eade5136900d36db6f004db5e918d7dbce4e96dc32 ECAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d461d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67080b00000001000000140000005500530045005200540072007500730074000000140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d8090000000100000016000000301406082b0601050507030306082b060105050703080f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 vacon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0 ECAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0\Blob = 030000000100000014000000a9062c5c1721ff87ebcbd89df03719755560e7a02000000001000000640400003082046030820348a003020102020900dea4d5fa33cf9e9e300d06092a864886f70d01010b0500307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e3020170d3137303432373135323731395a180f32313137303430333135323731395a307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e848962dfef81aecd6d6739d91455b9173452578cc0496b410a05f70b12be3aa7cc0d1bb8d5de7e11b4158e9db43f0b8864ef4ece0df801c96240d2da076b915bc6165a10ff83dd7958961c60f70470d8dc1438995491cc69693cb98652c3c8fa07c1d20238fcf0e565159ce77d0f791dc1031f476dbb80f13b7ea967c8901b1bf137e976c5a37754cee287442dde53f5f7b7ed9a464b82874634e7bf9fba9504cf297111530973aa8bfc0a2d4850efb59f04f8875bdcde82763632d96f93fb3f0668acbf981b4483d90cb920f4f2403de422eaa8641ecf3db8dfedae5b658bfb4adb9c51ac494092bfe3d91900ed83835ca3c723d17962fc2b63c4fad1087c30203010001a381e23081df301d0603551d0e04160414ddc4d59401f87b754557a8be5eb3ac461bb8bab33081af0603551d230481a73081a48014ddc4d59401f87b754557a8be5eb3ac461bb8bab3a18180a47e307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e820900dea4d5fa33cf9e9e300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010093d5660dced1b9c499adf1de074577b2f0e782dc7c878889fbd1e69f4cdf410b664008dcc4b8cf4add5f353a5fc753a6fc32335db370cbf53d0143d1af33605ad6eadaee20ba545e2389d681dfb6fdcdd28f96791a792601a683f60fbe5bc24e2c19c0cfffdc5c777c0a340078713e1ade978178c8ab55298656ad27110b8f39e7de7b8be4388f33450d0a985bdadc5308fa0c7785fed2cdd84f2ac099bbcde6aa9c45cb2bc39c3137e0b8305d25ed1c4ebbcb68c9348ce37a659f94ee36f98631f7bcac85e98955cd8b6fae8eba1edf02b2fe909da19d1bbdd4129bb18efc6f0bf2e31409be6ff0ecf440eade5136900d36db6f004db5e918d7dbce4e96dc32 ECAgent.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\2EFD69CD8052055D6DC5EAC7631A27A45E102A8B\Blob = 0300000001000000140000002efd69cd8052055d6dc5eac7631a27a45e102a8b200000000100000058050000308205543082043ca0030201020210121876db06e834da35c19890e6e650d0300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3135303731373030303030305a170d3138303931343233353935395a3081b0310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31253023060355040a141c53616e67666f7220546563686e6f6c6f6769657320436f2e2c4c7464312c302a060355040b1423726573656172636820616e6420646576656c6f706d656e74206465706172746d656e74312530230603550403141c53616e67666f7220546563686e6f6c6f6769657320436f2e2c4c746430820122300d06092a864886f70d01010105000382010f003082010a0282010100acc852ff226c28a5c22858d7793d2e147777fab1d2a477d63d912937d5a3ae8d3c24d77cbc98eebbcb7150852bde889a3b27995e26718a734a6b0d27dee19a86469dec07b3cfffcb9eba39673d95a7aed3f546bf5dd1aa7c863d2cbcc66e8facfcfd20b464ce07c8a17074c650c55ab2ba97c32c3689fed66d63dd9ac553aa4f54a3d117c57b63451c03cae6048139d05b53e3a512daa778c30ae5e1c2940e6f4769bac48808f1e39d8b0c703dc3592d5b1a8384d7882ab0e879721e609d259b6aaa07de8fe17b7e8418d545f67ba982c72331fcb7083ccf5c6938879c3f4c094bce1ead3a17315f12d20da73045e7b0434ceacecd610f19d51ab2b2e0c26e230203010001a38201623082015e30090603551d1304023000300e0603551d0f0101ff040403020780302b0603551d1f042430223020a01ea01c861a687474703a2f2f73662e73796d63622e636f6d2f73662e63726c30660603551d20045f305d305b060b6086480186f84501071703304c302306082b06010505070201161768747470733a2f2f642e73796d63622e636f6d2f637073302506082b0601050507020230190c1768747470733a2f2f642e73796d63622e636f6d2f72706130130603551d25040c300a06082b06010505070303305706082b06010505070101044b3049301f06082b060105050730018613687474703a2f2f73662e73796d63642e636f6d302606082b06010505073002861a687474703a2f2f73662e73796d63622e636f6d2f73662e637274301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301d0603551d0e041604148b9a352c7884797b474f0d042581fd6f3527b8e5300d06092a864886f70d010105050003820101009e02c33ef7badd9b9f8870fb759774d90a4c7f9d9d013d147bafb25ca723c7cc60f858743fcbc6fa4a3d4d37c5caa3613f6c955ddacfe9f8bff184d1e529835b2c474382a2b809f33e571769c9610f72340fd4eda76a4557dd75fd2b8865bac936085ac66715ca26a70132d7fcf0761b1e191b0cc706ea2c3efcb537b56272f4337e4d14798a0a6852f285065b62bdecb93fff7ca4a4dce93d9623250ea9791c0e7a7a4df215616936dc4adb45ab6ea923e77e071fd13ff3515a93b297dc1af597e59ab8588c3672ba8e51c535710f3bbbc5c981525c5e6fea977a8e77a67f495974030e0fd9330a812d1fad546be3ffa0a756fbccf5d9b29af6d437500b27c3 vacon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5CEA91B309BE5E0A5EE4DA8FD8C162847787B3CA\Blob = 0300000001000000140000005cea91b309be5e0a5ee4da8fd8c162847787b3ca2000000001000000200500003082051c30820404a0030201020210234d0da754e1f10eae2e6d26bbcd1b18300d06092a864886f70d01010b0500307f310b3009060355040613025553311d301b060355040a131453796d616e74656320436f72706f726174696f6e311f301d060355040b131653796d616e746563205472757374204e6574776f726b3130302e0603550403132753796d616e74656320436c61737320332053484132353620436f6465205369676e696e67204341301e170d3135313233313030303030305a170d3138303931343233353935395a3081b0310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31253023060355040a141c53616e67666f7220546563686e6f6c6f6769657320436f2e2c4c7464312c302a060355040b1423726573656172636820616e6420646576656c6f706d656e74206465706172746d656e74312530230603550403141c53616e67666f7220546563686e6f6c6f6769657320436f2e2c4c746430820120300d06092a864886f70d01010105000382010d00308201080282010100c0595e7714493cade5690897671e3e06acf314a0fe078cff559df66cd2a579efab43f61d0c60adf2a8eebf9a665bf6afe39a55c06fd87ca6ef531bb63da9bf5b843384c085fb7b0070e845433cc9bbfc5d1f9332a85a8e7707e741c90bbd1b551a5239592cf4bc0c872bee374b115d3cc101cd4c19a6c0a90f6de78ea7944f04c61bcd162d4cf976e7ba138f9a30b333a70e5b6ed1d608e438d18bbf57d0e7a1fd8897a47f2628d71bd64b6bfcd5e0a8d03064e30f8a2867f4d3264d53d03d7963989ba4f2d3f486400cd85a10b194f2e055b17052c239bb485952000b1db641fc7b0f7628118fb003e660d9f50ad9d9df731e597ffdef3de65a9644808653b9020103a38201623082015e30090603551d1304023000300e0603551d0f0101ff040403020780302b0603551d1f042430223020a01ea01c861a687474703a2f2f73762e73796d63622e636f6d2f73762e63726c30660603551d20045f305d305b060b6086480186f84501071703304c302306082b06010505070201161768747470733a2f2f642e73796d63622e636f6d2f637073302506082b0601050507020230190c1768747470733a2f2f642e73796d63622e636f6d2f72706130130603551d25040c300a06082b06010505070303305706082b06010505070101044b3049301f06082b060105050730018613687474703a2f2f73762e73796d63642e636f6d302606082b06010505073002861a687474703a2f2f73762e73796d63622e636f6d2f73762e637274301f0603551d23041830168014963b53f0793397af7d83ef2e2bcccab7861e7266301d0603551d0e041604147398bcef6eb19cdd27df2c2988153f050669a4b1300d06092a864886f70d01010b050003820101008ab4f0256e632d8e95f0b8e668ab115f08a22036dd089d19ad4abe0b885579a9389415c5638138c44966db8d8e13d850f3046f5aed9dd1dc8a70707fb7b0ab7e774f56c2e6306110ae8695c9ccd452fa366f273c9cc5635b41e76fd15439884c0d8ec87ef1e2b88552935b8e1aeeb6da162d05ec00a860d7c7ee894afe4fe456e122916f0a7fbbae0e4e1ecb9945a4d11ba532d2b7beeab0f42cf4ad43e72b72b0864f99a09aa5a742ccc1826a408559afa3a1cef61778e59319ea83e0cbd935aa83a2b0c22722b73d5029226b66c111f0bdc833478a547bd5016ed614bf84dd58596b63e22406fc74ade183b928bb58def97eeda5e22cb1eb933001df92bd99 vacon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5CEA91B309BE5E0A5EE4DA8FD8C162847787B3CA\Blob = 0f00000001000000200000004657a804ff701934257969425731293ebb5493e41b2b59e1bb733fc42ccb22d00300000001000000140000005cea91b309be5e0a5ee4da8fd8c162847787b3ca2000000001000000200500003082051c30820404a0030201020210234d0da754e1f10eae2e6d26bbcd1b18300d06092a864886f70d01010b0500307f310b3009060355040613025553311d301b060355040a131453796d616e74656320436f72706f726174696f6e311f301d060355040b131653796d616e746563205472757374204e6574776f726b3130302e0603550403132753796d616e74656320436c61737320332053484132353620436f6465205369676e696e67204341301e170d3135313233313030303030305a170d3138303931343233353935395a3081b0310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31253023060355040a141c53616e67666f7220546563686e6f6c6f6769657320436f2e2c4c7464312c302a060355040b1423726573656172636820616e6420646576656c6f706d656e74206465706172746d656e74312530230603550403141c53616e67666f7220546563686e6f6c6f6769657320436f2e2c4c746430820120300d06092a864886f70d01010105000382010d00308201080282010100c0595e7714493cade5690897671e3e06acf314a0fe078cff559df66cd2a579efab43f61d0c60adf2a8eebf9a665bf6afe39a55c06fd87ca6ef531bb63da9bf5b843384c085fb7b0070e845433cc9bbfc5d1f9332a85a8e7707e741c90bbd1b551a5239592cf4bc0c872bee374b115d3cc101cd4c19a6c0a90f6de78ea7944f04c61bcd162d4cf976e7ba138f9a30b333a70e5b6ed1d608e438d18bbf57d0e7a1fd8897a47f2628d71bd64b6bfcd5e0a8d03064e30f8a2867f4d3264d53d03d7963989ba4f2d3f486400cd85a10b194f2e055b17052c239bb485952000b1db641fc7b0f7628118fb003e660d9f50ad9d9df731e597ffdef3de65a9644808653b9020103a38201623082015e30090603551d1304023000300e0603551d0f0101ff040403020780302b0603551d1f042430223020a01ea01c861a687474703a2f2f73762e73796d63622e636f6d2f73762e63726c30660603551d20045f305d305b060b6086480186f84501071703304c302306082b06010505070201161768747470733a2f2f642e73796d63622e636f6d2f637073302506082b0601050507020230190c1768747470733a2f2f642e73796d63622e636f6d2f72706130130603551d25040c300a06082b06010505070303305706082b06010505070101044b3049301f06082b060105050730018613687474703a2f2f73762e73796d63642e636f6d302606082b06010505073002861a687474703a2f2f73762e73796d63622e636f6d2f73762e637274301f0603551d23041830168014963b53f0793397af7d83ef2e2bcccab7861e7266301d0603551d0e041604147398bcef6eb19cdd27df2c2988153f050669a4b1300d06092a864886f70d01010b050003820101008ab4f0256e632d8e95f0b8e668ab115f08a22036dd089d19ad4abe0b885579a9389415c5638138c44966db8d8e13d850f3046f5aed9dd1dc8a70707fb7b0ab7e774f56c2e6306110ae8695c9ccd452fa366f273c9cc5635b41e76fd15439884c0d8ec87ef1e2b88552935b8e1aeeb6da162d05ec00a860d7c7ee894afe4fe456e122916f0a7fbbae0e4e1ecb9945a4d11ba532d2b7beeab0f42cf4ad43e72b72b0864f99a09aa5a742ccc1826a408559afa3a1cef61778e59319ea83e0cbd935aa83a2b0c22722b73d5029226b66c111f0bdc833478a547bd5016ed614bf84dd58596b63e22406fc74ade183b928bb58def97eeda5e22cb1eb933001df92bd99 vacon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0\Blob = 140000000100000014000000ddc4d59401f87b754557a8be5eb3ac461bb8bab30f00000001000000200000009507653c8a7f2132efc2c772644a70ecbed4e7fc75d3ac32e56ad7462a1bc22f030000000100000014000000a9062c5c1721ff87ebcbd89df03719755560e7a0040000000100000010000000ef4bcf7680c4aadaf9c44228bba20fd12000000001000000640400003082046030820348a003020102020900dea4d5fa33cf9e9e300d06092a864886f70d01010b0500307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e3020170d3137303432373135323731395a180f32313137303430333135323731395a307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e848962dfef81aecd6d6739d91455b9173452578cc0496b410a05f70b12be3aa7cc0d1bb8d5de7e11b4158e9db43f0b8864ef4ece0df801c96240d2da076b915bc6165a10ff83dd7958961c60f70470d8dc1438995491cc69693cb98652c3c8fa07c1d20238fcf0e565159ce77d0f791dc1031f476dbb80f13b7ea967c8901b1bf137e976c5a37754cee287442dde53f5f7b7ed9a464b82874634e7bf9fba9504cf297111530973aa8bfc0a2d4850efb59f04f8875bdcde82763632d96f93fb3f0668acbf981b4483d90cb920f4f2403de422eaa8641ecf3db8dfedae5b658bfb4adb9c51ac494092bfe3d91900ed83835ca3c723d17962fc2b63c4fad1087c30203010001a381e23081df301d0603551d0e04160414ddc4d59401f87b754557a8be5eb3ac461bb8bab33081af0603551d230481a73081a48014ddc4d59401f87b754557a8be5eb3ac461bb8bab3a18180a47e307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e820900dea4d5fa33cf9e9e300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010093d5660dced1b9c499adf1de074577b2f0e782dc7c878889fbd1e69f4cdf410b664008dcc4b8cf4add5f353a5fc753a6fc32335db370cbf53d0143d1af33605ad6eadaee20ba545e2389d681dfb6fdcdd28f96791a792601a683f60fbe5bc24e2c19c0cfffdc5c777c0a340078713e1ade978178c8ab55298656ad27110b8f39e7de7b8be4388f33450d0a985bdadc5308fa0c7785fed2cdd84f2ac099bbcde6aa9c45cb2bc39c3137e0b8305d25ed1c4ebbcb68c9348ce37a659f94ee36f98631f7bcac85e98955cd8b6fae8eba1edf02b2fe909da19d1bbdd4129bb18efc6f0bf2e31409be6ff0ecf440eade5136900d36db6f004db5e918d7dbce4e96dc32 SangforPromoteService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0 ECAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 vacon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 vacon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0\Blob = 040000000100000010000000ef4bcf7680c4aadaf9c44228bba20fd1030000000100000014000000a9062c5c1721ff87ebcbd89df03719755560e7a00f00000001000000200000009507653c8a7f2132efc2c772644a70ecbed4e7fc75d3ac32e56ad7462a1bc22f2000000001000000640400003082046030820348a003020102020900dea4d5fa33cf9e9e300d06092a864886f70d01010b0500307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e3020170d3137303432373135323731395a180f32313137303430333135323731395a307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e848962dfef81aecd6d6739d91455b9173452578cc0496b410a05f70b12be3aa7cc0d1bb8d5de7e11b4158e9db43f0b8864ef4ece0df801c96240d2da076b915bc6165a10ff83dd7958961c60f70470d8dc1438995491cc69693cb98652c3c8fa07c1d20238fcf0e565159ce77d0f791dc1031f476dbb80f13b7ea967c8901b1bf137e976c5a37754cee287442dde53f5f7b7ed9a464b82874634e7bf9fba9504cf297111530973aa8bfc0a2d4850efb59f04f8875bdcde82763632d96f93fb3f0668acbf981b4483d90cb920f4f2403de422eaa8641ecf3db8dfedae5b658bfb4adb9c51ac494092bfe3d91900ed83835ca3c723d17962fc2b63c4fad1087c30203010001a381e23081df301d0603551d0e04160414ddc4d59401f87b754557a8be5eb3ac461bb8bab33081af0603551d230481a73081a48014ddc4d59401f87b754557a8be5eb3ac461bb8bab3a18180a47e307c310b300906035504061302434e31123010060355040813096775616e67646f6e673111300f060355040713087368656e7a68656e31223020060355040a131953616e67666f7220546563686e6f6c6f6769657320496e632e31223020060355040b131953616e67666f7220546563686e6f6c6f6769657320496e632e820900dea4d5fa33cf9e9e300c0603551d13040530030101ff300d06092a864886f70d01010b0500038201010093d5660dced1b9c499adf1de074577b2f0e782dc7c878889fbd1e69f4cdf410b664008dcc4b8cf4add5f353a5fc753a6fc32335db370cbf53d0143d1af33605ad6eadaee20ba545e2389d681dfb6fdcdd28f96791a792601a683f60fbe5bc24e2c19c0cfffdc5c777c0a340078713e1ade978178c8ab55298656ad27110b8f39e7de7b8be4388f33450d0a985bdadc5308fa0c7785fed2cdd84f2ac099bbcde6aa9c45cb2bc39c3137e0b8305d25ed1c4ebbcb68c9348ce37a659f94ee36f98631f7bcac85e98955cd8b6fae8eba1edf02b2fe909da19d1bbdd4129bb18efc6f0bf2e31409be6ff0ecf440eade5136900d36db6f004db5e918d7dbce4e96dc32 SangforPromoteService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0 ECAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0 ECAgent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\2EFD69CD8052055D6DC5EAC7631A27A45E102A8B vacon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a vacon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 vacon.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 vacon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A9062C5C1721FF87EBCBD89DF03719755560E7A0 SangforPromoteService.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SangforCSClientInstaller.exeECAgent.exepid process 1980 SangforCSClientInstaller.exe 1980 SangforCSClientInstaller.exe 1984 ECAgent.exe 1984 ECAgent.exe -
Suspicious behavior: LoadsDriver 3 IoCs
Processes:
pid process 460 460 460 -
Suspicious use of AdjustPrivilegeToken 58 IoCs
Processes:
Uninstall.exevacon.exeDrvInst.exevssvc.exeDrvInst.exeDrvInst.exedescription pid process Token: SeDebugPrivilege 864 Uninstall.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeBackupPrivilege 1260 vssvc.exe Token: SeRestorePrivilege 1260 vssvc.exe Token: SeAuditPrivilege 1260 vssvc.exe Token: SeBackupPrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 844 DrvInst.exe Token: SeRestorePrivilege 844 DrvInst.exe Token: SeRestorePrivilege 844 DrvInst.exe Token: SeRestorePrivilege 844 DrvInst.exe Token: SeRestorePrivilege 844 DrvInst.exe Token: SeRestorePrivilege 844 DrvInst.exe Token: SeRestorePrivilege 844 DrvInst.exe Token: SeLoadDriverPrivilege 844 DrvInst.exe Token: SeLoadDriverPrivilege 844 DrvInst.exe Token: SeLoadDriverPrivilege 844 DrvInst.exe Token: SeRestorePrivilege 1136 vacon.exe Token: SeLoadDriverPrivilege 1136 vacon.exe Token: SeRestorePrivilege 1184 DrvInst.exe Token: SeRestorePrivilege 1184 DrvInst.exe Token: SeRestorePrivilege 1184 DrvInst.exe Token: SeRestorePrivilege 1184 DrvInst.exe Token: SeRestorePrivilege 1184 DrvInst.exe Token: SeRestorePrivilege 1184 DrvInst.exe Token: SeRestorePrivilege 1184 DrvInst.exe Token: SeRestorePrivilege 1184 DrvInst.exe Token: SeLoadDriverPrivilege 1184 DrvInst.exe Token: SeLoadDriverPrivilege 1136 vacon.exe Token: SeLoadDriverPrivilege 1136 vacon.exe Token: SeLoadDriverPrivilege 1136 vacon.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Uninstall.exepid process 864 Uninstall.exe 864 Uninstall.exe -
Suspicious use of WriteProcessMemory 232 IoCs
Processes:
14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exeEasyConnectInstaller_.exeTcpDriverInstaller.exeDnsDriverInstaller.exedescription pid process target process PID 1764 wrote to memory of 1920 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe TaskServer.exe PID 1764 wrote to memory of 1920 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe TaskServer.exe PID 1764 wrote to memory of 1920 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe TaskServer.exe PID 1764 wrote to memory of 1920 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe TaskServer.exe PID 1764 wrote to memory of 1968 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe EasyConnectInstaller_.exe PID 1764 wrote to memory of 1968 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe EasyConnectInstaller_.exe PID 1764 wrote to memory of 1968 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe EasyConnectInstaller_.exe PID 1764 wrote to memory of 1968 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe EasyConnectInstaller_.exe PID 1764 wrote to memory of 1968 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe EasyConnectInstaller_.exe PID 1764 wrote to memory of 1968 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe EasyConnectInstaller_.exe PID 1764 wrote to memory of 1968 1764 14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe EasyConnectInstaller_.exe PID 1968 wrote to memory of 864 1968 EasyConnectInstaller_.exe Uninstall.exe PID 1968 wrote to memory of 864 1968 EasyConnectInstaller_.exe Uninstall.exe PID 1968 wrote to memory of 864 1968 EasyConnectInstaller_.exe Uninstall.exe PID 1968 wrote to memory of 864 1968 EasyConnectInstaller_.exe Uninstall.exe PID 1968 wrote to memory of 864 1968 EasyConnectInstaller_.exe Uninstall.exe PID 1968 wrote to memory of 864 1968 EasyConnectInstaller_.exe Uninstall.exe PID 1968 wrote to memory of 864 1968 EasyConnectInstaller_.exe Uninstall.exe PID 1968 wrote to memory of 1980 1968 EasyConnectInstaller_.exe SangforCSClientInstaller.exe PID 1968 wrote to memory of 1980 1968 EasyConnectInstaller_.exe SangforCSClientInstaller.exe PID 1968 wrote to memory of 1980 1968 EasyConnectInstaller_.exe SangforCSClientInstaller.exe PID 1968 wrote to memory of 1980 1968 EasyConnectInstaller_.exe SangforCSClientInstaller.exe PID 1968 wrote to memory of 1980 1968 EasyConnectInstaller_.exe SangforCSClientInstaller.exe PID 1968 wrote to memory of 1980 1968 EasyConnectInstaller_.exe SangforCSClientInstaller.exe PID 1968 wrote to memory of 1980 1968 EasyConnectInstaller_.exe SangforCSClientInstaller.exe PID 1968 wrote to memory of 1260 1968 EasyConnectInstaller_.exe TcpDriverInstaller.exe PID 1968 wrote to memory of 1260 1968 EasyConnectInstaller_.exe TcpDriverInstaller.exe PID 1968 wrote to memory of 1260 1968 EasyConnectInstaller_.exe TcpDriverInstaller.exe PID 1968 wrote to memory of 1260 1968 EasyConnectInstaller_.exe TcpDriverInstaller.exe PID 1968 wrote to memory of 1260 1968 EasyConnectInstaller_.exe TcpDriverInstaller.exe PID 1968 wrote to memory of 1260 1968 EasyConnectInstaller_.exe TcpDriverInstaller.exe PID 1968 wrote to memory of 1260 1968 EasyConnectInstaller_.exe TcpDriverInstaller.exe PID 1260 wrote to memory of 1904 1260 TcpDriverInstaller.exe Remove.exe PID 1260 wrote to memory of 1904 1260 TcpDriverInstaller.exe Remove.exe PID 1260 wrote to memory of 1904 1260 TcpDriverInstaller.exe Remove.exe PID 1260 wrote to memory of 1904 1260 TcpDriverInstaller.exe Remove.exe PID 1260 wrote to memory of 1904 1260 TcpDriverInstaller.exe Remove.exe PID 1260 wrote to memory of 1904 1260 TcpDriverInstaller.exe Remove.exe PID 1260 wrote to memory of 1904 1260 TcpDriverInstaller.exe Remove.exe PID 1260 wrote to memory of 268 1260 TcpDriverInstaller.exe Install.exe PID 1260 wrote to memory of 268 1260 TcpDriverInstaller.exe Install.exe PID 1260 wrote to memory of 268 1260 TcpDriverInstaller.exe Install.exe PID 1260 wrote to memory of 268 1260 TcpDriverInstaller.exe Install.exe PID 1260 wrote to memory of 268 1260 TcpDriverInstaller.exe Install.exe PID 1260 wrote to memory of 268 1260 TcpDriverInstaller.exe Install.exe PID 1260 wrote to memory of 268 1260 TcpDriverInstaller.exe Install.exe PID 1968 wrote to memory of 568 1968 EasyConnectInstaller_.exe DnsDriverInstaller.exe PID 1968 wrote to memory of 568 1968 EasyConnectInstaller_.exe DnsDriverInstaller.exe PID 1968 wrote to memory of 568 1968 EasyConnectInstaller_.exe DnsDriverInstaller.exe PID 1968 wrote to memory of 568 1968 EasyConnectInstaller_.exe DnsDriverInstaller.exe PID 1968 wrote to memory of 568 1968 EasyConnectInstaller_.exe DnsDriverInstaller.exe PID 1968 wrote to memory of 568 1968 EasyConnectInstaller_.exe DnsDriverInstaller.exe PID 1968 wrote to memory of 568 1968 EasyConnectInstaller_.exe DnsDriverInstaller.exe PID 568 wrote to memory of 800 568 DnsDriverInstaller.exe Remove.exe PID 568 wrote to memory of 800 568 DnsDriverInstaller.exe Remove.exe PID 568 wrote to memory of 800 568 DnsDriverInstaller.exe Remove.exe PID 568 wrote to memory of 800 568 DnsDriverInstaller.exe Remove.exe PID 568 wrote to memory of 800 568 DnsDriverInstaller.exe Remove.exe PID 568 wrote to memory of 800 568 DnsDriverInstaller.exe Remove.exe PID 568 wrote to memory of 800 568 DnsDriverInstaller.exe Remove.exe PID 568 wrote to memory of 796 568 DnsDriverInstaller.exe Install.exe PID 568 wrote to memory of 796 568 DnsDriverInstaller.exe Install.exe PID 568 wrote to memory of 796 568 DnsDriverInstaller.exe Install.exe PID 568 wrote to memory of 796 568 DnsDriverInstaller.exe Install.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe"C:\Users\Admin\AppData\Local\Temp\14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TaskServer.exeTaskServer.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exeEasyConnectInstaller_.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies service
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe" -QUICKREPAIR -HIDE -NODELSESSION -SessionId=-13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe"C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe"C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe"C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe"C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\expand.exe"expand.exe" -r "C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.CAB" "C:\Program Files (x86)\Sangfor\SSL\Promote"4⤵
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\expand.exe"expand.exe" -r "C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClient.CAB" "C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient"4⤵
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe" -SessionId=-13⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe" -SessionId=-13⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe"C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe"4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\vacon.exe"C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\vacon.exe" install "C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforCertificate.cer" "C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforCertificate256.cer" "C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforVNIC.inf" SangforVNIC4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies service
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe"C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\netsh.exenetsh interface ip set interface 11 dadtransmits=05⤵
- Modifies service
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe" reg ProxyIEX64.dll "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcpX64.dll"3⤵
- Executes dropped EXE
- Modifies service
- Modifies registry class
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe" reg SangforNspX64.dll "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNspX64.dll"3⤵
- Executes dropped EXE
- Modifies service
- Modifies registry class
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe"C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe" --restart4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe"C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe" -SessionId=-13⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe"C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe" -/StopServer4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe"C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe" -/StartServer4⤵
- Executes dropped EXE
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3ff9630f-0ed5-0990-3568-e74d850b0432}\sangforvnic.inf" "9" "693d7628f" "00000000000003CC" "WinSta0\Default" "0000000000000540" "208" "c:\program files (x86)\sangfor\ssl\csclient\vnic"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005C4" "00000000000005BC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "sangforvnic.inf:SangforVNIC.NTAMD64:SangforVNIC.ndi:5.9.0.0:sangforvnic" "693d7628f" "00000000000003CC" "00000000000005E0" "00000000000005B8"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Modifies service
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding1⤵
-
C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe"C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe"C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe" --import-sys --enable-loopback2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies system certificate store
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe"C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe" --from-sp2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe"C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe" --import-nss --enable-ie-loopback2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe"C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe" --import-sys --enable-loopback2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies system certificate store
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRA~2\Sangfor\SSL\CLIENT~1\ND_DKE~1.CAB
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforCertificate.cer
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforCertificate256.cer
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforVNIC.inf
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe
-
C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\vacon.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCore.dll
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNspX64.dll
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcpX64.dll
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
-
C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
-
C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
-
C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
-
C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
-
C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\SANGFORVPNLIBEAY32.dll
-
C:\Program Files (x86)\Sangfor\SSL\ECAgent\SANGFORVPNSSLEAY32.dll
-
C:\Program Files (x86)\Sangfor\SSL\Promote\MSVCP60.dll
-
C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.exe
-
C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClient.exe
-
C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
-
C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
-
C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
-
C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
-
C:\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
-
C:\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
-
C:\Users\Admin\AppData\Local\Temp\TaskServer.exe
-
C:\Users\Admin\AppData\Local\Temp\TaskServer.exe
-
C:\Users\Admin\AppData\Local\Temp\{3FF96~1\SangforVnic.sys
-
C:\Users\Admin\AppData\Local\Temp\{3ff9630f-0ed5-0990-3568-e74d850b0432}\SangforVnic.cat
-
C:\Users\Admin\AppData\Local\Temp\{3ff9630f-0ed5-0990-3568-e74d850b0432}\sangforvnic.inf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zalsryvg.Admin\cert8.db
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zalsryvg.Admin\key3.db
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zalsryvg.Admin\secmod.db
-
C:\Users\Admin\AppData\Roaming\Sangfor\SSL\Log\ECAgent_20200911.log
-
C:\Windows\INF\oem2.inf
-
C:\Windows\Logs\DPX\setupact.log
-
C:\Windows\SysWOW64\MSVCR100.dll
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Sangfor\SSL\Log\ECAgent_20200911.log
-
C:\Windows\System32\DRIVER~1\FILERE~1\SANGFO~1.INF\SangforVnic.sys
-
C:\Windows\System32\DriverStore\FileRepository\sangforvnic.inf_amd64_neutral_9183b83f3b2f3cd1\SangforVnic.cat
-
C:\Windows\System32\DriverStore\FileRepository\sangforvnic.inf_amd64_neutral_9183b83f3b2f3cd1\sangforvnic.PNF
-
C:\Windows\System32\DriverStore\FileRepository\sangforvnic.inf_amd64_neutral_9183b83f3b2f3cd1\sangforvnic.inf
-
C:\Windows\System32\DriverStore\INFCACHE.1
-
\??\c:\PROGRA~2\sangfor\ssl\csclient\vnic\SANGFO~1.SYS
-
\??\c:\program files (x86)\sangfor\ssl\csclient\vnic\SangforVnic.cat
-
\??\c:\program files (x86)\sangfor\ssl\promote\sangforpromote.cab
-
\??\c:\program files (x86)\sangfor\ssl\sangforserviceclient\sangforserviceclient.cab
-
\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
-
\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
-
\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
-
\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
-
\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
-
\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe
-
\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe
-
\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe
-
\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\vacon.exe
-
\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\vacon.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\CSClientManagerPrj.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\Nddkey\FT_ND_API.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\Nddkey\FT_ND_SC.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SSOClientPrj.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforBHO.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCDC.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCore.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCore.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforL3Vpn.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNsp.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNspX64.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNspX64.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforSddn.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcpX64.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\UrlWarrent.dll
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
-
\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
-
\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
-
\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
-
\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
-
\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
-
\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
-
\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
-
\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
-
\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
-
\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnSsleay32.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnSsleay32.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnSsleay32.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnSsleay32.dll
-
\Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnSsleay32.dll
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
-
\Program Files (x86)\Sangfor\SSL\Promote\msvcp60.dll
-
\Program Files (x86)\Sangfor\SSL\Promote\msvcp60.dll
-
\Program Files (x86)\Sangfor\SSL\RemoteAppClient\SfRemoteAppClient.exe
-
\Program Files (x86)\Sangfor\SSL\RemoteAppClient\SfRemoteAppClient.exe
-
\Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClient.exe
-
\Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClient.exe
-
\Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClient.exe
-
\Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClient.exe
-
\Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClientUninstaller.exe
-
\Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClient.exe
-
\Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClient.exe
-
\Program Files (x86)\Sangfor\SSL\SangforUpdate\SangforUD.exe
-
\Program Files (x86)\Sangfor\SSL\SangforUpdate\SangforUD.exe
-
\Program Files (x86)\Sangfor\SSL\SvpnJobber\SvpnJobber.exe
-
\Program Files (x86)\Sangfor\SSL\SvpnJobber\SvpnJobber.exe
-
\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
-
\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
-
\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
-
\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
-
\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
-
\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
-
\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
-
\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
-
\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
-
\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
-
\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
-
\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
-
\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
-
\Users\Admin\AppData\Local\Temp\TaskServer.exe
-
\Users\Admin\AppData\Local\Temp\nsd93D9.tmp\System.dll
-
\Users\Admin\AppData\Local\Temp\nsd93D9.tmp\System.dll
-
\Users\Admin\AppData\Local\Temp\nsi957E.tmp\System.dll
-
\Users\Admin\AppData\Local\Temp\nsi988A.tmp\nsExec.dll
-
\Users\Admin\AppData\Local\Temp\nss8EBA.tmp\KillProcDLL.dll
-
\Users\Admin\AppData\Local\Temp\nss8EBA.tmp\System.dll
-
\Users\Admin\AppData\Local\Temp\nss96F4.tmp\nsExec.dll
-
\Users\Admin\AppData\Local\Temp\nsx620F.tmp\SkinBtn.dll
-
\Users\Admin\AppData\Local\Temp\nsx620F.tmp\SkinProgress.dll
-
\Users\Admin\AppData\Local\Temp\nsx620F.tmp\System.dll
-
\Users\Admin\AppData\Local\Temp\nsx620F.tmp\dbdStaticCtrl.dll
-
\Users\Admin\AppData\Local\Temp\nsxA9F7.tmp\System.dll
-
\Users\Admin\AppData\Local\Temp\nsxA9F7.tmp\System.dll
-
\Users\Admin\AppData\Local\Temp\nsxA9F7.tmp\nsExec.dll
-
\Users\Admin\AppData\Local\Temp\nsxA9F7.tmp\nsExec.dll
-
\Users\Admin\AppData\Local\Temp\nsxA9F7.tmp\nsExec.dll
-
\Windows\SysWOW64\SangforInstallHelper.dll
-
\Windows\SysWOW64\msvcr100.dll
-
\Windows\SysWOW64\msvcr100.dll
-
\Windows\SysWOW64\msvcr100.dll
-
\Windows\SysWOW64\msvcr100.dll
-
\Windows\SysWOW64\msvcr100.dll
-
memory/268-226-0x0000000000000000-mapping.dmp
-
memory/268-67-0x0000000000000000-mapping.dmp
-
memory/360-147-0x0000000000000000-mapping.dmp
-
memory/564-17-0x000007FEF6720000-0x000007FEF699A000-memory.dmpFilesize
2.5MB
-
memory/568-74-0x0000000000000000-mapping.dmp
-
memory/604-165-0x0000000000000000-mapping.dmp
-
memory/796-90-0x0000000000000000-mapping.dmp
-
memory/800-82-0x0000000000000000-mapping.dmp
-
memory/864-19-0x0000000000000000-mapping.dmp
-
memory/900-110-0x0000000000000000-mapping.dmp
-
memory/932-138-0x0000000000000000-mapping.dmp
-
memory/980-221-0x0000000000000000-mapping.dmp
-
memory/996-250-0x0000000000000000-mapping.dmp
-
memory/996-156-0x0000000000000000-mapping.dmp
-
memory/1012-272-0x0000000000000000-mapping.dmp
-
memory/1016-175-0x0000000000000000-mapping.dmp
-
memory/1120-97-0x0000000000000000-mapping.dmp
-
memory/1136-191-0x0000000000000000-mapping.dmp
-
memory/1184-208-0x0000000000F70000-0x0000000000F72000-memory.dmpFilesize
8KB
-
memory/1184-209-0x0000000000F70000-0x0000000000F72000-memory.dmpFilesize
8KB
-
memory/1192-219-0x0000000000000000-mapping.dmp
-
memory/1192-264-0x0000000000000000-mapping.dmp
-
memory/1200-184-0x0000000000000000-mapping.dmp
-
memory/1256-231-0x0000000000000000-mapping.dmp
-
memory/1260-50-0x0000000000000000-mapping.dmp
-
memory/1380-213-0x0000000000000000-mapping.dmp
-
memory/1724-241-0x0000000000000000-mapping.dmp
-
memory/1764-280-0x0000000000000000-mapping.dmp
-
memory/1792-693-0x0000000000000000-mapping.dmp
-
memory/1792-705-0x0000000000E60000-0x0000000000E64000-memory.dmpFilesize
16KB
-
memory/1816-104-0x0000000000000000-mapping.dmp
-
memory/1824-124-0x0000000000000000-mapping.dmp
-
memory/1856-296-0x0000000000000000-mapping.dmp
-
memory/1856-307-0x0000000000E90000-0x0000000000E94000-memory.dmpFilesize
16KB
-
memory/1904-58-0x0000000000000000-mapping.dmp
-
memory/1920-1-0x0000000000000000-mapping.dmp
-
memory/1920-8-0x0000000000584000-0x0000000000589000-memory.dmpFilesize
20KB
-
memory/1924-691-0x0000000000000000-mapping.dmp
-
memory/1944-117-0x0000000000000000-mapping.dmp
-
memory/1968-5-0x0000000000000000-mapping.dmp
-
memory/1968-32-0x00000000054F0000-0x0000000005502000-memory.dmpFilesize
72KB
-
memory/1980-36-0x0000000000000000-mapping.dmp
-
memory/1984-313-0x0000000003370000-0x0000000003381000-memory.dmpFilesize
68KB
-
memory/1984-312-0x0000000002F60000-0x0000000002F71000-memory.dmpFilesize
68KB
-
memory/1984-337-0x0000000002F60000-0x0000000002F71000-memory.dmpFilesize
68KB
-
memory/1984-314-0x0000000002F60000-0x0000000002F71000-memory.dmpFilesize
68KB
-
memory/1984-317-0x0000000002F60000-0x0000000002F71000-memory.dmpFilesize
68KB
-
memory/1984-301-0x0000000000000000-mapping.dmp
-
memory/1984-339-0x0000000002F60000-0x0000000002F71000-memory.dmpFilesize
68KB
-
memory/1984-338-0x0000000003370000-0x0000000003381000-memory.dmpFilesize
68KB
-
memory/1992-131-0x0000000000000000-mapping.dmp