e596d6af81ecbb9fb5903c85ecacade2aa806482fcb6700699e69e676d342b0c

Analysis

max time kernel
146s
max time network
121s
platform
windows7_x64
resource
win7v20201028
submitted
12-11-2020 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EcV01.04.R.exe
Size

5.3MB
MD5

dc363cbc7660992d9642c9f560373375
SHA1

ab398f6df5dcc79980c4f04178c5449c6cb30da6
SHA256

e596d6af81ecbb9fb5903c85ecacade2aa806482fcb6700699e69e676d342b0c
SHA512

4375ef9a732e540b1ed211d107e66f19791df3d8cdbe67e9288b004483eef4c5b733e59d12d1bd5aedd65e658c64cdd96790079ce90296c984ea9b156ae09228

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 25 IoCs

Processes:

PluginManagerSetup.exePluginSetup.exePlugin.exeMPlugin.exeXSDPlugin.exeXSDMPlugin.exePlugin.exeMPlugin.exePlugin.exeXSDPlugin.exeMPlugin.exeXSDMPlugin.exeXSDPlugin.exeXSDMPlugin.exeXYRZSetup.exeXSDPlugin.exeXSDPlugin.exexyrzsvc.exexyrzsvc.exexyrzsvc.exexyrzsvc.exeSignToolSetup.exeSignTool.exexyrzsvc.exexyrzsvc.exe

pid	process
1064	PluginManagerSetup.exe
1192	PluginSetup.exe
1592	Plugin.exe
392	MPlugin.exe
916	XSDPlugin.exe
1016	XSDMPlugin.exe
524	Plugin.exe
928	MPlugin.exe
1136	Plugin.exe
1272	XSDPlugin.exe
1632	MPlugin.exe
1720	XSDMPlugin.exe
788	XSDPlugin.exe
1120	XSDMPlugin.exe
672	XYRZSetup.exe
1372	XSDPlugin.exe
1172	XSDPlugin.exe
432	xyrzsvc.exe
556	xyrzsvc.exe
524	xyrzsvc.exe
1260	xyrzsvc.exe
428	SignToolSetup.exe
652	SignTool.exe
1916	xyrzsvc.exe
1520	xyrzsvc.exe

Loads dropped DLL 36 IoCs

Processes:

EcV01.04.R.exePluginManagerSetup.exePluginSetup.exeXYRZSetup.exexyrzsvc.exexyrzsvc.exexyrzsvc.exexyrzsvc.exeSignToolSetup.exeSignTool.exexyrzsvc.exexyrzsvc.exe

pid	process
536	EcV01.04.R.exe
536	EcV01.04.R.exe
536	EcV01.04.R.exe
1064	PluginManagerSetup.exe
1064	PluginManagerSetup.exe
1064	PluginManagerSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1064	PluginManagerSetup.exe
672	XYRZSetup.exe
672	XYRZSetup.exe
672	XYRZSetup.exe
432	xyrzsvc.exe
556	xyrzsvc.exe
524	xyrzsvc.exe
1260	xyrzsvc.exe
536	EcV01.04.R.exe
428	SignToolSetup.exe
428	SignToolSetup.exe
428	SignToolSetup.exe
652	SignTool.exe
652	SignTool.exe
652	SignTool.exe
652	SignTool.exe
1916	xyrzsvc.exe
1520	xyrzsvc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SignToolSetup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	SignToolSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SignTool = "C:\\Program Files (x86)\\SignTool\\SignTool.exe"	SignToolSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

JavaScript code in executable 4 IoCs

Processes:

resource	yara_rule
\Program Files (x86)\SignTool\libcurl.dll	js
C:\Program Files (x86)\SignTool\LIBEAY32.dll	js
C:\Program Files (x86)\SignTool\libcurl.dll	js
\Program Files (x86)\SignTool\libeay32.dll	js

Drops file in System32 directory 20 IoCs

Processes:

Plugin.exePluginManagerSetup.exeEcV01.04.R.exePluginSetup.exeXSDPlugin.exeXSDPlugin.exeXYRZSetup.exeSignToolSetup.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Plugin.exe
File opened for modification	C:\Windows\SysWOW64\PluginManager\PluginSetup.exe	PluginManagerSetup.exe
File created	C:\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe	EcV01.04.R.exe
File created	C:\Windows\SysWOW64\PluginManager\PluginSetup.exe	PluginManagerSetup.exe
File created	C:\Windows\SysWOW64\PluginManager\XYRZSetup.exe	PluginManagerSetup.exe
File created	C:\Windows\SysWOW64\PluginManager\MPlugin.exe	PluginSetup.exe
File created	C:\Windows\SysWOW64\PluginManager\XSDMPlugin.exe	PluginSetup.exe
File created	C:\Windows\SysWOW64\PluginManager\uninst.exe	PluginSetup.exe
File opened for modification	C:\Windows\SysWOW64\PluginManager\SignToolSetup.exe	EcV01.04.R.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	XSDPlugin.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	XSDPlugin.exe
File opened for modification	C:\Windows\SysWOW64\PluginManager\XYRZSetup.exe	XYRZSetup.exe
File opened for modification	C:\Windows\SysWOW64\PluginManager\XYRZSetup.exe	PluginManagerSetup.exe
File opened for modification	C:\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe	PluginManagerSetup.exe
File opened for modification	C:\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe	EcV01.04.R.exe
File created	C:\Windows\SysWOW64\PluginManager\Plugin.exe	PluginSetup.exe
File created	C:\Windows\SysWOW64\PluginManager\SignToolSetup.exe	EcV01.04.R.exe
File created	C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe	PluginSetup.exe
File opened for modification	C:\Windows\SysWOW64\PluginManager\PluginSetup.exe	PluginSetup.exe
File opened for modification	C:\Windows\SysWOW64\PluginManager\SignToolSetup.exe	SignToolSetup.exe

Modifies service 2 TTPs 15 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

Plugin.exeXSDMPlugin.exexyrzsvc.exeMPlugin.exeXSDPlugin.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Plugin\EventMessageFile = "C:\\Windows\\SysWOW64\\PluginManager\\Plugin.exe"	Plugin.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\XSDMPlugin\TypesSupported = "7"	XSDMPlugin.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\xyrzsvc	xyrzsvc.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\xyrzsvc\EventMessageFile = "C:\\Program Files (x86)\\XYRZ\\xyrzsvc.exe"	xyrzsvc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\xyrzsvc\TypesSupported = "7"	xyrzsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\MPlugin	MPlugin.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\XSDPlugin\EventMessageFile = "C:\\Windows\\SysWOW64\\PluginManager\\XSDPlugin.exe"	XSDPlugin.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\XSDPlugin\TypesSupported = "7"	XSDPlugin.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Plugin	Plugin.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\MPlugin\TypesSupported = "7"	MPlugin.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\XSDMPlugin	XSDMPlugin.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\XSDMPlugin\EventMessageFile = "C:\\Windows\\SysWOW64\\PluginManager\\XSDMPlugin.exe"	XSDMPlugin.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Plugin\TypesSupported = "7"	Plugin.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\MPlugin\EventMessageFile = "C:\\Windows\\SysWOW64\\PluginManager\\MPlugin.exe"	MPlugin.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\XSDPlugin	XSDPlugin.exe

Drops file in Program Files directory 30 IoCs

Processes:

XYRZSetup.exeSignToolSetup.exePlugin.exexyrzsvc.exexyrzsvc.exeSignTool.exexyrzsvc.exexyrzsvc.exexyrzsvc.exexyrzsvc.exe

description	ioc	process
File created	C:\Program Files (x86)\XYRZ\serverjsp.ini	XYRZSetup.exe
File created	C:\Program Files (x86)\SignTool\SignTool.exe	SignToolSetup.exe
File created	C:\Program Files (x86)\SignTool\help.pdf	SignToolSetup.exe
File created	C:\Program Files (x86)\XYRZ\xyrzsvc.exe	XYRZSetup.exe
File created	C:\Program Files (x86)\XYRZ\uninst.exe	XYRZSetup.exe
File created	C:\Program Files (x86)\SignTool\libeay32.dll	SignToolSetup.exe
File created	C:\Program Files (x86)\SignTool\QRGenerator.dll	SignToolSetup.exe
File opened for modification	C:\Program Files (x86)\SignTool\uninstall.exe	Plugin.exe
File created	C:\Program Files (x86)\XYRZ\libeay32.dll	XYRZSetup.exe
File created	C:\Program Files (x86)\SignTool\CTptkcs.dll	SignToolSetup.exe
File created	C:\Program Files (x86)\XYRZ\libp11.dll	XYRZSetup.exe
File created	C:\Program Files (x86)\SignTool\libp11.dll	SignToolSetup.exe
File created	C:\Program Files (x86)\XYRZ\sqlite3.dll	XYRZSetup.exe
File created	C:\Program Files (x86)\XYRZ\Aisino.dll	XYRZSetup.exe
File opened for modification	C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log	xyrzsvc.exe
File opened for modification	C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log	xyrzsvc.exe
File created	C:\Program Files (x86)\SignTool\uninstall.exe	SignToolSetup.exe
File opened for modification	C:\Program Files (x86)\SignTool\20201112-SignTool.log	SignTool.exe
File created	C:\Program Files (x86)\XYRZ\JsDevInfoDll.dll	XYRZSetup.exe
File created	C:\Program Files (x86)\XYRZ\CTptkcs.dll	XYRZSetup.exe
File opened for modification	C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log	xyrzsvc.exe
File created	C:\Program Files (x86)\SignTool\libcurl.dll	SignToolSetup.exe
File opened for modification	C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log	xyrzsvc.exe
File created	C:\Program Files (x86)\SignTool\JsDevInfoDll.dll	SignToolSetup.exe
File created	C:\Program Files (x86)\SignTool\uninst.exe	SignToolSetup.exe
File opened for modification	C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log	xyrzsvc.exe
File created	C:\Program Files (x86)\XYRZ\libcurl.dll	XYRZSetup.exe
File created	C:\Program Files (x86)\XYRZ\SSLeay32.dll	XYRZSetup.exe
File created	C:\Program Files (x86)\SignTool\SSLeay32.dll	SignToolSetup.exe
File opened for modification	C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log	xyrzsvc.exe

NSIS installer 26 IoCs

installer

Processes:

resource	yara_rule
\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe	nsis_installer_1
\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe	nsis_installer_2
C:\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe	nsis_installer_1
C:\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe	nsis_installer_2
C:\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe	nsis_installer_1
C:\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe	nsis_installer_2
\Windows\SysWOW64\PluginManager\PluginSetup.exe	nsis_installer_1
\Windows\SysWOW64\PluginManager\PluginSetup.exe	nsis_installer_2
C:\Windows\SysWOW64\PluginManager\PluginSetup.exe	nsis_installer_1
C:\Windows\SysWOW64\PluginManager\PluginSetup.exe	nsis_installer_2
C:\Windows\SysWOW64\PluginManager\PluginSetup.exe	nsis_installer_1
C:\Windows\SysWOW64\PluginManager\PluginSetup.exe	nsis_installer_2
\Windows\SysWOW64\PluginManager\XYRZSetup.exe	nsis_installer_1
\Windows\SysWOW64\PluginManager\XYRZSetup.exe	nsis_installer_2
C:\Windows\SysWOW64\PluginManager\XYRZSetup.exe	nsis_installer_1
C:\Windows\SysWOW64\PluginManager\XYRZSetup.exe	nsis_installer_2
C:\Windows\SysWOW64\PluginManager\XYRZSetup.exe	nsis_installer_1
C:\Windows\SysWOW64\PluginManager\XYRZSetup.exe	nsis_installer_2
\Windows\SysWOW64\PluginManager\SignToolSetup.exe	nsis_installer_1
\Windows\SysWOW64\PluginManager\SignToolSetup.exe	nsis_installer_2
C:\Windows\SysWOW64\PluginManager\SignToolSetup.exe	nsis_installer_1
C:\Windows\SysWOW64\PluginManager\SignToolSetup.exe	nsis_installer_2
C:\Windows\SysWOW64\PluginManager\SignToolSetup.exe	nsis_installer_1
C:\Windows\SysWOW64\PluginManager\SignToolSetup.exe	nsis_installer_2
C:\Program Files (x86)\SignTool\uninstall.exe	nsis_installer_1
C:\Program Files (x86)\SignTool\uninstall.exe	nsis_installer_2

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1608 taskkill.exe

pid	process
1608	taskkill.exe

Modifies data under HKEY_USERS 53 IoCs

Processes:

Plugin.exeXSDPlugin.exeXSDPlugin.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Plugin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	Plugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	Plugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Plugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	XSDPlugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Plugin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = d0282accccb8d601	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77	Plugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	XSDPlugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1"	XSDPlugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Plugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1"	Plugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network"	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	XSDPlugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	XSDPlugin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000004000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	XSDPlugin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 7020d5c5ccb8d601	Plugin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	XSDPlugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Plugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	XSDPlugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0"	Plugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0"	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	XSDPlugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	XSDPlugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network"	Plugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Plugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Plugin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = 7020d5c5ccb8d601	Plugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	Plugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Plugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl	XSDPlugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Plugin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Plugin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Plugin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Plugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Plugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	XSDPlugin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	XSDPlugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}	XSDPlugin.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	XSDPlugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Plugin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 7020d5c5ccb8d601	XSDPlugin.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = d0282accccb8d601	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	XSDPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}	Plugin.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77	XSDPlugin.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

EcV01.04.R.exePluginManagerSetup.exePluginSetup.exeMPlugin.exeXSDMPlugin.exeXYRZSetup.exexyrzsvc.exeSignToolSetup.exexyrzsvc.exePlugin.exeXSDPlugin.exe

pid	process
536	EcV01.04.R.exe
536	EcV01.04.R.exe
536	EcV01.04.R.exe
536	EcV01.04.R.exe
1064	PluginManagerSetup.exe
1064	PluginManagerSetup.exe
1064	PluginManagerSetup.exe
1064	PluginManagerSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1192	PluginSetup.exe
1632	MPlugin.exe
1120	XSDMPlugin.exe
1120	XSDMPlugin.exe
672	XYRZSetup.exe
672	XYRZSetup.exe
432	xyrzsvc.exe
428	SignToolSetup.exe
428	SignToolSetup.exe
1260	xyrzsvc.exe
1260	xyrzsvc.exe
1260	xyrzsvc.exe
1260	xyrzsvc.exe
1260	xyrzsvc.exe
1136	Plugin.exe
1136	Plugin.exe
1260	xyrzsvc.exe
1260	xyrzsvc.exe
1260	xyrzsvc.exe
1136	Plugin.exe
1136	Plugin.exe
1136	Plugin.exe
1172	XSDPlugin.exe
1172	XSDPlugin.exe
1172	XSDPlugin.exe
1260	xyrzsvc.exe
1260	xyrzsvc.exe
1260	xyrzsvc.exe
1632	MPlugin.exe
1120	XSDMPlugin.exe
1260	xyrzsvc.exe
1260	xyrzsvc.exe
1260	xyrzsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1608 taskkill.exe

description	pid	process
Token: SeDebugPrivilege	1608	taskkill.exe

Suspicious use of WriteProcessMemory 96 IoCs

Processes:

EcV01.04.R.exePluginManagerSetup.exePluginSetup.exeXSDMPlugin.exeXYRZSetup.exe

description	pid	process	target process
PID 536 wrote to memory of 1064	536	EcV01.04.R.exe	PluginManagerSetup.exe
PID 536 wrote to memory of 1064	536	EcV01.04.R.exe	PluginManagerSetup.exe
PID 536 wrote to memory of 1064	536	EcV01.04.R.exe	PluginManagerSetup.exe
PID 536 wrote to memory of 1064	536	EcV01.04.R.exe	PluginManagerSetup.exe
PID 536 wrote to memory of 1064	536	EcV01.04.R.exe	PluginManagerSetup.exe
PID 536 wrote to memory of 1064	536	EcV01.04.R.exe	PluginManagerSetup.exe
PID 536 wrote to memory of 1064	536	EcV01.04.R.exe	PluginManagerSetup.exe
PID 1064 wrote to memory of 1192	1064	PluginManagerSetup.exe	PluginSetup.exe
PID 1064 wrote to memory of 1192	1064	PluginManagerSetup.exe	PluginSetup.exe
PID 1064 wrote to memory of 1192	1064	PluginManagerSetup.exe	PluginSetup.exe
PID 1064 wrote to memory of 1192	1064	PluginManagerSetup.exe	PluginSetup.exe
PID 1064 wrote to memory of 1192	1064	PluginManagerSetup.exe	PluginSetup.exe
PID 1064 wrote to memory of 1192	1064	PluginManagerSetup.exe	PluginSetup.exe
PID 1064 wrote to memory of 1192	1064	PluginManagerSetup.exe	PluginSetup.exe
PID 1192 wrote to memory of 1592	1192	PluginSetup.exe	Plugin.exe
PID 1192 wrote to memory of 1592	1192	PluginSetup.exe	Plugin.exe
PID 1192 wrote to memory of 1592	1192	PluginSetup.exe	Plugin.exe
PID 1192 wrote to memory of 1592	1192	PluginSetup.exe	Plugin.exe
PID 1192 wrote to memory of 392	1192	PluginSetup.exe	MPlugin.exe
PID 1192 wrote to memory of 392	1192	PluginSetup.exe	MPlugin.exe
PID 1192 wrote to memory of 392	1192	PluginSetup.exe	MPlugin.exe
PID 1192 wrote to memory of 392	1192	PluginSetup.exe	MPlugin.exe
PID 1192 wrote to memory of 916	1192	PluginSetup.exe	XSDPlugin.exe
PID 1192 wrote to memory of 916	1192	PluginSetup.exe	XSDPlugin.exe
PID 1192 wrote to memory of 916	1192	PluginSetup.exe	XSDPlugin.exe
PID 1192 wrote to memory of 916	1192	PluginSetup.exe	XSDPlugin.exe
PID 1192 wrote to memory of 1016	1192	PluginSetup.exe	XSDMPlugin.exe
PID 1192 wrote to memory of 1016	1192	PluginSetup.exe	XSDMPlugin.exe
PID 1192 wrote to memory of 1016	1192	PluginSetup.exe	XSDMPlugin.exe
PID 1192 wrote to memory of 1016	1192	PluginSetup.exe	XSDMPlugin.exe
PID 1192 wrote to memory of 524	1192	PluginSetup.exe	Plugin.exe
PID 1192 wrote to memory of 524	1192	PluginSetup.exe	Plugin.exe
PID 1192 wrote to memory of 524	1192	PluginSetup.exe	Plugin.exe
PID 1192 wrote to memory of 524	1192	PluginSetup.exe	Plugin.exe
PID 1192 wrote to memory of 928	1192	PluginSetup.exe	MPlugin.exe
PID 1192 wrote to memory of 928	1192	PluginSetup.exe	MPlugin.exe
PID 1192 wrote to memory of 928	1192	PluginSetup.exe	MPlugin.exe
PID 1192 wrote to memory of 928	1192	PluginSetup.exe	MPlugin.exe
PID 1192 wrote to memory of 1272	1192	PluginSetup.exe	XSDPlugin.exe
PID 1192 wrote to memory of 1272	1192	PluginSetup.exe	XSDPlugin.exe
PID 1192 wrote to memory of 1272	1192	PluginSetup.exe	XSDPlugin.exe
PID 1192 wrote to memory of 1272	1192	PluginSetup.exe	XSDPlugin.exe
PID 1192 wrote to memory of 1720	1192	PluginSetup.exe	XSDMPlugin.exe
PID 1192 wrote to memory of 1720	1192	PluginSetup.exe	XSDMPlugin.exe
PID 1192 wrote to memory of 1720	1192	PluginSetup.exe	XSDMPlugin.exe
PID 1192 wrote to memory of 1720	1192	PluginSetup.exe	XSDMPlugin.exe
PID 1064 wrote to memory of 672	1064	PluginManagerSetup.exe	XYRZSetup.exe
PID 1064 wrote to memory of 672	1064	PluginManagerSetup.exe	XYRZSetup.exe
PID 1064 wrote to memory of 672	1064	PluginManagerSetup.exe	XYRZSetup.exe
PID 1064 wrote to memory of 672	1064	PluginManagerSetup.exe	XYRZSetup.exe
PID 1064 wrote to memory of 672	1064	PluginManagerSetup.exe	XYRZSetup.exe
PID 1064 wrote to memory of 672	1064	PluginManagerSetup.exe	XYRZSetup.exe
PID 1064 wrote to memory of 672	1064	PluginManagerSetup.exe	XYRZSetup.exe
PID 1120 wrote to memory of 1372	1120	XSDMPlugin.exe	XSDPlugin.exe
PID 1120 wrote to memory of 1372	1120	XSDMPlugin.exe	XSDPlugin.exe
PID 1120 wrote to memory of 1372	1120	XSDMPlugin.exe	XSDPlugin.exe
PID 1120 wrote to memory of 1372	1120	XSDMPlugin.exe	XSDPlugin.exe
PID 672 wrote to memory of 432	672	XYRZSetup.exe	xyrzsvc.exe
PID 672 wrote to memory of 432	672	XYRZSetup.exe	xyrzsvc.exe
PID 672 wrote to memory of 432	672	XYRZSetup.exe	xyrzsvc.exe
PID 672 wrote to memory of 432	672	XYRZSetup.exe	xyrzsvc.exe
PID 672 wrote to memory of 556	672	XYRZSetup.exe	xyrzsvc.exe
PID 672 wrote to memory of 556	672	XYRZSetup.exe	xyrzsvc.exe
PID 672 wrote to memory of 556	672	XYRZSetup.exe	xyrzsvc.exe

C:\Users\Admin\AppData\Local\Temp\EcV01.04.R.exe
"C:\Users\Admin\AppData\Local\Temp\EcV01.04.R.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe
"C:\Windows\system32\PluginManager\PluginManagerSetup.exe" /S _?=C:\Windows\system32\PluginManager
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\PluginManager\PluginSetup.exe
"C:\Windows\system32\PluginManager\PluginSetup.exe" /S _?=C:\Windows\system32\PluginManager
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\PluginManager\Plugin.exe
C:\Windows\system32\PluginManager\Plugin.exe -i
4⤵
- Executes dropped EXE
- Modifies service
PID:1592

C:\Windows\SysWOW64\PluginManager\MPlugin.exe
C:\Windows\system32\PluginManager\MPlugin.exe -i
4⤵
- Executes dropped EXE
- Modifies service
PID:392

C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
C:\Windows\system32\PluginManager\XSDPlugin.exe -i
4⤵
- Executes dropped EXE
- Modifies service
PID:916

C:\Windows\SysWOW64\PluginManager\XSDMPlugin.exe
C:\Windows\system32\PluginManager\XSDMPlugin.exe -i
4⤵
- Executes dropped EXE
- Modifies service
PID:1016

C:\Windows\SysWOW64\PluginManager\Plugin.exe
C:\Windows\system32\PluginManager\Plugin.exe -start
4⤵
- Executes dropped EXE
PID:524

C:\Windows\SysWOW64\PluginManager\MPlugin.exe
C:\Windows\system32\PluginManager\MPlugin.exe -start
4⤵
- Executes dropped EXE
PID:928

C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
C:\Windows\system32\PluginManager\XSDPlugin.exe -start
4⤵
- Executes dropped EXE
PID:1272

C:\Windows\SysWOW64\PluginManager\XSDMPlugin.exe
C:\Windows\system32\PluginManager\XSDMPlugin.exe -start
4⤵
- Executes dropped EXE
PID:1720

C:\Windows\SysWOW64\PluginManager\XYRZSetup.exe
"C:\Windows\system32\PluginManager\XYRZSetup.exe" /S _?=C:\Windows\system32\PluginManager
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:672

C:\Program Files (x86)\XYRZ\xyrzsvc.exe
"C:\Program Files (x86)\XYRZ\xyrzsvc.exe" -readinfo
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:432

C:\Program Files (x86)\XYRZ\xyrzsvc.exe
"C:\Program Files (x86)\XYRZ\xyrzsvc.exe" -i
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies service
- Drops file in Program Files directory
PID:556

C:\Program Files (x86)\XYRZ\xyrzsvc.exe
"C:\Program Files (x86)\XYRZ\xyrzsvc.exe" -start
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:524

C:\Windows\SysWOW64\PluginManager\SignToolSetup.exe
"C:\Windows\system32\PluginManager\SignToolSetup.exe" /S _?=C:\Windows\system32\PluginManager
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:428

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C taskkill /F /IM SignTool.exe
3⤵
PID:1456

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM SignTool.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Program Files (x86)\SignTool\SignTool.exe
"C:\Program Files (x86)\SignTool\SignTool.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:652

C:\Windows\SysWOW64\PluginManager\Plugin.exe
C:\Windows\SysWOW64\PluginManager\Plugin.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1136

C:\Program Files (x86)\XYRZ\xyrzsvc.exe
"C:\Program Files (x86)\XYRZ/xyrzsvc.exe" -start
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1916

C:\Windows\SysWOW64\PluginManager\MPlugin.exe
C:\Windows\SysWOW64\PluginManager\MPlugin.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1632

C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:788

C:\Windows\SysWOW64\PluginManager\XSDMPlugin.exe
C:\Windows\SysWOW64\PluginManager\XSDMPlugin.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe -start
2⤵
- Executes dropped EXE
PID:1372

C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1172

C:\Program Files (x86)\XYRZ\xyrzsvc.exe
"C:\Program Files (x86)\XYRZ/xyrzsvc.exe" -start
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1520

C:\Program Files (x86)\XYRZ\xyrzsvc.exe
"C:\Program Files (x86)\XYRZ\xyrzsvc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Aisinosystem.inf
MD5
406e00d289a999b3b7089f77627c5b98

SHA1
768b075d2cd6a91cdfaf426c4a86d53c7d1e4fec

SHA256
8dec89fa896d4d228f5057c7e1c5a4d4ca614fa1523b273135db3eba233b3a60

SHA512
0a9362d00bddd161e4c4d43616ddd5321b4577108c29867f072f09472c7549569e61e9412ef00c2215ec08584245103f082c1bf8c84560dc338c07c833e4171f

Download Submit
C:\Program Files (x86)\SignTool\JsDevInfoDll.dll
MD5
7c348eac40b9dbf6bd52db2985abee42

SHA1
b71bf40e0c095d5afe79c5455fbe0270422a39a0

SHA256
465da3a1a0ab1844f559400ea292e7b2008063d3fb7b82482845ead178f7cc75

SHA512
e36a40d3bc01ebfe1f09d27a123ea5c379dc867752f4828ff8bb2ecfda2774ed9cdfdb9105f9de207b1ce1292125976cb10189e6123f7e3bc766e0da558b57d2

Download Submit
C:\Program Files (x86)\SignTool\LIBEAY32.dll
MD5
0852402f8f75c9a75a74114af75f34c5

SHA1
306a5198163979b500ea461fbb573c11b42af960

SHA256
306376bab846436faf7cace55372b82a948263d526c5bc950902beaaab4342b1

SHA512
7d51371e43a204a3b92fc32ac8b1372d840074001d9de6d64b8d1edc3dd57ee39da55c8e75fb70e61f7fd91eb838cb9ba8ee8669a07330bf4cab6d6be0ff9bc4

Download Submit
C:\Program Files (x86)\SignTool\SSLEAY32.dll
MD5
3cb5a5dc5701c2961742bdb05a43c6d0

SHA1
1f2c7d97762e3648f1c9aab3cbc2d10c27bc1ee6

SHA256
3ba8be5f74c80181ac1fdeb596e1b6ff42f017485f56079ea7732d50ac77b924

SHA512
1d0bde42056cdaa2e27b3eaa22e855cc04ad3c49c5d5a625cf82754728cbaa732ff8ebdc6224f40b0f8518f542c4c4b50e345103b7a850752193e4acbc8d4049

Download Submit
C:\Program Files (x86)\SignTool\SignTool.exe
MD5
b530975a4c2182c7f68cb0458c6e10d2

SHA1
4bcd5992a961c7f23db95a3f148a2bb59a8d3c7b

SHA256
7233138e42d59ceb624b9dca59a45fcce6650561b1354908daad601e6315fbd4

SHA512
54a918b31ba07f8bae34d3ffa951f40e2126413680ddc391e30d4abf06f80b8e4670eabf71a3d9343527b609c0d4cb09d14490f9d0fd7d005b2ff8101b4e5c4f

Download Submit
C:\Program Files (x86)\SignTool\libcurl.dll
MD5
b672963bb8fc75b7c122082b5e567058

SHA1
db65575bd8819a2fb005681e85f8232205e1d851

SHA256
fe49ba656906fbe801845996eda6822dfba32081efc7727771ec15d72b94955b

SHA512
616bf3f7e728b71fc17bb72c6a2a9c2340cc6807439dc664b7afe754d42dcf92e3410f73e62ad736f6654a75f11263d4186576d70dfa66f2addecd093bf9074e

Download Submit
C:\Program Files (x86)\SignTool\uninstall.exe
MD5
4d2f77c64ee70f2c831caf0afa4ed5bf

SHA1
dd6b78d2f0f3900108ff2a7b809e5626338706aa

SHA256
01d074beaefc7ba05fb5d111dfd60095b972713cd8718d31b162a9cb7e2df293

SHA512
f7ef0768f6e117739b9d3782a205c61e38936def45aea9868d8ac2b9dce4bbeaf201eaaf4ec5dab7318772d041974d6a2ec8db09c50f21085e783682dcb15af2

Download Submit
C:\Program Files (x86)\XYRZ\JsDevInfoDll.dll
MD5
7c348eac40b9dbf6bd52db2985abee42

SHA1
b71bf40e0c095d5afe79c5455fbe0270422a39a0

SHA256
465da3a1a0ab1844f559400ea292e7b2008063d3fb7b82482845ead178f7cc75

SHA512
e36a40d3bc01ebfe1f09d27a123ea5c379dc867752f4828ff8bb2ecfda2774ed9cdfdb9105f9de207b1ce1292125976cb10189e6123f7e3bc766e0da558b57d2

Download Submit
C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log
MD5
78e09f1023e074ddb5180ae5c463d76d

SHA1
82f083e68c07750bb10d838cb3fbe124097edf79

SHA256
12ec51d606196426ca005c58fd586cae4d12e6def6cab708799435bdbe7ee254

SHA512
697e854897cdbbf379695d0f8e63f9087970d4f398232ab6f1562ff499827e8f861f370be862c698fbb3c06b558d9844b8df7e95c132f1b66ab8229d6e2039c9

Download Submit
C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log
MD5
ac6492db80c9112eefa09fa42e86d21c

SHA1
846a3ffdad5cb4bc32e113006ed44d7db15ad4fd

SHA256
b12a022e5a35484e756e66e3b3bbfd3ff7d9a72ca7b2b7f85cfecdc287b14d23

SHA512
3c4ab11158810726a892d3bec57b4779b3fac80d503109e353f50c8e9d1bc83202acb26b452fadd3bc1c5b6660ca34b23c44f09b54b7f0885540e5585dcdcdd4

Download Submit
C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log
MD5
9b3c20a06513a20ac8e7d78808e8545b

SHA1
b53c918185935dd9343d1adfd03b1b4a1e458ebc

SHA256
57295837fd59254813d7c2a213db32a63b39872de33127c71c24d5c6d7e7030f

SHA512
9854e68b1acccf725ec6a959581d524558ad0d634e1bb0e583b86f085018102e5254c0987849638531bb90dbd7fd88f3367b6b8abecd5c937d69a9bc917a0679

Download Submit
C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log
MD5
d8aa1d653f9c6df234a04bb6d4d90d1c

SHA1
3c45ffbc3b5c912205b796e42d9ebb45a26c1d88

SHA256
831165d6fd49a856d4140e1262afc800c669e1c12bf46dc3da5826806dbd1af7

SHA512
f22e52dc5bd794646996d9b231d500f398431c9972eccd0ed369af29784e3dbdd3560126286ce178e5e9656c5c5c1e24ccc56638c960c2a484ff9f3e68445e92

Download Submit
C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log
MD5
70914840e88684f597a388c64b6f8605

SHA1
d3298a7faa15976bb2b9bee8aef7e866ce5284ef

SHA256
d78cd7eed73e2b7e84b0756d21861dd01981c6e3b3ab6dc543dbe1fc106856ba

SHA512
5319d25db47747d5794caa56a3deced035861acc19f6283136a56c4889bcccbee536052118f861a08415347cb78b95cbf5ada3e9509d0532e35e28b5b269ffa2

Download Submit
C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log
MD5
6ae745016cc38cada6f383182ff59dfc

SHA1
aff95aea7482f30f3e98fe36bc271799195242d5

SHA256
6d4396c78eaf2bd3a1c63c2a78cac852cb31a091a19b740adf31e69e9dc58bbd

SHA512
7260fc14f7f7ab809cf8821379265a0ae8d424422e9834853439ceabd40d82149ce789f8bc2319617f11f8fb86b027c360a463c51fbd8e1075a6f31c617ea3fe

Download Submit
C:\Program Files (x86)\XYRZ\logInfo\20201112-AisinoInvoiceGather_JSP.log
MD5
d5f96dbf361aba7317b4a216ad697912

SHA1
ffb0b04ada449c2e537933ca450ac580a1d8c221

SHA256
c9c5806c9a689138ca342486ce4dae1ce1431f49f03bd6ddab8f402c6559c6c1

SHA512
a8380cc07eed7ef96dc379f84b7e3a1bf681ef01154fc401ffcea82e643144d952fa14b322a04958764a52b7e81a9a05a385cd71a77bd638ef932d1e0da728f6

Download Submit
C:\Program Files (x86)\XYRZ\serverjsp.ini
MD5
29089980c0a857e1427948d11b42df4c

SHA1
e9d726f6522fe666be8f202f94342bd0e4dd3ecf

SHA256
f9cca50b4b68dba9d684afbdd9a21bc1fef2a4d771c0a17f95322401b1542568

SHA512
d14878cb41097f06a65d36024566b7761e033bb2a152b32aab32466558f47e78ff6b88f8ebf5bfd9740a34ee8177eeb261bd71a17cd377172b3c233de7430d2b

Download Submit
C:\Program Files (x86)\XYRZ\xyrzsvc.exe
MD5
da0bc97bfc6b8577ef35ab85c61b6731

SHA1
ca616998fae7f1df54fa4fb9f531e929265b36fe

SHA256
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a

SHA512
5a95c00df06996552243fcb56b742a262fdf11276d5f01ff7f190340be8af21fc1d191411587b1cb1dfd937698e5bb6e201fba030a3b252274b4029087abe2a6

Download Submit
C:\Program Files (x86)\XYRZ\xyrzsvc.exe
MD5
da0bc97bfc6b8577ef35ab85c61b6731

SHA1
ca616998fae7f1df54fa4fb9f531e929265b36fe

SHA256
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a

SHA512
5a95c00df06996552243fcb56b742a262fdf11276d5f01ff7f190340be8af21fc1d191411587b1cb1dfd937698e5bb6e201fba030a3b252274b4029087abe2a6

Download Submit
C:\Program Files (x86)\XYRZ\xyrzsvc.exe
MD5
da0bc97bfc6b8577ef35ab85c61b6731

SHA1
ca616998fae7f1df54fa4fb9f531e929265b36fe

SHA256
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a

SHA512
5a95c00df06996552243fcb56b742a262fdf11276d5f01ff7f190340be8af21fc1d191411587b1cb1dfd937698e5bb6e201fba030a3b252274b4029087abe2a6

Download Submit
C:\Program Files (x86)\XYRZ\xyrzsvc.exe
MD5
da0bc97bfc6b8577ef35ab85c61b6731

SHA1
ca616998fae7f1df54fa4fb9f531e929265b36fe

SHA256
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a

SHA512
5a95c00df06996552243fcb56b742a262fdf11276d5f01ff7f190340be8af21fc1d191411587b1cb1dfd937698e5bb6e201fba030a3b252274b4029087abe2a6

Download Submit
C:\Program Files (x86)\XYRZ\xyrzsvc.exe
MD5
da0bc97bfc6b8577ef35ab85c61b6731

SHA1
ca616998fae7f1df54fa4fb9f531e929265b36fe

SHA256
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a

SHA512
5a95c00df06996552243fcb56b742a262fdf11276d5f01ff7f190340be8af21fc1d191411587b1cb1dfd937698e5bb6e201fba030a3b252274b4029087abe2a6

Download Submit
C:\Program Files (x86)\XYRZ\xyrzsvc.exe
MD5
da0bc97bfc6b8577ef35ab85c61b6731

SHA1
ca616998fae7f1df54fa4fb9f531e929265b36fe

SHA256
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a

SHA512
5a95c00df06996552243fcb56b742a262fdf11276d5f01ff7f190340be8af21fc1d191411587b1cb1dfd937698e5bb6e201fba030a3b252274b4029087abe2a6

Download Submit
C:\Windows\SysWOW64\PluginManager\MPlugin.exe
MD5
8a1917b7f39d02d35eea767d5b92298f

SHA1
d3c2d35bf2c3cb9409034b1891909d819fd3a2c0

SHA256
bbd384c49e1c9c4ab83156836f24e904f0e981541685a78284b49e260d4ac65f

SHA512
11df3a0d3d55732d107a668fa8bffa68c0bc9892ecee13a0429accff5d5dd8a330370b66e26e84ddd628f89f44def6ee085d7cf75e5f758b3f61cce207540275

Download Submit
C:\Windows\SysWOW64\PluginManager\MPlugin.exe
MD5
8a1917b7f39d02d35eea767d5b92298f

SHA1
d3c2d35bf2c3cb9409034b1891909d819fd3a2c0

SHA256
bbd384c49e1c9c4ab83156836f24e904f0e981541685a78284b49e260d4ac65f

SHA512
11df3a0d3d55732d107a668fa8bffa68c0bc9892ecee13a0429accff5d5dd8a330370b66e26e84ddd628f89f44def6ee085d7cf75e5f758b3f61cce207540275

Download Submit
C:\Windows\SysWOW64\PluginManager\MPlugin.exe
MD5
8a1917b7f39d02d35eea767d5b92298f

SHA1
d3c2d35bf2c3cb9409034b1891909d819fd3a2c0

SHA256
bbd384c49e1c9c4ab83156836f24e904f0e981541685a78284b49e260d4ac65f

SHA512
11df3a0d3d55732d107a668fa8bffa68c0bc9892ecee13a0429accff5d5dd8a330370b66e26e84ddd628f89f44def6ee085d7cf75e5f758b3f61cce207540275

Download Submit
C:\Windows\SysWOW64\PluginManager\Plugin.exe
MD5
d499975fc96815252fc0e0d41790e859

SHA1
787bcd619fa1ae01fe617e79172621bf3a548f34

SHA256
f0a0829c7ea7c65ec1add6ef0f83bad99a4e5779219c04debd54f4add9c128b5

SHA512
75382ded572a5cdf8c7cebd4a3193234abf847e0d11b99baafff3488d2b4e4452175453f0ca014942b94c209f510391dc41a5d6214019deb5ff0d319f6d72257

Download Submit
C:\Windows\SysWOW64\PluginManager\Plugin.exe
MD5
d499975fc96815252fc0e0d41790e859

SHA1
787bcd619fa1ae01fe617e79172621bf3a548f34

SHA256
f0a0829c7ea7c65ec1add6ef0f83bad99a4e5779219c04debd54f4add9c128b5

SHA512
75382ded572a5cdf8c7cebd4a3193234abf847e0d11b99baafff3488d2b4e4452175453f0ca014942b94c209f510391dc41a5d6214019deb5ff0d319f6d72257

Download Submit
C:\Windows\SysWOW64\PluginManager\Plugin.exe
MD5
d499975fc96815252fc0e0d41790e859

SHA1
787bcd619fa1ae01fe617e79172621bf3a548f34

SHA256
f0a0829c7ea7c65ec1add6ef0f83bad99a4e5779219c04debd54f4add9c128b5

SHA512
75382ded572a5cdf8c7cebd4a3193234abf847e0d11b99baafff3488d2b4e4452175453f0ca014942b94c209f510391dc41a5d6214019deb5ff0d319f6d72257

Download Submit
C:\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe
MD5
849ef7b578b4d20621afd4f7765e33f3

SHA1
a685a116896f10ae7316ddc57856e935a42a4668

SHA256
ec609713b31c6a5e2d4982c0495265a444e092bacdf1ec5d6ec3140f4e9c8145

SHA512
3aee2bc5246e2f03e4dd6e6468275717e4ddd0beed52eb1a2010afe0f51080dd3149ee7dd33997fdc63381280c7fe8e2b6de85331ad9d30bd1043b61f1373c1a

Download Submit
C:\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe
MD5
849ef7b578b4d20621afd4f7765e33f3

SHA1
a685a116896f10ae7316ddc57856e935a42a4668

SHA256
ec609713b31c6a5e2d4982c0495265a444e092bacdf1ec5d6ec3140f4e9c8145

SHA512
3aee2bc5246e2f03e4dd6e6468275717e4ddd0beed52eb1a2010afe0f51080dd3149ee7dd33997fdc63381280c7fe8e2b6de85331ad9d30bd1043b61f1373c1a

Download Submit
C:\Windows\SysWOW64\PluginManager\PluginSetup.exe
MD5
9e4fea78aeaf4c3de163e4030eb94c0d

SHA1
756e454b5baa96766c678852bb653c150115b19f

SHA256
66a57abd0ba921a525541e572dbf46d6a62f1a235b8c484bfdfb019c2f090d2f

SHA512
0e5dd1c3d240a14380279eb04dbba01d0e45073784ae43ee72ca06d3ec6819469c34793783f37039e20c2f9ccbbbd9115bef7445dcfb760d0910e74812aa6430

Download Submit
C:\Windows\SysWOW64\PluginManager\PluginSetup.exe
MD5
9e4fea78aeaf4c3de163e4030eb94c0d

SHA1
756e454b5baa96766c678852bb653c150115b19f

SHA256
66a57abd0ba921a525541e572dbf46d6a62f1a235b8c484bfdfb019c2f090d2f

SHA512
0e5dd1c3d240a14380279eb04dbba01d0e45073784ae43ee72ca06d3ec6819469c34793783f37039e20c2f9ccbbbd9115bef7445dcfb760d0910e74812aa6430

Download Submit
C:\Windows\SysWOW64\PluginManager\SignToolSetup.exe
MD5
3ded5b33f57c1e3e2818fbcd65a625d1

SHA1
ed34b09a41c21ebae17a37ee12e82acf7d268d35

SHA256
9aa0c944d3022cc9f625230335b2bb46d59ed7b61bc4714d8e2d00e8349fd1f7

SHA512
fa55829ea319204a8b9e7a715110e3e820553b0c6b05c53be0ace614af0829d4b6bbafc0f5b3a720d962b749fb3f36fe481daa14f803582b27ea4b42057def69

Download Submit
C:\Windows\SysWOW64\PluginManager\SignToolSetup.exe
MD5
3ded5b33f57c1e3e2818fbcd65a625d1

SHA1
ed34b09a41c21ebae17a37ee12e82acf7d268d35

SHA256
9aa0c944d3022cc9f625230335b2bb46d59ed7b61bc4714d8e2d00e8349fd1f7

SHA512
fa55829ea319204a8b9e7a715110e3e820553b0c6b05c53be0ace614af0829d4b6bbafc0f5b3a720d962b749fb3f36fe481daa14f803582b27ea4b42057def69

Download Submit
C:\Windows\SysWOW64\PluginManager\XSDMPlugin.exe
MD5
ef343edd41f3e1c45b0afbc082bb911d

SHA1
7f662011bf21ba980cefafe1f017ac10f605d5c0

SHA256
95c9ed631d32102beab069cf2938e008ca031a47142a75ca0bf014ee80e10be8

SHA512
6be0faded22435d0ffb72335a8d1f7b7551597ccbc537b1e90582c0a0f0b94cca02eda7cb0c415cfe242857aa44d596c753c9fa000b11bb8cc237a8787bcea7b

Download Submit
C:\Windows\SysWOW64\PluginManager\XSDMPlugin.exe
MD5
ef343edd41f3e1c45b0afbc082bb911d

SHA1
7f662011bf21ba980cefafe1f017ac10f605d5c0

SHA256
95c9ed631d32102beab069cf2938e008ca031a47142a75ca0bf014ee80e10be8

SHA512
6be0faded22435d0ffb72335a8d1f7b7551597ccbc537b1e90582c0a0f0b94cca02eda7cb0c415cfe242857aa44d596c753c9fa000b11bb8cc237a8787bcea7b

Download Submit
C:\Windows\SysWOW64\PluginManager\XSDMPlugin.exe
MD5
ef343edd41f3e1c45b0afbc082bb911d

SHA1
7f662011bf21ba980cefafe1f017ac10f605d5c0

SHA256
95c9ed631d32102beab069cf2938e008ca031a47142a75ca0bf014ee80e10be8

SHA512
6be0faded22435d0ffb72335a8d1f7b7551597ccbc537b1e90582c0a0f0b94cca02eda7cb0c415cfe242857aa44d596c753c9fa000b11bb8cc237a8787bcea7b

Download Submit
C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
MD5
f5cb16920d3712f973586b5dcea7a6e2

SHA1
bba96cde1c28efc6faddfee5be579fcd7ed76634

SHA256
25a31103783e5bbf2987e419894da03b8a75fc8185f4cb5ef0f77817daf397f9

SHA512
c2220eb5fb477291be4ddfa757fb10aaa3b5146acbd91036a15173e7f5e8373e5b230255e4b733266f34dd16dae62ac78d21eafdb4d263d770a23b1f611902ad

Download Submit
C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
MD5
f5cb16920d3712f973586b5dcea7a6e2

SHA1
bba96cde1c28efc6faddfee5be579fcd7ed76634

SHA256
25a31103783e5bbf2987e419894da03b8a75fc8185f4cb5ef0f77817daf397f9

SHA512
c2220eb5fb477291be4ddfa757fb10aaa3b5146acbd91036a15173e7f5e8373e5b230255e4b733266f34dd16dae62ac78d21eafdb4d263d770a23b1f611902ad

Download Submit
C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
MD5
f5cb16920d3712f973586b5dcea7a6e2

SHA1
bba96cde1c28efc6faddfee5be579fcd7ed76634

SHA256
25a31103783e5bbf2987e419894da03b8a75fc8185f4cb5ef0f77817daf397f9

SHA512
c2220eb5fb477291be4ddfa757fb10aaa3b5146acbd91036a15173e7f5e8373e5b230255e4b733266f34dd16dae62ac78d21eafdb4d263d770a23b1f611902ad

Download Submit
C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
MD5
f5cb16920d3712f973586b5dcea7a6e2

SHA1
bba96cde1c28efc6faddfee5be579fcd7ed76634

SHA256
25a31103783e5bbf2987e419894da03b8a75fc8185f4cb5ef0f77817daf397f9

SHA512
c2220eb5fb477291be4ddfa757fb10aaa3b5146acbd91036a15173e7f5e8373e5b230255e4b733266f34dd16dae62ac78d21eafdb4d263d770a23b1f611902ad

Download Submit
C:\Windows\SysWOW64\PluginManager\XSDPlugin.exe
MD5
f5cb16920d3712f973586b5dcea7a6e2

SHA1
bba96cde1c28efc6faddfee5be579fcd7ed76634

SHA256
25a31103783e5bbf2987e419894da03b8a75fc8185f4cb5ef0f77817daf397f9

SHA512
c2220eb5fb477291be4ddfa757fb10aaa3b5146acbd91036a15173e7f5e8373e5b230255e4b733266f34dd16dae62ac78d21eafdb4d263d770a23b1f611902ad

Download Submit
C:\Windows\SysWOW64\PluginManager\XYRZSetup.exe
MD5
046d68d81adbfbbfe783ffc92df5d9c4

SHA1
b0736068c0bb91668a479b4879b8954b565fb51a

SHA256
a45d2a098837a49d352df5c227bc927b873ea20ecfdd940ab5a2ecdb07fa3314

SHA512
651693cf707744da103fe221e3ff7779eeeb49d5f1d549b08ed5ccfbb46871ed7ef7b837ca44a43a4c9d7a65210e0514420eac247d0223b2125264d4793c4acd

Download Submit
C:\Windows\SysWOW64\PluginManager\XYRZSetup.exe
MD5
046d68d81adbfbbfe783ffc92df5d9c4

SHA1
b0736068c0bb91668a479b4879b8954b565fb51a

SHA256
a45d2a098837a49d352df5c227bc927b873ea20ecfdd940ab5a2ecdb07fa3314

SHA512
651693cf707744da103fe221e3ff7779eeeb49d5f1d549b08ed5ccfbb46871ed7ef7b837ca44a43a4c9d7a65210e0514420eac247d0223b2125264d4793c4acd

Download Submit
\Program Files (x86)\SignTool\JsDevInfoDll.dll
MD5
7c348eac40b9dbf6bd52db2985abee42

SHA1
b71bf40e0c095d5afe79c5455fbe0270422a39a0

SHA256
465da3a1a0ab1844f559400ea292e7b2008063d3fb7b82482845ead178f7cc75

SHA512
e36a40d3bc01ebfe1f09d27a123ea5c379dc867752f4828ff8bb2ecfda2774ed9cdfdb9105f9de207b1ce1292125976cb10189e6123f7e3bc766e0da558b57d2

Download Submit
\Program Files (x86)\SignTool\SSLeay32.dll
MD5
3cb5a5dc5701c2961742bdb05a43c6d0

SHA1
1f2c7d97762e3648f1c9aab3cbc2d10c27bc1ee6

SHA256
3ba8be5f74c80181ac1fdeb596e1b6ff42f017485f56079ea7732d50ac77b924

SHA512
1d0bde42056cdaa2e27b3eaa22e855cc04ad3c49c5d5a625cf82754728cbaa732ff8ebdc6224f40b0f8518f542c4c4b50e345103b7a850752193e4acbc8d4049

Download Submit
\Program Files (x86)\SignTool\SignTool.exe
MD5
b530975a4c2182c7f68cb0458c6e10d2

SHA1
4bcd5992a961c7f23db95a3f148a2bb59a8d3c7b

SHA256
7233138e42d59ceb624b9dca59a45fcce6650561b1354908daad601e6315fbd4

SHA512
54a918b31ba07f8bae34d3ffa951f40e2126413680ddc391e30d4abf06f80b8e4670eabf71a3d9343527b609c0d4cb09d14490f9d0fd7d005b2ff8101b4e5c4f

Download Submit
\Program Files (x86)\SignTool\libcurl.dll
MD5
b672963bb8fc75b7c122082b5e567058

SHA1
db65575bd8819a2fb005681e85f8232205e1d851

SHA256
fe49ba656906fbe801845996eda6822dfba32081efc7727771ec15d72b94955b

SHA512
616bf3f7e728b71fc17bb72c6a2a9c2340cc6807439dc664b7afe754d42dcf92e3410f73e62ad736f6654a75f11263d4186576d70dfa66f2addecd093bf9074e

Download Submit
\Program Files (x86)\SignTool\libeay32.dll
MD5
0852402f8f75c9a75a74114af75f34c5

SHA1
306a5198163979b500ea461fbb573c11b42af960

SHA256
306376bab846436faf7cace55372b82a948263d526c5bc950902beaaab4342b1

SHA512
7d51371e43a204a3b92fc32ac8b1372d840074001d9de6d64b8d1edc3dd57ee39da55c8e75fb70e61f7fd91eb838cb9ba8ee8669a07330bf4cab6d6be0ff9bc4

Download Submit
\Program Files (x86)\XYRZ\JsDevInfoDll.dll
MD5
7c348eac40b9dbf6bd52db2985abee42

SHA1
b71bf40e0c095d5afe79c5455fbe0270422a39a0

SHA256
465da3a1a0ab1844f559400ea292e7b2008063d3fb7b82482845ead178f7cc75

SHA512
e36a40d3bc01ebfe1f09d27a123ea5c379dc867752f4828ff8bb2ecfda2774ed9cdfdb9105f9de207b1ce1292125976cb10189e6123f7e3bc766e0da558b57d2

Download Submit
\Program Files (x86)\XYRZ\JsDevInfoDll.dll
MD5
7c348eac40b9dbf6bd52db2985abee42

SHA1
b71bf40e0c095d5afe79c5455fbe0270422a39a0

SHA256
465da3a1a0ab1844f559400ea292e7b2008063d3fb7b82482845ead178f7cc75

SHA512
e36a40d3bc01ebfe1f09d27a123ea5c379dc867752f4828ff8bb2ecfda2774ed9cdfdb9105f9de207b1ce1292125976cb10189e6123f7e3bc766e0da558b57d2

Download Submit
\Program Files (x86)\XYRZ\JsDevInfoDll.dll
MD5
7c348eac40b9dbf6bd52db2985abee42

SHA1
b71bf40e0c095d5afe79c5455fbe0270422a39a0

SHA256
465da3a1a0ab1844f559400ea292e7b2008063d3fb7b82482845ead178f7cc75

SHA512
e36a40d3bc01ebfe1f09d27a123ea5c379dc867752f4828ff8bb2ecfda2774ed9cdfdb9105f9de207b1ce1292125976cb10189e6123f7e3bc766e0da558b57d2

Download Submit
\Program Files (x86)\XYRZ\JsDevInfoDll.dll
MD5
7c348eac40b9dbf6bd52db2985abee42

SHA1
b71bf40e0c095d5afe79c5455fbe0270422a39a0

SHA256
465da3a1a0ab1844f559400ea292e7b2008063d3fb7b82482845ead178f7cc75

SHA512
e36a40d3bc01ebfe1f09d27a123ea5c379dc867752f4828ff8bb2ecfda2774ed9cdfdb9105f9de207b1ce1292125976cb10189e6123f7e3bc766e0da558b57d2

Download Submit
\Program Files (x86)\XYRZ\JsDevInfoDll.dll
MD5
7c348eac40b9dbf6bd52db2985abee42

SHA1
b71bf40e0c095d5afe79c5455fbe0270422a39a0

SHA256
465da3a1a0ab1844f559400ea292e7b2008063d3fb7b82482845ead178f7cc75

SHA512
e36a40d3bc01ebfe1f09d27a123ea5c379dc867752f4828ff8bb2ecfda2774ed9cdfdb9105f9de207b1ce1292125976cb10189e6123f7e3bc766e0da558b57d2

Download Submit
\Program Files (x86)\XYRZ\JsDevInfoDll.dll
MD5
7c348eac40b9dbf6bd52db2985abee42

SHA1
b71bf40e0c095d5afe79c5455fbe0270422a39a0

SHA256
465da3a1a0ab1844f559400ea292e7b2008063d3fb7b82482845ead178f7cc75

SHA512
e36a40d3bc01ebfe1f09d27a123ea5c379dc867752f4828ff8bb2ecfda2774ed9cdfdb9105f9de207b1ce1292125976cb10189e6123f7e3bc766e0da558b57d2

Download Submit
\Program Files (x86)\XYRZ\xyrzsvc.exe
MD5
da0bc97bfc6b8577ef35ab85c61b6731

SHA1
ca616998fae7f1df54fa4fb9f531e929265b36fe

SHA256
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a

SHA512
5a95c00df06996552243fcb56b742a262fdf11276d5f01ff7f190340be8af21fc1d191411587b1cb1dfd937698e5bb6e201fba030a3b252274b4029087abe2a6

Download Submit
\Users\Admin\AppData\Local\Temp\nsc1787.tmp\ExecCmd.dll
MD5
b9380b0bea8854fd9f93cc1fda0dfeac

SHA1
edb8d58074e098f7b5f0d158abedc7fc53638618

SHA256
1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

SHA512
45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

Download Submit
\Users\Admin\AppData\Local\Temp\nsc1787.tmp\processwork.dll
MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Users\Admin\AppData\Local\Temp\nsi733.tmp\processwork.dll
MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Users\Admin\AppData\Local\Temp\nsi733.tmp\processwork.dll
MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Users\Admin\AppData\Local\Temp\nsiC61.tmp\processwork.dll
MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Users\Admin\AppData\Local\Temp\nsiC61.tmp\processwork.dll
MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Users\Admin\AppData\Local\Temp\nsiC61.tmp\processwork.dll
MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Users\Admin\AppData\Local\Temp\nsiC61.tmp\processwork.dll
MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Users\Admin\AppData\Local\Temp\nss117F.tmp\Timeout.dll
MD5
8434247d632607e12a4b7bfe5d2c4581

SHA1
bab3bc1141c0cd4a9ae2d7d1a62a0066f9d17e0b

SHA256
cf71e1dfc1f4cc84d45393ad54597c7681de6b40e99345a6e67b3ecb78cd59c4

SHA512
31b4313212558867a020696bfe1ae84a90c78c93353e2b134f0b62703201c9b0c5d3e80624a64f28440ac66afacf4ef44ea5407dd02d5e517586300a6a35372a

Download Submit
\Users\Admin\AppData\Local\Temp\nss117F.tmp\processwork.dll
MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Users\Admin\AppData\Local\Temp\nsx9B2.tmp\processwork.dll
MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Users\Admin\AppData\Local\Temp\nsx9B2.tmp\processwork.dll
MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Windows\SysWOW64\PluginManager\MPlugin.exe
MD5
8a1917b7f39d02d35eea767d5b92298f

SHA1
d3c2d35bf2c3cb9409034b1891909d819fd3a2c0

SHA256
bbd384c49e1c9c4ab83156836f24e904f0e981541685a78284b49e260d4ac65f

SHA512
11df3a0d3d55732d107a668fa8bffa68c0bc9892ecee13a0429accff5d5dd8a330370b66e26e84ddd628f89f44def6ee085d7cf75e5f758b3f61cce207540275

Download Submit
\Windows\SysWOW64\PluginManager\MPlugin.exe
MD5
8a1917b7f39d02d35eea767d5b92298f

SHA1
d3c2d35bf2c3cb9409034b1891909d819fd3a2c0

SHA256
bbd384c49e1c9c4ab83156836f24e904f0e981541685a78284b49e260d4ac65f

SHA512
11df3a0d3d55732d107a668fa8bffa68c0bc9892ecee13a0429accff5d5dd8a330370b66e26e84ddd628f89f44def6ee085d7cf75e5f758b3f61cce207540275

Download Submit
\Windows\SysWOW64\PluginManager\Plugin.exe
MD5
d499975fc96815252fc0e0d41790e859

SHA1
787bcd619fa1ae01fe617e79172621bf3a548f34

SHA256
f0a0829c7ea7c65ec1add6ef0f83bad99a4e5779219c04debd54f4add9c128b5

SHA512
75382ded572a5cdf8c7cebd4a3193234abf847e0d11b99baafff3488d2b4e4452175453f0ca014942b94c209f510391dc41a5d6214019deb5ff0d319f6d72257

Download Submit
\Windows\SysWOW64\PluginManager\Plugin.exe
MD5
d499975fc96815252fc0e0d41790e859

SHA1
787bcd619fa1ae01fe617e79172621bf3a548f34

SHA256
f0a0829c7ea7c65ec1add6ef0f83bad99a4e5779219c04debd54f4add9c128b5

SHA512
75382ded572a5cdf8c7cebd4a3193234abf847e0d11b99baafff3488d2b4e4452175453f0ca014942b94c209f510391dc41a5d6214019deb5ff0d319f6d72257

Download Submit
\Windows\SysWOW64\PluginManager\PluginManagerSetup.exe
MD5
849ef7b578b4d20621afd4f7765e33f3

SHA1
a685a116896f10ae7316ddc57856e935a42a4668

SHA256
ec609713b31c6a5e2d4982c0495265a444e092bacdf1ec5d6ec3140f4e9c8145

SHA512
3aee2bc5246e2f03e4dd6e6468275717e4ddd0beed52eb1a2010afe0f51080dd3149ee7dd33997fdc63381280c7fe8e2b6de85331ad9d30bd1043b61f1373c1a

Download Submit
\Windows\SysWOW64\PluginManager\PluginSetup.exe
MD5
9e4fea78aeaf4c3de163e4030eb94c0d

SHA1
756e454b5baa96766c678852bb653c150115b19f

SHA256
66a57abd0ba921a525541e572dbf46d6a62f1a235b8c484bfdfb019c2f090d2f

SHA512
0e5dd1c3d240a14380279eb04dbba01d0e45073784ae43ee72ca06d3ec6819469c34793783f37039e20c2f9ccbbbd9115bef7445dcfb760d0910e74812aa6430

Download Submit
\Windows\SysWOW64\PluginManager\SignToolSetup.exe
MD5
3ded5b33f57c1e3e2818fbcd65a625d1

SHA1
ed34b09a41c21ebae17a37ee12e82acf7d268d35

SHA256
9aa0c944d3022cc9f625230335b2bb46d59ed7b61bc4714d8e2d00e8349fd1f7

SHA512
fa55829ea319204a8b9e7a715110e3e820553b0c6b05c53be0ace614af0829d4b6bbafc0f5b3a720d962b749fb3f36fe481daa14f803582b27ea4b42057def69

Download Submit
\Windows\SysWOW64\PluginManager\XSDMPlugin.exe
MD5
ef343edd41f3e1c45b0afbc082bb911d

SHA1
7f662011bf21ba980cefafe1f017ac10f605d5c0

SHA256
95c9ed631d32102beab069cf2938e008ca031a47142a75ca0bf014ee80e10be8

SHA512
6be0faded22435d0ffb72335a8d1f7b7551597ccbc537b1e90582c0a0f0b94cca02eda7cb0c415cfe242857aa44d596c753c9fa000b11bb8cc237a8787bcea7b

Download Submit
\Windows\SysWOW64\PluginManager\XSDMPlugin.exe
MD5
ef343edd41f3e1c45b0afbc082bb911d

SHA1
7f662011bf21ba980cefafe1f017ac10f605d5c0

SHA256
95c9ed631d32102beab069cf2938e008ca031a47142a75ca0bf014ee80e10be8

SHA512
6be0faded22435d0ffb72335a8d1f7b7551597ccbc537b1e90582c0a0f0b94cca02eda7cb0c415cfe242857aa44d596c753c9fa000b11bb8cc237a8787bcea7b

Download Submit
\Windows\SysWOW64\PluginManager\XSDPlugin.exe
MD5
f5cb16920d3712f973586b5dcea7a6e2

SHA1
bba96cde1c28efc6faddfee5be579fcd7ed76634

SHA256
25a31103783e5bbf2987e419894da03b8a75fc8185f4cb5ef0f77817daf397f9

SHA512
c2220eb5fb477291be4ddfa757fb10aaa3b5146acbd91036a15173e7f5e8373e5b230255e4b733266f34dd16dae62ac78d21eafdb4d263d770a23b1f611902ad

Download Submit
\Windows\SysWOW64\PluginManager\XSDPlugin.exe
MD5
f5cb16920d3712f973586b5dcea7a6e2

SHA1
bba96cde1c28efc6faddfee5be579fcd7ed76634

SHA256
25a31103783e5bbf2987e419894da03b8a75fc8185f4cb5ef0f77817daf397f9

SHA512
c2220eb5fb477291be4ddfa757fb10aaa3b5146acbd91036a15173e7f5e8373e5b230255e4b733266f34dd16dae62ac78d21eafdb4d263d770a23b1f611902ad

Download Submit
\Windows\SysWOW64\PluginManager\XYRZSetup.exe
MD5
046d68d81adbfbbfe783ffc92df5d9c4

SHA1
b0736068c0bb91668a479b4879b8954b565fb51a

SHA256
a45d2a098837a49d352df5c227bc927b873ea20ecfdd940ab5a2ecdb07fa3314

SHA512
651693cf707744da103fe221e3ff7779eeeb49d5f1d549b08ed5ccfbb46871ed7ef7b837ca44a43a4c9d7a65210e0514420eac247d0223b2125264d4793c4acd

Download Submit
memory/392-20-0x0000000000000000-mapping.dmp

Download
memory/428-73-0x0000000000000000-mapping.dmp

Download
memory/432-54-0x0000000000000000-mapping.dmp

Download
memory/524-29-0x0000000000000000-mapping.dmp

Download
memory/524-62-0x0000000000000000-mapping.dmp

Download
memory/556-58-0x0000000000000000-mapping.dmp

Download
memory/652-81-0x0000000000000000-mapping.dmp

Download
memory/672-45-0x0000000000000000-mapping.dmp

Download
memory/916-23-0x0000000000000000-mapping.dmp

Download
memory/928-32-0x0000000000000000-mapping.dmp

Download
memory/1016-26-0x0000000000000000-mapping.dmp

Download
memory/1064-3-0x0000000000000000-mapping.dmp

Download
memory/1192-9-0x0000000000000000-mapping.dmp

Download
memory/1272-34-0x0000000000000000-mapping.dmp

Download
memory/1372-46-0x0000000000000000-mapping.dmp

Download
memory/1456-78-0x0000000000000000-mapping.dmp

Download
memory/1520-98-0x0000000000000000-mapping.dmp

Download
memory/1536-92-0x000007FEF6010000-0x000007FEF628A000-memory.dmp

Filesize
2.5MB

Download
memory/1592-17-0x0000000000000000-mapping.dmp

Download
memory/1608-79-0x0000000000000000-mapping.dmp

Download
memory/1720-39-0x0000000000000000-mapping.dmp

Download
memory/1916-94-0x0000000000000000-mapping.dmp

Download