Downloads.rar

General
Target

infected dot net installer.exe

Filesize

139MB

Completed

19-11-2020 10:39

Score
8 /10
Malware Config
Signatures 10

Filter: none

Defense Evasion
Discovery
Persistence
  • Executes dropped EXE
    ._cache_infected dot net installer.exeSynaptics.exeSetup.exe

    Reported IOCs

    pidprocess
    2924._cache_infected dot net installer.exe
    2800Synaptics.exe
    200Setup.exe
  • Checks computer location settings
    infected dot net installer.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nationinfected dot net installer.exe
  • Loads dropped DLL
    Setup.exe

    Reported IOCs

    pidprocess
    200Setup.exe
    200Setup.exe
    200Setup.exe
    200Setup.exe
    200Setup.exe
  • Adds Run key to start application
    infected dot net installer.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"infected dot net installer.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Checks processor information in registry
    Setup.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Setup.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzSetup.exe
  • Modifies registry class
    infected dot net installer.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instanceinfected dot net installer.exe
  • Modifies system certificate store
    Synaptics.exe

    TTPs

    Install Root CertificateModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349Synaptics.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986eSynaptics.exe
  • Suspicious behavior: EnumeratesProcesses
    Setup.exe

    Reported IOCs

    pidprocess
    200Setup.exe
    200Setup.exe
    200Setup.exe
    200Setup.exe
    200Setup.exe
    200Setup.exe
    200Setup.exe
    200Setup.exe
  • Suspicious use of WriteProcessMemory
    infected dot net installer.exe._cache_infected dot net installer.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3888 wrote to memory of 29243888infected dot net installer.exe._cache_infected dot net installer.exe
    PID 3888 wrote to memory of 29243888infected dot net installer.exe._cache_infected dot net installer.exe
    PID 3888 wrote to memory of 29243888infected dot net installer.exe._cache_infected dot net installer.exe
    PID 3888 wrote to memory of 28003888infected dot net installer.exeSynaptics.exe
    PID 3888 wrote to memory of 28003888infected dot net installer.exeSynaptics.exe
    PID 3888 wrote to memory of 28003888infected dot net installer.exeSynaptics.exe
    PID 2924 wrote to memory of 2002924._cache_infected dot net installer.exeSetup.exe
    PID 2924 wrote to memory of 2002924._cache_infected dot net installer.exeSetup.exe
    PID 2924 wrote to memory of 2002924._cache_infected dot net installer.exeSetup.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\infected dot net installer.exe
    "C:\Users\Admin\AppData\Local\Temp\infected dot net installer.exe"
    Checks computer location settings
    Adds Run key to start application
    Modifies registry class
    Suspicious use of WriteProcessMemory
    PID:3888
    • C:\Users\Admin\AppData\Local\Temp\._cache_infected dot net installer.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_infected dot net installer.exe"
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2924
      • C:\7d3cff8c829902903afa86034450\Setup.exe
        C:\7d3cff8c829902903afa86034450\\Setup.exe /x86 /x64 /web
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        PID:200
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      Executes dropped EXE
      Modifies system certificate store
      PID:2800
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\7d3cff8c829902903afa86034450\1025\LocalizedData.xml

                      MD5

                      d84db0827e0f455f607ef501108557d0

                      SHA1

                      d275924654f617ddaf01b032cf0bf26374fc6cd5

                      SHA256

                      a8d9fd3c7ebb7fee5adb3cafe6190131cebfcbeff7f0046a428c243f78eac559

                      SHA512

                      1b08115a4ea03217ce7a4d365899bd311a60490b7271db209d1e5979a612d95c853be33d895570e0fb0414ab16eb8fd822fe4e3396019a9edd0d0c7ff9e57232

                    • C:\7d3cff8c829902903afa86034450\1028\LocalizedData.xml

                      MD5

                      ff41100cc12e45a327d670652f0d6b87

                      SHA1

                      cb53d671cb66d28b6eb7247a1a0c70a114d07e6b

                      SHA256

                      ef3de7ab3d80a4d2865b9e191d2311112b4870103d383ae21882f251bbde7f0a

                      SHA512

                      f8a2f8db5957a43aa82bd7d193b2ff2a151bba6a9d0ad2d39e120909a0f8939123b389ebb4244a417f9e4d8e46629c49ac193c320231cb614253612af45281a8

                    • C:\7d3cff8c829902903afa86034450\1029\LocalizedData.xml

                      MD5

                      51130f3479df72fe12b05a7aba1891d3

                      SHA1

                      fbaf9c0269d532a3ce00d725cd40772bc0ad8f09

                      SHA256

                      8845d0f0fadfdf51b540d389bbb0a8a9655cf65055e55dcd54fa655576dd70a1

                      SHA512

                      b641e22b81babbde85a6f324851d35f47bd769fc0cff74911010ae620cf682f9c7bc4d946d2f80a46a9851f3cc912625991c8a3876f1d958ea4d49d8791d1815

                    • C:\7d3cff8c829902903afa86034450\1030\LocalizedData.xml

                      MD5

                      53aa67d27c43a35c6f61552ee9865f55

                      SHA1

                      504035de2fe6432d54bc69f0d126516f363e1905

                      SHA256

                      5d08b297b867179d8d2ec861dbf7e1dfdb283573430a55644e134ee39083157a

                      SHA512

                      7a284076f6f204e5be41eab3c3abb1983fbbc21669130cc7e6961a7b858f30caf83fbcb2ef44cfe712341ab664347df29d58b650f004608b015e61e4f5d4f47b

                    • C:\7d3cff8c829902903afa86034450\1031\LocalizedData.xml

                      MD5

                      f8e3a846d4aca062413094f1d953075e

                      SHA1

                      09f2aa5b5ef693051862965c7c1063d31623f433

                      SHA256

                      5a929328125673d922e7f969769b003f5cb6942daa92818a384d50ac755174c2

                      SHA512

                      95fead89ac87c700615deef0b5c75aa818172cb387fb5e7178d0a96adb4a60abe86c3793f1174ad27b3a12fe29a371682a032d83d2c63f50a223e37a9d5fc7c6

                    • C:\7d3cff8c829902903afa86034450\1032\LocalizedData.xml

                      MD5

                      8ecac4ca4cc3405929b06872e3f78e99

                      SHA1

                      805250d3aa16183dc2801558172633f718a839c4

                      SHA256

                      b9e9740a1f29eeaf213e1e0e01f189b6be1d8d44a2ab6df746eebe9cb772f588

                      SHA512

                      6f681c35a38a822f4747d6d2bcacefc49a07c9ca28a6b8eed38b8d760327419b5b469698bed37366c2480a4f118d4d36c6ae0f3c645f185e39a90ff26e749062

                    • C:\7d3cff8c829902903afa86034450\1033\LocalizedData.xml

                      MD5

                      24fde6338ea1a937945c3feb0b7b2281

                      SHA1

                      6b8b437cd3692207e891e205c246f64e3d81fdd5

                      SHA256

                      63d37577f760339ed4e40dc699308b25217ce678ce0be50c5f9ce540bb08e0a7

                      SHA512

                      9a51c7057de4f2ec607bb9820999c676c01c9baf49524011bb5669225d80154119757e8eb92d1952832a6cb20ea0e7da192b4b9ddf813fa4c2780200b3d7ba67

                    • C:\7d3cff8c829902903afa86034450\1033\SetupResources.dll

                      MD5

                      541d0525f83b665b9237bfe3e3483031

                      SHA1

                      ddc3b3dbf0524c38328b1dcbb7207e265b7d67cc

                      SHA256

                      6612a68898b89bcc6f1b74c11d4ec33a4b230ab567aed78d31e0120509ef2990

                      SHA512

                      bf6f131b0d26c6785991e1b4c460668e82e01fe949dbe94bd0ed4fb2be0cc38d50dc266f03ef491f33f447b7d724e045a486410e265561b77c3205964cab55ff

                    • C:\7d3cff8c829902903afa86034450\1035\LocalizedData.xml

                      MD5

                      de5ccb392face873eae6abc827d2d3a7

                      SHA1

                      50eab784e31d1462a6e760f39751e7e238ba46a2

                      SHA256

                      6638228cb95fc08eebc9026a2978d5c68852255571941a3828d9948251ca087d

                      SHA512

                      b615a69b49404d97ce0459412fbd53415dfbc1792ed95c1f1bd30f963790f3f219e028f559706e8b197ce0223a2c2d9f2e1cac7e3b50372ebef0d050100c6d10

                    • C:\7d3cff8c829902903afa86034450\1036\LocalizedData.xml

                      MD5

                      75bf2db655ca2442ae41495e158149c9

                      SHA1

                      514a48371362dfa2033ba99ecab80727f7e4b0ee

                      SHA256

                      1938c4ffedfbb7fea0636238abb7f8a8db53db62537437ff1ec0e12dca2abfab

                      SHA512

                      1b697d0621f47bb66d45ae85183a02ec78dd2b6458ef2b0897d5bbbd2892e15eaf90384bc351800b5d00cb0c3682db234fac2a75214d8ade4748fc100b1c85b2

                    • C:\7d3cff8c829902903afa86034450\1037\LocalizedData.xml

                      MD5

                      94f3480d829cee3470d2ba1046f2f613

                      SHA1

                      9a8ffc781afb5f087b39abe82c11e20d3e08b4f3

                      SHA256

                      eceb759e0f06e5d4f30bc8a982f099c6c268cff4a1459222da794d639c74f97f

                      SHA512

                      436d52da9c6c853616cf088c83b55032e491d6d76eeca0bf0cb40b7a84383a1fcffcb8ac0793cdea6af04d02acf5c1654d6b9461506ee704d95a9469581e8eaf

                    • C:\7d3cff8c829902903afa86034450\1038\LocalizedData.xml

                      MD5

                      818e35b3eb2e23785decef4e58d74433

                      SHA1

                      41b43d0b3f81a3a294aa941279a96f0764761547

                      SHA256

                      3d8b2c8079cf8117340a8fc363dceb9be102d6eb1a72881b0c43e1e4b934303e

                      SHA512

                      98ae09da1be0ebe609d0e11d868258ab322cdc631e3105296c8ce243d821b415f3c487cbb4cd366bb4bdb7f0f9447a25836e53320b424a9ff817cac728ff4ae2

                    • C:\7d3cff8c829902903afa86034450\1040\LocalizedData.xml

                      MD5

                      5e805353cb010fc22f51c1f15b8bcaa1

                      SHA1

                      9360f229aee4fed6897d4f9f239072aa22d6da9e

                      SHA256

                      02b83ebd2689e22668a5ee55a213091fdc090dfee42c0be9386f530d48af8950

                      SHA512

                      275d7c7c952a352417fe896c5be07f5a4c50ff51569cb04ab615cda6a880a8e83f651c87f226a1eb79d8286f777488bfaac2636a1a2057cf5db83037b3e1214f

                    • C:\7d3cff8c829902903afa86034450\1041\LocalizedData.xml

                      MD5

                      5ab13768b6c897eff96e35f91b834d25

                      SHA1

                      54f04c73a57a409e4c1fe317a825ee2ed4ddcd10

                      SHA256

                      87b5ce86b0134ea82215dcf04ffbf7f5c8a570f814f82b4c7ba6106195924c6b

                      SHA512

                      ee98f34723a1593ef12589ea9657f8d9a3c9dc8a3fb5eed6f8bb026c6656a3ca6fec8243745ed7fbf406019b6e2b42762c1ee74d26c0f70cc9da272291fe680f

                    • C:\7d3cff8c829902903afa86034450\1042\LocalizedData.xml

                      MD5

                      ad25367f86144f29946df3b3866e7dbe

                      SHA1

                      cc8470dbe0bfe9394742d639d9caeec961a27928

                      SHA256

                      90d0885f929059358fe76e61b560b3d188abbe7c041babefc82038f6faebb7eb

                      SHA512

                      66a343d1405e377bf2d303b0ec896814a46248c05dfe61a2c3167ed1c915964f7f57b335bd7fae324461e65e5ee6bc2384eff28f71c4325eb3c4f89611659afb

                    • C:\7d3cff8c829902903afa86034450\1043\LocalizedData.xml

                      MD5

                      898d2a1a5fac4d1a028aa11e0ed9f9b4

                      SHA1

                      343795fbc1bbf1b0982dc9e70501721433fba892

                      SHA256

                      73130da9b103f1812ca69cfffdf5750e74b0228cd40e0325a7f14e799aaf21a3

                      SHA512

                      fac3fd81d803c1029df6a3cd93060c950b0ba399fe074d438c4867d55468e7de9aa77bbd7b51fe866f6849684408c853d70956e94de39d4f61019825028a25e4

                    • C:\7d3cff8c829902903afa86034450\1044\LocalizedData.xml

                      MD5

                      a459afdbe20f5d4c904d3e3700ee9191

                      SHA1

                      22570b1de34c11796390057537269145a2c63438

                      SHA256

                      0ac4bcf5cee39ad42070e34393303ffe3ef27e71c8d9522f3dc01e12f93dda03

                      SHA512

                      b01536c774121ba9fe25014bb802b45449ba46529af8ad59f3ff93e339e7443238b268716ac051d24ac9eba093e5d66fd5c5faa2ca17bf744ec31e50627159ce

                    • C:\7d3cff8c829902903afa86034450\1045\LocalizedData.xml

                      MD5

                      95c6472f2c8329ec1c10f7df3a31c154

                      SHA1

                      624d46235912dc169913ba77caa7889219e2c394

                      SHA256

                      197722527d1ad65a10a29ecec04f029abc549eb5d05bc07a68107ad6dd4bd35b

                      SHA512

                      28149ab0c041dc35f717435f3c2218700090fc38723219c1cd40ec7f777c68d99dd08b6a42014ead8fb1e309637b6c33aa5dec0518dc1b72273c7a6fd7ef06c0

                    • C:\7d3cff8c829902903afa86034450\1046\LocalizedData.xml

                      MD5

                      c13b50e2a7f6e7e9343500771cf2d247

                      SHA1

                      0b679d20dda94224a5ddd80863a2a32de1cc6f1e

                      SHA256

                      3f9bf4eee9ece4a0181ea344344230d73d711aba2fa9248834e3b7547a3062cf

                      SHA512

                      32daea597a34f60ca5b73648d66663e4723c0d588af4ce08f76240aabbecd3a35abfbfd5e22abd8eac8ca64a9f2b3edadb8d1c24bc31f53ce5cd902dba3fc5da

                    • C:\7d3cff8c829902903afa86034450\1049\LocalizedData.xml

                      MD5

                      1c8ad8f7aacde7ac59bfd9730cfcae80

                      SHA1

                      815c79113429b37d34c7ddff46ceccfe58b4cddc

                      SHA256

                      4faa58922f623685f05386ce518c0243e3f310db5ac64c58e5b4e91a3e4477b7

                      SHA512

                      27d5871f862756945c66397d539c79bf6032ec0d6a06255ad6b57ad1df3c1e8c87dc55dcc3febfb4bd1ce4eb24f3268fab30b1df3fd1c035d66410337db73785

                    • C:\7d3cff8c829902903afa86034450\1053\LocalizedData.xml

                      MD5

                      984229d90d2e75f49cd9de5df014e484

                      SHA1

                      fc32854972f189305a38c11a62ef457cd94026c6

                      SHA256

                      c884f515f337e977d4cf1a19ff693c753813ede2e52a9dbe8f6ef25184ccae8d

                      SHA512

                      23101cc1b6c17f10a8d53c59c4e9bf6d24d03d781fa1a36fcb89315f2257ea4a1bd652bdbc81845479a88f00f1db52b35a0bba311a9885c7503689f9c25e49c2

                    • C:\7d3cff8c829902903afa86034450\1055\LocalizedData.xml

                      MD5

                      ddb64b6c4fc498c27d291edaaf65a536

                      SHA1

                      e312eef1e9a485c5c6fe4578bbe1dd0cadbb1e3e

                      SHA256

                      027180d93ceb875227a1d76a018b870cd1d09e143ffa1632b31c322b92dd6a35

                      SHA512

                      ddb55169000052fb27caeeb349939925c7df1535c5c697da7cc2be3224c2c8ebe64328d865d1dfdbad4c1e0588853c5309e31de747f71b7f3bc9b6a9eb4335c1

                    • C:\7d3cff8c829902903afa86034450\2052\LocalizedData.xml

                      MD5

                      759eb338d738ca6c531b9d5b06591b3b

                      SHA1

                      c9ed5ada615ccacd887a0d07ee25dfe1d7fbc00c

                      SHA256

                      a4c3bc545fc028935ad6ec4bd8ce51a300fab8a0b128cca89a8c14923d437b16

                      SHA512

                      82e6b969dedfdda477f6fb7fcb50a0acad0b26b9b4cca9f1adab5323c6c144da6c0bff34e39e0ef7b39f37ab5808f0064eace99867f7cd258e91aeb5aa5baef2

                    • C:\7d3cff8c829902903afa86034450\2070\LocalizedData.xml

                      MD5

                      6930ce4e8e28f54a0db5d919b6babd0e

                      SHA1

                      0278bf717168c061709e60ca754c8dc6e32b92d1

                      SHA256

                      4bbb7f8a9743a5a21711156dc978dc8683b3edcd9ca32e4c6a38dbe6f5001e04

                      SHA512

                      904dc390c6cad81e60159683fadc5e8556585b32f1f9482accfedf3ee6b14cd8240e2225e3ce8a0338da93162cef601c4e9798327a1bc390e62b4eb2fc59cd4c

                    • C:\7d3cff8c829902903afa86034450\3082\LocalizedData.xml

                      MD5

                      e58efac53fe2a16be9b99d0aa33baa3d

                      SHA1

                      7f2fecb6c4ebe9374a04f374d43465d968b3e33f

                      SHA256

                      64baa04b7ebb5ee833f43493497e99a6f2584bdc763a7c24700693cb89b35a0c

                      SHA512

                      b9b2e07e845e6bb509d4471cbe3c848836938e507308293f7c083c54cef61911a06110a5616c216ec72c39ce887b2e7f5961688809a2dad787d131ef2780d22e

                    • C:\7d3cff8c829902903afa86034450\DHTMLHeader.html

                      MD5

                      cd131d41791a543cc6f6ed1ea5bd257c

                      SHA1

                      f42a2708a0b42a13530d26515274d1fcdbfe8490

                      SHA256

                      e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

                      SHA512

                      a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

                    • C:\7d3cff8c829902903afa86034450\ParameterInfo.xml

                      MD5

                      4925613d29bc7350130c7076e4c92c1c

                      SHA1

                      2821351d3be08f982431ba789f034b9f028ca922

                      SHA256

                      9157a0afe34576dfea4ba64db5737867742b4e9346a1f2c149b98b6805d45e31

                      SHA512

                      3e69650e4101a14ef69f94fa54b02d8d305039165a0bffc519b3cf96f2dcbcf46845e4669d29ccc5ceb887b2f95fc4756265b19d5c17aa176d3d6dc53ed83f77

                    • C:\7d3cff8c829902903afa86034450\Setup.exe

                      MD5

                      8b3ecf4d59a85dae0960d3175865a06d

                      SHA1

                      fc81227ec438adc3f23e03a229a263d26bcf9092

                      SHA256

                      2b088aefcc76d0baa0bff0843bf458db27bacc47a8e698c9948e53ffc471828b

                      SHA512

                      a58a056a3a5814a13153b4c594ed72796b4598f8e715771fc31e60c60a2e26250768b8f36b18675b91e7ecc777ef27c7554f7a0e92c2dfaba74531e669c38263

                    • C:\7d3cff8c829902903afa86034450\Setup.exe

                      MD5

                      8b3ecf4d59a85dae0960d3175865a06d

                      SHA1

                      fc81227ec438adc3f23e03a229a263d26bcf9092

                      SHA256

                      2b088aefcc76d0baa0bff0843bf458db27bacc47a8e698c9948e53ffc471828b

                      SHA512

                      a58a056a3a5814a13153b4c594ed72796b4598f8e715771fc31e60c60a2e26250768b8f36b18675b91e7ecc777ef27c7554f7a0e92c2dfaba74531e669c38263

                    • C:\7d3cff8c829902903afa86034450\SetupEngine.dll

                      MD5

                      43bc7b5dfd2e45751d6d2ca7274063e4

                      SHA1

                      a8955033d0e94d33114a1205fe7038c6ae2f54f1

                      SHA256

                      a11af883273ddbd24bfed4a240c43f41ce3d8c7962ec970da2d4c7e13b563d04

                      SHA512

                      3f3068e660fea932e91e4d141d8202466b72447107ff43f90dea9557fc188696617025531220bc113dc19fdd7adf313a47ac5f2a4ce94c65f9aeb2d7deda7f36

                    • C:\7d3cff8c829902903afa86034450\SetupUi.dll

                      MD5

                      c6760e8b45ffa0cd56b843bc498b919d

                      SHA1

                      9faa762fcd06b2c216122c31a387d6d9cf5a6558

                      SHA256

                      26f324b3d8e7af4994459e118d20ef5b0abb332075432dd42c6597833486e269

                      SHA512

                      b83f7eab3ee1ef167f81c3ddfa6a578540fb0da2efd15b54650fcf5b35cdb6f54229e04887a6f66a78c4e20cdc21119db4e0f0ed3799eeea3d2e4a308ff3f54a

                    • C:\7d3cff8c829902903afa86034450\SetupUi.xsd

                      MD5

                      2fadd9e618eff8175f2a6e8b95c0cacc

                      SHA1

                      9ab1710a217d15b192188b19467932d947b0a4f8

                      SHA256

                      222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093

                      SHA512

                      a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca

                    • C:\7d3cff8c829902903afa86034450\SplashScreen.bmp

                      MD5

                      0966fcd5a4ab0ddf71f46c01eff3cdd5

                      SHA1

                      8f4554f079edad23bcd1096e6501a61cf1f8ec34

                      SHA256

                      31c13ecfc0eb27f34036fb65cc0e735cd444eec75376eea2642f926ac162dcb3

                      SHA512

                      a9e70a2fb5a9899acf086474d71d0e180e2234c40e68bcadb9bf4fe145774680cb55584b39fe53cc75de445c6bf5741fc9b15b18385cbbe20fc595fe0ff86fce

                    • C:\7d3cff8c829902903afa86034450\Strings.xml

                      MD5

                      8a28b474f4849bee7354ba4c74087cea

                      SHA1

                      c17514dfc33dd14f57ff8660eb7b75af9b2b37b0

                      SHA256

                      2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b

                      SHA512

                      a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369

                    • C:\7d3cff8c829902903afa86034450\UiInfo.xml

                      MD5

                      d8f565bd1492ef4a7c4bc26a641cd1ea

                      SHA1

                      d4c9c49b47be132944288855dc61dbf8539ec876

                      SHA256

                      6a0e20df2075c9a58b870233509321372e283ccccc6afaa886e12ba377546e64

                      SHA512

                      ecf57cc6f3f8c4b677246a451ad71835438d587fadc12d95ef1605eb9287b120068938576da95c10edc6d1d033b5968333a5f8b25ce97ecd347a42716cd2a102

                    • C:\7d3cff8c829902903afa86034450\graphics\print.ico

                      MD5

                      7e55ddc6d611176e697d01c90a1212cf

                      SHA1

                      e2620da05b8e4e2360da579a7be32c1b225deb1b

                      SHA256

                      ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed

                      SHA512

                      283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e

                    • C:\7d3cff8c829902903afa86034450\graphics\save.ico

                      MD5

                      7d62e82d960a938c98da02b1d5201bd5

                      SHA1

                      194e96b0440bf8631887e5e9d3cc485f8e90fbf5

                      SHA256

                      ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5

                      SHA512

                      ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67

                    • C:\7d3cff8c829902903afa86034450\graphics\setup.ico

                      MD5

                      3d25d679e0ff0b8c94273dcd8b07049d

                      SHA1

                      a517fc5e96bc68a02a44093673ee7e076ad57308

                      SHA256

                      288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f

                      SHA512

                      3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255

                    • C:\7d3cff8c829902903afa86034450\graphics\warn.ico

                      MD5

                      b2b1d79591fca103959806a4bf27d036

                      SHA1

                      481fd13a0b58299c41b3e705cb085c533038caf5

                      SHA256

                      fe4d06c318701bf0842d4b87d1bad284c553baf7a40987a7451338099d840a11

                      SHA512

                      5fe232415a39e0055abb5250b120ccdcd565ab102aa602a3083d4a4705ac6775d45e1ef0c2b787b3252232e9d4673fc3a77aab19ec79a3ff8b13c4d7094530d2

                    • C:\7d3cff8c829902903afa86034450\sqmapi.dll

                      MD5

                      d475bbd6fef8db2dde0da7ccfd2c9042

                      SHA1

                      80887bdb64335762a3b1d78f7365c4ee9cfaeab5

                      SHA256

                      8e9d77a216d8dd2be2b304e60edf85ce825309e67262fcff1891aede63909599

                      SHA512

                      f760e02d4d336ac384a0125291b9deac88c24f457271be686b6d817f01ea046d286c73deddbf0476dcc2ade3b3f5329563abd8f2f1e40aee817fee1e3766d008

                    • C:\ProgramData\Synaptics\Synaptics.exe

                      MD5

                      162bfe3f13a9c6d058cb08db605b47d4

                      SHA1

                      b858e4f8fae093581d83e91d861a2d3f16a8823f

                      SHA256

                      14487df946bb1bff496d5d595c4865cebb03f9704c8769dac000d18e8c7d92a8

                      SHA512

                      9b322d6888f33eea6edef675bcdb8cf54d3efe9f6807a30a4f9d4fb85c46632f894d526b54e97b1fb4be2f145b95f1399afd509732fcc435cc48036bff10d1e4

                    • C:\ProgramData\Synaptics\Synaptics.exe

                      MD5

                      162bfe3f13a9c6d058cb08db605b47d4

                      SHA1

                      b858e4f8fae093581d83e91d861a2d3f16a8823f

                      SHA256

                      14487df946bb1bff496d5d595c4865cebb03f9704c8769dac000d18e8c7d92a8

                      SHA512

                      9b322d6888f33eea6edef675bcdb8cf54d3efe9f6807a30a4f9d4fb85c46632f894d526b54e97b1fb4be2f145b95f1399afd509732fcc435cc48036bff10d1e4

                    • C:\Users\Admin\AppData\Local\Temp\._cache_infected dot net installer.exe

                      MD5

                      9e8253f0a993e53b4809dbd74b335227

                      SHA1

                      f6ba6f03c65c3996a258f58324a917463b2d6ff4

                      SHA256

                      e434828818f81e6e1f5955e84caec08662bd154a80b24a71a2eda530d8b2f66a

                      SHA512

                      404d67d59fcd767e65d86395b38d1a531465cee5bb3c5cf3d1205975ff76d27d477fe8cc3842b8134f17b61292d8e2ffba71134fe50a36afd60b189b027f5af0

                    • C:\Users\Admin\AppData\Local\Temp\._cache_infected dot net installer.exe

                      MD5

                      9e8253f0a993e53b4809dbd74b335227

                      SHA1

                      f6ba6f03c65c3996a258f58324a917463b2d6ff4

                      SHA256

                      e434828818f81e6e1f5955e84caec08662bd154a80b24a71a2eda530d8b2f66a

                      SHA512

                      404d67d59fcd767e65d86395b38d1a531465cee5bb3c5cf3d1205975ff76d27d477fe8cc3842b8134f17b61292d8e2ffba71134fe50a36afd60b189b027f5af0

                    • \7d3cff8c829902903afa86034450\1033\SetupResources.dll

                      MD5

                      541d0525f83b665b9237bfe3e3483031

                      SHA1

                      ddc3b3dbf0524c38328b1dcbb7207e265b7d67cc

                      SHA256

                      6612a68898b89bcc6f1b74c11d4ec33a4b230ab567aed78d31e0120509ef2990

                      SHA512

                      bf6f131b0d26c6785991e1b4c460668e82e01fe949dbe94bd0ed4fb2be0cc38d50dc266f03ef491f33f447b7d724e045a486410e265561b77c3205964cab55ff

                    • \7d3cff8c829902903afa86034450\1033\SetupResources.dll

                      MD5

                      541d0525f83b665b9237bfe3e3483031

                      SHA1

                      ddc3b3dbf0524c38328b1dcbb7207e265b7d67cc

                      SHA256

                      6612a68898b89bcc6f1b74c11d4ec33a4b230ab567aed78d31e0120509ef2990

                      SHA512

                      bf6f131b0d26c6785991e1b4c460668e82e01fe949dbe94bd0ed4fb2be0cc38d50dc266f03ef491f33f447b7d724e045a486410e265561b77c3205964cab55ff

                    • \7d3cff8c829902903afa86034450\SetupEngine.dll

                      MD5

                      43bc7b5dfd2e45751d6d2ca7274063e4

                      SHA1

                      a8955033d0e94d33114a1205fe7038c6ae2f54f1

                      SHA256

                      a11af883273ddbd24bfed4a240c43f41ce3d8c7962ec970da2d4c7e13b563d04

                      SHA512

                      3f3068e660fea932e91e4d141d8202466b72447107ff43f90dea9557fc188696617025531220bc113dc19fdd7adf313a47ac5f2a4ce94c65f9aeb2d7deda7f36

                    • \7d3cff8c829902903afa86034450\SetupUi.dll

                      MD5

                      c6760e8b45ffa0cd56b843bc498b919d

                      SHA1

                      9faa762fcd06b2c216122c31a387d6d9cf5a6558

                      SHA256

                      26f324b3d8e7af4994459e118d20ef5b0abb332075432dd42c6597833486e269

                      SHA512

                      b83f7eab3ee1ef167f81c3ddfa6a578540fb0da2efd15b54650fcf5b35cdb6f54229e04887a6f66a78c4e20cdc21119db4e0f0ed3799eeea3d2e4a308ff3f54a

                    • \7d3cff8c829902903afa86034450\sqmapi.dll

                      MD5

                      d475bbd6fef8db2dde0da7ccfd2c9042

                      SHA1

                      80887bdb64335762a3b1d78f7365c4ee9cfaeab5

                      SHA256

                      8e9d77a216d8dd2be2b304e60edf85ce825309e67262fcff1891aede63909599

                      SHA512

                      f760e02d4d336ac384a0125291b9deac88c24f457271be686b6d817f01ea046d286c73deddbf0476dcc2ade3b3f5329563abd8f2f1e40aee817fee1e3766d008

                    • memory/200-6-0x0000000000000000-mapping.dmp

                    • memory/200-46-0x0000000002A40000-0x0000000002A42000-memory.dmp

                    • memory/2800-3-0x0000000000000000-mapping.dmp

                    • memory/2924-0-0x0000000000000000-mapping.dmp