Analysis
-
max time kernel
196s -
max time network
209s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-09-2021 07:14
Static task
static1
Behavioral task
behavioral1
Sample
bc7986f0c9f431b839a13a9a0dfa2711f86e9e9afbed9b9b456066602881ba71.msi
Resource
win10-en-20210920
General
-
Target
bc7986f0c9f431b839a13a9a0dfa2711f86e9e9afbed9b9b456066602881ba71.msi
-
Size
104.4MB
-
MD5
3ef1e803695ceed8baa27d270b3dc649
-
SHA1
a0dff2e81809ab07a296d0114174eebff40cfada
-
SHA256
bc7986f0c9f431b839a13a9a0dfa2711f86e9e9afbed9b9b456066602881ba71
-
SHA512
4de1b4f6c720b8dd5d0bf4b4a0d4dc6985de45d056c2c1636ecf4757ac18bb76f696fbfd23e2e7d03eb2027fa945de246db3be2a72bcb6ef9a67c9fd19dcc396
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Blocklisted process makes network request 5 IoCs
Processes:
msiexec.exepowershell.exemsiexec.exeflow pid process 3 1796 msiexec.exe 5 1796 msiexec.exe 20 4088 powershell.exe 29 2492 msiexec.exe 30 2492 msiexec.exe -
Executes dropped EXE 15 IoCs
Processes:
MSIA6D6.tmpMSIA6D6.tmpnitro_pro13.exeAddinSetupTool.exeAddinSetupTool.exeAddinSetupTool.exeAddinSetupTool.exeNitroPDF.exenitro_module_loader.exeNitro_Slider.exeNitro_Slider.exeNitro_Slider.exeNitro_Slider.exeNitro_Slider.exepid process 2112 MSIA6D6.tmp 3468 MSIA6D6.tmp 1192 nitro_pro13.exe 3452 AddinSetupTool.exe 4808 AddinSetupTool.exe 4832 AddinSetupTool.exe 4856 AddinSetupTool.exe 2012 5356 NitroPDF.exe 5480 nitro_module_loader.exe 5612 Nitro_Slider.exe 5624 Nitro_Slider.exe 5968 Nitro_Slider.exe 2412 Nitro_Slider.exe 5988 Nitro_Slider.exe -
Registers new Print Monitor 2 TTPs
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Nitro_Slider.exeNitro_Slider.exeNitroPDF.exeNitro_Slider.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Nitro_Slider.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Nitro_Slider.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation NitroPDF.exe Key value queried \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation Nitro_Slider.exe -
Drops startup file 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\miCroSoFt\WINDOwS\stARt MENU\PRogrAMs\staRtuP\aad8174b5ff4d3bc9e9443812d0b0.lnK powershell.exe -
Loads dropped DLL 64 IoCs
Processes:
MsiExec.exeMSIA6D6.tmpMsiExec.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exeMsiExec.exeMsiExec.exerundll32.exeNitroPDF.exenitro_module_loader.exepid process 3520 MsiExec.exe 3520 MsiExec.exe 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 4264 MsiExec.exe 4324 rundll32.exe 4324 rundll32.exe 4324 rundll32.exe 4264 MsiExec.exe 4460 rundll32.exe 4460 rundll32.exe 4460 rundll32.exe 4264 MsiExec.exe 4616 rundll32.exe 4616 rundll32.exe 4616 rundll32.exe 4264 MsiExec.exe 4740 rundll32.exe 4740 rundll32.exe 4740 rundll32.exe 4264 MsiExec.exe 4880 rundll32.exe 4880 rundll32.exe 4880 rundll32.exe 1832 MsiExec.exe 1832 MsiExec.exe 1832 MsiExec.exe 4560 MsiExec.exe 4440 rundll32.exe 4440 rundll32.exe 4440 rundll32.exe 4560 MsiExec.exe 3468 MSIA6D6.tmp 3468 MSIA6D6.tmp 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5480 nitro_module_loader.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
nitro_pro13.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce nitro_pro13.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{7078916e-a680-44c9-9437-504aac249f57} = "\"C:\\ProgramData\\Package Cache\\{7078916e-a680-44c9-9437-504aac249f57}\\nitro_pro13.exe\" /burn.runonce" nitro_pro13.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory 34 IoCs
Processes:
msiexec.exeMsiExec.exedescription ioc process File created C:\Windows\SysWOW64\mfcm140u.dll msiexec.exe File created C:\Windows\system32\spool\DRIVERS\x64\NxPdfCreator.ini MsiExec.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\es-ES\NxPdfUI13.dll.mui MsiExec.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\fr-FR\NxPdfUI13.dll.mui MsiExec.exe File created C:\Windows\system32\de-DE\NxPrinterMonitor13.dll.mui MsiExec.exe File created C:\Windows\system32\nl-NL\NxPrinterMonitorUI13.dll.mui MsiExec.exe File created C:\Windows\SysWOW64\mfc140u.dll msiexec.exe File created C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT5.DLL MsiExec.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT5.DLL MsiExec.exe File created C:\Windows\system32\spool\DRIVERS\x64\NxPdfCreator.ppd MsiExec.exe File created C:\Windows\system32\NxPrinterMonitorUI13.dll MsiExec.exe File created C:\Windows\system32\it-IT\NxPrinterMonitor13.dll.mui MsiExec.exe File created C:\Windows\SysWOW64\mfc140.dll msiexec.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\nl-NL\NxPdfUI13.dll.mui MsiExec.exe File created C:\Windows\system32\de-DE\NxPrinterMonitorUI13.dll.mui MsiExec.exe File created C:\Windows\system32\en-US\NxPrinterMonitorUI13.dll.mui MsiExec.exe File created C:\Windows\system32\fr-FR\NxPrinterMonitor13.dll.mui MsiExec.exe File created C:\Windows\system32\spool\DRIVERS\x64\NxPdfUI13.dll MsiExec.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\de-DE\NxPdfUI13.dll.mui MsiExec.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\en-US\NxPdfUI13.dll.mui MsiExec.exe File created C:\Windows\system32\en-US\NxPrinterMonitor13.dll.mui MsiExec.exe File created C:\Windows\system32\nl-NL\NxPrinterMonitor13.dll.mui MsiExec.exe File created C:\Windows\SysWOW64\mfcm140.dll msiexec.exe File created C:\Windows\SysWOW64\msvcp140_2.dll msiexec.exe File created C:\Windows\SysWOW64\vcomp140.dll msiexec.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\it-IT\NxPdfUI13.dll.mui MsiExec.exe File created C:\Windows\system32\es-ES\NxPrinterMonitorUI13.dll.mui MsiExec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\spool\DRIVERS\x64\PS5UI.DLL MsiExec.exe File created C:\Windows\system32\spool\DRIVERS\x64\nitroui13.hlp MsiExec.exe File created C:\Windows\system32\NxPrinterMonitor13.dll MsiExec.exe File created C:\Windows\system32\fr-FR\NxPrinterMonitorUI13.dll.mui MsiExec.exe File created C:\Windows\system32\es-ES\NxPrinterMonitor13.dll.mui MsiExec.exe File created C:\Windows\system32\it-IT\NxPrinterMonitorUI13.dll.mui MsiExec.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exerundll32.exedescription ioc process File created C:\Program Files\Nitro\Pro\13\it-IT\np_attachments.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\fr-FR\np_forms.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\de-DE\np_layers.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\it-IT\np_stamper.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\HKdla-B5-V msiexec.exe File created C:\Program Files\Nitro\Pro\13\mip_core.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\UniJIS-UTF16-H msiexec.exe File created C:\Program Files\Nitro\Pro\13\x86\Eztwain4.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\np_objects.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\it-IT\np_page_edit.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\nl-NL\np_pdfa.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\UniHojo-UCS2-V msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\UniJIS-UCS2-HW-H msiexec.exe File created C:\Program Files\Nitro\Pro\13\zlib1.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\it-IT\ControlActivation.exe.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\Adobe-Japan1-3 msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\Adobe-Japan1-4 msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\Adobe-Korea1-UCS2 msiexec.exe File created C:\Program Files\Nitro\Pro\13\en-US\NitroPDF.exe.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\nl-NL\np_watermarks.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\Add-RKSJ-V msiexec.exe File created C:\Program Files\Nitro\Pro\13\fr-FR\np_watermarks.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\it-IT\NxPdfCreator.exe.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\cef\resources\locales\pt-BR.pak msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\UCS2-KSCpc-EUC msiexec.exe File created C:\Program Files\Nitro\Pro\13\en-US\ControlActivation.exe.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\CNS-EUC-H msiexec.exe File created C:\Program Files\Nitro\Pro\13\nl-NL\NitroPDFActiveX.ocx.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\en-US\np_accessibility.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\es-ES\np_create_pdf.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\np_layers.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\np_ocr.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\IRIS_OCR\resources\prt.ilex msiexec.exe File created C:\Program Files\Nitro\Pro\13\cef\resources\cef_extensions.pak msiexec.exe File created C:\Program Files (x86)\Nitro\Pro\13\SDL2.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\NxPrinterSetupProx64.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\idrsirisbarcodeextwrapper15.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\idrsirisbarcodewrapper15.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\nitro_module_loader.exe msiexec.exe File created C:\Program Files\Nitro\Pro\13\es-ES\np_attachments.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\Add-V msiexec.exe File created C:\Program Files\Nitro\Pro\13\txtFlt.flt msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\UniCNS-UTF8-H msiexec.exe File created C:\Program Files\Nitro\Pro\13\np_web_dav.dll msiexec.exe File created C:\Program Files (x86)\Nitro\Pro\13\crash_handler13.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\cef\resources\locales\el.pak msiexec.exe File created C:\Program Files\Nitro\Pro\13\html_to_pdf.exe msiexec.exe File created C:\Program Files\Nitro\Pro\13\NitroPDFSupportTools.exe msiexec.exe File created C:\Program Files\Nitro\Pro\13\x64\nl-NL\NxPdfUI13.dll.mui msiexec.exe File opened for modification C:\Program Files\Common Files\Nitro\Nitro.Pro.ShellExtension.Shim.dll rundll32.exe File created C:\Program Files\Nitro\Pro\13\CMAP\Adobe-Japan2-0 msiexec.exe File created C:\Program Files\Nitro\Pro\13\fr-FR\np_smart_tips.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\fr-FR\np_stamper.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\Adobe-GB1-0 msiexec.exe File created C:\Program Files\Nitro\Pro\13\ColorProfiles\JapanColor2001Uncoated.icc msiexec.exe File created C:\Program Files\Nitro\Pro\13\MSHTMLApi.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\es-ES\np_actions.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\np_signature_stamp.dll msiexec.exe File created C:\Program Files (x86)\Nitro\Pro\13\browser_plugins\NPNitroIE.dll.mui msiexec.exe File created C:\Program Files\Nitro\Pro\13\cef\resources\locales\zh-TW.pak msiexec.exe File created C:\Program Files\Nitro\Pro\13\CMAP\GBKp-EUC-V msiexec.exe File created C:\Program Files\Nitro\Pro\13\cef\resources\locales\es.pak msiexec.exe File created C:\Program Files\Nitro\Pro\13\Nitro.Swig.Net.dll msiexec.exe File created C:\Program Files\Nitro\Pro\13\nl-NL\np_cloud_storage.dll.mui msiexec.exe -
Drops file in Windows directory 64 IoCs
Processes:
rundll32.exemsiexec.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription ioc process File opened for modification C:\Windows\Installer\MSI8FC1.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfcm140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140_1.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSI8649.tmp-\NitroCA.dll rundll32.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vccorlib140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vcruntime140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\MSIF0B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIFA3B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8649.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI8649.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7F72.tmp-\NitroCA.dll rundll32.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSIF0B4.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI7F72.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8C16.tmp-\NitroCA.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI9502.tmp-\NitroCA.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIC443.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC4B2.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSI7F72.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSI9502.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8C16.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8C16.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8FC1.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfcm140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfcm140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vccorlib140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\{24E8C965-90F0-44CE-B305-FEBA0D900919}\Professional.ico msiexec.exe File opened for modification C:\Windows\Installer\36979.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfcm140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSIF0B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8649.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA9A4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC3A6.tmp msiexec.exe File created C:\Windows\Installer\36979.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSI9502.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSI8FC1.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\concrt140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\MSIF0B4.tmp-\NitroCA.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7F72.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vcruntime140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File created C:\Windows\Installer\{24E8C965-90F0-44CE-B305-FEBA0D900919}\Professional.ico msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\concrt140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe File opened for modification C:\Windows\Installer\MSI8FC1.tmp-\NitroCA.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI9502.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{24E8C965-90F0-44CE-B305-FEBA0D900919} msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143 msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exespoolsv.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 svchost.exe -
Modifies data under HKEY_USERS 40 IoCs
Processes:
CertUtil.exespoolsv.exeCertUtil.exesvchost.exeMsiExec.exesvchost.exemsiexec.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 CertUtil.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne01:" spoolsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-305 = "Endorsement Key Intermediate Certification Authorities" CertUtil.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Nitro PDF Creator = "winspool,Ne00:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne02:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Nitro PDF Creator = "winspool,Ne00:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne03:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-304 = "Endorsement Key Trusted Root Certification Authorities" CertUtil.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne03:,15,45" spoolsv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 CertUtil.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne01:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne03:,15,45" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne02:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@%systemroot%\system32\wsdapi.dll,-200 = "Trusted Devices" CertUtil.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@%SystemRoot%\System32\SessEnv.dll,-101 = "Remote Desktop" CertUtil.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne01:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne03:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne02:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Nitro PDF Creator = "winspool,Ne00:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne01:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Nitro PDF Creator = "winspool,Ne00:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne02:,15,45" spoolsv.exe -
Modifies registry class 64 IoCs
Processes:
msiexec.exenitro_pro13.exepowershell.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{303CFFAB-5F7E-4440-9703-9486A6A23B47}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\Version msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{25C03D4C-0995-4585-A11C-D114695CE112}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\DataBase\Content Type\application/ppdf msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NitroPDFProfessional.MSOfficeAddin13\CurVer msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{7078916e-a680-44c9-9437-504aac249f57} nitro_pro13.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.IE.ActiveDoc\CurVer\ = "NitroPDF.IE.ActiveDoc.13" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{303CFFAB-5F7E-4440-9703-9486A6A23B47}\TypeLib\Version = "d.0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{73BA4610-4C33-4056-9141-9C3E3DF75428}\d.0\0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\NitroPDF.exe\SupportedTypes\.ppdf msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5563B2BD-8933-4875-9D95-C517BEBCA174}\ = "INitroPDF_IE_ActiveDoc" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\NitroPDF.exe\SupportedTypes\.pdf msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3422E9DB-7B00-4552-B016-6FBF93C5A2D8}\d.0\HELPDIR\ = "C:\\Program Files (x86)\\Nitro\\Pro\\13\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.NitroPDFCtrl msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{303CFFAB-5F7E-4440-9703-9486A6A23B47}\TypeLib\Version = "d.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/xfdf\Extension = ".xfdf" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5563B2BD-8933-4875-9D95-C517BEBCA174}\TypeLib msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\MIME\Database\Content Type\application/pdf\CLSID = "{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.PPDFDoc.13 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\569C8E420F09EC443B50EFABD0099091\ProductName = "Nitro Pro" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0D2E999-B4F8-476C-A662-E18CED74FEC4}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithProgIds\NitroPDF.Document.13 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7570413-6651-467E-AF76-69BDD1265663}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{73BA4610-4C33-4056-9141-9C3E3DF75428}\d.0\0\win32\ = "C:\\Program Files (x86)\\Nitro\\Pro\\13\\npnitroie.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{73BA4610-4C33-4056-9141-9C3E3DF75428}\13.0\0\win32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{73BA4610-4C33-4056-9141-9C3E3DF75428}\13.0\HELPDIR\ = "C:\\Program Files (x86)\\Nitro\\Pro\\13\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\InprocServer32\ProgID = "NitroPDF.Document.13" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3BFAE61D-4A6D-4467-9E5E-FE5293D10F9F} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.XFDFDoc.13\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\Programmable\ msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\MiscStatus\1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\ msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7347baa5-ddad-428a-bbed-3a95b53237f7} msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\MIME\DataBase\Content Type\application/pdf msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xfdf\OpenWithProgids\NitroPDF.XFDFDoc.13 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fdf\shell\open.NitroPDF.exe.13\command\ = "\"C:\\Program Files\\Nitro\\Pro\\13\\NitroPDF.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\Control msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5563B2BD-8933-4875-9D95-C517BEBCA174}\TypeLib\ = "{73BA4610-4C33-4056-9141-9C3E3DF75428}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{D7570413-6651-467E-AF76-69BDD1265663}\Programmable msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\.ixdbeznczigoud powershell.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.xfdf\old\Content Type = "application/vnd.adobe.xfdf" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{73BA4610-4C33-4056-9141-9C3E3DF75428}\d.0\FLAGS\ = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\MiscStatus\1\ = "131473" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0D2E999-B4F8-476C-A662-E18CED74FEC4} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0D2E999-B4F8-476C-A662-E18CED74FEC4}\InprocServer32\ = "C:\\Program Files\\Nitro\\Pro\\13\\NitroPDFActiveX.ocx" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\ProgID msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\MIME\Database\Content Type\application/pdf\Extension = ".pdf" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\InstallPath = "C:\\Program Files (x86)\\Nitro\\Pro\\13\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.Document.13\shell\printto\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.IE.ActiveDoc\CLSID\ = "{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5563B2BD-8933-4875-9D95-C517BEBCA174}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fdf\OpenWithProgids\NitroPDF.FDFDoc.13 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\Content Type = "application/pdf" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.FDFDoc.13\FriendlyTypeName = "FDF Document (PDF Form data)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\TypeLib\ = "{73BA4610-4C33-4056-9141-9C3E3DF75428}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.IE.ActiveDoc.13\DocObject\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CEF53101-E1DB-4950-9C03-53FAB48081E2}\InprocServer32\ = "C:\\Program Files\\Nitro\\Pro\\13\\NitroPDFThumbnailProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\569C8E420F09EC443B50EFABD0099091\PrinterDriver = "NitroApp" msiexec.exe -
Processes:
Nitro_Slider.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Nitro_Slider.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Nitro_Slider.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Nitro_Slider.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exerundll32.exerundll32.exemsiexec.exeNitroPDF.exeNitro_Slider.exeNitro_Slider.exeNitro_Slider.exeNitro_Slider.exeNitro_Slider.exepid process 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4616 rundll32.exe 4740 rundll32.exe 2492 msiexec.exe 2492 msiexec.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5612 Nitro_Slider.exe 5612 Nitro_Slider.exe 5356 NitroPDF.exe 5624 Nitro_Slider.exe 5356 NitroPDF.exe 5624 Nitro_Slider.exe 5356 NitroPDF.exe 5356 NitroPDF.exe 5968 Nitro_Slider.exe 5968 Nitro_Slider.exe 2412 Nitro_Slider.exe 2412 Nitro_Slider.exe 5988 Nitro_Slider.exe 5988 Nitro_Slider.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1796 msiexec.exe Token: SeIncreaseQuotaPrivilege 1796 msiexec.exe Token: SeSecurityPrivilege 2492 msiexec.exe Token: SeCreateTokenPrivilege 1796 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1796 msiexec.exe Token: SeLockMemoryPrivilege 1796 msiexec.exe Token: SeIncreaseQuotaPrivilege 1796 msiexec.exe Token: SeMachineAccountPrivilege 1796 msiexec.exe Token: SeTcbPrivilege 1796 msiexec.exe Token: SeSecurityPrivilege 1796 msiexec.exe Token: SeTakeOwnershipPrivilege 1796 msiexec.exe Token: SeLoadDriverPrivilege 1796 msiexec.exe Token: SeSystemProfilePrivilege 1796 msiexec.exe Token: SeSystemtimePrivilege 1796 msiexec.exe Token: SeProfSingleProcessPrivilege 1796 msiexec.exe Token: SeIncBasePriorityPrivilege 1796 msiexec.exe Token: SeCreatePagefilePrivilege 1796 msiexec.exe Token: SeCreatePermanentPrivilege 1796 msiexec.exe Token: SeBackupPrivilege 1796 msiexec.exe Token: SeRestorePrivilege 1796 msiexec.exe Token: SeShutdownPrivilege 1796 msiexec.exe Token: SeDebugPrivilege 1796 msiexec.exe Token: SeAuditPrivilege 1796 msiexec.exe Token: SeSystemEnvironmentPrivilege 1796 msiexec.exe Token: SeChangeNotifyPrivilege 1796 msiexec.exe Token: SeRemoteShutdownPrivilege 1796 msiexec.exe Token: SeUndockPrivilege 1796 msiexec.exe Token: SeSyncAgentPrivilege 1796 msiexec.exe Token: SeEnableDelegationPrivilege 1796 msiexec.exe Token: SeManageVolumePrivilege 1796 msiexec.exe Token: SeImpersonatePrivilege 1796 msiexec.exe Token: SeCreateGlobalPrivilege 1796 msiexec.exe Token: SeCreateTokenPrivilege 1796 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1796 msiexec.exe Token: SeLockMemoryPrivilege 1796 msiexec.exe Token: SeIncreaseQuotaPrivilege 1796 msiexec.exe Token: SeMachineAccountPrivilege 1796 msiexec.exe Token: SeTcbPrivilege 1796 msiexec.exe Token: SeSecurityPrivilege 1796 msiexec.exe Token: SeTakeOwnershipPrivilege 1796 msiexec.exe Token: SeLoadDriverPrivilege 1796 msiexec.exe Token: SeSystemProfilePrivilege 1796 msiexec.exe Token: SeSystemtimePrivilege 1796 msiexec.exe Token: SeProfSingleProcessPrivilege 1796 msiexec.exe Token: SeIncBasePriorityPrivilege 1796 msiexec.exe Token: SeCreatePagefilePrivilege 1796 msiexec.exe Token: SeCreatePermanentPrivilege 1796 msiexec.exe Token: SeBackupPrivilege 1796 msiexec.exe Token: SeRestorePrivilege 1796 msiexec.exe Token: SeShutdownPrivilege 1796 msiexec.exe Token: SeDebugPrivilege 1796 msiexec.exe Token: SeAuditPrivilege 1796 msiexec.exe Token: SeSystemEnvironmentPrivilege 1796 msiexec.exe Token: SeChangeNotifyPrivilege 1796 msiexec.exe Token: SeRemoteShutdownPrivilege 1796 msiexec.exe Token: SeUndockPrivilege 1796 msiexec.exe Token: SeSyncAgentPrivilege 1796 msiexec.exe Token: SeEnableDelegationPrivilege 1796 msiexec.exe Token: SeManageVolumePrivilege 1796 msiexec.exe Token: SeImpersonatePrivilege 1796 msiexec.exe Token: SeCreateGlobalPrivilege 1796 msiexec.exe Token: SeCreateTokenPrivilege 1796 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1796 msiexec.exe Token: SeLockMemoryPrivilege 1796 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exeNitroPDF.exepid process 1796 msiexec.exe 5356 NitroPDF.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
NitroPDF.exeNitro_Slider.exeNitro_Slider.exeNitro_Slider.exeNitro_Slider.exeNitro_Slider.exepid process 5356 NitroPDF.exe 5356 NitroPDF.exe 5612 Nitro_Slider.exe 5624 Nitro_Slider.exe 5968 Nitro_Slider.exe 2412 Nitro_Slider.exe 5988 Nitro_Slider.exe 5356 NitroPDF.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msiexec.exemsiexec.exeMsiExec.exeMSIA6D6.tmpMSIA6D6.tmpMsiExec.exeMsiExec.exeMsiExec.exenet.exenet.exenet.exedescription pid process target process PID 2492 wrote to memory of 3520 2492 msiexec.exe MsiExec.exe PID 2492 wrote to memory of 3520 2492 msiexec.exe MsiExec.exe PID 2492 wrote to memory of 3520 2492 msiexec.exe MsiExec.exe PID 1796 wrote to memory of 2112 1796 msiexec.exe MSIA6D6.tmp PID 1796 wrote to memory of 2112 1796 msiexec.exe MSIA6D6.tmp PID 1796 wrote to memory of 2112 1796 msiexec.exe MSIA6D6.tmp PID 3520 wrote to memory of 4088 3520 MsiExec.exe powershell.exe PID 3520 wrote to memory of 4088 3520 MsiExec.exe powershell.exe PID 3520 wrote to memory of 4088 3520 MsiExec.exe powershell.exe PID 2112 wrote to memory of 3468 2112 MSIA6D6.tmp MSIA6D6.tmp PID 2112 wrote to memory of 3468 2112 MSIA6D6.tmp MSIA6D6.tmp PID 2112 wrote to memory of 3468 2112 MSIA6D6.tmp MSIA6D6.tmp PID 3468 wrote to memory of 1192 3468 MSIA6D6.tmp nitro_pro13.exe PID 3468 wrote to memory of 1192 3468 MSIA6D6.tmp nitro_pro13.exe PID 3468 wrote to memory of 1192 3468 MSIA6D6.tmp nitro_pro13.exe PID 2492 wrote to memory of 4264 2492 msiexec.exe MsiExec.exe PID 2492 wrote to memory of 4264 2492 msiexec.exe MsiExec.exe PID 4264 wrote to memory of 4324 4264 MsiExec.exe rundll32.exe PID 4264 wrote to memory of 4324 4264 MsiExec.exe rundll32.exe PID 4264 wrote to memory of 4460 4264 MsiExec.exe rundll32.exe PID 4264 wrote to memory of 4460 4264 MsiExec.exe rundll32.exe PID 4264 wrote to memory of 4616 4264 MsiExec.exe rundll32.exe PID 4264 wrote to memory of 4616 4264 MsiExec.exe rundll32.exe PID 4264 wrote to memory of 4740 4264 MsiExec.exe rundll32.exe PID 4264 wrote to memory of 4740 4264 MsiExec.exe rundll32.exe PID 4264 wrote to memory of 4880 4264 MsiExec.exe rundll32.exe PID 4264 wrote to memory of 4880 4264 MsiExec.exe rundll32.exe PID 2492 wrote to memory of 1832 2492 msiexec.exe MsiExec.exe PID 2492 wrote to memory of 1832 2492 msiexec.exe MsiExec.exe PID 2492 wrote to memory of 1832 2492 msiexec.exe MsiExec.exe PID 1832 wrote to memory of 4392 1832 MsiExec.exe reg.exe PID 1832 wrote to memory of 4392 1832 MsiExec.exe reg.exe PID 1832 wrote to memory of 4392 1832 MsiExec.exe reg.exe PID 1832 wrote to memory of 4336 1832 MsiExec.exe reg.exe PID 1832 wrote to memory of 4336 1832 MsiExec.exe reg.exe PID 1832 wrote to memory of 4336 1832 MsiExec.exe reg.exe PID 1832 wrote to memory of 4504 1832 MsiExec.exe reg.exe PID 1832 wrote to memory of 4504 1832 MsiExec.exe reg.exe PID 1832 wrote to memory of 4504 1832 MsiExec.exe reg.exe PID 2492 wrote to memory of 4560 2492 msiexec.exe MsiExec.exe PID 2492 wrote to memory of 4560 2492 msiexec.exe MsiExec.exe PID 4560 wrote to memory of 4440 4560 MsiExec.exe rundll32.exe PID 4560 wrote to memory of 4440 4560 MsiExec.exe rundll32.exe PID 2492 wrote to memory of 3452 2492 msiexec.exe AddinSetupTool.exe PID 2492 wrote to memory of 3452 2492 msiexec.exe AddinSetupTool.exe PID 2492 wrote to memory of 4808 2492 msiexec.exe AddinSetupTool.exe PID 2492 wrote to memory of 4808 2492 msiexec.exe AddinSetupTool.exe PID 2492 wrote to memory of 4832 2492 msiexec.exe AddinSetupTool.exe PID 2492 wrote to memory of 4832 2492 msiexec.exe AddinSetupTool.exe PID 2492 wrote to memory of 4856 2492 msiexec.exe AddinSetupTool.exe PID 2492 wrote to memory of 4856 2492 msiexec.exe AddinSetupTool.exe PID 4560 wrote to memory of 6020 4560 MsiExec.exe net.exe PID 4560 wrote to memory of 6020 4560 MsiExec.exe net.exe PID 6020 wrote to memory of 4416 6020 net.exe net1.exe PID 6020 wrote to memory of 4416 6020 net.exe net1.exe PID 4560 wrote to memory of 4392 4560 MsiExec.exe net.exe PID 4560 wrote to memory of 4392 4560 MsiExec.exe net.exe PID 4392 wrote to memory of 4444 4392 net.exe net1.exe PID 4392 wrote to memory of 4444 4392 net.exe net1.exe PID 4560 wrote to memory of 4228 4560 MsiExec.exe net.exe PID 4560 wrote to memory of 4228 4560 MsiExec.exe net.exe PID 4228 wrote to memory of 4652 4228 net.exe net1.exe PID 4228 wrote to memory of 4652 4228 net.exe net1.exe PID 4560 wrote to memory of 4648 4560 MsiExec.exe net.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bc7986f0c9f431b839a13a9a0dfa2711f86e9e9afbed9b9b456066602881ba71.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MSIA6D6.tmp"C:\Users\Admin\AppData\Local\Temp\MSIA6D6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{0E418D21-DB90-4D72-AB10-EEAFCC533C0C}\.cr\MSIA6D6.tmp"C:\Windows\Temp\{0E418D21-DB90-4D72-AB10-EEAFCC533C0C}\.cr\MSIA6D6.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\MSIA6D6.tmp" -burn.filehandle.attached=540 -burn.filehandle.self=5523⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.be\nitro_pro13.exe"C:\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.be\nitro_pro13.exe" -q -burn.elevated BurnPipe.{B89015BE-F957-4593-B716-6427859AC293} {B1988592-3D38-4E76-A53D-4F97D1A66A56} 34684⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
C:\Program Files\Nitro\Pro\13\NitroPDF.exe"C:\Program Files\Nitro\Pro\13\NitroPDF.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\mountvol.exeC:\Windows\System32\mountvol.exe C: /L5⤵
-
C:\Program Files\Nitro\Pro\13\nitro_module_loader.exe"C:\Program Files\Nitro\Pro\13\nitro_module_loader.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Nitro\Pro\13\Nitro_Slider.exe"C:\Program Files\Nitro\Pro\13\Nitro_Slider.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2736,7065136462039864169,13490650459049932050,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=utility --no-sandbox --locales-dir-path="C:\Program Files\Nitro\Pro\13\cef\resources\locales" --log-file="C:\Program Files\Nitro\Pro\13\debug.log" --log-severity=disable --resources-dir-path="C:\Program Files\Nitro\Pro\13\cef\resources" --lang=en-US --log-file="C:\Program Files\Nitro\Pro\13\debug.log" --mojo-platform-channel-handle=2740 /prefetch:85⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Nitro\Pro\13\Nitro_Slider.exe"C:\Program Files\Nitro\Pro\13\Nitro_Slider.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2736,7065136462039864169,13490650459049932050,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Program Files\Nitro\Pro\13\cef\resources\locales" --log-file="C:\Program Files\Nitro\Pro\13\debug.log" --log-severity=disable --resources-dir-path="C:\Program Files\Nitro\Pro\13\cef\resources" --lang=en-US --log-file="C:\Program Files\Nitro\Pro\13\debug.log" --mojo-platform-channel-handle=2764 /prefetch:85⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Nitro\Pro\13\Nitro_Slider.exe"C:\Program Files\Nitro\Pro\13\Nitro_Slider.exe" --type=renderer --no-sandbox --log-file="C:\Program Files\Nitro\Pro\13\debug.log" --field-trial-handle=2736,7065136462039864169,13490650459049932050,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --locales-dir-path="C:\Program Files\Nitro\Pro\13\cef\resources\locales" --log-file="C:\Program Files\Nitro\Pro\13\debug.log" --log-severity=disable --resources-dir-path="C:\Program Files\Nitro\Pro\13\cef\resources" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:15⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Nitro\Pro\13\Nitro_Slider.exe"C:\Program Files\Nitro\Pro\13\Nitro_Slider.exe" --type=renderer --no-sandbox --log-file="C:\Program Files\Nitro\Pro\13\debug.log" --field-trial-handle=2736,7065136462039864169,13490650459049932050,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --locales-dir-path="C:\Program Files\Nitro\Pro\13\cef\resources\locales" --log-file="C:\Program Files\Nitro\Pro\13\debug.log" --log-severity=disable --resources-dir-path="C:\Program Files\Nitro\Pro\13\cef\resources" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=2 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:15⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Nitro\Pro\13\Nitro_Slider.exe"C:\Program Files\Nitro\Pro\13\Nitro_Slider.exe" --type=renderer --no-sandbox --log-file="C:\Program Files\Nitro\Pro\13\debug.log" --field-trial-handle=2736,7065136462039864169,13490650459049932050,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --locales-dir-path="C:\Program Files\Nitro\Pro\13\cef\resources\locales" --log-file="C:\Program Files\Nitro\Pro\13\debug.log" --log-severity=disable --resources-dir-path="C:\Program Files\Nitro\Pro\13\cef\resources" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:15⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6BB960A55B44236F6DAA1E083379EA4B C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssA784.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiA742.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrA743.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrA744.txt" -propSep " :<->: " -testPrefix "_testValue."3⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding C7E06F7187B3F9A1EBA184EDC5F8C1062⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI7F72.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_229562 2 NitroCA!NitroCA.CustomActions.CheckUniversalCRTInstalled3⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8649.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_231078 7 NitroCA!NitroCA.CustomActions.GetOfficeBinaryType3⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8C16.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_232500 14 NitroCA!NitroCA.CustomActions.ClosePrompt3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8FC1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_233406 21 NitroCA!NitroCA.CustomActions.ClosePrompt_check3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9502.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_234750 28 NitroCA!NitroCA.CustomActions.ModifyMsiSourceList3⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 85CF78DAE17FCA7E91519F92082871B6 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\reg.exe"reg.exe" copy HKLM\SOFTWARE\Classes\.fdf HKLM\SOFTWARE\Classes\NitroPDF.fdf\old /f3⤵
-
C:\Windows\syswow64\reg.exe"reg.exe" copy HKLM\SOFTWARE\Classes\.pdf HKLM\SOFTWARE\Classes\NitroPDF.pdf\old /f3⤵
-
C:\Windows\syswow64\reg.exe"reg.exe" copy HKLM\SOFTWARE\Classes\.xfdf HKLM\SOFTWARE\Classes\NitroPDF.xfdf\old /f3⤵
- Modifies registry class
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding AB6FF95F9AACD85341B9AD2B896E8EC9 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIF0B4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_258390 45 NitroCA!NitroCA.CustomActions.MoveShellExtensionToCommonFiles3⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop LPDSVC3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop LPDSVC4⤵
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop spooler3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop spooler4⤵
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" start spooler3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start spooler4⤵
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" start LPDSVC3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start LPDSVC4⤵
-
C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe"C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe" /InstallExcelAddin 12⤵
- Executes dropped EXE
-
C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe"C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe" /InstallOutlookAddin 12⤵
- Executes dropped EXE
-
C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe"C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe" /InstallPowerPointAddin 12⤵
- Executes dropped EXE
-
C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe"C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe" /InstallWordAddin 12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\CertUtil.exeC:\Windows\SysWOW64\CertUtil –addstore –f "ca" "C:\Program Files\Nitro\Pro\13\notarius-certificate-authority.cer"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\CertUtil.exeC:\Windows\SysWOW64\CertUtil –addstore –f "ca" "C:\Program Files\Nitro\Pro\13\notarius-root-certificate-authority.cer"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.logMD5
cd6258539a68a12cfd67aa32b47b9524
SHA14694142a8a340a1c8f704ddeca923c838b8fb57f
SHA256da7f78245a20604ec25221bc9a2e74909854ee550bdfbe2458b48aaf764ebe98
SHA5128c0ede0e8d16fa647eb181979fd44cf384407a40fcc6dc87151b83f8fe1df181ab2d8c4b365b5b771388e83104e519c4df2a3cf411a3a2f8a3a2dfc7c46ae524
-
C:\Users\Admin\AppData\Local\Temp\MSIA3A8.tmpMD5
07ce413b1af6342187514871dc112c74
SHA18008f8bfeae99918b6323a3d1270dea63b3a8394
SHA2560ba7e90fe2a0005e1e0dad53e2678916650c3b95ff9b666b802d128276c8ec46
SHA51227df52bfcbc2d0ce3756a2526e632b5610d7047259b31aeeff12652de3e046bcd239e39c222a323654f475f1f913679b4fdd858303e0e105f7a300b6f6ed0fe5
-
C:\Users\Admin\AppData\Local\Temp\MSIA6D6.tmpMD5
044a5d8e2f1356de889aedb11fdcc679
SHA14e8416eb12d209509d49998ebe714612709eb4d6
SHA256e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7
SHA5123cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9
-
C:\Users\Admin\AppData\Local\Temp\MSIA6D6.tmpMD5
044a5d8e2f1356de889aedb11fdcc679
SHA14e8416eb12d209509d49998ebe714612709eb4d6
SHA256e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7
SHA5123cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9
-
C:\Users\Admin\AppData\Local\Temp\MSIA6E6.tmpMD5
c26c68e4a79fd2629714b17514411c40
SHA100138d8edea0918c4476da303415be399cf704c6
SHA25655434961c0b4bed88ae6bfe6e0e61a3a3dcc392858f0e53c6c14c272200203ed
SHA5126fc8028e6e52b6c9e74ac3ea6d19ed750047d46b7e4021d46e581b58367ffc11fb13b696dfa30a15305e94098a7fd12051ee37d32df91ef2ae1e2d9c642b02ea
-
C:\Users\Admin\AppData\Local\Temp\Nitro_Pro_20210922071546_000_NitroInstallationPackageId_x64_en.logMD5
88a5689ed29450e68112c87f6ae88233
SHA14fff49f6e6dd547f3dd163e10d19404235b6fe63
SHA2560f0e4b3f2e072e445bb5581ee397d16d8582bb3e50069fd2ee5835f2129870b3
SHA512eafcedcad3ad9148b9e004ea870ea91e8b73bb73219f54f81c1a9cea955a590cd04b6a4830c304082669bbf25d7a8a9f967571e87f642d027887e58e118ce8ce
-
C:\Users\Admin\AppData\Local\Temp\pssA784.ps1MD5
0c95bc11cfca37f84a19de0529377e13
SHA141f409dbbab04ef35c4f6489af6f85fceb9c501a
SHA25688748aae11029228d84aef0855f4bc084dfd70450db1f7029746d8bc85182f93
SHA5128a52f3c40440e3129a367609ee4b6e9e98aa62edec48592be03bad1aadcd389e2e58e095f4ea3d6f9cb458aa7101fcb5afdff66658885bfa0634c74c086db568
-
C:\Users\Admin\AppData\Local\Temp\scrA743.ps1MD5
6a251db4fad4a2248b0cc2e74461b07c
SHA1190aab8b9badd7a4fc75a1b925f0e1135af44230
SHA256e34af1b6edf33b155ca9854d084577c30e1bc9d96eee10014277a0e55a47beef
SHA512b37ba8374dc9acf92520142e0c71f48c1fc94199ef85749d08d0b9e0367f78719dc1ce3786b05a2068bc79cf76df3283a8e38e1f06f6185516adfd6e43796b13
-
C:\Windows\Installer\MSI7F72.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
C:\Windows\Installer\MSI8649.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
C:\Windows\Installer\MSI8C16.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
C:\Windows\Installer\MSI8FC1.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
C:\Windows\Installer\MSI9502.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
C:\Windows\Installer\MSIC3A6.tmpMD5
d773d9bd091e712df7560f576da53de8
SHA1165cfbdce1811883360112441f7237b287cf0691
SHA256e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
SHA51215a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
-
C:\Windows\Installer\MSIC443.tmpMD5
d773d9bd091e712df7560f576da53de8
SHA1165cfbdce1811883360112441f7237b287cf0691
SHA256e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
SHA51215a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
-
C:\Windows\Installer\MSIC4B2.tmpMD5
d773d9bd091e712df7560f576da53de8
SHA1165cfbdce1811883360112441f7237b287cf0691
SHA256e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
SHA51215a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
-
C:\Windows\Installer\MSIF0B4.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
C:\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.be\nitro_pro13.exeMD5
044a5d8e2f1356de889aedb11fdcc679
SHA14e8416eb12d209509d49998ebe714612709eb4d6
SHA256e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7
SHA5123cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9
-
C:\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.be\nitro_pro13.exeMD5
044a5d8e2f1356de889aedb11fdcc679
SHA14e8416eb12d209509d49998ebe714612709eb4d6
SHA256e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7
SHA5123cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9
-
C:\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\NitroInstallationPackageId_x64_enMD5
ebb262917d5d14ef901d9de3c29e7527
SHA15f7bfb2d88879aa626ef16c56602d774eaddfff5
SHA25645302c7f44a4f94854bfcf38790e5bbfe19ce549b1cea265243a7a67d6f39ddb
SHA512420feb3dc10b30cecb85991a247bf4ff8d8dbca8a84254540d0ed9a760fa1b22846278558efa08bade32cfc9997b53c227a5b1b37834765ca5e1bbdb8310bb04
-
C:\Windows\Temp\{0E418D21-DB90-4D72-AB10-EEAFCC533C0C}\.cr\MSIA6D6.tmpMD5
044a5d8e2f1356de889aedb11fdcc679
SHA14e8416eb12d209509d49998ebe714612709eb4d6
SHA256e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7
SHA5123cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9
-
C:\Windows\Temp\{0E418D21-DB90-4D72-AB10-EEAFCC533C0C}\.cr\MSIA6D6.tmpMD5
044a5d8e2f1356de889aedb11fdcc679
SHA14e8416eb12d209509d49998ebe714612709eb4d6
SHA256e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7
SHA5123cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9
-
\Users\Admin\AppData\Local\Temp\MSIA3A8.tmpMD5
07ce413b1af6342187514871dc112c74
SHA18008f8bfeae99918b6323a3d1270dea63b3a8394
SHA2560ba7e90fe2a0005e1e0dad53e2678916650c3b95ff9b666b802d128276c8ec46
SHA51227df52bfcbc2d0ce3756a2526e632b5610d7047259b31aeeff12652de3e046bcd239e39c222a323654f475f1f913679b4fdd858303e0e105f7a300b6f6ed0fe5
-
\Users\Admin\AppData\Local\Temp\MSIA6E6.tmpMD5
c26c68e4a79fd2629714b17514411c40
SHA100138d8edea0918c4476da303415be399cf704c6
SHA25655434961c0b4bed88ae6bfe6e0e61a3a3dcc392858f0e53c6c14c272200203ed
SHA5126fc8028e6e52b6c9e74ac3ea6d19ed750047d46b7e4021d46e581b58367ffc11fb13b696dfa30a15305e94098a7fd12051ee37d32df91ef2ae1e2d9c642b02ea
-
\Windows\Installer\MSI7F72.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSI7F72.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSI7F72.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Installer\MSI7F72.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Installer\MSI8649.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSI8649.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSI8649.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Installer\MSI8649.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Installer\MSI8C16.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSI8C16.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSI8C16.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Installer\MSI8C16.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Installer\MSI8FC1.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSI8FC1.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSI8FC1.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Installer\MSI8FC1.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Installer\MSI9502.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSI9502.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSI9502.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Installer\MSI9502.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Installer\MSIC3A6.tmpMD5
d773d9bd091e712df7560f576da53de8
SHA1165cfbdce1811883360112441f7237b287cf0691
SHA256e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
SHA51215a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
-
\Windows\Installer\MSIC443.tmpMD5
d773d9bd091e712df7560f576da53de8
SHA1165cfbdce1811883360112441f7237b287cf0691
SHA256e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
SHA51215a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
-
\Windows\Installer\MSIC4B2.tmpMD5
d773d9bd091e712df7560f576da53de8
SHA1165cfbdce1811883360112441f7237b287cf0691
SHA256e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
SHA51215a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
-
\Windows\Installer\MSIF0B4.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSIF0B4.tmpMD5
c2894c0391639b486ddb8f8c9dc3873e
SHA1fdbef2279fe4fb323749d30998cd239b51e4a2a2
SHA2560590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c
SHA512c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db
-
\Windows\Installer\MSIF0B4.tmp-\NitroCA.dllMD5
81cfdfc9cde37b8a847d8bc5326dc9d9
SHA1dabcd11ca3dc797e39c2b1db28adba365b99c0d2
SHA2562cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099
SHA512983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\BootstrapperCore.dllMD5
c4f7146ddc56763ccdb1cb3c09478708
SHA1bca088ab33cfb69adeae11a272e9c8a83f39a8c9
SHA256886cb2a994461f091752fc7b21e3143c212efd8841c757909e74ac32761880da
SHA512df2ca029e95f80fc5870e541db8b1d5a03266307bb5f7680ad630868a9a3c584b3a702fbec09c26fef7287c99f5d9d1f59cd59b74dcf740c9a8e7508e07d18b5
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\BootstrapperCore.dllMD5
c4f7146ddc56763ccdb1cb3c09478708
SHA1bca088ab33cfb69adeae11a272e9c8a83f39a8c9
SHA256886cb2a994461f091752fc7b21e3143c212efd8841c757909e74ac32761880da
SHA512df2ca029e95f80fc5870e541db8b1d5a03266307bb5f7680ad630868a9a3c584b3a702fbec09c26fef7287c99f5d9d1f59cd59b74dcf740c9a8e7508e07d18b5
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\GalaSoft.MvvmLight.WPF4.dllMD5
1e40431b501d55fe8ba59cabb3ce5c17
SHA1b8aef0f6829345d844960c3eaf96c41f76142f6c
SHA25692ef1bdf8c8140e34e5ae1eb8d9b7afba9921e5ada6317c6cdd0da2712f7e000
SHA5122ab5d887e717add46959a7193cbf1dbf73f2792130025e5712ae76058ce5923be8afdf3ed8d11ea6859b13126f88bb9e1099741c799ca90e3f7713955dd9638d
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\GalaSoft.MvvmLight.WPF4.dllMD5
1e40431b501d55fe8ba59cabb3ce5c17
SHA1b8aef0f6829345d844960c3eaf96c41f76142f6c
SHA25692ef1bdf8c8140e34e5ae1eb8d9b7afba9921e5ada6317c6cdd0da2712f7e000
SHA5122ab5d887e717add46959a7193cbf1dbf73f2792130025e5712ae76058ce5923be8afdf3ed8d11ea6859b13126f88bb9e1099741c799ca90e3f7713955dd9638d
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\NitroBA.dllMD5
6726d4b46346ef40dd3ea4376ae7d259
SHA1ffdaa10e1e3d1c7d7411f799a0889ce66014bc29
SHA2563e96b189fa7a160396742cdc93564dfce3ad3993a3e21118cf9114c8cb45e963
SHA512cd2a68f1ce4bc161b26466fa8f472803d7a10b339dff6c599e64863236ef59d9a0ed1b2f4168f8557b35d81d92edccdfd9d313096a88415838b6351af1ae249a
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\NitroBA.dllMD5
6726d4b46346ef40dd3ea4376ae7d259
SHA1ffdaa10e1e3d1c7d7411f799a0889ce66014bc29
SHA2563e96b189fa7a160396742cdc93564dfce3ad3993a3e21118cf9114c8cb45e963
SHA512cd2a68f1ce4bc161b26466fa8f472803d7a10b339dff6c599e64863236ef59d9a0ed1b2f4168f8557b35d81d92edccdfd9d313096a88415838b6351af1ae249a
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\PageTransitions.dllMD5
ad69d408b05b98180b25d23b0a790f01
SHA15fdbdae2979685db500d2b031e2a430ce16e592e
SHA25614090b63240c63bfe118a24b6f0112095f331ac46819f6f4ab62d8e9bbe4c646
SHA51212323f7190fd785277965996cffe141a5b2d5b11679961db6aa6744b8157df7f9bd7b5b935d3ca2a7e0be7ca5f0f60fd8885b94ae7cd70aea1572e90a2599eac
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\PageTransitions.dllMD5
ad69d408b05b98180b25d23b0a790f01
SHA15fdbdae2979685db500d2b031e2a430ce16e592e
SHA25614090b63240c63bfe118a24b6f0112095f331ac46819f6f4ab62d8e9bbe4c646
SHA51212323f7190fd785277965996cffe141a5b2d5b11679961db6aa6744b8157df7f9bd7b5b935d3ca2a7e0be7ca5f0f60fd8885b94ae7cd70aea1572e90a2599eac
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\mbahost.dllMD5
d7c697ceb6f40ce91dabfcbe8df08e22
SHA149cd0213a1655dcdb493668083ab2d7f55135381
SHA256b925d9d3e1e2c49bf05a1b0713e2750ee6e0c43c7adc9d3c3a1b9fb8c557c3df
SHA51222ca87979ca68f10b5fda64c27913d0f2a12c359b04e4a6caa3645303fbd47cd598c805fd9a43c8f3e0934e9d2db85f7a4e1eff26cb33d233efc05ee2613cfc1
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\metrics.dllMD5
aed8280e90f672f631d2aedebd6452bf
SHA1390b96ce6b4b1a47c12d8932c5e8da6e51fdd38a
SHA256a82332e0a9c9cee34f9a46d5e984901fa57a011f54e7b37b9716acf834746ced
SHA51223a223fc4da00038ff6b584f0a2a4186f49eaf4d8cb28dfdfa795048a4a977aa39848cb83bbfd8f0555412fd04c802b122267266e33a5ddc49d3e0ff1e2eca4f
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\metrics.dllMD5
aed8280e90f672f631d2aedebd6452bf
SHA1390b96ce6b4b1a47c12d8932c5e8da6e51fdd38a
SHA256a82332e0a9c9cee34f9a46d5e984901fa57a011f54e7b37b9716acf834746ced
SHA51223a223fc4da00038ff6b584f0a2a4186f49eaf4d8cb28dfdfa795048a4a977aa39848cb83bbfd8f0555412fd04c802b122267266e33a5ddc49d3e0ff1e2eca4f
-
\Windows\Temp\{083A93A4-C82F-4FC2-A81E-61350A35B2FB}\.ba\metrics.dllMD5
aed8280e90f672f631d2aedebd6452bf
SHA1390b96ce6b4b1a47c12d8932c5e8da6e51fdd38a
SHA256a82332e0a9c9cee34f9a46d5e984901fa57a011f54e7b37b9716acf834746ced
SHA51223a223fc4da00038ff6b584f0a2a4186f49eaf4d8cb28dfdfa795048a4a977aa39848cb83bbfd8f0555412fd04c802b122267266e33a5ddc49d3e0ff1e2eca4f
-
memory/1192-187-0x0000000000000000-mapping.dmp
-
memory/1832-329-0x0000000000000000-mapping.dmp
-
memory/2112-126-0x0000000000000000-mapping.dmp
-
memory/2412-392-0x0000000000000000-mapping.dmp
-
memory/3452-365-0x0000000000000000-mapping.dmp
-
memory/3468-169-0x0000000009470000-0x0000000009471000-memory.dmpFilesize
4KB
-
memory/3468-170-0x0000000006118000-0x0000000006119000-memory.dmpFilesize
4KB
-
memory/3468-130-0x0000000000000000-mapping.dmp
-
memory/3468-140-0x0000000006010000-0x0000000006011000-memory.dmpFilesize
4KB
-
memory/3468-143-0x0000000006110000-0x0000000006111000-memory.dmpFilesize
4KB
-
memory/3468-144-0x0000000006111000-0x0000000006112000-memory.dmpFilesize
4KB
-
memory/3468-145-0x0000000006113000-0x0000000006114000-memory.dmpFilesize
4KB
-
memory/3468-149-0x0000000006490000-0x0000000006491000-memory.dmpFilesize
4KB
-
memory/3468-153-0x0000000006470000-0x0000000006471000-memory.dmpFilesize
4KB
-
memory/3468-161-0x00000000069A0000-0x00000000069A1000-memory.dmpFilesize
4KB
-
memory/3468-164-0x0000000006114000-0x0000000006115000-memory.dmpFilesize
4KB
-
memory/3468-165-0x0000000006117000-0x0000000006118000-memory.dmpFilesize
4KB
-
memory/3468-188-0x0000000006119000-0x000000000611A000-memory.dmpFilesize
4KB
-
memory/3468-167-0x0000000006B40000-0x0000000006B41000-memory.dmpFilesize
4KB
-
memory/3520-119-0x0000000000000000-mapping.dmp
-
memory/4088-163-0x0000000007EC0000-0x0000000007EC1000-memory.dmpFilesize
4KB
-
memory/4088-129-0x0000000000000000-mapping.dmp
-
memory/4088-142-0x0000000007162000-0x0000000007163000-memory.dmpFilesize
4KB
-
memory/4088-154-0x00000000076E0000-0x00000000076E1000-memory.dmpFilesize
4KB
-
memory/4088-141-0x0000000007160000-0x0000000007161000-memory.dmpFilesize
4KB
-
memory/4088-155-0x0000000007DD0000-0x0000000007DD1000-memory.dmpFilesize
4KB
-
memory/4088-178-0x0000000009530000-0x0000000009531000-memory.dmpFilesize
4KB
-
memory/4088-156-0x0000000008020000-0x0000000008021000-memory.dmpFilesize
4KB
-
memory/4088-177-0x00000000094C0000-0x00000000094C1000-memory.dmpFilesize
4KB
-
memory/4088-176-0x0000000009810000-0x0000000009811000-memory.dmpFilesize
4KB
-
memory/4088-179-0x0000000009DB0000-0x0000000009DB1000-memory.dmpFilesize
4KB
-
memory/4088-184-0x000000000A930000-0x000000000A931000-memory.dmpFilesize
4KB
-
memory/4088-168-0x0000000008810000-0x0000000008811000-memory.dmpFilesize
4KB
-
memory/4088-137-0x00000000077A0000-0x00000000077A1000-memory.dmpFilesize
4KB
-
memory/4088-186-0x0000000007163000-0x0000000007164000-memory.dmpFilesize
4KB
-
memory/4088-166-0x00000000084F0000-0x00000000084F1000-memory.dmpFilesize
4KB
-
memory/4088-135-0x0000000007010000-0x0000000007011000-memory.dmpFilesize
4KB
-
memory/4088-157-0x0000000008090000-0x0000000008091000-memory.dmpFilesize
4KB
-
memory/4088-191-0x0000000009B10000-0x0000000009B1A000-memory.dmpFilesize
40KB
-
memory/4228-373-0x0000000000000000-mapping.dmp
-
memory/4264-201-0x0000000000000000-mapping.dmp
-
memory/4324-206-0x0000000000000000-mapping.dmp
-
memory/4324-219-0x00000207E7C69000-0x00000207E7C6A000-memory.dmpFilesize
4KB
-
memory/4324-216-0x00000207E7C64000-0x00000207E7C66000-memory.dmpFilesize
8KB
-
memory/4324-218-0x00000207E7C67000-0x00000207E7C69000-memory.dmpFilesize
8KB
-
memory/4324-223-0x00000207CF500000-0x00000207CF501000-memory.dmpFilesize
4KB
-
memory/4324-214-0x00000207E7C60000-0x00000207E7C62000-memory.dmpFilesize
8KB
-
memory/4324-215-0x00000207E7C62000-0x00000207E7C64000-memory.dmpFilesize
8KB
-
memory/4324-211-0x00000207CF520000-0x00000207CF521000-memory.dmpFilesize
4KB
-
memory/4336-337-0x0000000000000000-mapping.dmp
-
memory/4392-334-0x0000000000000000-mapping.dmp
-
memory/4392-371-0x0000000000000000-mapping.dmp
-
memory/4416-370-0x0000000000000000-mapping.dmp
-
memory/4440-364-0x00000226658A9000-0x00000226658AA000-memory.dmpFilesize
4KB
-
memory/4440-346-0x0000000000000000-mapping.dmp
-
memory/4440-362-0x00000226658A4000-0x00000226658A6000-memory.dmpFilesize
8KB
-
memory/4440-360-0x00000226658A0000-0x00000226658A2000-memory.dmpFilesize
8KB
-
memory/4440-363-0x00000226658A7000-0x00000226658A9000-memory.dmpFilesize
8KB
-
memory/4440-361-0x00000226658A2000-0x00000226658A4000-memory.dmpFilesize
8KB
-
memory/4444-372-0x0000000000000000-mapping.dmp
-
memory/4460-230-0x0000000000000000-mapping.dmp
-
memory/4460-247-0x0000028FBF872000-0x0000028FBF874000-memory.dmpFilesize
8KB
-
memory/4460-246-0x0000028FBF870000-0x0000028FBF872000-memory.dmpFilesize
8KB
-
memory/4460-248-0x0000028FBF874000-0x0000028FBF876000-memory.dmpFilesize
8KB
-
memory/4460-249-0x0000028FBF877000-0x0000028FBF879000-memory.dmpFilesize
8KB
-
memory/4460-250-0x0000028FBF879000-0x0000028FBF87A000-memory.dmpFilesize
4KB
-
memory/4504-340-0x0000000000000000-mapping.dmp
-
memory/4560-341-0x0000000000000000-mapping.dmp
-
memory/4616-279-0x000001FC7CF02000-0x000001FC7CF04000-memory.dmpFilesize
8KB
-
memory/4616-282-0x000001FC7CF09000-0x000001FC7CF0A000-memory.dmpFilesize
4KB
-
memory/4616-256-0x0000000000000000-mapping.dmp
-
memory/4616-280-0x000001FC7CF04000-0x000001FC7CF06000-memory.dmpFilesize
8KB
-
memory/4616-278-0x000001FC7CF00000-0x000001FC7CF02000-memory.dmpFilesize
8KB
-
memory/4616-281-0x000001FC7CF07000-0x000001FC7CF09000-memory.dmpFilesize
8KB
-
memory/4648-375-0x0000000000000000-mapping.dmp
-
memory/4652-374-0x0000000000000000-mapping.dmp
-
memory/4708-376-0x0000000000000000-mapping.dmp
-
memory/4740-305-0x0000016144854000-0x0000016144856000-memory.dmpFilesize
8KB
-
memory/4740-302-0x0000016144850000-0x0000016144852000-memory.dmpFilesize
8KB
-
memory/4740-303-0x0000016144852000-0x0000016144854000-memory.dmpFilesize
8KB
-
memory/4740-306-0x0000016144857000-0x0000016144859000-memory.dmpFilesize
8KB
-
memory/4740-307-0x0000016144859000-0x000001614485A000-memory.dmpFilesize
4KB
-
memory/4740-276-0x0000000000000000-mapping.dmp
-
memory/4772-377-0x0000000000000000-mapping.dmp
-
memory/4808-366-0x0000000000000000-mapping.dmp
-
memory/4832-367-0x0000000000000000-mapping.dmp
-
memory/4832-378-0x0000000000000000-mapping.dmp
-
memory/4856-368-0x0000000000000000-mapping.dmp
-
memory/4880-301-0x0000000000000000-mapping.dmp
-
memory/4880-328-0x000002437F559000-0x000002437F55A000-memory.dmpFilesize
4KB
-
memory/4880-327-0x000002437F557000-0x000002437F559000-memory.dmpFilesize
8KB
-
memory/4880-326-0x000002437F554000-0x000002437F556000-memory.dmpFilesize
8KB
-
memory/4880-325-0x000002437F552000-0x000002437F554000-memory.dmpFilesize
8KB
-
memory/4880-324-0x000002437F550000-0x000002437F552000-memory.dmpFilesize
8KB
-
memory/5356-380-0x00007FF7967E0000-0x00007FF7973B1000-memory.dmpFilesize
11.8MB
-
memory/5356-381-0x0000016D79DD0000-0x0000016D79DD1000-memory.dmpFilesize
4KB
-
memory/5356-387-0x0000016D7E3D0000-0x0000016D7E47F000-memory.dmpFilesize
700KB
-
memory/5356-390-0x0000016D7E810000-0x0000016D7E8E9000-memory.dmpFilesize
868KB
-
memory/5356-379-0x0000000000000000-mapping.dmp
-
memory/5388-382-0x0000000000000000-mapping.dmp
-
memory/5480-383-0x0000000000000000-mapping.dmp
-
memory/5612-385-0x0000000000000000-mapping.dmp
-
memory/5624-386-0x0000000000000000-mapping.dmp
-
memory/5968-391-0x0000000000000000-mapping.dmp
-
memory/5988-394-0x0000000000000000-mapping.dmp
-
memory/6020-369-0x0000000000000000-mapping.dmp