Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-10-2021 04:47
Static task
static1
Behavioral task
behavioral1
Sample
run_848a9.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
run_848a9.exe
Resource
win10-en-20211014
General
-
Target
run_848a9.exe
-
Size
1.7MB
-
MD5
67c86865ba800ab9f761356d4cc5c08c
-
SHA1
1f3dcc460c3fb02704e69cd8509445a92ac3600d
-
SHA256
8dbbe3e8657d87e842026b7051a7b0680d3838749773997df91f123034a7566d
-
SHA512
328c47921cfa939403736e63d0a5f5659dce3a916a44e6d0b0434ae4672bf96530a86cb19c2709a67914381fd8fc1c40b6e12209a35735743a8988a6166b50ff
Malware Config
Signatures
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Blocklisted process makes network request 62 IoCs
Processes:
MsiExec.exeflow pid process 53 1976 MsiExec.exe 54 1976 MsiExec.exe 55 1976 MsiExec.exe 56 1976 MsiExec.exe 57 1976 MsiExec.exe 58 1976 MsiExec.exe 59 1976 MsiExec.exe 60 1976 MsiExec.exe 61 1976 MsiExec.exe 62 1976 MsiExec.exe 63 1976 MsiExec.exe 64 1976 MsiExec.exe 65 1976 MsiExec.exe 66 1976 MsiExec.exe 67 1976 MsiExec.exe 68 1976 MsiExec.exe 69 1976 MsiExec.exe 70 1976 MsiExec.exe 71 1976 MsiExec.exe 72 1976 MsiExec.exe 73 1976 MsiExec.exe 74 1976 MsiExec.exe 75 1976 MsiExec.exe 76 1976 MsiExec.exe 77 1976 MsiExec.exe 78 1976 MsiExec.exe 79 1976 MsiExec.exe 80 1976 MsiExec.exe 81 1976 MsiExec.exe 82 1976 MsiExec.exe 83 1976 MsiExec.exe 84 1976 MsiExec.exe 85 1976 MsiExec.exe 86 1976 MsiExec.exe 87 1976 MsiExec.exe 88 1976 MsiExec.exe 89 1976 MsiExec.exe 90 1976 MsiExec.exe 91 1976 MsiExec.exe 92 1976 MsiExec.exe 93 1976 MsiExec.exe 94 1976 MsiExec.exe 95 1976 MsiExec.exe 96 1976 MsiExec.exe 97 1976 MsiExec.exe 98 1976 MsiExec.exe 99 1976 MsiExec.exe 100 1976 MsiExec.exe 101 1976 MsiExec.exe 102 1976 MsiExec.exe 103 1976 MsiExec.exe 104 1976 MsiExec.exe 105 1976 MsiExec.exe 106 1976 MsiExec.exe 107 1976 MsiExec.exe 108 1976 MsiExec.exe 109 1976 MsiExec.exe 110 1976 MsiExec.exe 111 1976 MsiExec.exe 112 1976 MsiExec.exe 113 1976 MsiExec.exe 114 1976 MsiExec.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
Processes:
DrvInst.exedescription ioc process File opened for modification C:\Windows\system32\DRIVERS\SETB26E.tmp DrvInst.exe File created C:\Windows\system32\DRIVERS\SETB26E.tmp DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\tap0901.sys DrvInst.exe -
Executes dropped EXE 22 IoCs
Processes:
run_848a9.tmpsetup.exesetup.tmpsetup_0.exesetup_0.tmptakemyfileapp2.exesetup_1.exesetup_1.tmphostwin.exesetup_3.exesetup_5.exeWebCompanionInstaller.exeWebCompanion.exeLavasoft.WCAssistant.WinService.exeWebCompanion.exesetup_6.exesetup_6.tmptapinstall.exetapinstall.exemask_svc.exemask_svc.exemask_svc.exepid process 1216 run_848a9.tmp 1360 setup.exe 1616 setup.tmp 1832 setup_0.exe 1680 setup_0.tmp 2020 takemyfileapp2.exe 1684 setup_1.exe 840 setup_1.tmp 1824 hostwin.exe 1072 setup_3.exe 2312 setup_5.exe 2340 WebCompanionInstaller.exe 3000 WebCompanion.exe 2192 Lavasoft.WCAssistant.WinService.exe 2296 WebCompanion.exe 2400 setup_6.exe 1468 setup_6.tmp 2716 tapinstall.exe 2780 tapinstall.exe 2856 mask_svc.exe 2444 mask_svc.exe 2504 mask_svc.exe -
Loads dropped DLL 64 IoCs
Processes:
run_848a9.exerun_848a9.tmpsetup.exesetup.tmpsetup_0.exesetup_0.tmpsetup_1.exesetup_1.tmpsetup_3.exeMsiExec.exeMsiExec.exeMsiExec.exesetup_5.exeWebCompanionInstaller.exeWebCompanion.exepid process 1612 run_848a9.exe 1216 run_848a9.tmp 1216 run_848a9.tmp 1216 run_848a9.tmp 1216 run_848a9.tmp 1216 run_848a9.tmp 1360 setup.exe 1616 setup.tmp 1616 setup.tmp 1832 setup_0.exe 1680 setup_0.tmp 1616 setup.tmp 1684 setup_1.exe 840 setup_1.tmp 840 setup_1.tmp 840 setup_1.tmp 840 setup_1.tmp 840 setup_1.tmp 1616 setup.tmp 1072 setup_3.exe 1072 setup_3.exe 1072 setup_3.exe 1836 MsiExec.exe 1836 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 1072 setup_3.exe 1976 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 816 MsiExec.exe 1976 MsiExec.exe 1400 1616 setup.tmp 2312 setup_5.exe 2340 WebCompanionInstaller.exe 2340 WebCompanionInstaller.exe 2340 WebCompanionInstaller.exe 2340 WebCompanionInstaller.exe 2340 WebCompanionInstaller.exe 2340 WebCompanionInstaller.exe 2340 WebCompanionInstaller.exe 2340 WebCompanionInstaller.exe 2340 WebCompanionInstaller.exe 3000 WebCompanion.exe 3000 WebCompanion.exe 3000 WebCompanion.exe 3000 WebCompanion.exe 3000 WebCompanion.exe 3000 WebCompanion.exe 3000 WebCompanion.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WebCompanion.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Program Files (x86)\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize " WebCompanion.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
setup_3.exemsiexec.exedescription ioc process File opened (read-only) \??\H: setup_3.exe File opened (read-only) \??\Y: setup_3.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: setup_3.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: setup_3.exe File opened (read-only) \??\N: setup_3.exe File opened (read-only) \??\P: setup_3.exe File opened (read-only) \??\S: setup_3.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: setup_3.exe File opened (read-only) \??\G: setup_3.exe File opened (read-only) \??\Z: setup_3.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: setup_3.exe File opened (read-only) \??\R: setup_3.exe File opened (read-only) \??\T: setup_3.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: setup_3.exe File opened (read-only) \??\F: setup_3.exe File opened (read-only) \??\I: setup_3.exe File opened (read-only) \??\W: setup_3.exe File opened (read-only) \??\X: setup_3.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: setup_3.exe File opened (read-only) \??\V: setup_3.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: setup_3.exe File opened (read-only) \??\O: setup_3.exe File opened (read-only) \??\Q: setup_3.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: setup_3.exe -
Drops file in System32 directory 25 IoCs
Processes:
DrvInst.exeDrvInst.exeLavasoft.WCAssistant.WinService.exetapinstall.exedescription ioc process File created C:\Windows\System32\DriverStore\Temp\{5c3c419d-e0b7-5656-3c9f-d9254564ff7d}\SET652A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c3c419d-e0b7-5656-3c9f-d9254564ff7d}\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstor.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE Lavasoft.WCAssistant.WinService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c3c419d-e0b7-5656-3c9f-d9254564ff7d}\SET652A.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt tapinstall.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat tapinstall.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_neutral_a572b7f20c402d28\oemvista.PNF DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c3c419d-e0b7-5656-3c9f-d9254564ff7d} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5c3c419d-e0b7-5656-3c9f-d9254564ff7d}\SET6529.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c3c419d-e0b7-5656-3c9f-d9254564ff7d}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2 Lavasoft.WCAssistant.WinService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_28DD3630238B51427119DAF9326B45F2 Lavasoft.WCAssistant.WinService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c3c419d-e0b7-5656-3c9f-d9254564ff7d}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c3c419d-e0b7-5656-3c9f-d9254564ff7d}\SET653B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5c3c419d-e0b7-5656-3c9f-d9254564ff7d}\SET653B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_neutral_a572b7f20c402d28\oemvista.PNF DrvInst.exe File created C:\Windows\System32\DriverStore\INFCACHE.0 DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE Lavasoft.WCAssistant.WinService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5c3c419d-e0b7-5656-3c9f-d9254564ff7d}\SET6529.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat tapinstall.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
mask_svc.exemask_svc.exemask_svc.exepid process 2856 mask_svc.exe 2444 mask_svc.exe 2504 mask_svc.exe -
Drops file in Program Files directory 64 IoCs
Processes:
WebCompanionInstaller.exesetup_6.tmpsetup_0.tmpsetup_1.tmpmsiexec.exedescription ioc process File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\MaskVPN\is-5E0JV.tmp setup_6.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-3TTL2.tmp setup_6.tmp File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Esent.Interop.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe.config WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.Loader.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll WebCompanionInstaller.exe File opened for modification C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe setup_6.tmp File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionIcon_Pro.ico WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll WebCompanionInstaller.exe File opened for modification C:\Program Files (x86)\MaskVPN\MaskVPN.exe setup_6.tmp File created C:\Program Files (x86)\MaskVPN\is-RH94O.tmp setup_6.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-LVU75.tmp setup_6.tmp File created C:\Program Files (x86)\MaskVPN\is-OP040.tmp setup_6.tmp File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\DotNetZip.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebcompaionReimageIcon.ico WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe.config WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.pdb WebCompanionInstaller.exe File opened for modification C:\Program Files (x86)\MaskVPN\ssleay32.dll setup_6.tmp File opened for modification C:\Program Files (x86)\MaskVPN\ipseccmd.exe setup_6.tmp File created C:\Program Files (x86)\MaskVPN\is-0H8AV.tmp setup_6.tmp File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\NCalc.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\MaskVPN\is-RC5TO.tmp setup_6.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-VFVJS.tmp setup_6.tmp File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.IEController.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ucrtbased.dll WebCompanionInstaller.exe File opened for modification C:\Program Files (x86)\MaskVPN\tunnle.exe setup_6.tmp File created C:\Program Files (x86)\MaskVPN\is-0OORJ.tmp setup_6.tmp File opened for modification C:\Program Files (x86)\MaskVPN\unins000.dat setup_6.tmp File opened for modification C:\Program Files (x86)\TakeMyFile\takemyfileapp2.exe setup_0.tmp File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\MaskVPN\is-US8QG.tmp setup_6.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-DF61B.tmp setup_6.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_1.tmp File created C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk msiexec.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Omni.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\liblz4.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll WebCompanionInstaller.exe File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp64\devcon.exe setup_6.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp32\devcon.exe setup_6.tmp File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url msiexec.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Ad-Aware Web Companion.exe WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Automation.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\MozCompressor.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\System.Data.SQLite.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Extension\@wcextensionff.xpi WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\MaskVPN\is-3PQGF.tmp setup_6.tmp File created C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe msiexec.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-TOU74.tmp setup_6.tmp File created C:\Program Files (x86)\MaskVPN\unins000.msg setup_6.tmp File opened for modification C:\Program Files (x86)\MaskVPN\mask_svc.exe setup_6.tmp File created C:\Program Files (x86)\TakeMyFile\is-DTPPK.tmp setup_0.tmp File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\acs17.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\log4net.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe File created C:\Program Files (x86)\Lavasoft\Web Companion\Application\ru-RU\WebCompanionInstaller.resources.dll WebCompanionInstaller.exe -
Drops file in Windows directory 48 IoCs
Processes:
msiexec.exeDrvInst.exetapinstall.exeDrvInst.exeWebCompanionInstaller.exeDrvInst.exeWebCompanion.exedescription ioc process File opened for modification C:\Windows\Installer\f76652b.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f766529.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6E93.tmp msiexec.exe File created C:\Windows\Installer\f76652b.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI789E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI78DD.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI6B36.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI77A1.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File opened for modification C:\Windows\Installer\MSI6847.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI784F.tmp msiexec.exe File opened for modification C:\Windows\INF\oem2.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI780F.tmp msiexec.exe File created C:\Windows\INF\oem2.inf DrvInst.exe File opened for modification C:\Windows\Installer\f766529.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI757A.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new WebCompanionInstaller.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\oem2.PNF DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev2 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSI6A5B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6D6A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6FCE.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSI6A0C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6F60.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI75BB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7687.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.app.log tapinstall.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new WebCompanion.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new WebCompanion.exe File opened for modification C:\Windows\Installer\MSI6C12.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6F11.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI758B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI790D.tmp msiexec.exe File created C:\Windows\Installer\f76652d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7A66.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new WebCompanionInstaller.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
takemyfileapp2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 takemyfileapp2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString takemyfileapp2.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1576 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
mask_svc.exemsiexec.exeLavasoft.WCAssistant.WinService.exeDrvInst.exeDrvInst.exeDrvInst.exenetsh.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" mask_svc.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\drivers\pacer.sys,-100 = "Quality of Service Packet Scheduler. This component provides network traffic control, including rate-of-flow and prioritization services." DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-162 = "Central Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Lavasoft.WCAssistant.WinService.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-522 = "N. Central Asia Standard Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" mask_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Lavasoft.WCAssistant.WinService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-571 = "China Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" mask_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe -
Modifies registry class 28 IoCs
Processes:
msiexec.exesetup_0.tmpdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TakeMyFile\command setup_0.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TakeMyFile\command\ = "C:\\Program Files (x86)\\TakeMyFile\\takemyfileapp2.exe \"%1\"" setup_0.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\PackageCode = "06B073E49A8D6C24C95A4819BE5CEF22" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9\C414548CC3098124D97E31A29BF7FD26 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TakeMyFile\icon = "C:\\Program Files (x86)\\TakeMyFile\\takemyfileapp2.exe" setup_0.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductName = "Windows Manager" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TakeMyFile setup_0.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductIcon = "C:\\Windows\\Installer\\{C845414C-903C-4218-9DE7-132AB97FDF62}\\logo.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Version = "16777216" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\PackageName = "Windows Manager - Postback Johan.msi" msiexec.exe -
Processes:
setup_6.tmptapinstall.exesetup.tmpsetup_3.exeWebCompanionInstaller.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC setup_6.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0f00000001000000140000001b4e387db74a69a0470cb08f598beb3b511617530300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 setup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 setup_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a WebCompanionInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 WebCompanionInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a WebCompanionInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f setup_6.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 setup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A setup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 setup_3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 setup_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 0f00000001000000200000002dc1a6a6cb0cb42f7e0d2c56f38bc7decbccd143405f669070ce130f9249ba48030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f tapinstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd setup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 setup_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a setup_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a WebCompanionInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be setup_6.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA setup_6.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA tapinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 setup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 setup_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a setup_3.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
run_848a9.tmpsetup_0.tmpsetup_1.tmpMsiExec.exeMsiExec.exemsiexec.exeLavasoft.WCAssistant.WinService.exeWebCompanion.exesetup_6.tmpWebCompanion.exechrome.exechrome.exemask_svc.exemask_svc.exemask_svc.exechrome.exepid process 1216 run_848a9.tmp 1216 run_848a9.tmp 1680 setup_0.tmp 1680 setup_0.tmp 840 setup_1.tmp 840 setup_1.tmp 1836 MsiExec.exe 1976 MsiExec.exe 1976 MsiExec.exe 628 msiexec.exe 628 msiexec.exe 2192 Lavasoft.WCAssistant.WinService.exe 2192 Lavasoft.WCAssistant.WinService.exe 3000 WebCompanion.exe 3000 WebCompanion.exe 3000 WebCompanion.exe 3000 WebCompanion.exe 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 2296 WebCompanion.exe 2296 WebCompanion.exe 2296 WebCompanion.exe 3028 chrome.exe 2140 chrome.exe 2140 chrome.exe 2856 mask_svc.exe 2444 mask_svc.exe 2504 mask_svc.exe 2888 chrome.exe 2504 mask_svc.exe 2504 mask_svc.exe 1468 setup_6.tmp 1468 setup_6.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
setup.tmppid process 1616 setup.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exesetup_3.exedescription pid process Token: SeRestorePrivilege 628 msiexec.exe Token: SeTakeOwnershipPrivilege 628 msiexec.exe Token: SeSecurityPrivilege 628 msiexec.exe Token: SeCreateTokenPrivilege 1072 setup_3.exe Token: SeAssignPrimaryTokenPrivilege 1072 setup_3.exe Token: SeLockMemoryPrivilege 1072 setup_3.exe Token: SeIncreaseQuotaPrivilege 1072 setup_3.exe Token: SeMachineAccountPrivilege 1072 setup_3.exe Token: SeTcbPrivilege 1072 setup_3.exe Token: SeSecurityPrivilege 1072 setup_3.exe Token: SeTakeOwnershipPrivilege 1072 setup_3.exe Token: SeLoadDriverPrivilege 1072 setup_3.exe Token: SeSystemProfilePrivilege 1072 setup_3.exe Token: SeSystemtimePrivilege 1072 setup_3.exe Token: SeProfSingleProcessPrivilege 1072 setup_3.exe Token: SeIncBasePriorityPrivilege 1072 setup_3.exe Token: SeCreatePagefilePrivilege 1072 setup_3.exe Token: SeCreatePermanentPrivilege 1072 setup_3.exe Token: SeBackupPrivilege 1072 setup_3.exe Token: SeRestorePrivilege 1072 setup_3.exe Token: SeShutdownPrivilege 1072 setup_3.exe Token: SeDebugPrivilege 1072 setup_3.exe Token: SeAuditPrivilege 1072 setup_3.exe Token: SeSystemEnvironmentPrivilege 1072 setup_3.exe Token: SeChangeNotifyPrivilege 1072 setup_3.exe Token: SeRemoteShutdownPrivilege 1072 setup_3.exe Token: SeUndockPrivilege 1072 setup_3.exe Token: SeSyncAgentPrivilege 1072 setup_3.exe Token: SeEnableDelegationPrivilege 1072 setup_3.exe Token: SeManageVolumePrivilege 1072 setup_3.exe Token: SeImpersonatePrivilege 1072 setup_3.exe Token: SeCreateGlobalPrivilege 1072 setup_3.exe Token: SeCreateTokenPrivilege 1072 setup_3.exe Token: SeAssignPrimaryTokenPrivilege 1072 setup_3.exe Token: SeLockMemoryPrivilege 1072 setup_3.exe Token: SeIncreaseQuotaPrivilege 1072 setup_3.exe Token: SeMachineAccountPrivilege 1072 setup_3.exe Token: SeTcbPrivilege 1072 setup_3.exe Token: SeSecurityPrivilege 1072 setup_3.exe Token: SeTakeOwnershipPrivilege 1072 setup_3.exe Token: SeLoadDriverPrivilege 1072 setup_3.exe Token: SeSystemProfilePrivilege 1072 setup_3.exe Token: SeSystemtimePrivilege 1072 setup_3.exe Token: SeProfSingleProcessPrivilege 1072 setup_3.exe Token: SeIncBasePriorityPrivilege 1072 setup_3.exe Token: SeCreatePagefilePrivilege 1072 setup_3.exe Token: SeCreatePermanentPrivilege 1072 setup_3.exe Token: SeBackupPrivilege 1072 setup_3.exe Token: SeRestorePrivilege 1072 setup_3.exe Token: SeShutdownPrivilege 1072 setup_3.exe Token: SeDebugPrivilege 1072 setup_3.exe Token: SeAuditPrivilege 1072 setup_3.exe Token: SeSystemEnvironmentPrivilege 1072 setup_3.exe Token: SeChangeNotifyPrivilege 1072 setup_3.exe Token: SeRemoteShutdownPrivilege 1072 setup_3.exe Token: SeUndockPrivilege 1072 setup_3.exe Token: SeSyncAgentPrivilege 1072 setup_3.exe Token: SeEnableDelegationPrivilege 1072 setup_3.exe Token: SeManageVolumePrivilege 1072 setup_3.exe Token: SeImpersonatePrivilege 1072 setup_3.exe Token: SeCreateGlobalPrivilege 1072 setup_3.exe Token: SeCreateTokenPrivilege 1072 setup_3.exe Token: SeAssignPrimaryTokenPrivilege 1072 setup_3.exe Token: SeLockMemoryPrivilege 1072 setup_3.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
run_848a9.tmpsetup_0.tmpsetup_1.tmpsetup_3.exeWebCompanion.exesetup_6.tmpchrome.exepid process 1216 run_848a9.tmp 1680 setup_0.tmp 840 setup_1.tmp 1072 setup_3.exe 2296 WebCompanion.exe 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 1468 setup_6.tmp 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe -
Suspicious use of SendNotifyMessage 33 IoCs
Processes:
WebCompanion.exechrome.exepid process 2296 WebCompanion.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe 2140 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
run_848a9.exerun_848a9.tmpsetup.exesetup.tmpsetup_0.exesetup_0.tmpsetup_1.exesetup_1.tmpdescription pid process target process PID 1612 wrote to memory of 1216 1612 run_848a9.exe run_848a9.tmp PID 1612 wrote to memory of 1216 1612 run_848a9.exe run_848a9.tmp PID 1612 wrote to memory of 1216 1612 run_848a9.exe run_848a9.tmp PID 1612 wrote to memory of 1216 1612 run_848a9.exe run_848a9.tmp PID 1612 wrote to memory of 1216 1612 run_848a9.exe run_848a9.tmp PID 1612 wrote to memory of 1216 1612 run_848a9.exe run_848a9.tmp PID 1612 wrote to memory of 1216 1612 run_848a9.exe run_848a9.tmp PID 1216 wrote to memory of 1360 1216 run_848a9.tmp setup.exe PID 1216 wrote to memory of 1360 1216 run_848a9.tmp setup.exe PID 1216 wrote to memory of 1360 1216 run_848a9.tmp setup.exe PID 1216 wrote to memory of 1360 1216 run_848a9.tmp setup.exe PID 1216 wrote to memory of 1360 1216 run_848a9.tmp setup.exe PID 1216 wrote to memory of 1360 1216 run_848a9.tmp setup.exe PID 1216 wrote to memory of 1360 1216 run_848a9.tmp setup.exe PID 1360 wrote to memory of 1616 1360 setup.exe setup.tmp PID 1360 wrote to memory of 1616 1360 setup.exe setup.tmp PID 1360 wrote to memory of 1616 1360 setup.exe setup.tmp PID 1360 wrote to memory of 1616 1360 setup.exe setup.tmp PID 1360 wrote to memory of 1616 1360 setup.exe setup.tmp PID 1360 wrote to memory of 1616 1360 setup.exe setup.tmp PID 1360 wrote to memory of 1616 1360 setup.exe setup.tmp PID 1616 wrote to memory of 1832 1616 setup.tmp setup_0.exe PID 1616 wrote to memory of 1832 1616 setup.tmp setup_0.exe PID 1616 wrote to memory of 1832 1616 setup.tmp setup_0.exe PID 1616 wrote to memory of 1832 1616 setup.tmp setup_0.exe PID 1616 wrote to memory of 1832 1616 setup.tmp setup_0.exe PID 1616 wrote to memory of 1832 1616 setup.tmp setup_0.exe PID 1616 wrote to memory of 1832 1616 setup.tmp setup_0.exe PID 1832 wrote to memory of 1680 1832 setup_0.exe setup_0.tmp PID 1832 wrote to memory of 1680 1832 setup_0.exe setup_0.tmp PID 1832 wrote to memory of 1680 1832 setup_0.exe setup_0.tmp PID 1832 wrote to memory of 1680 1832 setup_0.exe setup_0.tmp PID 1832 wrote to memory of 1680 1832 setup_0.exe setup_0.tmp PID 1832 wrote to memory of 1680 1832 setup_0.exe setup_0.tmp PID 1832 wrote to memory of 1680 1832 setup_0.exe setup_0.tmp PID 1680 wrote to memory of 2020 1680 setup_0.tmp takemyfileapp2.exe PID 1680 wrote to memory of 2020 1680 setup_0.tmp takemyfileapp2.exe PID 1680 wrote to memory of 2020 1680 setup_0.tmp takemyfileapp2.exe PID 1680 wrote to memory of 2020 1680 setup_0.tmp takemyfileapp2.exe PID 1616 wrote to memory of 1684 1616 setup.tmp setup_1.exe PID 1616 wrote to memory of 1684 1616 setup.tmp setup_1.exe PID 1616 wrote to memory of 1684 1616 setup.tmp setup_1.exe PID 1616 wrote to memory of 1684 1616 setup.tmp setup_1.exe PID 1616 wrote to memory of 1684 1616 setup.tmp setup_1.exe PID 1616 wrote to memory of 1684 1616 setup.tmp setup_1.exe PID 1616 wrote to memory of 1684 1616 setup.tmp setup_1.exe PID 1684 wrote to memory of 840 1684 setup_1.exe setup_1.tmp PID 1684 wrote to memory of 840 1684 setup_1.exe setup_1.tmp PID 1684 wrote to memory of 840 1684 setup_1.exe setup_1.tmp PID 1684 wrote to memory of 840 1684 setup_1.exe setup_1.tmp PID 1684 wrote to memory of 840 1684 setup_1.exe setup_1.tmp PID 1684 wrote to memory of 840 1684 setup_1.exe setup_1.tmp PID 1684 wrote to memory of 840 1684 setup_1.exe setup_1.tmp PID 840 wrote to memory of 1824 840 setup_1.tmp hostwin.exe PID 840 wrote to memory of 1824 840 setup_1.tmp hostwin.exe PID 840 wrote to memory of 1824 840 setup_1.tmp hostwin.exe PID 840 wrote to memory of 1824 840 setup_1.tmp hostwin.exe PID 1616 wrote to memory of 1072 1616 setup.tmp setup_3.exe PID 1616 wrote to memory of 1072 1616 setup.tmp setup_3.exe PID 1616 wrote to memory of 1072 1616 setup.tmp setup_3.exe PID 1616 wrote to memory of 1072 1616 setup.tmp setup_3.exe PID 1616 wrote to memory of 1072 1616 setup.tmp setup_3.exe PID 1616 wrote to memory of 1072 1616 setup.tmp setup_3.exe PID 1616 wrote to memory of 1072 1616 setup.tmp setup_3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\run_848a9.exe"C:\Users\Admin\AppData\Local\Temp\run_848a9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-K94M6.tmp\run_848a9.tmp"C:\Users\Admin\AppData\Local\Temp\is-K94M6.tmp\run_848a9.tmp" /SL5="$50154,986812,780800,C:\Users\Admin\AppData\Local\Temp\run_848a9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RFBT0.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\is-RFBT0.tmp\setup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1DG6G.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-1DG6G.tmp\setup.tmp" /SL5="$101B8,921114,831488,C:\Users\Admin\AppData\Local\Temp\is-RFBT0.tmp\setup.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_0.exe"C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_0.exe" /pid=2651945 /cid=2094 /VERYSILENT5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-75MR6.tmp\setup_0.tmp"C:\Users\Admin\AppData\Local\Temp\is-75MR6.tmp\setup_0.tmp" /SL5="$10226,859139,58368,C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_0.exe" /pid=2651945 /cid=2094 /VERYSILENT6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\TakeMyFile\takemyfileapp2.exe"C:\Program Files (x86)\TakeMyFile\takemyfileapp2.exe" report 2651945 20947⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_1.exe"C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_1.exe" /VERYSILENT /id=20945⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NASVG.tmp\setup_1.tmp"C:\Users\Admin\AppData\Local\Temp\is-NASVG.tmp\setup_1.tmp" /SL5="$2022E,140765,56832,C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_1.exe" /VERYSILENT /id=20946⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-35TAG.tmp\hostwin.exe"C:\Users\Admin\AppData\Local\Temp\is-35TAG.tmp\hostwin.exe" 2094 647⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_3.exe"C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_3.exe" /qn CAMPAIGN="2094"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2094 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_3.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1635223689 /qn CAMPAIGN=""2094"" " CAMPAIGN="2094"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_5.exe"C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_5.exe" --silent --partner=IT2011175⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8091C3E6\WebCompanionInstaller.exe.\WebCompanionInstaller.exe --partner=IT201117 --version=7.0.2417.4248 --prod --silent --partner=IT2011176⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
-
C:\Windows\SysWOW64\sc.exe"sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto7⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" failure WCAssistantService reset= 30 actions= restart/600007⤵
-
C:\Windows\SysWOW64\sc.exe"sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone7⤵
-
C:\Windows\SysWOW64\netsh.exenetsh http add urlacl url=http://+:9007/ user=Everyone8⤵
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo=7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u_x3qpen.cmdline"8⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES339F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC339E.tmp"9⤵
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --afterinstall7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://webcompanion.com/wp/index.php?partnerId=IT201117&utm_campaign=WP060220&sourceTraffic=WC&installDate=2021-10-29T04:52:34&mk=f6015c6f-c68d-124e-a017-eec7df096d3e&ik=2b9a0166-041e-45a6-9f87-568c0344d36a8⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef16a4f50,0x7fef16a4f60,0x7fef16a4f709⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=816 /prefetch:89⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:29⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1768 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:19⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:19⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2668 /prefetch:29⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3696 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3780 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3788 /prefetch:89⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3404 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3468 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3732 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3220 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3444 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3904 /prefetch:89⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1568 /prefetch:19⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,3576569188015896940,4999811736545826401,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:19⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_6.exe"C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_6.exe" /silent /subid=5625⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-RN24A.tmp\setup_6.tmp"C:\Users\Admin\AppData\Local\Temp\is-RN24A.tmp\setup_6.tmp" /SL5="$70234,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_6.exe" /silent /subid=5626⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "7⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09018⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "7⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap09018⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies system certificate store
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 31248651124D86C7F49F74FC291842C4 C2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D00381A3150A56597D2427DFD7F8B2C02⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71A8DF995E5781E62797D9DBC2D0CECF M Global\MSI00002⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone2⤵
-
C:\Windows\system32\netsh.exenetsh http add urlacl url=http://+:9007/ user=Everyone3⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0e62f8f1-2481-6960-a36e-3d178256436e}\oemvista.inf" "9" "6d14a44ff" "00000000000003C4" "WinSta0\Default" "0000000000000594" "208" "c:\program files (x86)\maskvpn\driver\win764"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot13" "" "" "66d15495b" "0000000000000000" "00000000000005EC" "00000000000005E0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:tap0901.NTamd64:tap0901.ndi:9.0.0.21:tap0901" "6d14a44ff" "00000000000003C4" "00000000000005E4" "00000000000005F4"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\TakeMyFile\takemyfileapp2.exeMD5
96f0ec1dd262f03d9c4dc71ca0c4abb3
SHA1b25222639d324fe07ad6dc9cc240046bf036af85
SHA2560555fd26a051d4576f81a6384807430dc290f997eca72e4ab6f058c79101d64b
SHA512e9a42f045073f34b3dbab630edb1a6befee1d07d4ef0c584fcd384aca297ec9d2b66595d0ad9264338f3cf6d5fde715bac799651a8a99ecc5d369a1ddcae6899
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44DMD5
82c84b49ec1ed0c40c42712d196590ea
SHA166e6e6f53c8eaf0b9a3210859a9b820f56fe5ba2
SHA256d6e4dc21be32a086c4a3d0410e0748102b7c9cbcc2833d05c27282cf785e21a7
SHA51281b63ee6d8eb9ba0f4fb712bb222852468c6cfe42bc0432cfa107694fa94d27b2cc61bd4d01bb988275250bf71e67c1b7922981a56a454d4d2c9c1c1c8f26964
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015MD5
ab5c36d10261c173c5896f3478cdc6b7
SHA187ac53810ad125663519e944bc87ded3979cbee4
SHA256f8e90fb0557fe49d7702cfb506312ac0b24c97802f9c782696db6d47f434e8e9
SHA512e83e4eae44e7a9cbcd267dbfc25a7f4f68b50591e3bbe267324b1f813c9220d565b284994ded5f7d2d371d50e1ebfa647176ec8de9716f754c6b5785c6e897fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_7ACDCC18BE3F9272783F723CF7E4C78BMD5
be7147c68f1191cbf918b1e79bddbcc6
SHA132df9a89667ef742f25294da2c8bf0d00b746fb9
SHA2564b6c03b8b0bab5c82a60cf24d6c35a52ce35ff91b5986961637a6d14e1f2536f
SHA512591118f45798be017b3c9063a89c7d77e6bacfdf5a0afa278d87c2efa6f8da7c5057b78a2157c24f65a777eeffaaefb0d458404e2121c966bc0bce87e5e758df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44DMD5
5df321fe06e169a17275061d51101f31
SHA1cdde9ccec63f29b57b749256d5cf516f8ab13666
SHA256108d4903a4b23221f6091e74860871c209a615b9448a91b9e39593871669a2ee
SHA512a5778a613a1ccdee2d21fbe4b33dbff8e33f0d941517dddaa94e38bfd16167d2d38b219e6f3e94d21a2bacaf16cc132048c26af9f33a5cd5b5f2060e2c2f05fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
22e3b8d553fc4f760ef629c3743a7249
SHA1fd8c9c45c1d8c87c01537722fb8eae7bbacc517a
SHA256f8f67e4dd96fa1e765e6ce68aeed66723bc15c5125c2b44aae08434f3b2281ee
SHA512bc392bff0260c6612b33e681dd2c8f7fac877a8f2a22b223728f77a8c4d7c92933d2a12cae7b45ab31b333033c4775953966b5256b7fa44100fd66f0c7a0d5dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
6fb13bb8000ea50a0e23e156de16ab10
SHA13b9117cff1c6dcb1bd392a1aaa82b13552c7d827
SHA256172dc67cb8f8a2940c5377a1948fddca87a8f074cb6eeabd893065d155a8f176
SHA51292b0de3b607fa6b844db9de4f678c8bede9a80024578ce7993d333550521bc671fc814ca795b05158f578d7951aee5c6fc7c9680a1c0adf6ec1633f408a0e4cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_7ACDCC18BE3F9272783F723CF7E4C78BMD5
322bda90aaf4f9b4ebc2052633450a3d
SHA1c64c41c40ee0cc6bfe9cd002830eea2c300af761
SHA256e7c3aa3bfd750407547975c914011aec5f0685f85bf7c3b193bd31dfff68048d
SHA512d9a3f71a018a1eb2f48da7b56a587dfcd41e8c356c91ac0adb79ee97c59d028dffcd9cb4b491204e628c1aca3e7b8093edcd2a2fb504f47ed9b250ff5f002864
-
C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.iniMD5
5a0a9c9c6b067c1ede956675d900159d
SHA1aacf1bcb40032b50a7aed6d5c0a08aef7bb557fb
SHA25638e6eeb190532a58bb08ac99d26ec19fcf066866534af056e4494853a3045497
SHA512d9fef54307b819a4a5217620e520f68b20f74661e77b836c6e246c7e42c1ddc43098d0bf5f14822e470b769746166d9a3d774fb47a8d35ecb72f95909c5542ba
-
C:\Users\Admin\AppData\Local\Temp\MSI5EDF.tmpMD5
d07ddd437009ebb9c21882579bf2df0d
SHA1a24a636db25ed29e5353fa5d274bf80c2ab8ad98
SHA256c4f49b995e259a043af81d987c6781b8736f5709348bb997edad183ccc396caf
SHA5128c845ec3effc0041db3a550adddc1f175e1169ca00767c89d38fabaa59f97ae987b529c0ad71d0def0007a21fb3fd98200b0834408c5889d93f9ea035c60eca3
-
C:\Users\Admin\AppData\Local\Temp\MSI6086.tmpMD5
5a25fb13ed470b77eefd2eb89cb62c47
SHA13dbe567e3c8c8cd0f7e3c71a2536578ee11bf2a6
SHA2560dca4854897ca77080c57936ad5c7c6c5f5c656a5785c09c7d2c1d196e4f3336
SHA5122ec64666ad42e955e91378af855da59d3bcfb4cc3574bf023dda878c7d3e3dec442625de6e6b0434d1caf86a525395b04038cf7fdc6c292405d9f19c6f4e9952
-
C:\Users\Admin\AppData\Local\Temp\is-1DG6G.tmp\setup.tmpMD5
38e9177040663abdf7cb42d237b03d9d
SHA10b95b3694406d9d86aa3e4953f42d471977ff03d
SHA2562a322dbda4ac86aed04ab99f9f2c277c2f84b6046e234c3ae55ceec53883b594
SHA51278db4c72b2e10d665775e7f306d926060c95ba47610e809e0a21006280f9f0280fa572168b9c9ee00e2121090db9a20dc524677d961fea4292c41c44ba3cb30f
-
C:\Users\Admin\AppData\Local\Temp\is-35TAG.tmp\hostwin.exeMD5
b3bb91ad96f2d4c041861ce59ba6ac73
SHA1e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3
SHA2560581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426
SHA512e3a8426d202a8aad79aad5d75549753cf70b9c2c0fa4c9468f03d089eca8e529b56cd8fa16b7be3a4cfc019d43ff458b9dc8a1cae44b6ed75e27f21489a2cbdd
-
C:\Users\Admin\AppData\Local\Temp\is-75MR6.tmp\setup_0.tmpMD5
1afbd25db5c9a90fe05309f7c4fbcf09
SHA1baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA2563bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
SHA5123a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
-
C:\Users\Admin\AppData\Local\Temp\is-75MR6.tmp\setup_0.tmpMD5
1afbd25db5c9a90fe05309f7c4fbcf09
SHA1baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA2563bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
SHA5123a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_0.exeMD5
2c9cd007de9f99579da31ce28481ede0
SHA172b8f13007747ca6231f7da558fec3fa1b996b98
SHA2563b87f07a3ed4782c8fcebe44ae6b036d717aa127db34995c24f2d9f1c7dce44d
SHA512f3c7c1b47839d628b94701f12165113cb3e300cf46e2b213267159465713bbae26be70c48be652365a5bebf9559e9ec46310914a983ddf9b86a9708b5441d447
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_0.exeMD5
2c9cd007de9f99579da31ce28481ede0
SHA172b8f13007747ca6231f7da558fec3fa1b996b98
SHA2563b87f07a3ed4782c8fcebe44ae6b036d717aa127db34995c24f2d9f1c7dce44d
SHA512f3c7c1b47839d628b94701f12165113cb3e300cf46e2b213267159465713bbae26be70c48be652365a5bebf9559e9ec46310914a983ddf9b86a9708b5441d447
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_1.exeMD5
5dd257000cde6a086046cadff128eba9
SHA1cbef6958c188daa91e66607443a0421b36b35f19
SHA256f8f138e3290ccbaa58efe016d661eb19cb8731ff89a5df2af5015a22becdb0dd
SHA5127a1139f109ea5d47e312b850ec904c762028b5cc35254ac2dd9f2fe1bf74b70f0c5dbaaced48b63b0485116db99a1c23acf62ae96e0f07bcfcd018f10abc939c
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_1.exeMD5
5dd257000cde6a086046cadff128eba9
SHA1cbef6958c188daa91e66607443a0421b36b35f19
SHA256f8f138e3290ccbaa58efe016d661eb19cb8731ff89a5df2af5015a22becdb0dd
SHA5127a1139f109ea5d47e312b850ec904c762028b5cc35254ac2dd9f2fe1bf74b70f0c5dbaaced48b63b0485116db99a1c23acf62ae96e0f07bcfcd018f10abc939c
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_3.exeMD5
78b13010746f790292949e6bd53321da
SHA1fdc327892bd4d3f41b0a5210dbdd54e381ff3ae3
SHA256b945185dc04126878956ebc6246cb62391edba6e64d954f3f33ce767e74238e7
SHA5122422e5c7e354e6b6fb9f539cb56c6a6bc9ca9dcd0eeda80209975819504f59ce09e49c5e5586d6a646e6c16dd4fba87422d1dbd7d590c49f67a2fda2489dca9c
-
C:\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_3.exeMD5
78b13010746f790292949e6bd53321da
SHA1fdc327892bd4d3f41b0a5210dbdd54e381ff3ae3
SHA256b945185dc04126878956ebc6246cb62391edba6e64d954f3f33ce767e74238e7
SHA5122422e5c7e354e6b6fb9f539cb56c6a6bc9ca9dcd0eeda80209975819504f59ce09e49c5e5586d6a646e6c16dd4fba87422d1dbd7d590c49f67a2fda2489dca9c
-
C:\Users\Admin\AppData\Local\Temp\is-K94M6.tmp\run_848a9.tmpMD5
172be78472394107d27ae2337ad8bf58
SHA1530b852a568698a51fb11e137f8c5da54c21a29c
SHA256b45d8b87c446af32aaead1b658bb10b22ba951cba63d432f665cd8c0150a576b
SHA512903f4f3846627e03593163e89c2cd06c43a76cccbadd7eb345fd851433d290cc95737255f12d961106b43bc0a3012ea577fca0246dd7ead4665786654f122a22
-
C:\Users\Admin\AppData\Local\Temp\is-K94M6.tmp\run_848a9.tmpMD5
172be78472394107d27ae2337ad8bf58
SHA1530b852a568698a51fb11e137f8c5da54c21a29c
SHA256b45d8b87c446af32aaead1b658bb10b22ba951cba63d432f665cd8c0150a576b
SHA512903f4f3846627e03593163e89c2cd06c43a76cccbadd7eb345fd851433d290cc95737255f12d961106b43bc0a3012ea577fca0246dd7ead4665786654f122a22
-
C:\Users\Admin\AppData\Local\Temp\is-NASVG.tmp\setup_1.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-NASVG.tmp\setup_1.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-RFBT0.tmp\setup.exeMD5
af5770a146da7de3837f95f622c150e5
SHA183edfc1970dcec10ac1a3fad0281486b8fc23810
SHA256864a35c54d0d9aa563d4e300bd003c83502f45df8736c2f6bbb0edf74870a2e7
SHA51215f40a0d8af86b809768ff6ee87633be59ab06d2db2b6281c30bd2e81a9b10fefb9f9737e9a770e9b084997086c45e6d3d9a2ce70ec29b0b94eab04157a2d936
-
C:\Users\Admin\AppData\Local\Temp\is-RFBT0.tmp\setup.exeMD5
af5770a146da7de3837f95f622c150e5
SHA183edfc1970dcec10ac1a3fad0281486b8fc23810
SHA256864a35c54d0d9aa563d4e300bd003c83502f45df8736c2f6bbb0edf74870a2e7
SHA51215f40a0d8af86b809768ff6ee87633be59ab06d2db2b6281c30bd2e81a9b10fefb9f9737e9a770e9b084997086c45e6d3d9a2ce70ec29b0b94eab04157a2d936
-
C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msiMD5
b4aefb36c0fb1cbd0850d43b5042704e
SHA175aa3e799186d627c31bb4fbdcff8c1f2788ef9f
SHA256bc7eed24c7197e4d6302a7cb21e40c16d5f3a0fd9962187b3f77b56346690062
SHA512248579ff25516d61bdda5e04cfd8d6478a1e52f0db802e7874460c61b2afe124815a1ec5d21b06f707f95577b221e43f923d71522ec047b0b0e8b1df535b829b
-
C:\Windows\Installer\MSI6847.tmpMD5
07df9ca625c2cb953b2a7f7f699cee7c
SHA13225e84b51ba76eb650231c94231b70b70b997c9
SHA256265d462e9bd3fc4bdf925590a852707a52e0707407fdc4ba40a468542e8dbb77
SHA512104a32900ac3f7a3815ce4670aa430677eb48bd3b8a5e17f0a05c333b8faf776756408784c8191ea51ffd54ad52d7fcbf2611570a275efdc6bf1b04b5706f9fd
-
C:\Windows\Installer\MSI6A0C.tmpMD5
d07ddd437009ebb9c21882579bf2df0d
SHA1a24a636db25ed29e5353fa5d274bf80c2ab8ad98
SHA256c4f49b995e259a043af81d987c6781b8736f5709348bb997edad183ccc396caf
SHA5128c845ec3effc0041db3a550adddc1f175e1169ca00767c89d38fabaa59f97ae987b529c0ad71d0def0007a21fb3fd98200b0834408c5889d93f9ea035c60eca3
-
C:\Windows\Installer\MSI6A5B.tmpMD5
d07ddd437009ebb9c21882579bf2df0d
SHA1a24a636db25ed29e5353fa5d274bf80c2ab8ad98
SHA256c4f49b995e259a043af81d987c6781b8736f5709348bb997edad183ccc396caf
SHA5128c845ec3effc0041db3a550adddc1f175e1169ca00767c89d38fabaa59f97ae987b529c0ad71d0def0007a21fb3fd98200b0834408c5889d93f9ea035c60eca3
-
C:\Windows\Installer\MSI6B36.tmpMD5
d07ddd437009ebb9c21882579bf2df0d
SHA1a24a636db25ed29e5353fa5d274bf80c2ab8ad98
SHA256c4f49b995e259a043af81d987c6781b8736f5709348bb997edad183ccc396caf
SHA5128c845ec3effc0041db3a550adddc1f175e1169ca00767c89d38fabaa59f97ae987b529c0ad71d0def0007a21fb3fd98200b0834408c5889d93f9ea035c60eca3
-
C:\Windows\Installer\MSI6C12.tmpMD5
07df9ca625c2cb953b2a7f7f699cee7c
SHA13225e84b51ba76eb650231c94231b70b70b997c9
SHA256265d462e9bd3fc4bdf925590a852707a52e0707407fdc4ba40a468542e8dbb77
SHA512104a32900ac3f7a3815ce4670aa430677eb48bd3b8a5e17f0a05c333b8faf776756408784c8191ea51ffd54ad52d7fcbf2611570a275efdc6bf1b04b5706f9fd
-
C:\Windows\Installer\MSI6D6A.tmpMD5
5a25fb13ed470b77eefd2eb89cb62c47
SHA13dbe567e3c8c8cd0f7e3c71a2536578ee11bf2a6
SHA2560dca4854897ca77080c57936ad5c7c6c5f5c656a5785c09c7d2c1d196e4f3336
SHA5122ec64666ad42e955e91378af855da59d3bcfb4cc3574bf023dda878c7d3e3dec442625de6e6b0434d1caf86a525395b04038cf7fdc6c292405d9f19c6f4e9952
-
\Program Files (x86)\TakeMyFile\takemyfileapp2.exeMD5
96f0ec1dd262f03d9c4dc71ca0c4abb3
SHA1b25222639d324fe07ad6dc9cc240046bf036af85
SHA2560555fd26a051d4576f81a6384807430dc290f997eca72e4ab6f058c79101d64b
SHA512e9a42f045073f34b3dbab630edb1a6befee1d07d4ef0c584fcd384aca297ec9d2b66595d0ad9264338f3cf6d5fde715bac799651a8a99ecc5d369a1ddcae6899
-
\Users\Admin\AppData\Local\Temp\INA5E81.tmpMD5
07df9ca625c2cb953b2a7f7f699cee7c
SHA13225e84b51ba76eb650231c94231b70b70b997c9
SHA256265d462e9bd3fc4bdf925590a852707a52e0707407fdc4ba40a468542e8dbb77
SHA512104a32900ac3f7a3815ce4670aa430677eb48bd3b8a5e17f0a05c333b8faf776756408784c8191ea51ffd54ad52d7fcbf2611570a275efdc6bf1b04b5706f9fd
-
\Users\Admin\AppData\Local\Temp\MSI5EDF.tmpMD5
d07ddd437009ebb9c21882579bf2df0d
SHA1a24a636db25ed29e5353fa5d274bf80c2ab8ad98
SHA256c4f49b995e259a043af81d987c6781b8736f5709348bb997edad183ccc396caf
SHA5128c845ec3effc0041db3a550adddc1f175e1169ca00767c89d38fabaa59f97ae987b529c0ad71d0def0007a21fb3fd98200b0834408c5889d93f9ea035c60eca3
-
\Users\Admin\AppData\Local\Temp\MSI6086.tmpMD5
5a25fb13ed470b77eefd2eb89cb62c47
SHA13dbe567e3c8c8cd0f7e3c71a2536578ee11bf2a6
SHA2560dca4854897ca77080c57936ad5c7c6c5f5c656a5785c09c7d2c1d196e4f3336
SHA5122ec64666ad42e955e91378af855da59d3bcfb4cc3574bf023dda878c7d3e3dec442625de6e6b0434d1caf86a525395b04038cf7fdc6c292405d9f19c6f4e9952
-
\Users\Admin\AppData\Local\Temp\is-1DG6G.tmp\setup.tmpMD5
38e9177040663abdf7cb42d237b03d9d
SHA10b95b3694406d9d86aa3e4953f42d471977ff03d
SHA2562a322dbda4ac86aed04ab99f9f2c277c2f84b6046e234c3ae55ceec53883b594
SHA51278db4c72b2e10d665775e7f306d926060c95ba47610e809e0a21006280f9f0280fa572168b9c9ee00e2121090db9a20dc524677d961fea4292c41c44ba3cb30f
-
\Users\Admin\AppData\Local\Temp\is-35TAG.tmp\_isetup\_shfoldr.dllMD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-35TAG.tmp\_isetup\_shfoldr.dllMD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-35TAG.tmp\hostwin.exeMD5
b3bb91ad96f2d4c041861ce59ba6ac73
SHA1e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3
SHA2560581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426
SHA512e3a8426d202a8aad79aad5d75549753cf70b9c2c0fa4c9468f03d089eca8e529b56cd8fa16b7be3a4cfc019d43ff458b9dc8a1cae44b6ed75e27f21489a2cbdd
-
\Users\Admin\AppData\Local\Temp\is-35TAG.tmp\hostwin.exeMD5
b3bb91ad96f2d4c041861ce59ba6ac73
SHA1e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3
SHA2560581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426
SHA512e3a8426d202a8aad79aad5d75549753cf70b9c2c0fa4c9468f03d089eca8e529b56cd8fa16b7be3a4cfc019d43ff458b9dc8a1cae44b6ed75e27f21489a2cbdd
-
\Users\Admin\AppData\Local\Temp\is-35TAG.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
\Users\Admin\AppData\Local\Temp\is-75MR6.tmp\setup_0.tmpMD5
1afbd25db5c9a90fe05309f7c4fbcf09
SHA1baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA2563bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
SHA5123a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
-
\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\idp.dllMD5
55c310c0319260d798757557ab3bf636
SHA10892eb7ed31d8bb20a56c6835990749011a2d8de
SHA25654e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
-
\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_0.exeMD5
2c9cd007de9f99579da31ce28481ede0
SHA172b8f13007747ca6231f7da558fec3fa1b996b98
SHA2563b87f07a3ed4782c8fcebe44ae6b036d717aa127db34995c24f2d9f1c7dce44d
SHA512f3c7c1b47839d628b94701f12165113cb3e300cf46e2b213267159465713bbae26be70c48be652365a5bebf9559e9ec46310914a983ddf9b86a9708b5441d447
-
\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_1.exeMD5
5dd257000cde6a086046cadff128eba9
SHA1cbef6958c188daa91e66607443a0421b36b35f19
SHA256f8f138e3290ccbaa58efe016d661eb19cb8731ff89a5df2af5015a22becdb0dd
SHA5127a1139f109ea5d47e312b850ec904c762028b5cc35254ac2dd9f2fe1bf74b70f0c5dbaaced48b63b0485116db99a1c23acf62ae96e0f07bcfcd018f10abc939c
-
\Users\Admin\AppData\Local\Temp\is-DRS2I.tmp\setup_3.exeMD5
78b13010746f790292949e6bd53321da
SHA1fdc327892bd4d3f41b0a5210dbdd54e381ff3ae3
SHA256b945185dc04126878956ebc6246cb62391edba6e64d954f3f33ce767e74238e7
SHA5122422e5c7e354e6b6fb9f539cb56c6a6bc9ca9dcd0eeda80209975819504f59ce09e49c5e5586d6a646e6c16dd4fba87422d1dbd7d590c49f67a2fda2489dca9c
-
\Users\Admin\AppData\Local\Temp\is-K94M6.tmp\run_848a9.tmpMD5
172be78472394107d27ae2337ad8bf58
SHA1530b852a568698a51fb11e137f8c5da54c21a29c
SHA256b45d8b87c446af32aaead1b658bb10b22ba951cba63d432f665cd8c0150a576b
SHA512903f4f3846627e03593163e89c2cd06c43a76cccbadd7eb345fd851433d290cc95737255f12d961106b43bc0a3012ea577fca0246dd7ead4665786654f122a22
-
\Users\Admin\AppData\Local\Temp\is-NASVG.tmp\setup_1.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
\Users\Admin\AppData\Local\Temp\is-RFBT0.tmp\setup.exeMD5
af5770a146da7de3837f95f622c150e5
SHA183edfc1970dcec10ac1a3fad0281486b8fc23810
SHA256864a35c54d0d9aa563d4e300bd003c83502f45df8736c2f6bbb0edf74870a2e7
SHA51215f40a0d8af86b809768ff6ee87633be59ab06d2db2b6281c30bd2e81a9b10fefb9f9737e9a770e9b084997086c45e6d3d9a2ce70ec29b0b94eab04157a2d936
-
\Users\Admin\AppData\Local\Temp\is-RFBT0.tmp\setup.exeMD5
af5770a146da7de3837f95f622c150e5
SHA183edfc1970dcec10ac1a3fad0281486b8fc23810
SHA256864a35c54d0d9aa563d4e300bd003c83502f45df8736c2f6bbb0edf74870a2e7
SHA51215f40a0d8af86b809768ff6ee87633be59ab06d2db2b6281c30bd2e81a9b10fefb9f9737e9a770e9b084997086c45e6d3d9a2ce70ec29b0b94eab04157a2d936
-
\Users\Admin\AppData\Local\Temp\is-RFBT0.tmp\setup.exeMD5
af5770a146da7de3837f95f622c150e5
SHA183edfc1970dcec10ac1a3fad0281486b8fc23810
SHA256864a35c54d0d9aa563d4e300bd003c83502f45df8736c2f6bbb0edf74870a2e7
SHA51215f40a0d8af86b809768ff6ee87633be59ab06d2db2b6281c30bd2e81a9b10fefb9f9737e9a770e9b084997086c45e6d3d9a2ce70ec29b0b94eab04157a2d936
-
\Users\Admin\AppData\Local\Temp\is-RFBT0.tmp\setup.exeMD5
af5770a146da7de3837f95f622c150e5
SHA183edfc1970dcec10ac1a3fad0281486b8fc23810
SHA256864a35c54d0d9aa563d4e300bd003c83502f45df8736c2f6bbb0edf74870a2e7
SHA51215f40a0d8af86b809768ff6ee87633be59ab06d2db2b6281c30bd2e81a9b10fefb9f9737e9a770e9b084997086c45e6d3d9a2ce70ec29b0b94eab04157a2d936
-
\Users\Admin\AppData\Local\Temp\is-RFBT0.tmp\setup.exeMD5
af5770a146da7de3837f95f622c150e5
SHA183edfc1970dcec10ac1a3fad0281486b8fc23810
SHA256864a35c54d0d9aa563d4e300bd003c83502f45df8736c2f6bbb0edf74870a2e7
SHA51215f40a0d8af86b809768ff6ee87633be59ab06d2db2b6281c30bd2e81a9b10fefb9f9737e9a770e9b084997086c45e6d3d9a2ce70ec29b0b94eab04157a2d936
-
\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dllMD5
858c99cc729be2db6f37e25747640333
SHA169070df2849c1373fae9a4b4a884f14fd8ae39f1
SHA256d4f839922c901906f549c687ccc58a010861a6a006a15c32e1a7f2e3d703b4d9
SHA512f53e00bbedba0edbc363589a2be76ac836915b95d8e887bf5ee4080f34d773a19d9dd43e715569ea21f85a9434de2a16b51c52b00afd89d268bfc929e1e8e695
-
\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dllMD5
858c99cc729be2db6f37e25747640333
SHA169070df2849c1373fae9a4b4a884f14fd8ae39f1
SHA256d4f839922c901906f549c687ccc58a010861a6a006a15c32e1a7f2e3d703b4d9
SHA512f53e00bbedba0edbc363589a2be76ac836915b95d8e887bf5ee4080f34d773a19d9dd43e715569ea21f85a9434de2a16b51c52b00afd89d268bfc929e1e8e695
-
\Windows\Installer\MSI6847.tmpMD5
07df9ca625c2cb953b2a7f7f699cee7c
SHA13225e84b51ba76eb650231c94231b70b70b997c9
SHA256265d462e9bd3fc4bdf925590a852707a52e0707407fdc4ba40a468542e8dbb77
SHA512104a32900ac3f7a3815ce4670aa430677eb48bd3b8a5e17f0a05c333b8faf776756408784c8191ea51ffd54ad52d7fcbf2611570a275efdc6bf1b04b5706f9fd
-
\Windows\Installer\MSI6A0C.tmpMD5
d07ddd437009ebb9c21882579bf2df0d
SHA1a24a636db25ed29e5353fa5d274bf80c2ab8ad98
SHA256c4f49b995e259a043af81d987c6781b8736f5709348bb997edad183ccc396caf
SHA5128c845ec3effc0041db3a550adddc1f175e1169ca00767c89d38fabaa59f97ae987b529c0ad71d0def0007a21fb3fd98200b0834408c5889d93f9ea035c60eca3
-
\Windows\Installer\MSI6A5B.tmpMD5
d07ddd437009ebb9c21882579bf2df0d
SHA1a24a636db25ed29e5353fa5d274bf80c2ab8ad98
SHA256c4f49b995e259a043af81d987c6781b8736f5709348bb997edad183ccc396caf
SHA5128c845ec3effc0041db3a550adddc1f175e1169ca00767c89d38fabaa59f97ae987b529c0ad71d0def0007a21fb3fd98200b0834408c5889d93f9ea035c60eca3
-
\Windows\Installer\MSI6B36.tmpMD5
d07ddd437009ebb9c21882579bf2df0d
SHA1a24a636db25ed29e5353fa5d274bf80c2ab8ad98
SHA256c4f49b995e259a043af81d987c6781b8736f5709348bb997edad183ccc396caf
SHA5128c845ec3effc0041db3a550adddc1f175e1169ca00767c89d38fabaa59f97ae987b529c0ad71d0def0007a21fb3fd98200b0834408c5889d93f9ea035c60eca3
-
\Windows\Installer\MSI6C12.tmpMD5
07df9ca625c2cb953b2a7f7f699cee7c
SHA13225e84b51ba76eb650231c94231b70b70b997c9
SHA256265d462e9bd3fc4bdf925590a852707a52e0707407fdc4ba40a468542e8dbb77
SHA512104a32900ac3f7a3815ce4670aa430677eb48bd3b8a5e17f0a05c333b8faf776756408784c8191ea51ffd54ad52d7fcbf2611570a275efdc6bf1b04b5706f9fd
-
\Windows\Installer\MSI6D6A.tmpMD5
5a25fb13ed470b77eefd2eb89cb62c47
SHA13dbe567e3c8c8cd0f7e3c71a2536578ee11bf2a6
SHA2560dca4854897ca77080c57936ad5c7c6c5f5c656a5785c09c7d2c1d196e4f3336
SHA5122ec64666ad42e955e91378af855da59d3bcfb4cc3574bf023dda878c7d3e3dec442625de6e6b0434d1caf86a525395b04038cf7fdc6c292405d9f19c6f4e9952
-
memory/816-166-0x0000000000000000-mapping.dmp
-
memory/840-116-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/840-109-0x0000000000000000-mapping.dmp
-
memory/900-191-0x0000000000000000-mapping.dmp
-
memory/1072-131-0x0000000000190000-0x000000000022D000-memory.dmpFilesize
628KB
-
memory/1072-124-0x0000000000000000-mapping.dmp
-
memory/1080-192-0x0000000000000000-mapping.dmp
-
memory/1188-190-0x0000000001FC0000-0x0000000001FC1000-memory.dmpFilesize
4KB
-
memory/1188-187-0x0000000000000000-mapping.dmp
-
memory/1216-63-0x0000000074091000-0x0000000074093000-memory.dmpFilesize
8KB
-
memory/1216-62-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1216-58-0x0000000000000000-mapping.dmp
-
memory/1360-70-0x0000000000000000-mapping.dmp
-
memory/1360-77-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1468-215-0x0000000007E10000-0x0000000007E14000-memory.dmpFilesize
16KB
-
memory/1468-217-0x0000000007E10000-0x0000000007E14000-memory.dmpFilesize
16KB
-
memory/1468-222-0x0000000002190000-0x00000000021E7000-memory.dmpFilesize
348KB
-
memory/1468-213-0x0000000007E10000-0x0000000007E14000-memory.dmpFilesize
16KB
-
memory/1468-214-0x0000000007E10000-0x0000000007E14000-memory.dmpFilesize
16KB
-
memory/1468-218-0x0000000007E10000-0x0000000007E14000-memory.dmpFilesize
16KB
-
memory/1468-216-0x0000000007E10000-0x0000000007E14000-memory.dmpFilesize
16KB
-
memory/1468-219-0x0000000007E10000-0x0000000007E14000-memory.dmpFilesize
16KB
-
memory/1468-205-0x0000000000000000-mapping.dmp
-
memory/1468-220-0x0000000007E10000-0x0000000007E14000-memory.dmpFilesize
16KB
-
memory/1468-208-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1468-207-0x0000000007050000-0x0000000007330000-memory.dmpFilesize
2.9MB
-
memory/1468-210-0x0000000001F80000-0x0000000001F81000-memory.dmpFilesize
4KB
-
memory/1576-155-0x0000000000000000-mapping.dmp
-
memory/1588-193-0x0000000000000000-mapping.dmp
-
memory/1612-61-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/1612-54-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1616-78-0x0000000000000000-mapping.dmp
-
memory/1616-82-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1680-90-0x0000000000000000-mapping.dmp
-
memory/1680-100-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1684-103-0x0000000000000000-mapping.dmp
-
memory/1684-115-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1692-142-0x0000000000000000-mapping.dmp
-
memory/1824-122-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmpFilesize
8KB
-
memory/1824-120-0x0000000000000000-mapping.dmp
-
memory/1832-84-0x0000000000000000-mapping.dmp
-
memory/1832-93-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1836-136-0x0000000000000000-mapping.dmp
-
memory/1976-150-0x0000000000000000-mapping.dmp
-
memory/2020-97-0x0000000000000000-mapping.dmp
-
memory/2020-101-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2192-185-0x0000000000B60000-0x0000000000B62000-memory.dmpFilesize
8KB
-
memory/2192-186-0x000007FEEDF80000-0x000007FEEF653000-memory.dmpFilesize
22.8MB
-
memory/2192-195-0x0000000000B8B000-0x0000000000B8D000-memory.dmpFilesize
8KB
-
memory/2192-188-0x0000000000B6A000-0x0000000000B89000-memory.dmpFilesize
124KB
-
memory/2296-196-0x0000000000000000-mapping.dmp
-
memory/2296-223-0x0000000006D20000-0x0000000006D21000-memory.dmpFilesize
4KB
-
memory/2296-203-0x0000000002941000-0x0000000002942000-memory.dmpFilesize
4KB
-
memory/2296-209-0x0000000002946000-0x0000000002957000-memory.dmpFilesize
68KB
-
memory/2296-198-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB
-
memory/2296-226-0x0000000002959000-0x000000000295A000-memory.dmpFilesize
4KB
-
memory/2296-221-0x0000000002957000-0x0000000002958000-memory.dmpFilesize
4KB
-
memory/2312-168-0x0000000000000000-mapping.dmp
-
memory/2340-172-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2340-170-0x0000000000000000-mapping.dmp
-
memory/2400-204-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2400-199-0x0000000000000000-mapping.dmp
-
memory/2444-243-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/2444-246-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/2444-241-0x0000000000000000-mapping.dmp
-
memory/2444-250-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/2504-259-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2712-227-0x0000000000000000-mapping.dmp
-
memory/2716-228-0x0000000000000000-mapping.dmp
-
memory/2732-173-0x0000000000000000-mapping.dmp
-
memory/2752-229-0x0000000000000000-mapping.dmp
-
memory/2760-174-0x0000000000000000-mapping.dmp
-
memory/2780-230-0x0000000000000000-mapping.dmp
-
memory/2788-175-0x0000000000000000-mapping.dmp
-
memory/2856-235-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/2856-239-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2856-232-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2856-233-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2856-231-0x0000000000000000-mapping.dmp
-
memory/2856-236-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/2856-237-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/2856-238-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/2868-176-0x0000000000000000-mapping.dmp
-
memory/2908-177-0x0000000000000000-mapping.dmp
-
memory/3000-189-0x0000000000CE1000-0x0000000000CE2000-memory.dmpFilesize
4KB
-
memory/3000-181-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB
-
memory/3000-182-0x00000000063E0000-0x00000000063E1000-memory.dmpFilesize
4KB
-
memory/3000-179-0x0000000000000000-mapping.dmp