9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb

Analysis

max time kernel
92s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe
Size

7.2MB
MD5

f6f67d62dc4d8c38a11e80f444455c75
SHA1

8e7a35240aedf74d1dd705a9c8861b7c35f9802f
SHA256

9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb
SHA512

e3e0814a713fc095bc58f69c77b1ff2b02bd927d4df1b5c6fbb5718ec4794c8e6fedfa5435cc14c50dce2b776670724484aa682a27bf0656319e2d18022e6a82
SSDEEP

196608:63F6n80W6uG09+KOvpyUUgd8KVmHxs5XzkBLCW2d1:eFREugJ8K8Hx2zkBwd1

Score

8^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

irsetup.exeSecure Fast PC.exe

pid process

1740 irsetup.exe
1836 Secure Fast PC.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/1740-66-0x0000000000400000-0x00000000007CB000-memory.dmp	upx
\Program Files (x86)\Developerts LLC\Secure Fast PC\uninstall.exe	upx
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	upx
behavioral1/memory/1740-76-0x0000000000400000-0x00000000007CB000-memory.dmp	upx

Loads dropped DLL 27 IoCs

Processes:

9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exeirsetup.exeSecure Fast PC.exe

pid	process
2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe
2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe
2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe
2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe
1740	irsetup.exe
1740	irsetup.exe
1740	irsetup.exe
1740	irsetup.exe
1740	irsetup.exe
1740	irsetup.exe
1740	irsetup.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe
1836	Secure Fast PC.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 48 IoCs

Processes:

irsetup.exe

description	ioc	process
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\SQLite.Interop.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\System.Data.SQLite.EF6.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\System.Data.SQLite.Linq.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\TelerikCommon.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\System.Data.SQLite.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Uninstall\uninstall.dat	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\SFCAutoScan.exe.config	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\SFCUpdater.exe	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\SFCUpdater.exe.config	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\System.Data.SQLite.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.Themes.Aqua.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.UI.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\TelerikCommon.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Uninstall\uniFD05.tmp	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\EntityFramework.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Ionic.Zip.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Uninstall\uniFD05.tmp	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\EntityFramework.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe.config	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\SFCAutoScan.exe	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.Themes.Windows8.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.UI.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Uninstall\uninstall.xml	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\EntityFramework.SqlServer.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\EULA.rtf	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\SFCUpdater.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\SQLite.Interop.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.Themes.Aqua.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.Themes.Windows8.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\uninstall.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\EULA.rtf	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Ionic.Zip.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\SFCAutoScan.exe.config	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\SFCUpdater.exe.config	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\System.Data.SQLite.Linq.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Uninstall\uninstall.dat	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Common Tools.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\EntityFramework.SqlServer.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe.config	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\System.Data.SQLite.EF6.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\lua5.1.dll	irsetup.exe
File created	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Uninstall\uninstall.xml	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Common Tools.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\SFCAutoScan.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.dll	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375962889"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51308BF1-6B16-11ED-B68C-6A6CB2F85B9F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dab606b86c1e314c9c0abeb2d9c71fe9000000000200000000001066000000010000200000006c30b15f32baa7cf4d89c0a1a33283ba68b74a3edda30c800755ee7c86b348b8000000000e8000000002000020000000dd0d1e6cd71b045b59316b76af320f3df8d367287036d650c37baf3fa0276c4f2000000005cdef11c7b650912f81568bd2c0173843bc0a33e53ad551e8498d65ab0f41cd40000000be757697ee36bbf47ac2d4e206c11af65c83d53bccf7aa82bb6a5b334510fea01658f2970b75263de70db8935ee495bd164b5936799919af76553894fa28abe0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e0523223ffd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dab606b86c1e314c9c0abeb2d9c71fe900000000020000000000106600000001000020000000ae2968039a99ed43464e57c62533317b7cd4f3f5e71085f602875fe1d797b01f000000000e80000000020000200000005b5406539c10509446f6d1543680902db3fbe3dee3f98fe66c54a8fb2a3a288290000000402da6c9036f5d8936bca3a6134b68a1176fde9a7d6ea54b88013b69fe85f302cbd8b2d1e440b941263fccdc8c54d12cef6d193222235154bd1297b1b184d29efc198e8dbd5c6930fd7a2d150f3af664dc7952fe986d0f8415bb0277ed79e79a2d037ad43f6782c30992af87b095319d7bdfe3a5f79bd1076cfbbd5315c8737e4fc6846cdb68c64b69a1a18d8a995252400000000ad4856b85a099b87a7fe1ae662d1dce9ce735e42b284dcd25e0f8d5c30334e4e76a3b3b0d429beeee72917b204269086b2434ec0e3d53ac1d88244c67d262d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Secure Fast PC.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	Secure Fast PC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Secure Fast PC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Secure Fast PC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Secure Fast PC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Secure Fast PC.exe

description pid process

Token: SeDebugPrivilege 1836 Secure Fast PC.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeSecure Fast PC.exe

pid process

1176 iexplore.exe
1836 Secure Fast PC.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Secure Fast PC.exe

pid process

1836 Secure Fast PC.exe

description	pid	process
Token: SeDebugPrivilege	1836	Secure Fast PC.exe

pid	process
1176	iexplore.exe
1836	Secure Fast PC.exe

pid	process
1836	Secure Fast PC.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

irsetup.exeiexplore.exeIEXPLORE.EXESecure Fast PC.exe

pid	process
1740	irsetup.exe
1740	irsetup.exe
1176	iexplore.exe
1176	iexplore.exe
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1836	Secure Fast PC.exe
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exeirsetup.exeiexplore.exe

description	pid	process	target process
PID 2032 wrote to memory of 1740	2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe	irsetup.exe
PID 2032 wrote to memory of 1740	2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe	irsetup.exe
PID 2032 wrote to memory of 1740	2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe	irsetup.exe
PID 2032 wrote to memory of 1740	2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe	irsetup.exe
PID 2032 wrote to memory of 1740	2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe	irsetup.exe
PID 2032 wrote to memory of 1740	2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe	irsetup.exe
PID 2032 wrote to memory of 1740	2032	9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe	irsetup.exe
PID 1740 wrote to memory of 1176	1740	irsetup.exe	iexplore.exe
PID 1740 wrote to memory of 1176	1740	irsetup.exe	iexplore.exe
PID 1740 wrote to memory of 1176	1740	irsetup.exe	iexplore.exe
PID 1740 wrote to memory of 1176	1740	irsetup.exe	iexplore.exe
PID 1740 wrote to memory of 1836	1740	irsetup.exe	Secure Fast PC.exe
PID 1740 wrote to memory of 1836	1740	irsetup.exe	Secure Fast PC.exe
PID 1740 wrote to memory of 1836	1740	irsetup.exe	Secure Fast PC.exe
PID 1740 wrote to memory of 1836	1740	irsetup.exe	Secure Fast PC.exe
PID 1176 wrote to memory of 1636	1176	iexplore.exe	IEXPLORE.EXE
PID 1176 wrote to memory of 1636	1176	iexplore.exe	IEXPLORE.EXE
PID 1176 wrote to memory of 1636	1176	iexplore.exe	IEXPLORE.EXE
PID 1176 wrote to memory of 1636	1176	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe
"C:\Users\Admin\AppData\Local\Temp\9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742194 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\9746c16df7b6be74da65247ae8e97ca496e1fa1a85b49f641217efa9894b12cb.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2292972927-2705560509-2768824231-1000"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://store.developerts.com/ThankYou.aspx?ADV=5
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1636

C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe
"C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Common Tools.dll
Filesize
361KB

MD5
b9f1a6a7e3592ace4cfac8569f169427

SHA1
30b68067c79b69db805efc4c4af4d7e0e7a65c5b

SHA256
ef38e4491652a733c9e6e184c72b2b67874b0f0db3e44685f30b81e75bd6f30b

SHA512
a3df9eaf9a2da3dd94f49cb6aebf51c23eee72cd401721d15e3741f2ee7976ae737b390965815ac5bb9f482b7bbc9ecc5781d2e503dabffeaaf9ac0d7da7695c

Download Submit
C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe
Filesize
729KB

MD5
7218cc6f8a65c82764883ddc4ad695ea

SHA1
3b4d54521371a5f511d78911f63aafe9d11942f7

SHA256
054532151e0c65f450d4a12369e4ce26ddb1e1cd8705f8ce49a8ff6362f767f6

SHA512
389a7113e2a7017be155520a9afcc5375a3a6d0622a8e3931d4ed4bfdbb261e72f2d1098ab8836dd60c6597b1024b454c99395e76200d0657e567b200c1417ba

Download Submit
C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe
Filesize
729KB

MD5
7218cc6f8a65c82764883ddc4ad695ea

SHA1
3b4d54521371a5f511d78911f63aafe9d11942f7

SHA256
054532151e0c65f450d4a12369e4ce26ddb1e1cd8705f8ce49a8ff6362f767f6

SHA512
389a7113e2a7017be155520a9afcc5375a3a6d0622a8e3931d4ed4bfdbb261e72f2d1098ab8836dd60c6597b1024b454c99395e76200d0657e567b200c1417ba

Download Submit
C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe.config
Filesize
11KB

MD5
381889268c3a15e9b781217710aea797

SHA1
0671dcb2cdb043ff34ae7c8517d129bd9e95c359

SHA256
f0d52c6f8aa7dcbafd1c3159c6eb77f74a3dc6cf9c79ffc8213d69a3a198127f

SHA512
3352631a491e8cac0edb5ec3e7abad38e913d72c1e2370098537ae68de6a85e9e7ff7ce75d83dffbc7d3d17f0f207b0ec00fc87ead7341555d64f95e17a0052d

Download Submit
C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.Themes.Aqua.dll
Filesize
256KB

MD5
cb2a70a96d1a5169ce0da120ac1678be

SHA1
03813ab2b451ffaaac1da32cab0b8fb6049cc566

SHA256
d0174ad55f9d4a46fd24bbf8289806bedc2f05f2b28aea798e9bf5fd20313807

SHA512
01fe48912ba79116aa2a698603176f4fb4158f7626677b315cc9f606dd879d69977b734b81f69a788fcbf9464cce038e690a6925c1335bcf852c71620d5a4ecb

Download Submit
C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.UI.dll
Filesize
3.8MB

MD5
092cff53504132e4e8ce5556e223478c

SHA1
bc5b666ee5ca7059d17d91f937a94fb34dafa3c9

SHA256
7acbb46dea04fa30cb81bf50e3d79c8d505bb0e382371e1cd26e82ce8f00d480

SHA512
7f5bd19bf40145000f4bb0cce73e644b6a6d678c641a357995e60fb22c3b870f1c3e876c505314b13793d6ce73e97ede9ea240dd5243c73fb0992460fc43c4fb

Download Submit
C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.dll
Filesize
2.1MB

MD5
364c96e78fa520745223bf6d0dbbdd65

SHA1
ae333f358bc31caa54759cd0d38a48eeb068599c

SHA256
7aec4d5b2089fed53c1b9fd5bdbdc0e1c7df1239606f0f9dfdcd49966947af9d

SHA512
ed9cfbea54ed44e89ecc6c77235b9a98341cf45eb75af784bd8b3ebcb41db9fc17300f2773a6e7c7a1c9e2c1b042a84425f720ab1c4413e5102f5e6d4cca380b

Download Submit
C:\Program Files (x86)\Developerts LLC\Secure Fast PC\TelerikCommon.dll
Filesize
573KB

MD5
fb5bad50e8660cd38262cb32e7e99a24

SHA1
fb8ab3fb38652ac1b507a09a904e9a147b2b70ef

SHA256
f13e30542ad51c7fce136e0384c82c9453aaed7644aceecdb07d63bb08f7ec46

SHA512
4ecd705c178e75016df91bdea85595252b02f8c2e60dddb0255eca150eea606a93307b596d9c4a02fd09c166ad1af5f5f620c77d240c3872c06cc4e0157dc2eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8c8e469b28cff6e9e055ec0aa797bff6

SHA1
73e766309d848fd7a9cd7d5ef60f07cf77cdb12d

SHA256
09e9d787f2c9ea5e3ec80040cba719b06c42056658415a2a18fa673f2244dd92

SHA512
615224f97e0f170cb113957de08fc49efe9d2b754fe611d54b20aa6ef6a3c90b9cec9f5ae3442e8d4c163975134503ee68847279872f92a399f039dcc2baff52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0dba6b06eb14c50357b998573b660f97

SHA1
d2f81a0fab0bc521c186f4d0ffdb1db24c806844

SHA256
88caf29c247ad93937f5e5e9562b311a4d064307739708b8560cd29cf31b4cb6

SHA512
f4e489cea54734c542317687b708282fdb8125b900208ac4ade3340005095d4635ec2d7d0f0b88643267036e11d94acf268306ad16a1fed8aa1a9d89b976ebcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Filesize
318KB

MD5
b5fc476c1bf08d5161346cc7dd4cb0ba

SHA1
280fac9cf711d93c95f6b80ac97d89cf5853c096

SHA256
12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

SHA512
17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I1X4BLRE.txt
Filesize
608B

MD5
348e6d5754a77b84052b22decccd31bc

SHA1
4f77c3e9957c43149257b91378ff4d363d522063

SHA256
2b1cbdd956ac28b3b8878f56f7fa2e5805f5c87b9713f5c6b253f58e6b1bc05e

SHA512
5b4a87a57a7e356e77bdf5c17974b0c18c55159755e38ebe4c5dc2c709a94203649932efb7b3018ebd00bdd55f059fbb20fdc767a3828266342e1f331fcf3a7a

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Common Tools.dll
Filesize
361KB

MD5
b9f1a6a7e3592ace4cfac8569f169427

SHA1
30b68067c79b69db805efc4c4af4d7e0e7a65c5b

SHA256
ef38e4491652a733c9e6e184c72b2b67874b0f0db3e44685f30b81e75bd6f30b

SHA512
a3df9eaf9a2da3dd94f49cb6aebf51c23eee72cd401721d15e3741f2ee7976ae737b390965815ac5bb9f482b7bbc9ecc5781d2e503dabffeaaf9ac0d7da7695c

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Common Tools.dll
Filesize
361KB

MD5
b9f1a6a7e3592ace4cfac8569f169427

SHA1
30b68067c79b69db805efc4c4af4d7e0e7a65c5b

SHA256
ef38e4491652a733c9e6e184c72b2b67874b0f0db3e44685f30b81e75bd6f30b

SHA512
a3df9eaf9a2da3dd94f49cb6aebf51c23eee72cd401721d15e3741f2ee7976ae737b390965815ac5bb9f482b7bbc9ecc5781d2e503dabffeaaf9ac0d7da7695c

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe
Filesize
729KB

MD5
7218cc6f8a65c82764883ddc4ad695ea

SHA1
3b4d54521371a5f511d78911f63aafe9d11942f7

SHA256
054532151e0c65f450d4a12369e4ce26ddb1e1cd8705f8ce49a8ff6362f767f6

SHA512
389a7113e2a7017be155520a9afcc5375a3a6d0622a8e3931d4ed4bfdbb261e72f2d1098ab8836dd60c6597b1024b454c99395e76200d0657e567b200c1417ba

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe
Filesize
729KB

MD5
7218cc6f8a65c82764883ddc4ad695ea

SHA1
3b4d54521371a5f511d78911f63aafe9d11942f7

SHA256
054532151e0c65f450d4a12369e4ce26ddb1e1cd8705f8ce49a8ff6362f767f6

SHA512
389a7113e2a7017be155520a9afcc5375a3a6d0622a8e3931d4ed4bfdbb261e72f2d1098ab8836dd60c6597b1024b454c99395e76200d0657e567b200c1417ba

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe
Filesize
729KB

MD5
7218cc6f8a65c82764883ddc4ad695ea

SHA1
3b4d54521371a5f511d78911f63aafe9d11942f7

SHA256
054532151e0c65f450d4a12369e4ce26ddb1e1cd8705f8ce49a8ff6362f767f6

SHA512
389a7113e2a7017be155520a9afcc5375a3a6d0622a8e3931d4ed4bfdbb261e72f2d1098ab8836dd60c6597b1024b454c99395e76200d0657e567b200c1417ba

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe
Filesize
729KB

MD5
7218cc6f8a65c82764883ddc4ad695ea

SHA1
3b4d54521371a5f511d78911f63aafe9d11942f7

SHA256
054532151e0c65f450d4a12369e4ce26ddb1e1cd8705f8ce49a8ff6362f767f6

SHA512
389a7113e2a7017be155520a9afcc5375a3a6d0622a8e3931d4ed4bfdbb261e72f2d1098ab8836dd60c6597b1024b454c99395e76200d0657e567b200c1417ba

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.Themes.Aqua.dll
Filesize
256KB

MD5
cb2a70a96d1a5169ce0da120ac1678be

SHA1
03813ab2b451ffaaac1da32cab0b8fb6049cc566

SHA256
d0174ad55f9d4a46fd24bbf8289806bedc2f05f2b28aea798e9bf5fd20313807

SHA512
01fe48912ba79116aa2a698603176f4fb4158f7626677b315cc9f606dd879d69977b734b81f69a788fcbf9464cce038e690a6925c1335bcf852c71620d5a4ecb

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.Themes.Aqua.dll
Filesize
256KB

MD5
cb2a70a96d1a5169ce0da120ac1678be

SHA1
03813ab2b451ffaaac1da32cab0b8fb6049cc566

SHA256
d0174ad55f9d4a46fd24bbf8289806bedc2f05f2b28aea798e9bf5fd20313807

SHA512
01fe48912ba79116aa2a698603176f4fb4158f7626677b315cc9f606dd879d69977b734b81f69a788fcbf9464cce038e690a6925c1335bcf852c71620d5a4ecb

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.Themes.Aqua.dll
Filesize
256KB

MD5
cb2a70a96d1a5169ce0da120ac1678be

SHA1
03813ab2b451ffaaac1da32cab0b8fb6049cc566

SHA256
d0174ad55f9d4a46fd24bbf8289806bedc2f05f2b28aea798e9bf5fd20313807

SHA512
01fe48912ba79116aa2a698603176f4fb4158f7626677b315cc9f606dd879d69977b734b81f69a788fcbf9464cce038e690a6925c1335bcf852c71620d5a4ecb

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.Themes.Aqua.dll
Filesize
256KB

MD5
cb2a70a96d1a5169ce0da120ac1678be

SHA1
03813ab2b451ffaaac1da32cab0b8fb6049cc566

SHA256
d0174ad55f9d4a46fd24bbf8289806bedc2f05f2b28aea798e9bf5fd20313807

SHA512
01fe48912ba79116aa2a698603176f4fb4158f7626677b315cc9f606dd879d69977b734b81f69a788fcbf9464cce038e690a6925c1335bcf852c71620d5a4ecb

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.UI.dll
Filesize
3.8MB

MD5
092cff53504132e4e8ce5556e223478c

SHA1
bc5b666ee5ca7059d17d91f937a94fb34dafa3c9

SHA256
7acbb46dea04fa30cb81bf50e3d79c8d505bb0e382371e1cd26e82ce8f00d480

SHA512
7f5bd19bf40145000f4bb0cce73e644b6a6d678c641a357995e60fb22c3b870f1c3e876c505314b13793d6ce73e97ede9ea240dd5243c73fb0992460fc43c4fb

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.UI.dll
Filesize
3.8MB

MD5
092cff53504132e4e8ce5556e223478c

SHA1
bc5b666ee5ca7059d17d91f937a94fb34dafa3c9

SHA256
7acbb46dea04fa30cb81bf50e3d79c8d505bb0e382371e1cd26e82ce8f00d480

SHA512
7f5bd19bf40145000f4bb0cce73e644b6a6d678c641a357995e60fb22c3b870f1c3e876c505314b13793d6ce73e97ede9ea240dd5243c73fb0992460fc43c4fb

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.UI.dll
Filesize
3.8MB

MD5
092cff53504132e4e8ce5556e223478c

SHA1
bc5b666ee5ca7059d17d91f937a94fb34dafa3c9

SHA256
7acbb46dea04fa30cb81bf50e3d79c8d505bb0e382371e1cd26e82ce8f00d480

SHA512
7f5bd19bf40145000f4bb0cce73e644b6a6d678c641a357995e60fb22c3b870f1c3e876c505314b13793d6ce73e97ede9ea240dd5243c73fb0992460fc43c4fb

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.UI.dll
Filesize
3.8MB

MD5
092cff53504132e4e8ce5556e223478c

SHA1
bc5b666ee5ca7059d17d91f937a94fb34dafa3c9

SHA256
7acbb46dea04fa30cb81bf50e3d79c8d505bb0e382371e1cd26e82ce8f00d480

SHA512
7f5bd19bf40145000f4bb0cce73e644b6a6d678c641a357995e60fb22c3b870f1c3e876c505314b13793d6ce73e97ede9ea240dd5243c73fb0992460fc43c4fb

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.dll
Filesize
2.1MB

MD5
364c96e78fa520745223bf6d0dbbdd65

SHA1
ae333f358bc31caa54759cd0d38a48eeb068599c

SHA256
7aec4d5b2089fed53c1b9fd5bdbdc0e1c7df1239606f0f9dfdcd49966947af9d

SHA512
ed9cfbea54ed44e89ecc6c77235b9a98341cf45eb75af784bd8b3ebcb41db9fc17300f2773a6e7c7a1c9e2c1b042a84425f720ab1c4413e5102f5e6d4cca380b

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.dll
Filesize
2.1MB

MD5
364c96e78fa520745223bf6d0dbbdd65

SHA1
ae333f358bc31caa54759cd0d38a48eeb068599c

SHA256
7aec4d5b2089fed53c1b9fd5bdbdc0e1c7df1239606f0f9dfdcd49966947af9d

SHA512
ed9cfbea54ed44e89ecc6c77235b9a98341cf45eb75af784bd8b3ebcb41db9fc17300f2773a6e7c7a1c9e2c1b042a84425f720ab1c4413e5102f5e6d4cca380b

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.dll
Filesize
2.1MB

MD5
364c96e78fa520745223bf6d0dbbdd65

SHA1
ae333f358bc31caa54759cd0d38a48eeb068599c

SHA256
7aec4d5b2089fed53c1b9fd5bdbdc0e1c7df1239606f0f9dfdcd49966947af9d

SHA512
ed9cfbea54ed44e89ecc6c77235b9a98341cf45eb75af784bd8b3ebcb41db9fc17300f2773a6e7c7a1c9e2c1b042a84425f720ab1c4413e5102f5e6d4cca380b

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\Telerik.WinControls.dll
Filesize
2.1MB

MD5
364c96e78fa520745223bf6d0dbbdd65

SHA1
ae333f358bc31caa54759cd0d38a48eeb068599c

SHA256
7aec4d5b2089fed53c1b9fd5bdbdc0e1c7df1239606f0f9dfdcd49966947af9d

SHA512
ed9cfbea54ed44e89ecc6c77235b9a98341cf45eb75af784bd8b3ebcb41db9fc17300f2773a6e7c7a1c9e2c1b042a84425f720ab1c4413e5102f5e6d4cca380b

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\TelerikCommon.dll
Filesize
573KB

MD5
fb5bad50e8660cd38262cb32e7e99a24

SHA1
fb8ab3fb38652ac1b507a09a904e9a147b2b70ef

SHA256
f13e30542ad51c7fce136e0384c82c9453aaed7644aceecdb07d63bb08f7ec46

SHA512
4ecd705c178e75016df91bdea85595252b02f8c2e60dddb0255eca150eea606a93307b596d9c4a02fd09c166ad1af5f5f620c77d240c3872c06cc4e0157dc2eb

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\TelerikCommon.dll
Filesize
573KB

MD5
fb5bad50e8660cd38262cb32e7e99a24

SHA1
fb8ab3fb38652ac1b507a09a904e9a147b2b70ef

SHA256
f13e30542ad51c7fce136e0384c82c9453aaed7644aceecdb07d63bb08f7ec46

SHA512
4ecd705c178e75016df91bdea85595252b02f8c2e60dddb0255eca150eea606a93307b596d9c4a02fd09c166ad1af5f5f620c77d240c3872c06cc4e0157dc2eb

Download Submit
\Program Files (x86)\Developerts LLC\Secure Fast PC\uninstall.exe
Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Filesize
1.3MB

MD5
dec931e86140139380ea0df57cd132b6

SHA1
b717fd548382064189c16cb94dda28b1967a5712

SHA256
5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9

SHA512
14d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Filesize
318KB

MD5
b5fc476c1bf08d5161346cc7dd4cb0ba

SHA1
280fac9cf711d93c95f6b80ac97d89cf5853c096

SHA256
12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650

SHA512
17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697

Download Submit
memory/1740-59-0x0000000000000000-mapping.dmp

Download
memory/1740-76-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/1740-66-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/1836-73-0x0000000000000000-mapping.dmp

Download
memory/1836-103-0x0000000005F00000-0x0000000005F46000-memory.dmp

Filesize
280KB

Download
memory/1836-99-0x0000000005CF0000-0x0000000005D86000-memory.dmp

Filesize
600KB

Download
memory/1836-92-0x00000000053B0000-0x00000000055C4000-memory.dmp

Filesize
2.1MB

Download
memory/1836-78-0x0000000000100000-0x00000000001BA000-memory.dmp

Filesize
744KB

Download
memory/1836-86-0x0000000004FE0000-0x00000000053AC000-memory.dmp

Filesize
3.8MB

Download
memory/1836-108-0x0000000004FA6000-0x0000000004FB7000-memory.dmp

Filesize
68KB

Download
memory/1836-109-0x00000000072D0000-0x00000000072F0000-memory.dmp

Filesize
128KB

Download
memory/1836-110-0x0000000004FA6000-0x0000000004FB7000-memory.dmp

Filesize
68KB

Download
memory/1836-82-0x0000000001E40000-0x0000000001EA0000-memory.dmp

Filesize
384KB

Download
memory/2032-65-0x0000000002C50000-0x000000000301B000-memory.dmp

Filesize
3.8MB

Download
memory/2032-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download