a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0

Analysis

max time kernel
146s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Size

8.3MB
MD5

0109a577549d0c58f8f67abbeb07b039
SHA1

7a5e6239de9dcf98df3bdcc9b6076601422d7059
SHA256

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0
SHA512

c22f144f7ea61b05d7bbec20ac88984554c19c5d8947732c159e7bb981cc972ec4c08110bede1b73042898a0ebe193b17279eddc061a1ae5f6c97b48d648abba
SSDEEP

196608:lOG/7EobI1aTZr+QjgcjhXc6IQtnQDRbUFjeVbBLTwbL:lFE81oQj+GQ2Fje5BLEX

Score

8^/10

adware bootkit discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

Processes:

pack.exemediabar.exeMoviesToolbarMediaBar.exeMoviesToolbarMediaBar.exeMoviesToolbarMediaBar.exeSafetyNutManager.exeSafetyNutManager.exeSafetyNutManager.exesafetynut.exe

pid	process
1940	pack.exe
244	mediabar.exe
3744	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
1336	MoviesToolbarMediaBar.exe
552	SafetyNutManager.exe
4712	SafetyNutManager.exe
2872	SafetyNutManager.exe
1640	safetynut.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Registers COM server for autorun 1 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32\ = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\x64\\SAFD52~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32\ = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\x64\\SAFD52~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\InprocServer32\ = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\SRTOOL~1\\IE\\searchresultsDx64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Sets file execution options in registry 2 TTPs 47 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe\debugger = "tasklist.exe"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe

Loads dropped DLL 64 IoCs

Processes:

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exeMoviesToolbarMediaBar.exeMoviesToolbarMediaBar.exeMoviesToolbarMediaBar.exeregsvr32.exe

pid	process
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
1336	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
1488	regsvr32.exe
1336	MoviesToolbarMediaBar.exe
1336	MoviesToolbarMediaBar.exe
1336	MoviesToolbarMediaBar.exe
1336	MoviesToolbarMediaBar.exe
1336	MoviesToolbarMediaBar.exe
1336	MoviesToolbarMediaBar.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

File opened (read-only) \??\D: explorer.exe

description	ioc	process
File opened (read-only)	\??\D:	explorer.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a4ad8fd9-b395-43e3-88b5-240710b48e27}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\ = "Movies Search App (Dist. by Somoto Ltd.)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a4ad8fd9-b395-43e3-88b5-240710b48e27}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\ = "Movies Search App (Dist. by Somoto Ltd.)"	regsvr32.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe

description ioc process

File opened for modification \??\PhysicalDrive0 a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe

Drops file in Program Files directory 64 IoCs

Processes:

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exeMoviesToolbarMediaBar.exepack.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Movies App\SafetyNut\safetycrt.dll	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\search-over.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\gamecategory.xsl	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close-over.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-joystick24.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\uwa\template.html	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\blank.gif	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\lock.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-right22-over.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\uwa\close-hot.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\components\windowmediator.js	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\namespacetoolbar.css	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\bg-btn-end.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\radio-checked.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\weather-contour.png	MoviesToolbarMediaBar.exe
File created	C:\Program Files (x86)\Movies App\SafetyNut\safetynut_ie.dll	pack.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\btn_ask_search.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\video.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\button-splitter-down-vista.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\options-weather.png	MoviesToolbarMediaBar.exe
File created	C:\Program Files (x86)\Movies App\SafetyNut\x64\Internet Explorer Settings Update.exe	pack.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\radiobeta-stopped.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\uwa\close-normal.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\content\lib\dtxwin.xul	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\tab-off-l.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\default\scripts\defscript.js	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-previous.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\menul-bgover.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-close-greyover.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\Koyotesoft_Icon_16x16.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\arrow-right.gif	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\btn_settings_17padding_18pxheight.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\add.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\throbber.gif	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\left-menu-hover.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\uwa\border_09.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\uwa\border_18.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\skin.xml	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\menuitemright-down-vista.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\box-uncheck.png	MoviesToolbarMediaBar.exe
File created	C:\Program Files (x86)\Movies App\SafetyNut\favicon.ico	pack.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\sv.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\ttlbar-right.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-sml-drop.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\topbar-inside-gradient.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\js\default.js	MoviesToolbarMediaBar.exe
File opened for modification	C:\Program Files (x86)\Movies App\SafetyNut\safetycrt36.dll	pack.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\logo_movies_18h.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\bg-btn-start.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\btnright-down-vista.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\tab-on-r.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchboxlite_end.png	MoviesToolbarMediaBar.exe
File created	C:\Program Files (x86)\Movies App\SafetyNut\x64\Internet Explorer Settings.exe	pack.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\css\ie7-only.css	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-right-over.png	MoviesToolbarMediaBar.exe
File created	C:\Program Files (x86)\Movies App\SafetyNut\x64\configmgrc2.cfg	pack.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.url.js	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\locale\toolbar\de.js	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\skin-bluesky.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\images\panel-botm-noscroll.png	MoviesToolbarMediaBar.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.tinyscrollbar.min.js	MoviesToolbarMediaBar.exe
File opened for modification	C:\Program Files (x86)\Movies App\SafetyNut\x64\safetynut.dll	pack.exe
File created	C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\chrome\skin\toolbarsplitter.png	MoviesToolbarMediaBar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exeMoviesToolbarMediaBar.exeregsvr32.exeMoviesToolbarMediaBar.exeMoviesToolbarMediaBar.exesafetynut.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\URL = "http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=0&systemid=473&v=n13452-3464&apn_uid=6653763123574123&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms}"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\Groups = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\${dtUserElevationPolicyID}\Policy = "3"	MoviesToolbarMediaBar.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\FaviconPath = "C:\\Program Files (x86)\\Movies App\\SafetyNut\\favicon.ico"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\ShowSearchSuggestions = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{a4ad8fd9-b395-43e3-88b5-240710b48e27} = "Movies Search App (Dist. by Somoto Ltd.)"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\ShowSearchSuggestions = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\AppPath = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\SRTOOL~1"	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\AppPath = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\SRTOOL~1\\GC"	MoviesToolbarMediaBar.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\${dtUserElevationPolicyID}	MoviesToolbarMediaBar.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	MoviesToolbarMediaBar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\ShowTabsWelcome = "0"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShowClosedTabs = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\ShowSearchSuggestions = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\toolbar	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\${dtUserElevationPolicyID}\AppPath = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\SRTOOL~1\\IE"	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\AppPath = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\SRTOOL~1\\IE"	MoviesToolbarMediaBar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\Policy = "3"	MoviesToolbarMediaBar.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY	safetynut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\Deleted = "0"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\FaviconPath = "C:\\Program Files (x86)\\Movies App\\SafetyNut\\favicon.ico"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER	safetynut.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000	safetynut.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\SuggestionsURL_JSON = "http://www.search.ask.com/suggest.php?src=ieb&gct=ds&appid=0&systemid=473&v=n13452-3464&apn_uid=6653763123574123&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&qu={searchTerms}&ft=json"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\SuggestionsURL_JSON = "http://www.search.ask.com/suggest.php?src=ieb&gct=ds&appid=0&systemid=473&v=n13452-3464&apn_uid=6653763123574123&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&qu={searchTerms}&ft=json"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}	MoviesToolbarMediaBar.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\DisplayName = "Ask.com"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FrameAuto = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FrameAuto = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CE2E5F6B-94E9-4056-8DB0-B417C51917E1}	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CE2E5F6B-94E9-4056-8DB0-B417C51917E1}\AppPath = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\SRTOOL~1\\IE"	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\SuggestionsURL_JSON = "http://www.search.ask.com/suggest.php?src=ieb&gct=ds&appid=0&systemid=473&v=n13452-3464&apn_uid=6653763123574123&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&qu={searchTerms}&ft=json"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\Deleted = "0"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{a4ad8fd9-b395-43e3-88b5-240710b48e27} = "Movies Search App (Dist. by Somoto Ltd.)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\${dtUserElevationPolicyID}\AppName = "dtuser.exe"	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\${dtUserElevationPolicyID}\AppName = "dtuser.exe"	MoviesToolbarMediaBar.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software	safetynut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\DisplayName = "Ask.com"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\AppName = "uninstall.exe"	MoviesToolbarMediaBar.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\toolbar	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\10 = "10"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\${dtUserElevationPolicyID}\Policy = "3"	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CE2E5F6B-94E9-4056-8DB0-B417C51917E1}\AppName = "dtuser.exe"	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\Deleted = "0"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\FaviconPath = "C:\\Program Files (x86)\\Movies App\\SafetyNut\\favicon.ico"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Approved Extensions	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CE2E5F6B-94E9-4056-8DB0-B417C51917E1}\Policy = "3"	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\DisplayName = "Ask.com"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}\URL = "http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=0&systemid=473&v=n13452-3464&apn_uid=6653763123574123&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms}"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

Processes:

MoviesToolbarMediaBar.exeMoviesToolbarMediaBar.exea7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exeMoviesToolbarMediaBar.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.search.ask.com/?o=APN10640A&gct=hp&d=473-0&v=n13452-3464&t=4"	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.search.ask.com/?o=APN10640A&gct=hp&d=473-0&v=n13452-3464&t=4"	MoviesToolbarMediaBar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.search.ask.com/?o=APN10640A&gct=hp&d=473-0&v=n13452-3464&t=4"	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.search.ask.com/?o=APN10640A&gct=hp&d=473-0&v=n13452-3464&t=4"	MoviesToolbarMediaBar.exe

Modifies registry class 64 IoCs

Processes:

explorer.exeSearchApp.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeStartMenuExperienceHost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001002000000014000000494c2006200024003c0010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004002000001002000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf3030303000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040404040a0a0a0a0f0f0f0f0ffffffff9f9f9f9f0000000090909090ffffffffffffffffffffffff9090909000000000000000000000000010101010b0b0b0b0f0f0f0f0b8b8b8b8f3f3f3f32f2f2f2f0303030390909090f0f0f0f07070707030303030a6a6a6a6f9f9f9f9909090900000000010101010d0d0d0d0b0b0b0b01f1f1f1ff0f0f0f0404040400000000000000000ffffffff707070700000000060606060ffffffffa6a6a6a6ffffffff00000000b0b0b0b0b0b0b0b00000000060606060d0d0d0d0000000000000000000000000ffffffff3030303060606060ffffffff6060606040404040ffffffff40404040f0f0f0f01010101000000000a0a0a0a070707070000000000000000000000000ffffffff9c9c9c9cffffffff606060600000000070707070ffffffffb8b8b8b8fffffffffffffffffffffffffffffffffffffffffffffffffbfbfbfb0f0f0f0f90909090f9f9f9f9a6a6a6a64040404070707070f0f0f0f090909090e0e0e0e0303030300000000000000000ffffffff101010100000000000000000000000000000000090909090ffffffffffffffffffffffff9090909000000000ffffffff000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000009f9f9f9fffffffff000000000000000000000000ffffffff000000000000000000000000000000000000000000000000efefefef000000000000000000000000ffffffffe0e0e0e0303030300000000000000000ffffffff101010100000000000000000000000000000000010101010ffffffff000000000000000030303030e0e0e0e0b8b8b8b8ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffb8b8b8b840404040f0f0f0f01010101000000000a0a0a0a0707070700000000000000000000000000000000070707070a0a0a0a00000000010101010f0f0f0f04040404000000000b0b0b0b0b0b0b0b00000000060606060d0d0d0d000000000000000000000000000000000d0d0d0d06060606000000000b0b0b0b0b0b0b0b0000000000000000010101010d0d0d0d0b0b0b0b01f1f1f1ff0f0f0f040404040000000000000000040404040f0f0f0f01f1f1f1fb0b0b0b0d0d0d0d01010101000000000000000000000000010101010b0b0b0b0f0f0f0f0b8b8b8b8f3f3f3f33030303030303030f3f3f3f3b8b8b8b8f0f0f0f0b0b0b0b01010101000000000000000000000000000000000000000000000000040404040a0a0a0a0f0f0f0f0fffffffffffffffff0f0f0f0a0a0a0a040404040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf3030303000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040404040a0a0a0a0f0f0f0f0ffffffff9f9f9f9f0000000090909090ffffffffffffffffffffffff9090909000000000000000000000000010101010b0b0b0b0f0f0f0f0b8b8b8b8f3f3f3f32f2f2f2f0303030390909090f0f0f0f07070707030303030a6a6a6a6f9f9f9f9909090900000000010101010d0d0d0d0b0b0b0b01f1f1f1ff0f0f0f0404040400000000000000000ffffffff707070700000000060606060ffffffffa6a6a6a6ffffffff00000000b0b0b0b0b0b0b0b00000000060606060d0d0d0d0000000000000000000000000ffffffff3030303060606060ffffffff6060606040404040ffffffff40404040f0f0f0f01010101000000000a0a0a0a070707070000000000000000000000000ffffffff9c9c9c9cffffffff606060600000000070707070ffffffffb8b8b8b8fffffffffffffffffffffffffffffffffffffffffffffffffbfbfbfb0f0f0f0f90909090f9f9f9f9a6a6a6a64040404070707070f0f0f0f090909090e0e0e0e0303030300000000000000000ffffffff101010100000000000000000000000000000000090909090ffffffffffffffffffffffff9090909000000000ffffffff000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000009f9f9f9fffffffff000000000000000000000000ffffffff000000000000000000000000000000000000000000000000efefefef000000000000000000000000ffffffffe0e0e0e0303030300000000000000000ffffffff101010100000000000000000000000000000000010101010ffffffff000000000000000030303030e0e0e0e0b8b8b8b8ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffb8b8b8b840404040f0f0f0f01010101000000000a0a0a0a0707070700000000000000000000000000000000070707070a0a0a0a00000000010101010f0f0f0f04040404000000000b0b0b0b0b0b0b0b00000000060606060d0d0d0d000000000000000000000000000000000d0d0d0d06060606000000000b0b0b0b0b0b0b0b0000000000000000010101010d0d0d0d0b0b0b0b01f1f1f1ff0f0f0f040404040000000000000000040404040f0f0f0f01f1f1f1fb0b0b0b0d0d0d0d01010101000000000000000000000000010101010b0b0b0b0f0f0f0f0b8b8b8b8f3f3f3f33030303030303030f3f3f3f3b8b8b8b8f0f0f0f0b0b0b0b01010101000000000000000000000000000000000000000000000000040404040a0a0a0a0f0f0f0f0fffffffffffffffff0f0f0f0a0a0a0a040404040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060606060a0a0a0a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060606060ffffffff60606060000000000000000030303030868686869999999999999999999999999999999999999999999999999999999999999999babababaffffffff60606060303030300a0a0a0a3c3c3c3c9e9e9e9e9999999999999999999999999999999999999999999999999999999999999999babababaffffffff606060603a3a3a3a999999996b6b6b6b464646467d7d7d7d8c8c8c8ca6a6a6a69999999999999999999999999999999999999999babababaffffffff606060603a3a3a3aa6a6a6a69b9b9b9b7d7d7d7d6666666666666666666666666c6c6c6c8c8c8c8c9b9b9b9b9b9b9b9b99999999babababaffffffff60606060404040409f9f9f9f8e8e8e8e808080808080808066666666666666666666666666666666666666666666666684848484b7b7b7b7ffffffff606060603030303097979797808080808080808080808080787878785a5a5a5a66666666666666666666666666666666666666669c9c9c9cffffffff606060602626262687878787808080808080808080808080808080802828282820202020666666666666666666666666666666669c9c9c9cffffffff606060601d1d1d1d4d4d4d4d535353536a6a6a6a6b6b6b6b40404040101010100000000000000000202020205a5a5a5a69696969a0a0a0a0ffffffff606060601d1d1d1d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d3a3a3a3a00000000000000000000000000000000000000000000000063636363ffffffff606060601d1d1d1d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d484848480e0e0e0e000000000000000000000000000000000000000060606060ffffffff606060600a0a0a0a4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d444444440e0e0e0e000000000000000000000000000000000000000000000000a0a0a0a06060606000000000000000000000000013131313131313130e0e0e0e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000056565678888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf4d4d4d6c33333348888888bf6f6f6f9b2b2b2b3c888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf6a6a6a953737374d888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf808080b4888888bf888888bf808080b30909090c6c6c6c97888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf787878a8111111186f6f6f9c888888bf888888bf5e5e5e831010101711111118888888bf888888bf888888bf888888bf888888bf888888bf888888bf888888bf4d4d4d6c000000000909090c4d4d4d6c888888bf888888bf888888bf101010176363638b888888bf888888bf888888bf828282b65c5c5c81696969934545456000000000000000000000000011111118888888bf888888bf888888bf6f6f6f9b0808080b4242425d4f4f4f6e4c4c4c6b111111182222222f1515151e000000000000000000000000000000000000000067676790888888bf888888bf888888bf838383b96a6a6a956666668f6666668f777777a7888888bf3c3c3c5400000000000000000000000000000000000000000909090c565656786767679056565678808080b4888888bf888888bf888888bf888888bf808080b40909090c0000000000000000000000000000000000000000000000000000000000000000000000001a1a1a24787878a8888888bf888888bf676767901a1a1a240000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf30303030000000000000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef30303030000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8fffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff30303030000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbfffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040dfdfdfdf0000000020202020ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000010101010ffffffff0000000000000000ffffffff0000000000000000ffffffffffffffff00000000000000000000000000000000ffffffff000000000000000070707070afafafaf0000000040404040cfcfcfcf0000000020202020ffffffffffffffffffffffffffffffff6060606000000000ffffffff0000000000000000ffffffff40404040000000009f9f9f9f8f8f8f8f0000000050505050bfbfbfbf000000000000000060606060ffffffff60606060ffffffff0000000000000000000000000000000060606060efefefef10101010000000008f8f8f8f8f8f8f8f00000000000000000000000060606060ffffffffffffffff00000000000000000000000000000000ffffffff505050500000000010101010efefefef303030300000000000000000000000000000000060606060ffffffff0000000000000000000000000000000000000000000000000000000080808080bfbfbfbf0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfdfdfdf303030300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000000ffffffff00000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400200000100010000000000000900000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000f0410000c00000008190000093800000138400000000000033c1000077fe000077ee000033cc00000000000013c8000093c9000081810000c0030000f00f0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000f0410000c00000008190000093800000138400000000000033c1000077fe000077ee000033cc00000000000013c8000093c9000081810000c0030000f00f0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000fff100008000000000000000000000000000000000000000000000000001000080070000e0070000c00f0000ce3f0000ffff0000ffff0000ffff0000ffff0000ffff0000ffff0000f0000000000000000000000000000000000100000003000080070000c0070000c0070000fc0f0000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000ffff0000fff90000f3f90000e3c80000c3c400000b2400007b2400007b3600007b3600007b2400000b240000c3c40000e3c80000f3f90000fff90000ffff0000ffff0000d80f0000df7f0000df7f0000c0000000dffe0000dffe0000dffe000007fe000077fe000057fe000007fe000077fe000000000000ffff0000ffff0000000000000000000000000000000000000000000000000100000008000000200000000a0000001401000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000100000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8751"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A4AD8FD9-B395-43E3-88B5-240710B48E27}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6014D692-4409-4EDD-ABB2-36CA26DC2A2E}\TypeLib\ = "{934BEE21-C5A4-457E-B130-77CA098FBBD3}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MoviesToolbarHelper.DNSGuard\CurVer\ = "MoviesToolbarHelper.UrlHelper.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32\ = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\SAFD52~1.DLL"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{934BEE21-C5A4-457E-B130-77CA098FBBD3}\1.0\FLAGS	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{a4ad8fd9-b395-43e3-88b5-240710b48e27}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\ = "ErrorFilter Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10569"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MoviesToolbarHelper.DNSGuard.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\VersionIndependentProgID\ = "MoviesToolbarHelper.UrlHelper"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7148"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A4AD8FD9-B395-43E3-88B5-240710B48E27}\Implemented Categories	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MoviesToolbarHelper.DNSGuard.1\ = "SafetyNut"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MoviesToolbarHelper.DNSGuard\ = "SafetyNut"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\ = "SafetyNut"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\ProgID	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\InprocServer32\ = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\SRTOOL~1\\IE\\searchresultsDx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MoviesToolbarHelper.DNSGuard.1\CLSID\ = "{338a754c-b46e-4bf2-8ac8-23de36862ad3}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32\ = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\SAFD52~1.DLL"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8074"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6014D692-4409-4EDD-ABB2-36CA26DC2A2E}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2712"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\ProgID\ = "MoviesToolbarHelper.UrlHelper.1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{934BEE21-C5A4-457E-B130-77CA098FBBD3}\1.0\ = "MoviesToolbarHelper Type Library"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\Programmable	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "10569"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MoviesToolbarHelper.DNSGuard.1\ = "SafetyNut"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32\ = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\x64\\SAFD52~1.DLL"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32\ = "C:\\PROGRA~2\\MOVIES~1\\SAFETY~1\\x64\\SAFD52~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\ = "ErrorFilter Class"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10580"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MoviesToolbarHelper.DNSGuard\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6014D692-4409-4EDD-ABB2-36CA26DC2A2E}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8074"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exeMoviesToolbarMediaBar.exe

pid	process
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

676

pid	process
676

Suspicious use of AdjustPrivilegeToken 62 IoCs

Processes:

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeDebugPrivilege	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe
Token: SeShutdownPrivilege	984	explorer.exe
Token: SeCreatePagefilePrivilege	984	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

MoviesToolbarMediaBar.exeMoviesToolbarMediaBar.exeexplorer.exe

pid	process
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
4400	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
3744	MoviesToolbarMediaBar.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

explorer.exe

pid	process
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe
984	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

StartMenuExperienceHost.exeSearchApp.exeexplorer.exe

pid process

1356 StartMenuExperienceHost.exe
4988 SearchApp.exe
984 explorer.exe
984 explorer.exe

pid	process
1356	StartMenuExperienceHost.exe
4988	SearchApp.exe
984	explorer.exe
984	explorer.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exeMoviesToolbarMediaBar.exeregsvr32.exeSafetyNutManager.exe

description	pid	process	target process
PID 4740 wrote to memory of 1940	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	pack.exe
PID 4740 wrote to memory of 1940	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	pack.exe
PID 4740 wrote to memory of 1940	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	pack.exe
PID 4740 wrote to memory of 244	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	mediabar.exe
PID 4740 wrote to memory of 244	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	mediabar.exe
PID 4740 wrote to memory of 244	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	mediabar.exe
PID 4740 wrote to memory of 3744	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	MoviesToolbarMediaBar.exe
PID 4740 wrote to memory of 3744	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	MoviesToolbarMediaBar.exe
PID 4740 wrote to memory of 3744	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	MoviesToolbarMediaBar.exe
PID 4740 wrote to memory of 4400	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	MoviesToolbarMediaBar.exe
PID 4740 wrote to memory of 4400	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	MoviesToolbarMediaBar.exe
PID 4740 wrote to memory of 4400	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	MoviesToolbarMediaBar.exe
PID 4740 wrote to memory of 1336	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	MoviesToolbarMediaBar.exe
PID 4740 wrote to memory of 1336	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	MoviesToolbarMediaBar.exe
PID 4740 wrote to memory of 1336	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	MoviesToolbarMediaBar.exe
PID 3744 wrote to memory of 1488	3744	MoviesToolbarMediaBar.exe	regsvr32.exe
PID 3744 wrote to memory of 1488	3744	MoviesToolbarMediaBar.exe	regsvr32.exe
PID 3744 wrote to memory of 1488	3744	MoviesToolbarMediaBar.exe	regsvr32.exe
PID 3744 wrote to memory of 4168	3744	MoviesToolbarMediaBar.exe	regsvr32.exe
PID 3744 wrote to memory of 4168	3744	MoviesToolbarMediaBar.exe	regsvr32.exe
PID 3744 wrote to memory of 4168	3744	MoviesToolbarMediaBar.exe	regsvr32.exe
PID 4168 wrote to memory of 3204	4168	regsvr32.exe	regsvr32.exe
PID 4168 wrote to memory of 3204	4168	regsvr32.exe	regsvr32.exe
PID 4740 wrote to memory of 5092	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	regsvr32.exe
PID 4740 wrote to memory of 5092	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	regsvr32.exe
PID 4740 wrote to memory of 5092	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	regsvr32.exe
PID 4740 wrote to memory of 3440	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	regsvr32.exe
PID 4740 wrote to memory of 3440	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	regsvr32.exe
PID 4740 wrote to memory of 552	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	SafetyNutManager.exe
PID 4740 wrote to memory of 552	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	SafetyNutManager.exe
PID 4740 wrote to memory of 552	4740	a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe	SafetyNutManager.exe
PID 4712 wrote to memory of 2872	4712	SafetyNutManager.exe	SafetyNutManager.exe
PID 4712 wrote to memory of 2872	4712	SafetyNutManager.exe	SafetyNutManager.exe
PID 4712 wrote to memory of 2872	4712	SafetyNutManager.exe	SafetyNutManager.exe
PID 4712 wrote to memory of 1640	4712	SafetyNutManager.exe	safetynut.exe
PID 4712 wrote to memory of 1640	4712	SafetyNutManager.exe	safetynut.exe
PID 4712 wrote to memory of 1640	4712	SafetyNutManager.exe	safetynut.exe

C:\Users\Admin\AppData\Local\Temp\a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe
"C:\Users\Admin\AppData\Local\Temp\a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0.exe"
1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Modifies WinLogon
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740

C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\pack.exe
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\pack.exe "-oC:\Program Files (x86)\Movies App\SafetyNut" -y
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1940

C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\mediabar.exe
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\mediabar.exe "-oC:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp" -y
2⤵
- Executes dropped EXE
PID:244

C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe /S /appId=0 /sysId=473 /trackId=BND101 /userGuid=6653763123574123 /FORCELANGUAGE=1033 /d=473-0 /v=n13452-3464 /t=${T_PARAM} /SkipDefaultSearch /trgb=IE /D=C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3744

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx.dll"
3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1488

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx64.dll"
3⤵
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\system32\regsvr32.exe
/s "C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx64.dll"
4⤵
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:3204

C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe /S /appId=0 /sysId=473 /trackId=BND101 /userGuid=6653763123574123 /FORCELANGUAGE=1033 /d=473-0 /v=n13452-3464 /t=${T_PARAM} /SkipDefaultSearch /trgb=FF /D=C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of FindShellTrayWindow
PID:4400

C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe /S /appId=0 /sysId=473 /trackId=BND101 /userGuid=6653763123574123 /FORCELANGUAGE=1033 /d=473-0 /v=n13452-3464 /t=${T_PARAM} /SkipDefaultSearch /trgb=CR /D=C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1336

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s C:\PROGRA~2\MOVIES~1\SAFETY~1\SAFD52~1.DLL
2⤵
- Modifies registry class
PID:5092

C:\Windows\SYSTEM32\regsvr32.exe
regsvr32.exe /s C:\PROGRA~2\MOVIES~1\SAFETY~1\x64\SAFD52~1.DLL
2⤵
- Registers COM server for autorun
- Modifies registry class
PID:3440

C:\Program Files (x86)\Movies App\SafetyNut\SafetyNutManager.exe
"C:\Program Files (x86)\Movies App\SafetyNut\SafetyNutManager.exe" -install
2⤵
- Executes dropped EXE
PID:552

C:\Program Files (x86)\Movies App\SafetyNut\SafetyNutManager.exe
"C:\Program Files (x86)\Movies App\SafetyNut\SafetyNutManager.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712

C:\Program Files (x86)\Movies App\SafetyNut\SafetyNutManager.exe
"C:\Program Files (x86)\Movies App\SafetyNut\SafetyNutManager.exe" -monitor 796
2⤵
- Executes dropped EXE
PID:2872

C:\Program Files (x86)\Movies App\SafetyNut\safetynut.exe
"C:\Program Files (x86)\Movies App\SafetyNut\safetynut.exe"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
PID:1640

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:984

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1356

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Winlogon Helper DLL

T1004

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Movies App\SafetyNut\Internet Explorer Settings Update.exe
Filesize
1.1MB

MD5
738c94e92652c2ef11a5147e4088f82f

SHA1
87c436428ac7a9566ea9d2467c97292a6935e0dc

SHA256
addcc1602bf94f9bb64181a80522f5a3fe40b3dcdea664f835a059772236faac

SHA512
98d836a2342e45c9f22a1d751529a13be453ba0b770292791056953df57c4db8f627e76ca1392bb37539a613bbebb6b6c6c27a1e5dded2f3666e16b375636700

Download Submit
C:\Program Files (x86)\Movies App\SafetyNut\safetycrt.dll
Filesize
477KB

MD5
c1df2bf04a3f5463af5139182471bd88

SHA1
0016ccab08f5d57b6799c0074e30fbc5636254be

SHA256
23d5c8e9e073abf3a4dcfa81d6dc95a14febb699fb39ef84eb9ed5b306f683e9

SHA512
fd7db4ce0982ed5d70a49b56df40adc3a6411597341be663b27c51565a5935b6d015ade8aaee903b671bac136b89558cfbf0dea273961d4364576fe6000671df

Download Submit
C:\Program Files (x86)\Movies App\SafetyNut\safetycrt36.dll
Filesize
477KB

MD5
325f29ec42a4387fafc17e1bba9c5ac0

SHA1
4e2b363e2ad1df638466a97e320e675932e493ed

SHA256
a7aaf9406ddcfd73715786a8a6893c499c257adde604e9a1b8a9321011051ff9

SHA512
2aedd9ca5606331a0b1fb8fbc2ec97930460c468d6da3dd98e1cd9f039427a4425b786ca2f30a4a722d48b7a127325236ca308f581b3f4ee51ac511ea8dbf24f

Download Submit
C:\Program Files (x86)\Movies App\SafetyNut\x64\Internet Explorer Settings Update.exe
Filesize
1.1MB

MD5
6aaa61d229838e336a050009bfb1f619

SHA1
70204efaff2671496a3609c2615353ea7520a24c

SHA256
b4898f29484d3fd46614a5145912046e7cea3d46d846cb803e67af5342d5c6bf

SHA512
7a1e609f84eb18d8abf268070154433fcfd1a919a3e083fc457255eacfee000e3fa5c30f46e24f17159cd5e75e564a6295f30fc2461fc164a38273edf3b39d7b

Download Submit
C:\Program Files (x86)\Movies App\SafetyNut\x64\safetycrt.dll
Filesize
647KB

MD5
5c5d68de2ae1530ecf9056c7e3c02b51

SHA1
cd4889c1acea067ece0e19dcb4d20ef528ebca6d

SHA256
d6d872bb988068180152974770c5b70fc811396e47c7830ce2328429931e0ca8

SHA512
fc7b48df58644a658010e47f4ca210b22929857c49e5c63c044946794a45b8c3d67f491d85eee30a261c317de803dcb25efd3fc1abc92dfce4aec76dd29846b9

Download Submit
C:\Program Files (x86)\Movies App\SafetyNut\x64\safetycrt36.dll
Filesize
646KB

MD5
5a34f1d2da42dd0ce1b6b739aae498c2

SHA1
4f723f86f26694d1c1edbf4b754ecce2b6d8d8ff

SHA256
217aedbb3ba5e13ce41ddb0dc4f85384f0a11b57478aca77d145a431f4fadeb0

SHA512
5a1550fb119f8aa0845986071903f96beb98265ab6e2237497ffdb9866bb3ef2988fa0c14c3be97230cf395f4d3d5fe5703911865a8d9ce1dc5ad189bfc5c7ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\51C2.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\530B.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\556D.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\580E.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\583E.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\585E.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\58AD.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\58ED.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\593C.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\597B.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\599C.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\59CC.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\59FB.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A0C.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A3C.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A6C.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5A9C.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ABC.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5AFB.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5B4B.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5B8A.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5BBA.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5BEA.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\5C4A.tmp
Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\DTX\Reporting\ReportingHelper.dll
Filesize
185KB

MD5
cd36c68e6c1263092527ff8f699b44f1

SHA1
d0f66db91ed3f2b6f8e2eec481c2e315fc785200

SHA256
0b8be117a7bf2619985f617f0dcf5351db3bcb995df5e7fca42d16f7b60eb16c

SHA512
87fea99a3ebe2c624f7631d3c7281b6d9a459a46f5375452a86fcc3da7975916c8975342766d3f26fa4836c0541f675bf8a9850432d80a0afd2ba3a614bdd4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm6534.tmp\InetLoad.dll
Filesize
17KB

MD5
e241424579fdfd683f0adff02b7483a8

SHA1
c4cde72b3e5e34730a41d43383d1234279dff1f6

SHA256
c8601ee8eda1952ac188c05ae0527b51e525ee4ff36f67218dfdd2d48c79fd6a

SHA512
a0c0f4bb55b8c0143266705292805fcb98f72dbdc4b724569cb31bd7488258ded63583e1f060c1d7bf003d3df2018b05a0720cee3064b6f6c60247e959636947

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm6534.tmp\InetLoad.dll
Filesize
17KB

MD5
e241424579fdfd683f0adff02b7483a8

SHA1
c4cde72b3e5e34730a41d43383d1234279dff1f6

SHA256
c8601ee8eda1952ac188c05ae0527b51e525ee4ff36f67218dfdd2d48c79fd6a

SHA512
a0c0f4bb55b8c0143266705292805fcb98f72dbdc4b724569cb31bd7488258ded63583e1f060c1d7bf003d3df2018b05a0720cee3064b6f6c60247e959636947

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm6534.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm6534.tmp\UAC.dll
Filesize
16KB

MD5
0d422e0c03a7d9428c6c02175d7dc9f8

SHA1
5e13d49521cfbbe52cd74de8e1682789f0268969

SHA256
9f47ec720d74e538bbc8d0c1118efcbc52e52050dbe98c27029fc35329996f7c

SHA512
2edf47b24c4201e082841824d6ad9047a06e9a877d799e87befaf5d54179c924849d2e608cf9f60a1480828edcd98e19f3d139d19bdb4b96ee4939fe58bf0887

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm6534.tmp\UAC.dll
Filesize
16KB

MD5
0d422e0c03a7d9428c6c02175d7dc9f8

SHA1
5e13d49521cfbbe52cd74de8e1682789f0268969

SHA256
9f47ec720d74e538bbc8d0c1118efcbc52e52050dbe98c27029fc35329996f7c

SHA512
2edf47b24c4201e082841824d6ad9047a06e9a877d799e87befaf5d54179c924849d2e608cf9f60a1480828edcd98e19f3d139d19bdb4b96ee4939fe58bf0887

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm6534.tmp\xml.dll
Filesize
26KB

MD5
fbda05aa26e02d38effb82294e83ea69

SHA1
aa2291ace177515173315668480c74442e21549d

SHA256
565e439a6262cbe6c8164312ad330930738efa8d4defcbcdcc1eeb752fdb75b3

SHA512
3fd4dcbe059df3078f7709b2b9edbe30744ad7ff6e4cd1c494b40bb796a31838d5c9761fe9db860c38bd929c364df4767435fb85dc4e4115e361dd9d640c256f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm6534.tmp\xml.dll
Filesize
26KB

MD5
fbda05aa26e02d38effb82294e83ea69

SHA1
aa2291ace177515173315668480c74442e21549d

SHA256
565e439a6262cbe6c8164312ad330930738efa8d4defcbcdcc1eeb752fdb75b3

SHA512
3fd4dcbe059df3078f7709b2b9edbe30744ad7ff6e4cd1c494b40bb796a31838d5c9761fe9db860c38bd929c364df4767435fb85dc4e4115e361dd9d640c256f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm6534.tmp\xml.dll
Filesize
26KB

MD5
fbda05aa26e02d38effb82294e83ea69

SHA1
aa2291ace177515173315668480c74442e21549d

SHA256
565e439a6262cbe6c8164312ad330930738efa8d4defcbcdcc1eeb752fdb75b3

SHA512
3fd4dcbe059df3078f7709b2b9edbe30744ad7ff6e4cd1c494b40bb796a31838d5c9761fe9db860c38bd929c364df4767435fb85dc4e4115e361dd9d640c256f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm6534.tmp\xml.dll
Filesize
26KB

MD5
fbda05aa26e02d38effb82294e83ea69

SHA1
aa2291ace177515173315668480c74442e21549d

SHA256
565e439a6262cbe6c8164312ad330930738efa8d4defcbcdcc1eeb752fdb75b3

SHA512
3fd4dcbe059df3078f7709b2b9edbe30744ad7ff6e4cd1c494b40bb796a31838d5c9761fe9db860c38bd929c364df4767435fb85dc4e4115e361dd9d640c256f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9472.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9472.tmp\UAC.dll
Filesize
16KB

MD5
0d422e0c03a7d9428c6c02175d7dc9f8

SHA1
5e13d49521cfbbe52cd74de8e1682789f0268969

SHA256
9f47ec720d74e538bbc8d0c1118efcbc52e52050dbe98c27029fc35329996f7c

SHA512
2edf47b24c4201e082841824d6ad9047a06e9a877d799e87befaf5d54179c924849d2e608cf9f60a1480828edcd98e19f3d139d19bdb4b96ee4939fe58bf0887

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9472.tmp\UAC.dll
Filesize
16KB

MD5
0d422e0c03a7d9428c6c02175d7dc9f8

SHA1
5e13d49521cfbbe52cd74de8e1682789f0268969

SHA256
9f47ec720d74e538bbc8d0c1118efcbc52e52050dbe98c27029fc35329996f7c

SHA512
2edf47b24c4201e082841824d6ad9047a06e9a877d799e87befaf5d54179c924849d2e608cf9f60a1480828edcd98e19f3d139d19bdb4b96ee4939fe58bf0887

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9472.tmp\inetc.dll
Filesize
20KB

MD5
134b93f8bd1f82cd2f1b06c878580703

SHA1
29cdbce7a2caf1f7e4d2a139c42336d490074665

SHA256
45153adf50541316468e2b189a0f8127be9fb29e2f920e7eeaa6aceb438db8c4

SHA512
f970c38debb6631dab7369e2bc96237f16a8fd328d9d35a2b54cb688e1807f62cc6d63230afe89ce5c3945097ae4466872c72929a9623adde3ee57bddf54b692

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9472.tmp\inetc.dll
Filesize
20KB

MD5
134b93f8bd1f82cd2f1b06c878580703

SHA1
29cdbce7a2caf1f7e4d2a139c42336d490074665

SHA256
45153adf50541316468e2b189a0f8127be9fb29e2f920e7eeaa6aceb438db8c4

SHA512
f970c38debb6631dab7369e2bc96237f16a8fd328d9d35a2b54cb688e1807f62cc6d63230afe89ce5c3945097ae4466872c72929a9623adde3ee57bddf54b692

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9472.tmp\xml.dll
Filesize
26KB

MD5
fbda05aa26e02d38effb82294e83ea69

SHA1
aa2291ace177515173315668480c74442e21549d

SHA256
565e439a6262cbe6c8164312ad330930738efa8d4defcbcdcc1eeb752fdb75b3

SHA512
3fd4dcbe059df3078f7709b2b9edbe30744ad7ff6e4cd1c494b40bb796a31838d5c9761fe9db860c38bd929c364df4767435fb85dc4e4115e361dd9d640c256f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9472.tmp\xml.dll
Filesize
26KB

MD5
fbda05aa26e02d38effb82294e83ea69

SHA1
aa2291ace177515173315668480c74442e21549d

SHA256
565e439a6262cbe6c8164312ad330930738efa8d4defcbcdcc1eeb752fdb75b3

SHA512
3fd4dcbe059df3078f7709b2b9edbe30744ad7ff6e4cd1c494b40bb796a31838d5c9761fe9db860c38bd929c364df4767435fb85dc4e4115e361dd9d640c256f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9472.tmp\xml.dll
Filesize
26KB

MD5
fbda05aa26e02d38effb82294e83ea69

SHA1
aa2291ace177515173315668480c74442e21549d

SHA256
565e439a6262cbe6c8164312ad330930738efa8d4defcbcdcc1eeb752fdb75b3

SHA512
3fd4dcbe059df3078f7709b2b9edbe30744ad7ff6e4cd1c494b40bb796a31838d5c9761fe9db860c38bd929c364df4767435fb85dc4e4115e361dd9d640c256f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq9472.tmp\xml.dll
Filesize
26KB

MD5
fbda05aa26e02d38effb82294e83ea69

SHA1
aa2291ace177515173315668480c74442e21549d

SHA256
565e439a6262cbe6c8164312ad330930738efa8d4defcbcdcc1eeb752fdb75b3

SHA512
3fd4dcbe059df3078f7709b2b9edbe30744ad7ff6e4cd1c494b40bb796a31838d5c9761fe9db860c38bd929c364df4767435fb85dc4e4115e361dd9d640c256f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\Helper.dll
Filesize
2.0MB

MD5
df80fd9ee2891ecc997e48a09fa74f88

SHA1
9592fa0f405c309e4aa40eaedb5badf8067d85d3

SHA256
71a54c0f7bd02022f131f5cdee27394fde7fdb8feb74a8f20b48bd59fe79e2fc

SHA512
b9b3b14f02e09acc9f2bbd5d4e54bf95c6520eec16532bb1acebeb1474fb16300f416f2a4cce0a73a9a9821281db20d47e7ab4ea9bff7ce4c53a7975d1a18df6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\System.dll
Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\UserInfo.dll
Filesize
4KB

MD5
c7ce0e47c83525983fd2c4c9566b4aad

SHA1
38b7ad7bb32ffae35540fce373b8a671878dc54e

SHA256
6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae

SHA512
ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\UserInfo.dll
Filesize
4KB

MD5
c7ce0e47c83525983fd2c4c9566b4aad

SHA1
38b7ad7bb32ffae35540fce373b8a671878dc54e

SHA256
6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae

SHA512
ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\UserInfo.dll
Filesize
4KB

MD5
c7ce0e47c83525983fd2c4c9566b4aad

SHA1
38b7ad7bb32ffae35540fce373b8a671878dc54e

SHA256
6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae

SHA512
ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe
Filesize
2.1MB

MD5
0b572a69b95f40b1f67a059625fa2063

SHA1
71bd3c553c8e78088b27a30472d490bfefce9840

SHA256
66426e1c325e8ad86bb1680c8638bc3e773da5073e2dbe673d10cf9044386988

SHA512
ccd555468eab205ef15219c768ac0fa0218d9d775b1100cf40e1b0cd08619e49a0899b18b2459d47cd2dd1df452e9b4c09396bf5bbc37fdbe1263802a719de39

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe
Filesize
2.1MB

MD5
0b572a69b95f40b1f67a059625fa2063

SHA1
71bd3c553c8e78088b27a30472d490bfefce9840

SHA256
66426e1c325e8ad86bb1680c8638bc3e773da5073e2dbe673d10cf9044386988

SHA512
ccd555468eab205ef15219c768ac0fa0218d9d775b1100cf40e1b0cd08619e49a0899b18b2459d47cd2dd1df452e9b4c09396bf5bbc37fdbe1263802a719de39

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\MoviesToolbarMediaBar.exe
Filesize
2.1MB

MD5
0b572a69b95f40b1f67a059625fa2063

SHA1
71bd3c553c8e78088b27a30472d490bfefce9840

SHA256
66426e1c325e8ad86bb1680c8638bc3e773da5073e2dbe673d10cf9044386988

SHA512
ccd555468eab205ef15219c768ac0fa0218d9d775b1100cf40e1b0cd08619e49a0899b18b2459d47cd2dd1df452e9b4c09396bf5bbc37fdbe1263802a719de39

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\mediabar.exe
Filesize
2.2MB

MD5
c7d2e92fe164f51e4426cf9571cd5510

SHA1
0164e2ec3b59bff6b5da4ed3a35a04ef0bc5c292

SHA256
7aa8edef8ee83abdbb0867f216bf0825e10b45ce9cfcd39ccb43f8f9b031da7a

SHA512
a73f587309868544f33794f265888e5d3ee59d01e49a6c146215c2161340c483684874bb8899ab91742c7f2c9ea5ed46c833c66cfefb0f80f9988f0350bfe33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\mediabar.exe
Filesize
2.2MB

MD5
c7d2e92fe164f51e4426cf9571cd5510

SHA1
0164e2ec3b59bff6b5da4ed3a35a04ef0bc5c292

SHA256
7aa8edef8ee83abdbb0867f216bf0825e10b45ce9cfcd39ccb43f8f9b031da7a

SHA512
a73f587309868544f33794f265888e5d3ee59d01e49a6c146215c2161340c483684874bb8899ab91742c7f2c9ea5ed46c833c66cfefb0f80f9988f0350bfe33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\pack.exe
Filesize
3.5MB

MD5
2c0c8f844b8db194494ec0862aca1bf8

SHA1
773dc9c434bbb9afe4685fe257688e4a2175c7f6

SHA256
661446c04d731c660b1e57ca9de6cb3754471deb2c98cec9209e99118883bc70

SHA512
ca76b072d6828c6197603308a576e4eaecceabe11fa1e02f64766fe31b61a5cf1f641fa3e9ae3a9dfa216e49972e6ce6accf1fd0f9397a6fb9b3d4139d8c7c48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\nsu51C1.tmp\pack.exe
Filesize
3.5MB

MD5
2c0c8f844b8db194494ec0862aca1bf8

SHA1
773dc9c434bbb9afe4685fe257688e4a2175c7f6

SHA256
661446c04d731c660b1e57ca9de6cb3754471deb2c98cec9209e99118883bc70

SHA512
ca76b072d6828c6197603308a576e4eaecceabe11fa1e02f64766fe31b61a5cf1f641fa3e9ae3a9dfa216e49972e6ce6accf1fd0f9397a6fb9b3d4139d8c7c48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv93A.tmp\registry.dll
Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\somotoimeshmoviestoolbar-manifest.xml
Filesize
9KB

MD5
bf13084e10c0c9e021523fe3fb216acd

SHA1
b4f6d10ac4e9a1eefeb39b5bc20ee9f809e8ad22

SHA256
495c0056381d7ee765c0411556c809e1eeda219fd9dc6e11e76678863455e995

SHA512
6292c824e6072e70796ec6a0d8d435a1c047b11856cbd6b2239129394d12ffde5b34fbfb1932e57b35ff70a339c71b6cf3f33d3ad36d0fd2cee1e9fc4a7d2ab6

Download Submit
memory/244-172-0x0000000000000000-mapping.dmp

Download
memory/552-221-0x0000000000000000-mapping.dmp

Download
memory/1336-215-0x0000000002191000-0x0000000002193000-memory.dmp

Filesize
8KB

Download
memory/1336-220-0x0000000003A61000-0x0000000003A64000-memory.dmp

Filesize
12KB

Download
memory/1336-222-0x0000000003A61000-0x0000000003A65000-memory.dmp

Filesize
16KB

Download
memory/1336-211-0x0000000002171000-0x0000000002175000-memory.dmp

Filesize
16KB

Download
memory/1336-209-0x0000000000000000-mapping.dmp

Download
memory/1336-213-0x0000000002170000-0x0000000002178000-memory.dmp

Filesize
32KB

Download
memory/1488-210-0x0000000000000000-mapping.dmp

Download
memory/1640-226-0x0000000000000000-mapping.dmp

Download
memory/1940-163-0x0000000000000000-mapping.dmp

Download
memory/2872-225-0x0000000000000000-mapping.dmp

Download
memory/3204-216-0x0000000000000000-mapping.dmp

Download
memory/3440-219-0x0000000000000000-mapping.dmp

Download
memory/3744-218-0x0000000003AC1000-0x0000000003AC6000-memory.dmp

Filesize
20KB

Download
memory/3744-190-0x0000000002FF1000-0x0000000002FF3000-memory.dmp

Filesize
8KB

Download
memory/3744-175-0x0000000000000000-mapping.dmp

Download
memory/3744-184-0x0000000002160000-0x0000000002168000-memory.dmp

Filesize
32KB

Download
memory/3744-224-0x00000000042B1000-0x00000000042B5000-memory.dmp

Filesize
16KB

Download
memory/3744-181-0x0000000002161000-0x0000000002165000-memory.dmp

Filesize
16KB

Download
memory/3744-223-0x0000000007251000-0x0000000007254000-memory.dmp

Filesize
12KB

Download
memory/4168-212-0x0000000000000000-mapping.dmp

Download
memory/4400-196-0x0000000002221000-0x0000000002225000-memory.dmp

Filesize
16KB

Download
memory/4400-191-0x0000000000000000-mapping.dmp

Download
memory/4400-199-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/4400-207-0x0000000003021000-0x0000000003024000-memory.dmp

Filesize
12KB

Download
memory/4400-208-0x0000000003021000-0x0000000003025000-memory.dmp

Filesize
16KB

Download
memory/4988-236-0x0000020218F10000-0x0000020218F30000-memory.dmp

Filesize
128KB

Download
memory/4988-241-0x000002022BC68000-0x000002022BC70000-memory.dmp

Filesize
32KB

Download
memory/5092-217-0x0000000000000000-mapping.dmp

Download