17039d8920c1a6f2302272b784383c4737df7e30adc2b6f42d8cde1be21eba66

Analysis

max time kernel
127s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2022 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CNGB_Installer.exe
Size

36.3MB
MD5

9bbbcd32d4d99546d94e6f026501e32a
SHA1

986e306fc79ab6a650cdd516c5e7d97adbbe522a
SHA256

17039d8920c1a6f2302272b784383c4737df7e30adc2b6f42d8cde1be21eba66
SHA512

509e9fc35802415162c123779587d0416f2af4a0911656c21936bad473870df5a29747dcb60e227e2decb29aa38e086e7e7cff19d3237cba89f3dde165c47a18
SSDEEP

786432:YPjHMaI+OxsPtQL1sNyC/dz0Pkf4S87mEFn/GcZkIXK/:Yrl22tAW4qZQ+Utn/GcZJK/

Score

10^/10

agilenet discovery persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 16 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Crynet Game Booster\SeparatorBefore	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Crynet Game Booster\icon = "C:\\Program Files (x86)\\Crynet Solutions\\Crynet Game Booster\\CNGBT.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\lnkfile\shell\Crynet Game Booster\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Crynet Game Booster\command\ = "C:\\Program Files (x86)\\Crynet Solutions\\Crynet Game Booster\\CNGBT.exe %1 %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Crynet Game Booster\SeparatorAfter	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Crynet Game Booster\SeparatorBefore	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Crynet Game Booster\ = "Add to Crynet Game Booster"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Crynet Game Booster\SeparatorAfter	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\Crynet Game Booster\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Crynet Game Booster\command\ = "C:\\Program Files (x86)\\Crynet Solutions\\Crynet Game Booster\\CNGBT.exe %1 %*"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\Crynet Game Booster	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Crynet Game Booster	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\Crynet Game Booster\ = "Add to Crynet Game Booster"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Crynet Game Booster\icon = "C:\\Program Files (x86)\\Crynet Solutions\\Crynet Game Booster\\CNGBT.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\lnkfile\shell\Crynet Game Booster	msiexec.exe

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
3392	AccessDatabaseEngine_X64.exe
4884	dismhost.exe
4328	dismhost.exe
3700	dismhost.exe
760	dismhost.exe
3056	CNGBT.exe
4868	CNGB.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6F3DD387-5AF2-492B-BDE2-30FF2F451241}\InprocServer32\Class = "Microsoft.Office.Interop.Access.Dao.PrivDBEngineClass"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5EC4D34-77DA-4F7A-B8C4-8A910C1C1CFE}\InprocServer32\Class = "Microsoft.Office.Interop.Access.Dao.QueryDefClass"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6F3DD387-5AF2-492B-BDE2-30FF2F451241}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6F3DD387-5AF2-492B-BDE2-30FF2F451241}\InprocServer32\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE9CDADA-F510-49E7-B176-A2304EF2901D}\InprocServer32\SystemDB = "system.mdw"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{252BFDA2-4B21-4872-ABA3-043945949BF8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{812034D2-760F-11CF-9370-00AA00B8BF00}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD7791B9-43FD-42C5-AE42-8DD2811F0419}\InprocServer32\Class = "Microsoft.Office.Interop.Access.Dao.DBEngineClass"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FE9CDADA-F510-49E7-B176-A2304EF2901D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{367E582C-F71C-4BF9-AA1B-9F62B793E9C5}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Access.Dao.TableDefClass"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6F3DD387-5AF2-492B-BDE2-30FF2F451241}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{805B7F91-C9CF-4EDF-ACA6-775664FDFB3E}\InprocServer32\14.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5EC4D34-77DA-4F7A-B8C4-8A910C1C1CFE}\InprocServer32\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1EB89D6-0A9C-4575-A0AE-654A990A454C}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Access.Dao.FieldClass"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B722BCCD-4E68-101B-A2BC-00AA00404770}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E3187A-AFEB-45A5-B754-B33975FC140E}\InprocServer32\ = "C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6F3DD387-5AF2-492B-BDE2-30FF2F451241}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B83A43E-3F73-4A35-BC00-E5726F517DBF}\InprocServer32\InprocServer32 = 780062002700420056005d002a00380041002400340021002100210021004d004b004b0053006b0041006300650052006500640069007300740044006500700065006e00640065006e0063006900650073003e0066002e0030002900460042006600700032004000560070002d0056004800570055006d004500400000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5EC4D34-77DA-4F7A-B8C4-8A910C1C1CFE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{805B7F91-C9CF-4EDF-ACA6-775664FDFB3E}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1EB89D6-0A9C-4575-A0AE-654A990A454C}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1EB89D6-0A9C-4575-A0AE-654A990A454C}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE9CDADA-F510-49E7-B176-A2304EF2901D}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5EC4D34-77DA-4F7A-B8C4-8A910C1C1CFE}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D0B22D03-D05D-4C6D-8AB7-9392E84A87B9}\InprocServer32\Class = "Microsoft.Office.Interop.Access.Dao.RelationClass"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D0B22D03-D05D-4C6D-8AB7-9392E84A87B9}\InprocServer32\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FE9CDADA-F510-49E7-B176-A2304EF2901D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{805B7F91-C9CF-4EDF-ACA6-775664FDFB3E}\InprocServer32\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{805B7F91-C9CF-4EDF-ACA6-775664FDFB3E}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97A2762C-403C-4953-A121-7A75ABCE4373}\InprocServer32\Class = "Microsoft.Office.Interop.Access.Dao.GroupClass"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97A2762C-403C-4953-A121-7A75ABCE4373}\InprocServer32\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{805B7F91-C9CF-4EDF-ACA6-775664FDFB3E}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5EC4D34-77DA-4F7A-B8C4-8A910C1C1CFE}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97E3187A-AFEB-45A5-B754-B33975FC140E}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1EB89D6-0A9C-4575-A0AE-654A990A454C}\InprocServer32\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{97A2762C-403C-4953-A121-7A75ABCE4373}\InprocServer32\14.0.0.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{252BFDA2-4B21-4872-ABA3-043945949BF8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD7791B9-43FD-42C5-AE42-8DD2811F0419}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6F3DD387-5AF2-492B-BDE2-30FF2F451241}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD7791B9-43FD-42C5-AE42-8DD2811F0419}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Access.Dao.DBEngineClass"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{367E582C-F71C-4BF9-AA1B-9F62B793E9C5}\InprocServer32\Class = "Microsoft.Office.Interop.Access.Dao.TableDefClass"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D0B22D03-D05D-4C6D-8AB7-9392E84A87B9}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32\Class = "Microsoft.Office.Interop.Access.Dao.IndexClass"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B83A43E-3F73-4A35-BC00-E5726F517DBF}\InprocServer32\ = "C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3BE786A0-0366-4F5C-9434-25CF162E475E}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{367E582C-F71C-4BF9-AA1B-9F62B793E9C5}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{367E582C-F71C-4BF9-AA1B-9F62B793E9C5}\InprocServer32\14.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{367E582C-F71C-4BF9-AA1B-9F62B793E9C5}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D5EC4D34-77DA-4F7A-B8C4-8A910C1C1CFE}\InprocServer32\14.0.0.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3B83A43E-3F73-4A35-BC00-E5726F517DBF}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B83A43E-3F73-4A35-BC00-E5726F517DBF}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3BE786A0-0366-4F5C-9434-25CF162E475E}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD7791B9-43FD-42C5-AE42-8DD2811F0419}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D0B22D03-D05D-4C6D-8AB7-9392E84A87B9}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97A2762C-403C-4953-A121-7A75ABCE4373}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Access.Dao, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5EC4D34-77DA-4F7A-B8C4-8A910C1C1CFE}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD7791B9-43FD-42C5-AE42-8DD2811F0419}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	CNGB_Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	CNGBT.exe

Loads dropped DLL 64 IoCs

pid	Process
1304	MsiExec.exe
1876	MsiExec.exe
3044	MsiExec.exe
3044	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
1300	MsiExec.exe
1300	MsiExec.exe
1300	MsiExec.exe
1300	MsiExec.exe
1300	MsiExec.exe
1300	MsiExec.exe
1300	MsiExec.exe
1300	MsiExec.exe
1300	MsiExec.exe
1300	MsiExec.exe
700	MsiExec.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4884	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe
4328	dismhost.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/4868-233-0x0000018BAEF60000-0x0000018BAEFC6000-memory.dmp	agile_net

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	CNGB_Installer.exe
File opened (read-only)	\??\Q:	CNGB_Installer.exe
File opened (read-only)	\??\R:	CNGB_Installer.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	CNGB_Installer.exe
File opened (read-only)	\??\G:	CNGB_Installer.exe
File opened (read-only)	\??\K:	CNGB_Installer.exe
File opened (read-only)	\??\S:	CNGB_Installer.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	CNGB_Installer.exe
File opened (read-only)	\??\P:	CNGB_Installer.exe
File opened (read-only)	\??\T:	CNGB_Installer.exe
File opened (read-only)	\??\L:	CNGB_Installer.exe
File opened (read-only)	\??\X:	CNGB_Installer.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	CNGB_Installer.exe
File opened (read-only)	\??\X:	CNGB_Installer.exe
File opened (read-only)	\??\Y:	CNGB_Installer.exe
File opened (read-only)	\??\A:	CNGB_Installer.exe
File opened (read-only)	\??\O:	CNGB_Installer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	CNGB_Installer.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	CNGB_Installer.exe
File opened (read-only)	\??\T:	CNGB_Installer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\F:	CNGB_Installer.exe
File opened (read-only)	\??\O:	CNGB_Installer.exe
File opened (read-only)	\??\E:	CNGB_Installer.exe
File opened (read-only)	\??\I:	CNGB_Installer.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	CNGB_Installer.exe
File opened (read-only)	\??\B:	CNGB_Installer.exe
File opened (read-only)	\??\V:	CNGB_Installer.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	CNGB_Installer.exe
File opened (read-only)	\??\U:	CNGB_Installer.exe
File opened (read-only)	\??\W:	CNGB_Installer.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	CNGB_Installer.exe
File opened (read-only)	\??\L:	CNGB_Installer.exe
File opened (read-only)	\??\R:	CNGB_Installer.exe
File opened (read-only)	\??\M:	CNGB_Installer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	CNGB_Installer.exe
File opened (read-only)	\??\P:	CNGB_Installer.exe
File opened (read-only)	\??\Z:	CNGB_Installer.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	CNGB_Installer.exe
File opened (read-only)	\??\W:	CNGB_Installer.exe
File opened (read-only)	\??\Y:	CNGB_Installer.exe
File opened (read-only)	\??\Z:	CNGB_Installer.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ResourceCleaner.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\tmp\ResourceCleaner.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\symbols\tmp\ResourceCleaner.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\dll\wntdll.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wntdll.pdb	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSECache\AceRedist\1033\Catalog\files14.cat	AccessDatabaseEngine_X64.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\BattleNetLibrary.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\Microsoft.WindowsAPICodePack.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODTXT.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEWSTR.DLL	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\7za.exe	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\tepp.exe	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\578a8f1891a4d5d3b4fb7c55c80b3abat	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\GogLibrary.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\Playnite.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\Transitions.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\bin\cb_resources\7c49b153d4b59f8c0cf8c3e18dc80cb7	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODEXL.DLL	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\CNGB.exe	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\Bunifu_UI_v1.5.3.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\NLog.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\apps\apps x86\1D2AF28EAA254C283DF3B3FCD325DDD6	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\Uninstall.lnk	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\906d02977116ab7a0d611bc36fbbef99	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\Playnite.SDK.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\SQLite-net.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\bin\cb_resources\fdb6a566acddbbac26c0875e4acd0dea	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\bin\cb_resources\a03490c03eaa102dadc25dca3cc6772b	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\bin\cb_resources\75eec5a819fd971e63a55c466a36211c	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCH.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\DPInst32.exe	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\OriginLibrary.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEOLEDB.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXP_XPS.DLL	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\Bunifu.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\EnumInstalledPrograms.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\System.IO.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\crynet.mdb	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\apps\apps x86\2BC4CA278341430CDD04A63E3D27856A	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\VBAJET32.DLL	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\bin\cb_resources\c38caa6ed3ce0d315ef2929bc17154a1	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\bin\cb_resources\30d62a2c5ed9084f681f828f3490ccf5	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEODDBS.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEXBE.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\STSLISTI.DLL	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\DPInst64.exe	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\BethesdaLibrary.dll	msiexec.exe
File created	C:\Program Files (x86)\MSECache\AceRedist\1033\AceRedist.msi	AccessDatabaseEngine_X64.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\MySql.Data.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\bin\cb_resources\68f96eefa7b34346670149f370c7af5a	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\STSLIST.CHM	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\SQLABC_ModernUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEEXCL.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREP.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\EXPSRV.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACEREDST.TXT	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\Microsoft.WindowsAPICodePack.Shell.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\SteamLibrary.dll	msiexec.exe
File created	C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\bin\cb_resources\020be165a3e587d7c83cb489c3ec9923	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\pubpol23.dat	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File created	C:\Windows\assembly\tmp\YR3P39R8\INPFP81W	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\000041091D0090400100000000F01FEC	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICABB.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{90140000-00D1-0409-1000-0000000FF1CE}	msiexec.exe
File opened for modification	C:\Windows\Installer\e56e5c5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC49C.tmp	msiexec.exe
File created	C:\Windows\Installer\{123E1B2E-7C16-4B0A-BC3A-AEABFEF0CA65}\cryneticon.4.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{123E1B2E-7C16-4B0A-BC3A-AEABFEF0CA65}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA5A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF508.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA03F.tmp	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol24.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA529.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEDC0.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221223165750473.0\9.0.30729.4148.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221223165750410.0\msvcm90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221223165750410.0	msiexec.exe
File created	C:\Windows\Installer\e56e5c5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FD1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Installer\MSIF061.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221223165750473.0\9.0.30729.4148.cat	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Installer\MSIC3D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{123E1B2E-7C16-4B0A-BC3A-AEABFEF0CA65}\cryneticon.4.exe	msiexec.exe
File created	C:\Windows\assembly\tmp\YJN08SWU\Microsoft.Office.interop.access.dao.dll	msiexec.exe
File created	C:\Windows\Installer\e56e5c4.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221223165750410.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_069f922e.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC391.tmp	msiexec.exe
File created	C:\Windows\Installer\e56e5c1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF311.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221223165750410.0\msvcr90.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\000041091D0090400100000000F01FEC\14.0.7015\OSE.EXE	msiexec.exe
File opened for modification	C:\Windows\assembly\PublisherPolicy.tme	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Installer\MSICAAA.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20221223165750410.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_069f922e.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\000041091D0090400100000000F01FEC\14.0.7015	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA40E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA46D.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Installer\MSICA8A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF3A0.tmp	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCDF.tmp	msiexec.exe
File created	C:\Windows\Tasks\C__Users_Admin_AppData_Local_Temp_CNGB_Installer.exe.job	CNGB_Installer.exe
File created	C:\Windows\Installer\{123E1B2E-7C16-4B0A-BC3A-AEABFEF0CA65}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\000041091D0090400100000000F01FEC\14.0.7015\OSE.EXE	msiexec.exe
File created	C:\Windows\assembly\pubpol24.dat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20221223165750473.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{123E1B2E-7C16-4B0A-BC3A-AEABFEF0CA65}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF322.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2D2.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\YR3P39R8\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000005cb6ed2f2c7878f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000005cb6ed20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090005cb6ed2000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000005cb6ed200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000005cb6ed200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{d26ecb05-0000-0000-0000-d01200000000}\MaxCapacity = "15140"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{d26ecb05-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{d26ecb05-0000-0000-0000-d01200000000}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{00000099-0000-0010-8000-00AA006D2EA4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0328-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0368-0000-0000-C000-000000000046}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0398-0000-0000-C000-000000000046}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0000003B-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C170B-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C03C4-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C03F1-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D0B22D03-D05D-4C6D-8AB7-9392E84A87B9}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Access.Dao.RelationClass"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C0321-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C0372-0000-0000-C000-000000000046}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C03B2-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DAO.Relation.120\ = "Microsoft Office 12.0 Access Database Engine Relation"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\Version = "2.5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C0914-0000-0000-C000-000000000046}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{00194002-D9C3-11D3-8D59-0050048384E3}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C0392-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C1724-0000-0000-C000-000000000046}\ = "IMsoPlotArea"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C172A-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4AC9E1DA-5BAD-4AC7-86E3-24F4CDCECA28}\c.0\0\Win32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C0322-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CAC6328-B9B0-11D3-8D59-0050048384E3}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C037B-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000CD903-0000-0000-C000-000000000046}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000CD6A2-0000-0000-C000-000000000046}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C033C-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C1727-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03C9-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DAO.PrivateDBEngine.120\ = "Microsoft Office 12.0 Access Database Engine PrivateDBEngine"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0385-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C033B-0000-0000-C000-000000000046}\ = "_CustomTaskPane"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{00000049-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C038F-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C0398-0000-0000-C000-000000000046}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C1728-0000-0000-C000-000000000046}\TypeLib\Version = "2.5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C1726-0000-0000-C000-000000000046}\TypeLib	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2B1E32161C7A0B4CBA3EABAEF0FAC56\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000059-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000031-0000-0010-8000-00AA006D2EA4}\ = "Recordset"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{00000033-0000-0010-8000-00AA006D2EA4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000CD6A3-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C1730-0000-0000-C000-000000000046}\ = "IMsoChartFormat"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C03CC-0000-0000-C000-000000000046}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03E2-0000-0000-C000-000000000046}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1EB89D6-0A9C-4575-A0AE-654A990A454C}\ProgID\ = "DAO.Field.120"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{57CD4321-2AEC-3A3A-B673-E9542ED0C9A3}\14.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD7791B9-43FD-42C5-AE42-8DD2811F0419}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Access.Dao.DBEngineClass"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0333-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000CD900-0000-0000-C000-000000000046}\TypeLib\Version = "2.5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C03CD-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2B1E32161C7A0B4CBA3EABAEF0FAC56\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000059-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000099-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C030E-0000-0000-C000-000000000046}\ = "_CommandBarButton"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C031A-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000CD102-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{000C1716-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03F0-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{2EF8E039-F0C8-3A24-B0C7-F151D7F584E5}\14.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0311-0000-0000-C000-000000000046}\ = "CalloutFormat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0368-0000-0000-C000-000000000046}\ = "ScopeFolder"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000CDB0E-0000-0000-C000-000000000046}\ = "CustomXMLValidationError"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03D0-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{0000005D-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4840	msiexec.exe
4840	msiexec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4540	MsiExec.exe
4840	msiexec.exe
4840	msiexec.exe
700	MsiExec.exe
700	MsiExec.exe
3056	CNGBT.exe
4868	CNGB.exe
4868	CNGB.exe
4868	CNGB.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4840	msiexec.exe
Token: SeCreateTokenPrivilege	1084	CNGB_Installer.exe
Token: SeAssignPrimaryTokenPrivilege	1084	CNGB_Installer.exe
Token: SeLockMemoryPrivilege	1084	CNGB_Installer.exe
Token: SeIncreaseQuotaPrivilege	1084	CNGB_Installer.exe
Token: SeMachineAccountPrivilege	1084	CNGB_Installer.exe
Token: SeTcbPrivilege	1084	CNGB_Installer.exe
Token: SeSecurityPrivilege	1084	CNGB_Installer.exe
Token: SeTakeOwnershipPrivilege	1084	CNGB_Installer.exe
Token: SeLoadDriverPrivilege	1084	CNGB_Installer.exe
Token: SeSystemProfilePrivilege	1084	CNGB_Installer.exe
Token: SeSystemtimePrivilege	1084	CNGB_Installer.exe
Token: SeProfSingleProcessPrivilege	1084	CNGB_Installer.exe
Token: SeIncBasePriorityPrivilege	1084	CNGB_Installer.exe
Token: SeCreatePagefilePrivilege	1084	CNGB_Installer.exe
Token: SeCreatePermanentPrivilege	1084	CNGB_Installer.exe
Token: SeBackupPrivilege	1084	CNGB_Installer.exe
Token: SeRestorePrivilege	1084	CNGB_Installer.exe
Token: SeShutdownPrivilege	1084	CNGB_Installer.exe
Token: SeDebugPrivilege	1084	CNGB_Installer.exe
Token: SeAuditPrivilege	1084	CNGB_Installer.exe
Token: SeSystemEnvironmentPrivilege	1084	CNGB_Installer.exe
Token: SeChangeNotifyPrivilege	1084	CNGB_Installer.exe
Token: SeRemoteShutdownPrivilege	1084	CNGB_Installer.exe
Token: SeUndockPrivilege	1084	CNGB_Installer.exe
Token: SeSyncAgentPrivilege	1084	CNGB_Installer.exe
Token: SeEnableDelegationPrivilege	1084	CNGB_Installer.exe
Token: SeManageVolumePrivilege	1084	CNGB_Installer.exe
Token: SeImpersonatePrivilege	1084	CNGB_Installer.exe
Token: SeCreateGlobalPrivilege	1084	CNGB_Installer.exe
Token: SeCreateTokenPrivilege	1084	CNGB_Installer.exe
Token: SeAssignPrimaryTokenPrivilege	1084	CNGB_Installer.exe
Token: SeLockMemoryPrivilege	1084	CNGB_Installer.exe
Token: SeIncreaseQuotaPrivilege	1084	CNGB_Installer.exe
Token: SeMachineAccountPrivilege	1084	CNGB_Installer.exe
Token: SeTcbPrivilege	1084	CNGB_Installer.exe
Token: SeSecurityPrivilege	1084	CNGB_Installer.exe
Token: SeTakeOwnershipPrivilege	1084	CNGB_Installer.exe
Token: SeLoadDriverPrivilege	1084	CNGB_Installer.exe
Token: SeSystemProfilePrivilege	1084	CNGB_Installer.exe
Token: SeSystemtimePrivilege	1084	CNGB_Installer.exe
Token: SeProfSingleProcessPrivilege	1084	CNGB_Installer.exe
Token: SeIncBasePriorityPrivilege	1084	CNGB_Installer.exe
Token: SeCreatePagefilePrivilege	1084	CNGB_Installer.exe
Token: SeCreatePermanentPrivilege	1084	CNGB_Installer.exe
Token: SeBackupPrivilege	1084	CNGB_Installer.exe
Token: SeRestorePrivilege	1084	CNGB_Installer.exe
Token: SeShutdownPrivilege	1084	CNGB_Installer.exe
Token: SeDebugPrivilege	1084	CNGB_Installer.exe
Token: SeAuditPrivilege	1084	CNGB_Installer.exe
Token: SeSystemEnvironmentPrivilege	1084	CNGB_Installer.exe
Token: SeChangeNotifyPrivilege	1084	CNGB_Installer.exe
Token: SeRemoteShutdownPrivilege	1084	CNGB_Installer.exe
Token: SeUndockPrivilege	1084	CNGB_Installer.exe
Token: SeSyncAgentPrivilege	1084	CNGB_Installer.exe
Token: SeEnableDelegationPrivilege	1084	CNGB_Installer.exe
Token: SeManageVolumePrivilege	1084	CNGB_Installer.exe
Token: SeImpersonatePrivilege	1084	CNGB_Installer.exe
Token: SeCreateGlobalPrivilege	1084	CNGB_Installer.exe
Token: SeCreateTokenPrivilege	1084	CNGB_Installer.exe
Token: SeAssignPrimaryTokenPrivilege	1084	CNGB_Installer.exe
Token: SeLockMemoryPrivilege	1084	CNGB_Installer.exe
Token: SeIncreaseQuotaPrivilege	1084	CNGB_Installer.exe
Token: SeMachineAccountPrivilege	1084	CNGB_Installer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1084	CNGB_Installer.exe
1084	CNGB_Installer.exe
3056	CNGBT.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3056	CNGBT.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4868	CNGB.exe
4868	CNGB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 1304	4840	msiexec.exe	83
PID 4840 wrote to memory of 1304	4840	msiexec.exe	83
PID 4840 wrote to memory of 1304	4840	msiexec.exe	83
PID 1084 wrote to memory of 3392	1084	CNGB_Installer.exe	92
PID 1084 wrote to memory of 3392	1084	CNGB_Installer.exe	92
PID 1084 wrote to memory of 3392	1084	CNGB_Installer.exe	92
PID 4840 wrote to memory of 1876	4840	msiexec.exe	93
PID 4840 wrote to memory of 1876	4840	msiexec.exe	93
PID 4840 wrote to memory of 3044	4840	msiexec.exe	94
PID 4840 wrote to memory of 3044	4840	msiexec.exe	94
PID 4840 wrote to memory of 3044	4840	msiexec.exe	94
PID 4840 wrote to memory of 4540	4840	msiexec.exe	96
PID 4840 wrote to memory of 4540	4840	msiexec.exe	96
PID 4840 wrote to memory of 4540	4840	msiexec.exe	96
PID 1084 wrote to memory of 2988	1084	CNGB_Installer.exe	97
PID 1084 wrote to memory of 2988	1084	CNGB_Installer.exe	97
PID 1084 wrote to memory of 2988	1084	CNGB_Installer.exe	97
PID 4840 wrote to memory of 2740	4840	msiexec.exe	101
PID 4840 wrote to memory of 2740	4840	msiexec.exe	101
PID 4840 wrote to memory of 1300	4840	msiexec.exe	103
PID 4840 wrote to memory of 1300	4840	msiexec.exe	103
PID 4840 wrote to memory of 1300	4840	msiexec.exe	103
PID 4840 wrote to memory of 700	4840	msiexec.exe	104
PID 4840 wrote to memory of 700	4840	msiexec.exe	104
PID 4840 wrote to memory of 700	4840	msiexec.exe	104
PID 700 wrote to memory of 3772	700	MsiExec.exe	105
PID 700 wrote to memory of 3772	700	MsiExec.exe	105
PID 3772 wrote to memory of 4884	3772	dism.exe	107
PID 3772 wrote to memory of 4884	3772	dism.exe	107
PID 700 wrote to memory of 4756	700	MsiExec.exe	108
PID 700 wrote to memory of 4756	700	MsiExec.exe	108
PID 4756 wrote to memory of 4328	4756	dism.exe	110
PID 4756 wrote to memory of 4328	4756	dism.exe	110
PID 700 wrote to memory of 5088	700	MsiExec.exe	111
PID 700 wrote to memory of 5088	700	MsiExec.exe	111
PID 5088 wrote to memory of 3700	5088	dism.exe	113
PID 5088 wrote to memory of 3700	5088	dism.exe	113
PID 700 wrote to memory of 2636	700	MsiExec.exe	114
PID 700 wrote to memory of 2636	700	MsiExec.exe	114
PID 2636 wrote to memory of 760	2636	dism.exe	116
PID 2636 wrote to memory of 760	2636	dism.exe	116
PID 700 wrote to memory of 2564	700	MsiExec.exe	117
PID 700 wrote to memory of 2564	700	MsiExec.exe	117
PID 700 wrote to memory of 2564	700	MsiExec.exe	117
PID 2564 wrote to memory of 1364	2564	cmd.exe	119
PID 2564 wrote to memory of 1364	2564	cmd.exe	119
PID 2564 wrote to memory of 1364	2564	cmd.exe	119
PID 700 wrote to memory of 3124	700	MsiExec.exe	120
PID 700 wrote to memory of 3124	700	MsiExec.exe	120
PID 700 wrote to memory of 3124	700	MsiExec.exe	120
PID 700 wrote to memory of 904	700	MsiExec.exe	122
PID 700 wrote to memory of 904	700	MsiExec.exe	122
PID 700 wrote to memory of 904	700	MsiExec.exe	122
PID 904 wrote to memory of 728	904	cmd.exe	124
PID 904 wrote to memory of 728	904	cmd.exe	124
PID 904 wrote to memory of 728	904	cmd.exe	124
PID 904 wrote to memory of 5092	904	cmd.exe	126
PID 904 wrote to memory of 5092	904	cmd.exe	126
PID 904 wrote to memory of 5092	904	cmd.exe	126
PID 904 wrote to memory of 3608	904	cmd.exe	127
PID 904 wrote to memory of 3608	904	cmd.exe	127
PID 904 wrote to memory of 3608	904	cmd.exe	127
PID 700 wrote to memory of 4112	700	MsiExec.exe	128
PID 700 wrote to memory of 4112	700	MsiExec.exe	128

C:\Users\Admin\AppData\Local\Temp\CNGB_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\CNGB_Installer.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Roaming\Crynet Solutions\Crynet Game Booster\prerequisites\AccessDatabaseEngine_X64.exe
  "C:\Users\Admin\AppData\Roaming\Crynet Solutions\Crynet Game Booster\prerequisites\AccessDatabaseEngine_X64.exe" /quiet
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3392
- C:\Users\Admin\AppData\Local\Temp\CNGB_Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\CNGB_Installer.exe" /i "C:\Users\Admin\AppData\Local\Temp\{123E1B2E-7C16-4B0A-BC3A-AEABFEF0CA65}\Crynet Game Booster.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster" CLIENTPROCESSID="1084" SECONDSEQUENCE="1" CHAINERUIPROCESSID="1084Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_MISSING_PREREQS="Access Database Engine (30 MB)" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\CNGB_Installer.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\CNGB_Installer.exe" AI_INSTALL="1"
  2⤵
  - Enumerates connected drives
  PID:2988

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8A54E98C0C49B0C828FCD9FA4E1A41A1 C
  2⤵
  - Loads dropped DLL
  PID:1304
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4EFD042C3D96A8363291AFA60B42957A
  2⤵
  - Loads dropped DLL
  PID:1876
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 683887F17CD37525C67F18D7970402B3
  2⤵
  - Loads dropped DLL
  PID:3044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FD76177D6EDE27D89D47AF180E19F75E C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- - C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\CNGBT.exe
    "C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\CNGBT.exe" mainui
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3056
  - - C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\CNGB.exe
      "C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\CNGB.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4868
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 625D33FD3863779693EC7E321340F096
  2⤵
  - Loads dropped DLL
  PID:1300
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0D7A2078EEA5F6AE0256134453485991 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\dism.exe
    /quiet /norestart /english /online /get-features /format:table
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\5111F11C-871F-4421-BADB-475113EC0E79\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\5111F11C-871F-4421-BADB-475113EC0E79\dismhost.exe {3CA4F756-F815-4071-9915-7AE6C9490AF5}
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      PID:4884
- - C:\Windows\system32\dism.exe
    /quiet /norestart /english /online /get-features /format:table
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\397B2C1F-CFA3-4888-A125-73AB201FF4F4\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\397B2C1F-CFA3-4888-A125-73AB201FF4F4\dismhost.exe {F37E9B5B-6504-49E2-9B89-DA938C1B3E32}
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      PID:4328
- - C:\Windows\system32\dism.exe
    /quiet /norestart /english /online /get-features /format:table
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\3B75C6D8-4DB7-4A80-B556-3553800F090B\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\3B75C6D8-4DB7-4A80-B556-3553800F090B\dismhost.exe {EBC64690-1A10-4530-8902-8C5D9288DCA9}
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:3700
- - C:\Windows\system32\dism.exe
    /quiet /norestart /english /online /get-features /format:table
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\1E0F6E49-4832-4E05-BA10-C930C23E2ACC\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\1E0F6E49-4832-4E05-BA10-C930C23E2ACC\dismhost.exe {4561558A-7076-48C2-9F2A-BCAAE17C2926}
      4⤵
      Executes dropped EXE
      PID:760
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{45FE3379-E366-46E9-B1E4-2B786E68634D}.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1364
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{45FE3379-E366-46E9-B1E4-2B786E68634D}.bat"
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{62E7A693-BAA2-4484-8020-F4DC0E3D4A3D}.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c dir /b /a "0"
      4⤵
      PID:728
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy /E /Y /K /H /I "0\*" "C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\"
      4⤵
      Enumerates system info in registry
      PID:5092
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:3608
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{2E46CE3E-3A6C-48D5-9A14-0E8045012601}.bat"
    3⤵
    PID:4112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c dir /b /a "1"
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\xcopy.exe
      xcopy /E /Y /K /H /I "1\*" "C:\Program Files (x86)\Crynet Solutions\Crynet Game Booster\"
      4⤵
      Enumerates system info in registry
      PID:3716
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4796

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MSECache\AceRedist\1033\AceRedist.msi

Filesize
27.7MB

MD5
45da4b73e3c5b6c844d1d1ffca6c3e0c

SHA1
d62050075fed6da1666d43cc127a28478cdd1351

SHA256
ab5c2a174d8d466dd4d941095ef433d91d433b4f3766fdaca09abc7e5a03c050

SHA512
2ba2a905d4fea0b964331242c7ce117c8f5d3ff3c91856e057f3c02a80ff5abcc34e71b88e1f242dd2ddf2e98f3fc80f715fa9668093f48ac12bb137590fde0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5111F11C-871F-4421-BADB-475113EC0E79\DismCorePS.dll

Filesize
183KB

MD5
a033f16836d6f8acbe3b27b614b51453

SHA1
716297072897aea3ec985640793d2cdcbf996cf9

SHA256
e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e

SHA512
ad5b641d93ad35b3c7a3b56cdf576750d1ad4c63e2a16006739888f0702280cad57dd0a6553ef426111c04ceafd6d1e87f6e7486a171fff77f243311aee83871

Download Submit
C:\Users\Admin\AppData\Local\Temp\5111F11C-871F-4421-BADB-475113EC0E79\DismCorePS.dll

Filesize
183KB

MD5
a033f16836d6f8acbe3b27b614b51453

SHA1
716297072897aea3ec985640793d2cdcbf996cf9

SHA256
e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e

SHA512
ad5b641d93ad35b3c7a3b56cdf576750d1ad4c63e2a16006739888f0702280cad57dd0a6553ef426111c04ceafd6d1e87f6e7486a171fff77f243311aee83871

Download Submit
C:\Users\Admin\AppData\Local\Temp\5111F11C-871F-4421-BADB-475113EC0E79\DismHost.exe

Filesize
142KB

MD5
e5d5e9c1f65b8ec7aa5b7f1b1acdd731

SHA1
dbb14dcda6502ab1d23a7c77d405dafbcbeb439e

SHA256
e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80

SHA512
7cf80d4a16c5dbbf61fcb22ebe30cf78ca42a030b7d7b4ad017f28fba2c9b111e8cf5b3064621453a44869bbaed124d6fb1e8d2c8fe8202f1e47579d874fa4bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\5111F11C-871F-4421-BADB-475113EC0E79\DismProv.dll

Filesize
255KB

MD5
490be3119ea17fa29329e77b7e416e80

SHA1
c71191c3415c98b7d9c9bbcf1005ce6a813221da

SHA256
ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a

SHA512
6339b030008b7d009d36abf0f9595da9b793264ebdce156d4a330d095a5d7602ba074075ea05fef3dde474fc1d8e778480429de308c121df0bf3075177f26f13

Download Submit
C:\Users\Admin\AppData\Local\Temp\5111F11C-871F-4421-BADB-475113EC0E79\dismprov.dll

Filesize
255KB

MD5
490be3119ea17fa29329e77b7e416e80

SHA1
c71191c3415c98b7d9c9bbcf1005ce6a813221da

SHA256
ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a

SHA512
6339b030008b7d009d36abf0f9595da9b793264ebdce156d4a330d095a5d7602ba074075ea05fef3dde474fc1d8e778480429de308c121df0bf3075177f26f13

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI16D6.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI16D6.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1734.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1734.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1735.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1735.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1746.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1746.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1757.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1757.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI17D5.tmp

Filesize
381KB

MD5
187b28dc39caa752ec53aacf7fa095ec

SHA1
28b16a15ee7808c7347644d1539fdea1e0976626

SHA256
9585df326a864f7e3aa7eacb589e2c05a57f19535a8c54570b9ec6743dad0b0e

SHA512
702c91d997fdf327e1730d20b80196d94030b6e24cd53f3364914c39f8f28fdcb95b5c4d4f8d8bdaa29aa0f4741de4de9fa954d3f22d7bf606ebe8dce1fabc66

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI17D5.tmp

Filesize
381KB

MD5
187b28dc39caa752ec53aacf7fa095ec

SHA1
28b16a15ee7808c7347644d1539fdea1e0976626

SHA256
9585df326a864f7e3aa7eacb589e2c05a57f19535a8c54570b9ec6743dad0b0e

SHA512
702c91d997fdf327e1730d20b80196d94030b6e24cd53f3364914c39f8f28fdcb95b5c4d4f8d8bdaa29aa0f4741de4de9fa954d3f22d7bf606ebe8dce1fabc66

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1824.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1824.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1863.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1863.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI18A3.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI18A3.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI18B3.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI18B3.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6DF2.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI6DF2.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Access Database Engine 2010 (0).log

Filesize
1KB

MD5
ecd12fe3e1439aaed947cdd34f6757c2

SHA1
37db1a5198429ae7cb608a926c85f91eea107c02

SHA256
50769844b1e43a2cbf76a9dfe3bba306b7888c1bab14d6f61c5160075b7a2291

SHA512
d8b305dab7276238abde71b3930a569c94e07546d55445b3a21808485dfc38ab75331ed5342b6b3bbc2931940f158210dd7ba89e8dac3ad76ca899942c5ba445

Download Submit
C:\Users\Admin\AppData\Local\Temp\{123E1B2E-7C16-4B0A-BC3A-AEABFEF0CA65}\Crynet Game Booster.msi

Filesize
3.3MB

MD5
de469c5d5a27a34420491978e2df2f32

SHA1
60a44e1ee74e6f220137f2fb1bc167d284724b05

SHA256
80d8df58b80397347e084b781df7c5066e4a33ef044829f97097e2d00ff52a50

SHA512
f9cd44e71eef7fedf22d81fb2f31858a685063f0241759d652907a1d98ace38751e72e6b6c88dbef9c98d6d63aed7af5f28815151e6d0a983a535dcc314f4d93

Download Submit
C:\Users\Admin\AppData\Roaming\Crynet Solutions\Crynet Game Booster\prerequisites\AccessDatabaseEngine_X64.exe

Filesize
27.3MB

MD5
54b4128152d27f652a7805acd4ae75d6

SHA1
8d52e4d00054af5c131740896355bfc283904289

SHA256
15e5151bde13aa6756b7d0c74db5831932559fc4a60d1f7a43ed1f44e8102558

SHA512
72895cd7bde4833ba3d45a6be8d23d817387f1f2dcf6c267b56a7b45d87106d8e6e1c537ca88a354e5ee79e43934047a57accef81bec43451ee13fd561c9f770

Download Submit
C:\Users\Admin\AppData\Roaming\Crynet Solutions\Crynet Game Booster\prerequisites\AccessDatabaseEngine_X64.exe

Filesize
27.3MB

MD5
54b4128152d27f652a7805acd4ae75d6

SHA1
8d52e4d00054af5c131740896355bfc283904289

SHA256
15e5151bde13aa6756b7d0c74db5831932559fc4a60d1f7a43ed1f44e8102558

SHA512
72895cd7bde4833ba3d45a6be8d23d817387f1f2dcf6c267b56a7b45d87106d8e6e1c537ca88a354e5ee79e43934047a57accef81bec43451ee13fd561c9f770

Download Submit
C:\Windows\Installer\MSI9F72.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Windows\Installer\MSI9F72.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Windows\Installer\MSI9FD1.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Windows\Installer\MSI9FD1.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Windows\Installer\MSIA03F.tmp

Filesize
381KB

MD5
187b28dc39caa752ec53aacf7fa095ec

SHA1
28b16a15ee7808c7347644d1539fdea1e0976626

SHA256
9585df326a864f7e3aa7eacb589e2c05a57f19535a8c54570b9ec6743dad0b0e

SHA512
702c91d997fdf327e1730d20b80196d94030b6e24cd53f3364914c39f8f28fdcb95b5c4d4f8d8bdaa29aa0f4741de4de9fa954d3f22d7bf606ebe8dce1fabc66

Download Submit
C:\Windows\Installer\MSIA03F.tmp

Filesize
381KB

MD5
187b28dc39caa752ec53aacf7fa095ec

SHA1
28b16a15ee7808c7347644d1539fdea1e0976626

SHA256
9585df326a864f7e3aa7eacb589e2c05a57f19535a8c54570b9ec6743dad0b0e

SHA512
702c91d997fdf327e1730d20b80196d94030b6e24cd53f3364914c39f8f28fdcb95b5c4d4f8d8bdaa29aa0f4741de4de9fa954d3f22d7bf606ebe8dce1fabc66

Download Submit
C:\Windows\Installer\MSIA2C1.tmp

Filesize
699KB

MD5
63bf44c4354c1892260df74b594d8be2

SHA1
fbdf1576f1e1cb8e254ca5cfdd63b3e08ec15ad6

SHA256
bb76ad8868c790bebeeea5201d5b3ba43b8e7f4a8cc964bd7c985058b2442f38

SHA512
9b193c7f88b3d2295932dcee720a2a673569b50f06ceb154f204d8cb1edc270f3cdf110aea3b92ffaacc299fa941a8710aea7363a0582ed2f9fe3288d44633b0

Download Submit
C:\Windows\Installer\MSIA2C1.tmp

Filesize
699KB

MD5
63bf44c4354c1892260df74b594d8be2

SHA1
fbdf1576f1e1cb8e254ca5cfdd63b3e08ec15ad6

SHA256
bb76ad8868c790bebeeea5201d5b3ba43b8e7f4a8cc964bd7c985058b2442f38

SHA512
9b193c7f88b3d2295932dcee720a2a673569b50f06ceb154f204d8cb1edc270f3cdf110aea3b92ffaacc299fa941a8710aea7363a0582ed2f9fe3288d44633b0

Download Submit
C:\Windows\Installer\MSIA2D2.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Windows\Installer\MSIA2D2.tmp

Filesize
259KB

MD5
f4856ffe500e45f2ee07ccebb06f9958

SHA1
905bfb953d755d965a900a0d4ba05619bfe0ef3f

SHA256
7238299a109a796d086d9cf611ffef1e4ae768898b1006022f464890544482b8

SHA512
31d02f0b041495853ab98c93808b6efc7a866ce282334d60edd60c4167b6f1b87d06b50a73c3784417a5878be290616fe8587eca5d7f6b5699c3a0aa91170820

Download Submit
C:\Windows\Installer\MSIA380.tmp

Filesize
621KB

MD5
b93e5fa88017a228ee1091d766bbfe13

SHA1
8f7fc1e2c4c01d6f8277aaeeb02a9ef68f088af7

SHA256
d7b541d96212954fcd68c6099978fc3fd94014fd11059228949807fdb0c35bed

SHA512
a9447fefa1a9d8998876849e4a3c18bdaa67d7c3fd6342d565bd54adaca0f669180f63987da410a41fe21799a5c40a144670a0eb995a71924ad28df9b616ae07

Download Submit
C:\Windows\Installer\MSIA380.tmp

Filesize
621KB

MD5
b93e5fa88017a228ee1091d766bbfe13

SHA1
8f7fc1e2c4c01d6f8277aaeeb02a9ef68f088af7

SHA256
d7b541d96212954fcd68c6099978fc3fd94014fd11059228949807fdb0c35bed

SHA512
a9447fefa1a9d8998876849e4a3c18bdaa67d7c3fd6342d565bd54adaca0f669180f63987da410a41fe21799a5c40a144670a0eb995a71924ad28df9b616ae07

Download Submit
C:\Windows\Installer\MSIA3EE.tmp

Filesize
116KB

MD5
9ee37574c451f62188edb510214f22c1

SHA1
22b50374f6f18ddc29fbf79a89d6ef0bb1754516

SHA256
562a1cb8ff0be05f94a3bd54cc7dae46403ba575d08c69b80cd0f8f7d4ff385e

SHA512
3d1a96c14426e2d814dbea62935fcb0edd150923661288f29aedb7878a2fc4e309de06c7166684c36fbe26de490bf68e62ccac6f4b7252154e6b78371f90567a

Download Submit
C:\Windows\Installer\MSIA3EE.tmp

Filesize
116KB

MD5
9ee37574c451f62188edb510214f22c1

SHA1
22b50374f6f18ddc29fbf79a89d6ef0bb1754516

SHA256
562a1cb8ff0be05f94a3bd54cc7dae46403ba575d08c69b80cd0f8f7d4ff385e

SHA512
3d1a96c14426e2d814dbea62935fcb0edd150923661288f29aedb7878a2fc4e309de06c7166684c36fbe26de490bf68e62ccac6f4b7252154e6b78371f90567a

Download Submit
C:\Windows\Installer\MSIA40E.tmp

Filesize
142KB

MD5
666fcfb5348442ef0fa7d151c96b25f9

SHA1
d675ba472a76878be8960d5bb88b68aedd8165b4

SHA256
c5a832d70c363f10703493b3bf0583c6003498dd9c4d54932e6dd03262922e77

SHA512
dacbe03a4ebe6f05f76c979e5d9c4b75880c981e109ef6ced4d686da686e6e903e698f493d775548fa4c339b3c88efeccc9697245b7cecfa772a99b02ce7eecb

Download Submit
C:\Windows\Installer\MSIA40E.tmp

Filesize
142KB

MD5
666fcfb5348442ef0fa7d151c96b25f9

SHA1
d675ba472a76878be8960d5bb88b68aedd8165b4

SHA256
c5a832d70c363f10703493b3bf0583c6003498dd9c4d54932e6dd03262922e77

SHA512
dacbe03a4ebe6f05f76c979e5d9c4b75880c981e109ef6ced4d686da686e6e903e698f493d775548fa4c339b3c88efeccc9697245b7cecfa772a99b02ce7eecb

Download Submit
C:\Windows\Installer\MSIA46D.tmp

Filesize
699KB

MD5
63bf44c4354c1892260df74b594d8be2

SHA1
fbdf1576f1e1cb8e254ca5cfdd63b3e08ec15ad6

SHA256
bb76ad8868c790bebeeea5201d5b3ba43b8e7f4a8cc964bd7c985058b2442f38

SHA512
9b193c7f88b3d2295932dcee720a2a673569b50f06ceb154f204d8cb1edc270f3cdf110aea3b92ffaacc299fa941a8710aea7363a0582ed2f9fe3288d44633b0

Download Submit
C:\Windows\Installer\MSIA46D.tmp

Filesize
699KB

MD5
63bf44c4354c1892260df74b594d8be2

SHA1
fbdf1576f1e1cb8e254ca5cfdd63b3e08ec15ad6

SHA256
bb76ad8868c790bebeeea5201d5b3ba43b8e7f4a8cc964bd7c985058b2442f38

SHA512
9b193c7f88b3d2295932dcee720a2a673569b50f06ceb154f204d8cb1edc270f3cdf110aea3b92ffaacc299fa941a8710aea7363a0582ed2f9fe3288d44633b0

Download Submit
C:\Windows\Installer\MSIA529.tmp

Filesize
381KB

MD5
187b28dc39caa752ec53aacf7fa095ec

SHA1
28b16a15ee7808c7347644d1539fdea1e0976626

SHA256
9585df326a864f7e3aa7eacb589e2c05a57f19535a8c54570b9ec6743dad0b0e

SHA512
702c91d997fdf327e1730d20b80196d94030b6e24cd53f3364914c39f8f28fdcb95b5c4d4f8d8bdaa29aa0f4741de4de9fa954d3f22d7bf606ebe8dce1fabc66

Download Submit
C:\Windows\Installer\MSIA529.tmp

Filesize
381KB

MD5
187b28dc39caa752ec53aacf7fa095ec

SHA1
28b16a15ee7808c7347644d1539fdea1e0976626

SHA256
9585df326a864f7e3aa7eacb589e2c05a57f19535a8c54570b9ec6743dad0b0e

SHA512
702c91d997fdf327e1730d20b80196d94030b6e24cd53f3364914c39f8f28fdcb95b5c4d4f8d8bdaa29aa0f4741de4de9fa954d3f22d7bf606ebe8dce1fabc66

Download Submit
C:\Windows\Installer\MSIA5D6.tmp

Filesize
621KB

MD5
b93e5fa88017a228ee1091d766bbfe13

SHA1
8f7fc1e2c4c01d6f8277aaeeb02a9ef68f088af7

SHA256
d7b541d96212954fcd68c6099978fc3fd94014fd11059228949807fdb0c35bed

SHA512
a9447fefa1a9d8998876849e4a3c18bdaa67d7c3fd6342d565bd54adaca0f669180f63987da410a41fe21799a5c40a144670a0eb995a71924ad28df9b616ae07

Download Submit
C:\Windows\Installer\MSIA5D6.tmp

Filesize
621KB

MD5
b93e5fa88017a228ee1091d766bbfe13

SHA1
8f7fc1e2c4c01d6f8277aaeeb02a9ef68f088af7

SHA256
d7b541d96212954fcd68c6099978fc3fd94014fd11059228949807fdb0c35bed

SHA512
a9447fefa1a9d8998876849e4a3c18bdaa67d7c3fd6342d565bd54adaca0f669180f63987da410a41fe21799a5c40a144670a0eb995a71924ad28df9b616ae07

Download Submit
C:\Windows\Installer\MSIEDC0.tmp

Filesize
304KB

MD5
3c5a9fd95e7a757b6ba5154a56403a1f

SHA1
d07ba88b7ebd7eec4b85716ec2db3c7ba7151859

SHA256
6f3f78fb18e37447586903c6405e492fc9bc4c78de6d4e68ba901faff30155d8

SHA512
ad35f746d57cfcd7e6ec44393c25b8fd42bf6bf450a459ff9afef58a723efd5422fb058c1701c0add3ecbd52b4fed7aa3193affdad91ba4eed43b88db296d8a6

Download Submit
C:\Windows\Installer\MSIEDC0.tmp

Filesize
304KB

MD5
3c5a9fd95e7a757b6ba5154a56403a1f

SHA1
d07ba88b7ebd7eec4b85716ec2db3c7ba7151859

SHA256
6f3f78fb18e37447586903c6405e492fc9bc4c78de6d4e68ba901faff30155d8

SHA512
ad35f746d57cfcd7e6ec44393c25b8fd42bf6bf450a459ff9afef58a723efd5422fb058c1701c0add3ecbd52b4fed7aa3193affdad91ba4eed43b88db296d8a6

Download Submit
C:\Windows\Installer\MSIF061.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSIF061.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSIF322.tmp

Filesize
148KB

MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
C:\Windows\Installer\MSIF322.tmp

Filesize
148KB

MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
C:\Windows\Installer\MSIF3A0.tmp

Filesize
304KB

MD5
3c5a9fd95e7a757b6ba5154a56403a1f

SHA1
d07ba88b7ebd7eec4b85716ec2db3c7ba7151859

SHA256
6f3f78fb18e37447586903c6405e492fc9bc4c78de6d4e68ba901faff30155d8

SHA512
ad35f746d57cfcd7e6ec44393c25b8fd42bf6bf450a459ff9afef58a723efd5422fb058c1701c0add3ecbd52b4fed7aa3193affdad91ba4eed43b88db296d8a6

Download Submit
C:\Windows\Installer\MSIF3A0.tmp

Filesize
304KB

MD5
3c5a9fd95e7a757b6ba5154a56403a1f

SHA1
d07ba88b7ebd7eec4b85716ec2db3c7ba7151859

SHA256
6f3f78fb18e37447586903c6405e492fc9bc4c78de6d4e68ba901faff30155d8

SHA512
ad35f746d57cfcd7e6ec44393c25b8fd42bf6bf450a459ff9afef58a723efd5422fb058c1701c0add3ecbd52b4fed7aa3193affdad91ba4eed43b88db296d8a6

Download Submit
C:\Windows\Installer\MSIF508.tmp

Filesize
86KB

MD5
ff58cd07bf4913ef899efd2dfb112553

SHA1
f14c1681de808543071602f17a6299f8b4ba2ae8

SHA256
1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391

SHA512
23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

Download Submit
C:\Windows\Installer\MSIF508.tmp

Filesize
86KB

MD5
ff58cd07bf4913ef899efd2dfb112553

SHA1
f14c1681de808543071602f17a6299f8b4ba2ae8

SHA256
1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391

SHA512
23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

Download Submit
memory/3056-246-0x000001C5FA249000-0x000001C5FA24F000-memory.dmp

Filesize
24KB

Download
memory/3056-229-0x000001C5FD710000-0x000001C5FD7D0000-memory.dmp

Filesize
768KB

Download
memory/3056-234-0x000001C5FE2E0000-0x000001C5FE2F2000-memory.dmp

Filesize
72KB

Download
memory/3056-236-0x000001C5FE330000-0x000001C5FE342000-memory.dmp

Filesize
72KB

Download
memory/3056-237-0x000001C5FE860000-0x000001C5FE89A000-memory.dmp

Filesize
232KB

Download
memory/3056-238-0x000001C5FA249000-0x000001C5FA24F000-memory.dmp

Filesize
24KB

Download
memory/3056-227-0x000001C5F6BD0000-0x000001C5F7012000-memory.dmp

Filesize
4.3MB

Download
memory/3056-243-0x00007FF86F7C0000-0x00007FF870281000-memory.dmp

Filesize
10.8MB

Download
memory/3056-242-0x000001C5FBA70000-0x000001C5FBADA000-memory.dmp

Filesize
424KB

Download
memory/3056-232-0x000001C5FD8C0000-0x000001C5FD8DA000-memory.dmp

Filesize
104KB

Download
memory/3056-228-0x00007FF86F7C0000-0x00007FF870281000-memory.dmp

Filesize
10.8MB

Download
memory/4840-153-0x000001FCEE940000-0x000001FCEE948000-memory.dmp

Filesize
32KB

Download
memory/4840-152-0x000001FCEF220000-0x000001FCEF236000-memory.dmp

Filesize
88KB

Download
memory/4868-231-0x0000018B93040000-0x0000018B93B34000-memory.dmp

Filesize
11.0MB

Download
memory/4868-245-0x00007FF86F7C0000-0x00007FF870281000-memory.dmp

Filesize
10.8MB

Download
memory/4868-247-0x0000018BAEE5A000-0x0000018BAEE5F000-memory.dmp

Filesize
20KB

Download
memory/4868-233-0x0000018BAEF60000-0x0000018BAEFC6000-memory.dmp

Filesize
408KB

Download
memory/4868-239-0x00000193B8CA0000-0x00000193B8CAA000-memory.dmp

Filesize
40KB

Download
memory/4868-240-0x0000018BAEE5A000-0x0000018BAEE5F000-memory.dmp

Filesize
20KB

Download
memory/4868-241-0x00000193BC360000-0x00000193BC363000-memory.dmp

Filesize
12KB

Download
memory/4868-248-0x00000193BC360000-0x00000193BC363000-memory.dmp

Filesize
12KB

Download
memory/4868-244-0x0000018BB1EB0000-0x0000018BB1EC8000-memory.dmp

Filesize
96KB

Download
memory/4868-235-0x00007FF86F7C0000-0x00007FF870281000-memory.dmp

Filesize
10.8MB

Download