dc2c8c8369c3dee48feb6b43b5467f22e6a0c939257207828104ed8d94b154d2

Analysis

max time kernel
301s
max time network
286s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-05-2023 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lorex.AdluminInstaller.msi
Size

6.5MB
MD5

ba9f849e3c6e57316548367f0f6a444b
SHA1

34b80863cddfd512be800f366f282eb58fdfc640
SHA256

dc2c8c8369c3dee48feb6b43b5467f22e6a0c939257207828104ed8d94b154d2
SHA512

93c324b2849e9642de25370d3e73f246384f00c2ef49c2d624f495447b856e4a74911066779650a35249bd8518cf4b4944c168982c3613f29f6a9405b74aa21d
SSDEEP

98304:ZiWF9TZpfEK0lk5xmY7aRGm7XCiiQO95anWA25u2tEYjTMy5rp5WpiSvv:r91pSlkqFGICii15HrgYjTMIrfWESvv

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

Processes:

msiexec.exemsiexec.exe

flow pid process

2 1724 msiexec.exe
4 1724 msiexec.exe
6 1724 msiexec.exe
8 1724 msiexec.exe
13 1072 msiexec.exe
Executes dropped EXE 3 IoCs

Processes:

sentryagent.exeSysmon64.exeSysmon64.exe

pid process

512 sentryagent.exe
672 Sysmon64.exe
960 Sysmon64.exe

flow	pid	process
2	1724	msiexec.exe
4	1724	msiexec.exe
6	1724	msiexec.exe
8	1724	msiexec.exe
13	1072	msiexec.exe

pid	process
512	sentryagent.exe
672	Sysmon64.exe
960	Sysmon64.exe

Loads dropped DLL 38 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exesentryagent.exe

pid	process
1112	MsiExec.exe
1112	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1360	MsiExec.exe
1360	MsiExec.exe
1360	MsiExec.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
700
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe
512	sentryagent.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

45 checkip.amazonaws.com

flow	ioc
45	checkip.amazonaws.com

Drops file in System32 directory 14 IoCs

Processes:

sentryagent.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_DDCB2DD85990061C1CEA5347464E8D24	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_DDCB2DD85990061C1CEA5347464E8D24	sentryagent.exe

Drops file in Program Files directory 23 IoCs

Processes:

msiexec.exeMsiExec.exesentryagent.exe

description	ioc	process
File created	C:\Program Files (x86)\Sentry\SA\Sysmon64.exe	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\sentryagent.InstallState	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Sentry\SA\candid.tmp	sentryagent.exe
File created	C:\Program Files (x86)\Sentry\SA\config.xml	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\AdluminCommon.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\AdluminTools.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\AWSSDK.Kinesis.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\netstandard.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\Microsoft.Win32.TaskScheduler.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\libzstd.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\sentryagent.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\ZstdNet.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\AdluminUpdater.exe	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\AWSSDK.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\candid.tmp	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\Sysmon.exe	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\Eula.txt	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\sentryagent.exe	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\adlumind27br01ap01zl_johnson1a_sml_oFF_icon.ico	msiexec.exe

Drops file in Windows directory 18 IoCs

Processes:

DrvInst.exemsiexec.exeSysmon64.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIC046.tmp	msiexec.exe
File created	C:\Windows\Installer\{904551C0-C463-4E7B-B54D-82F7D4EFE2F9}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Sysmon64.exe	Sysmon64.exe
File created	C:\Windows\Installer\6cbdf3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC259.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Sysmon64.exe	Sysmon64.exe
File created	C:\Windows\SysmonDrv.sys	Sysmon64.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{904551C0-C463-4E7B-B54D-82F7D4EFE2F9}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\6cbdf6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6cbdf4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\6cbdf3.msi	msiexec.exe
File created	C:\Windows\Installer\6cbdf4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC2C.tmp	msiexec.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1768 sc.exe
1364 sc.exe
316 sc.exe
1740 sc.exe

pid	process
1768	sc.exe
1364	sc.exe
316	sc.exe
1740	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sentryagent.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sentryagent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	sentryagent.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

832 schtasks.exe
2108 schtasks.exe
2116 schtasks.exe
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeipconfig.exeipconfig.exeipconfig.exe

pid process

1012 ipconfig.exe
2124 ipconfig.exe
3028 ipconfig.exe
1356 ipconfig.exe

pid	process
832	schtasks.exe
2108	schtasks.exe
2116	schtasks.exe

pid	process
1012	ipconfig.exe
2124	ipconfig.exe
3028	ipconfig.exe
1356	ipconfig.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exesentryagent.exeSysmon64.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\System Monitor	Sysmon64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\System Monitor	Sysmon64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\System Monitor\EulaAccepted = "1"	Sysmon64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe

Modifies registry class 49 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Runtime.CompilerServices.Unsafe.dll\System.Runtime.CompilerServices.Unsafe,Version="4.0.4.1",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B03F = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e004a0063006a003f006400480061004200760055007d005f00600061004900350041005e0068004f0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminCommon.dll\AdluminCommon,Version="1.6.1.1",Culture="neutral",ProcessorArchitecture="MSIL" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e00770047006e0048002c00590067002b005200390024006000650036002c006400240051007a00410000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Buffers.dll\System.Buffers,Version="4.0.3.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13FFCD2DDD51" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e004b0074005100700031004900350048002b007400340047002b007a0078005500390061007100380000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminUpdater.exe\AdluminUpdater,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0027005200350060003d006a002e006f005d00580043003f0033003f0046005a003f0054005e00480000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AWSSDK.Core.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AWSSDK.Core.dll\AWSSDK.Core,Version="3.3.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="885C28607F98E604" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0032006d00250035003f0031003800540034005b00320035004a00670039005f00520029005700530000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Memory.dll\System.Memory,Version="4.0.1.1",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13FFCD2DDD51" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0056002900470055003d004200540038002100720064004c0029006c0034004400520046004700480000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C155409364CB7E45BD4287F4DFE2E9F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\ProductName = "Adlumin"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|sentryagent.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\ProductIcon = "C:\\Windows\\Installer\\{904551C0-C463-4E7B-B54D-82F7D4EFE2F9}\\_853F67D554F05449430E7E.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminCommon.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Net.Http.dll	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminTools.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminTools.dll\AdluminTools,Version="1.6.1.1",Culture="neutral",ProcessorArchitecture="MSIL" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0057002900640062002600440058003600540056007d0071007b0055005f00420075005a005900430000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|Microsoft.Win32.TaskScheduler.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Net.Http.dll\System.Net.Http,Version="4.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B03F5F7F11D50A3A" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0078005100680073003700750025006b007700280042006e006a003f002a005300690076002400310000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AC710AF53FF38054FACD86AD67331D5B\0C155409364CB7E45BD4287F4DFE2E9F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\PackageCode = "9717E01E34DB87145B5393ED497B910B"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|ZstdNet.dll\ZstdNet,Version="1.4.5.0",Culture="neutral",ProcessorArchitecture="MSIL" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e00280041002500550043002e002e00500075002e003f006b006c007e004f0045003f007a006400770000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|netstandard.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Buffers.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AWSSDK.Kinesis.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Memory.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|sentryagent.exe\sentryagent,Version="1.6.1.1",Culture="neutral",ProcessorArchitecture="x86" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e00640077003f0049003200750075003500450036004a004a002400360028002600300048007d00610000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C155409364CB7E45BD4287F4DFE2E9F\DefaultFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\PackageName = "Lorex.AdluminInstaller.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|ZstdNet.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|netstandard.dll\netstandard,Version="2.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13FFCD2DDD51" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0071004e002d0078004b004d0056002d0045005a00550063004d007400760058005a0065004700740000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminUpdater.exe	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AWSSDK.Kinesis.dll\AWSSDK.Kinesis,Version="3.3.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="885C28607F98E604" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0053003300650044004800610074005b004a0060005a002700390038002e002a00320069007700350000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|Microsoft.Win32.TaskScheduler.dll\Microsoft.Win32.TaskScheduler,Version="2.9.1.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="E25603A88B3AA7DA" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0033006c0058004400240029003d004300380065004a004a006d0058006a002a005600290065006e0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\Version = "169738255"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AC710AF53FF38054FACD86AD67331D5B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\Net	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2444 reg.exe

pid	process
2444	reg.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

sentryagent.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	sentryagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	sentryagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	sentryagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	sentryagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	sentryagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	sentryagent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1072 msiexec.exe
1072 msiexec.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468

pid	process
1072	msiexec.exe
1072	msiexec.exe

pid	process
468

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1724	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeSecurityPrivilege	1072	msiexec.exe
Token: SeCreateTokenPrivilege	1724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1724	msiexec.exe
Token: SeLockMemoryPrivilege	1724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1724	msiexec.exe
Token: SeMachineAccountPrivilege	1724	msiexec.exe
Token: SeTcbPrivilege	1724	msiexec.exe
Token: SeSecurityPrivilege	1724	msiexec.exe
Token: SeTakeOwnershipPrivilege	1724	msiexec.exe
Token: SeLoadDriverPrivilege	1724	msiexec.exe
Token: SeSystemProfilePrivilege	1724	msiexec.exe
Token: SeSystemtimePrivilege	1724	msiexec.exe
Token: SeProfSingleProcessPrivilege	1724	msiexec.exe
Token: SeIncBasePriorityPrivilege	1724	msiexec.exe
Token: SeCreatePagefilePrivilege	1724	msiexec.exe
Token: SeCreatePermanentPrivilege	1724	msiexec.exe
Token: SeBackupPrivilege	1724	msiexec.exe
Token: SeRestorePrivilege	1724	msiexec.exe
Token: SeShutdownPrivilege	1724	msiexec.exe
Token: SeDebugPrivilege	1724	msiexec.exe
Token: SeAuditPrivilege	1724	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1724	msiexec.exe
Token: SeChangeNotifyPrivilege	1724	msiexec.exe
Token: SeRemoteShutdownPrivilege	1724	msiexec.exe
Token: SeUndockPrivilege	1724	msiexec.exe
Token: SeSyncAgentPrivilege	1724	msiexec.exe
Token: SeEnableDelegationPrivilege	1724	msiexec.exe
Token: SeManageVolumePrivilege	1724	msiexec.exe
Token: SeImpersonatePrivilege	1724	msiexec.exe
Token: SeCreateGlobalPrivilege	1724	msiexec.exe
Token: SeCreateTokenPrivilege	1724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1724	msiexec.exe
Token: SeLockMemoryPrivilege	1724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1724	msiexec.exe
Token: SeMachineAccountPrivilege	1724	msiexec.exe
Token: SeTcbPrivilege	1724	msiexec.exe
Token: SeSecurityPrivilege	1724	msiexec.exe
Token: SeTakeOwnershipPrivilege	1724	msiexec.exe
Token: SeLoadDriverPrivilege	1724	msiexec.exe
Token: SeSystemProfilePrivilege	1724	msiexec.exe
Token: SeSystemtimePrivilege	1724	msiexec.exe
Token: SeProfSingleProcessPrivilege	1724	msiexec.exe
Token: SeIncBasePriorityPrivilege	1724	msiexec.exe
Token: SeCreatePagefilePrivilege	1724	msiexec.exe
Token: SeCreatePermanentPrivilege	1724	msiexec.exe
Token: SeBackupPrivilege	1724	msiexec.exe
Token: SeRestorePrivilege	1724	msiexec.exe
Token: SeShutdownPrivilege	1724	msiexec.exe
Token: SeDebugPrivilege	1724	msiexec.exe
Token: SeAuditPrivilege	1724	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1724	msiexec.exe
Token: SeChangeNotifyPrivilege	1724	msiexec.exe
Token: SeRemoteShutdownPrivilege	1724	msiexec.exe
Token: SeUndockPrivilege	1724	msiexec.exe
Token: SeSyncAgentPrivilege	1724	msiexec.exe
Token: SeEnableDelegationPrivilege	1724	msiexec.exe
Token: SeManageVolumePrivilege	1724	msiexec.exe
Token: SeImpersonatePrivilege	1724	msiexec.exe
Token: SeCreateGlobalPrivilege	1724	msiexec.exe
Token: SeCreateTokenPrivilege	1724	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1724 msiexec.exe
1724 msiexec.exe

pid	process
1724	msiexec.exe
1724	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exesentryagent.exeSysmon64.exeSysmon64.execmd.exe

description	pid	process	target process
PID 1072 wrote to memory of 1112	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1112	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1112	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1112	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1112	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1112	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1112	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1316	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1316	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1316	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1316	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1316	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1316	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1316	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1360	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1360	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1360	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1360	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1360	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1360	1072	msiexec.exe	MsiExec.exe
PID 1072 wrote to memory of 1360	1072	msiexec.exe	MsiExec.exe
PID 512 wrote to memory of 1768	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 1768	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 1768	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 1768	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 672	512	sentryagent.exe	Sysmon64.exe
PID 512 wrote to memory of 672	512	sentryagent.exe	Sysmon64.exe
PID 512 wrote to memory of 672	512	sentryagent.exe	Sysmon64.exe
PID 512 wrote to memory of 672	512	sentryagent.exe	Sysmon64.exe
PID 672 wrote to memory of 960	672	Sysmon64.exe	Sysmon64.exe
PID 672 wrote to memory of 960	672	Sysmon64.exe	Sysmon64.exe
PID 672 wrote to memory of 960	672	Sysmon64.exe	Sysmon64.exe
PID 960 wrote to memory of 2020	960	Sysmon64.exe	wevtutil.exe
PID 960 wrote to memory of 2020	960	Sysmon64.exe	wevtutil.exe
PID 960 wrote to memory of 2020	960	Sysmon64.exe	wevtutil.exe
PID 960 wrote to memory of 1460	960	Sysmon64.exe	wevtutil.exe
PID 960 wrote to memory of 1460	960	Sysmon64.exe	wevtutil.exe
PID 960 wrote to memory of 1460	960	Sysmon64.exe	wevtutil.exe
PID 512 wrote to memory of 1364	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 1364	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 1364	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 1364	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 316	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 316	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 316	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 316	512	sentryagent.exe	sc.exe
PID 512 wrote to memory of 1012	512	sentryagent.exe	ipconfig.exe
PID 512 wrote to memory of 1012	512	sentryagent.exe	ipconfig.exe
PID 512 wrote to memory of 1012	512	sentryagent.exe	ipconfig.exe
PID 512 wrote to memory of 1012	512	sentryagent.exe	ipconfig.exe
PID 512 wrote to memory of 1424	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 1424	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 1424	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 1424	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 1100	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 1100	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 1100	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 1100	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 824	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 824	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 824	512	sentryagent.exe	cmd.exe
PID 512 wrote to memory of 824	512	sentryagent.exe	cmd.exe
PID 1424 wrote to memory of 928	1424	cmd.exe	auditpol.exe
PID 1424 wrote to memory of 928	1424	cmd.exe	auditpol.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Lorex.AdluminInstaller.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1724

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 8EC05E20055EA0B2175691424EBB15BC C
2⤵
- Loads dropped DLL
PID:1112

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 51DD32A1C9A42ECEA4156E5C0FD7F512
2⤵
- Loads dropped DLL
PID:1316

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 24D0DFBA24E14E71B78185DFC429C0AD M Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:1360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1784

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E0" "0000000000000328"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1980

C:\Program Files (x86)\Sentry\SA\sentryagent.exe
"C:\Program Files (x86)\Sentry\SA\sentryagent.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:512

C:\Windows\SysWOW64\sc.exe
"sc" queryex Sysmon64
2⤵
- Launches sc.exe
PID:1768

C:\Program Files (x86)\Sentry\SA\Sysmon64.exe
"C:\Program Files (x86)\Sentry\SA\Sysmon64" -accepteula -i .\config.xml
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\Sysmon64.exe
"C:\Windows\Sysmon64.exe" -nologo -accepteula -m
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" um "C:\Windows\TEMP\MANE5BE.tmp"
4⤵
PID:2020

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" im "C:\Windows\TEMP\MANE716.tmp"
4⤵
PID:1460

C:\Windows\SysWOW64\sc.exe
"sc" qc Sysmon64
2⤵
- Launches sc.exe
PID:1364

C:\Windows\SysWOW64\sc.exe
"sc" qc Sysmon64
2⤵
- Launches sc.exe
PID:316

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:1012

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C auditpol /set /subcategory:"Process Creation" && auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable && auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable && auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable && auditpol /set /subcategory:"File Share" /success:enable /failure:enable && auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable && auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable && reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Policies\Microsoft\Microsoft Antimalware" /v ThreatFileHashLogging /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Policies\Microsoft\Windows PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Policies\Microsoft\Windows PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Microsoft Antimalware" /v ThreatFileHashLogging /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Windows PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Windows PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"Process Creation"
3⤵
PID:928

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable
3⤵
PID:2140

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
3⤵
PID:2296

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
3⤵
PID:2344

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"File Share" /success:enable /failure:enable
3⤵
PID:2384

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
3⤵
PID:2412

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
3⤵
PID:2432

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:2444

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Microsoft Antimalware" /v ThreatFileHashLogging /t REG_DWORD /d 1 /f
3⤵
PID:2468

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f
3⤵
PID:2484

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f
3⤵
PID:2492

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Microsoft Antimalware" /v ThreatFileHashLogging /t REG_DWORD /d 1 /f
3⤵
PID:2504

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Windows PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f
3⤵
PID:2512

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Windows PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f
3⤵
PID:2520

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C sc failure sentryagent actions= restart/60000/restart/60000/""/60000 reset= 86400
2⤵
PID:824

C:\Windows\SysWOW64\sc.exe
sc failure sentryagent actions= restart/60000/restart/60000/""/60000 reset= 86400
3⤵
- Launches sc.exe
PID:1740

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /create /tn "SA Routine Update" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 07:05 /rl HIGHEST /ru "SYSTEM"
2⤵
PID:1100

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /create /tn "SA Routine Update" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 07:05 /rl HIGHEST /ru "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:832

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /create /tn "Adlumin1" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 16:57 /rl HIGHEST /ru "SYSTEM"
2⤵
PID:1804

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /create /tn "Adlumin1" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 16:57 /rl HIGHEST /ru "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2108

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /create /tn "Adlumin2" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 03:36 /rl HIGHEST /ru "SYSTEM"
2⤵
PID:2056

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /create /tn "Adlumin2" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 03:36 /rl HIGHEST /ru "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2116

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:2124

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:3028

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:1356

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6cbdf5.rbs
Filesize
14KB

MD5
30f71d36054cefba7a865dee8b2e0dae

SHA1
971526c49e6e4e649c2e98d1563d9f0b582f9688

SHA256
a383862ecee785b05fb9d3852744ac454b21432e77d5b4456d74f8f5f62aeb60

SHA512
d59c38d55a516c8be950ed335d0ef35e971e3e43f10719416b3c1e1f514eeb359cdd438e5afa3343a9c70fb1fdebf327d7a55a54fee324f672fd2bc6858c36e9

Download Submit
C:\Program Files (x86)\Sentry\SA\AWSSDK.Core.dll
Filesize
1.5MB

MD5
ef9915bc36b80a289f732b4fff4000e7

SHA1
fc4e5b725e3ad825b7372c877498f752a4961c77

SHA256
2c7598133925ea63ac61c43dddaf3b7e0de59122564bd9c42d3363a530ebc427

SHA512
8742e19f5d8dea1247bf63f751c9b82a193a8fb1a449222df0c1b1f8e86e685b22c4141e035bad2e6dd87e77445fa2bbd7a1948e35e3f45f70ddfec06853945a

Download Submit
C:\Program Files (x86)\Sentry\SA\AWSSDK.Kinesis.dll
Filesize
115KB

MD5
83ab5a05fde27136563d1c016be16bd3

SHA1
fa7e9402496abc4b31eb70801dae376e6acc78e9

SHA256
62464a81a6c64c2beeed738dcd57f2cf2449c993694e894402106213f06edc6e

SHA512
4eff62c7727999c216fb35af3323bb623fd8c68cd5c838cc586b36bd14be9c01f808af7e11d9b0646e1e3ddd88d4c9123f7cc144118ecfa918a7f58662309957

Download Submit
C:\Program Files (x86)\Sentry\SA\AdluminCommon.dll
Filesize
26KB

MD5
c7698d14156331bd4fe57b936ff1a1dc

SHA1
5aa451a5a26ba382e3b693927c3f13a59467a958

SHA256
87233077d7da0c215ecab66993fe55a3a3d62f7cde8e1ba579977d5a65dd5b0e

SHA512
c5fe522accf9f14c973715f2da5540f1c914cf6e24beae12f439f5aa24fc75ad523fcd035b2181787eee3d161f2696e6b16bb63fabadcf12eb1f12ee01b2548a

Download Submit
C:\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
C:\Program Files (x86)\Sentry\SA\Microsoft.Win32.TaskScheduler.dll
Filesize
326KB

MD5
6faa5bc69ea08d067b6b454918af3f69

SHA1
8e5ea5cf270aef4331291805a3e96a8fdbca0dd2

SHA256
6928bf7bb271eacf64ed826b46597f73111867009720167c070e214488c4c445

SHA512
f98c7cc55746f562c4ed0896f51d351bfe1ed309f3f2b3722bd424f50cb76b99264667a8b951eece7e49e29fcb73053963ef47ca4268377d714f5e94937b5299

Download Submit
C:\Program Files (x86)\Sentry\SA\Sysmon64.exe
Filesize
4.2MB

MD5
70b29632de85b610b5918b6fe0084333

SHA1
d5bb8d8a27052b68ec8952a35ef145bb3ba2cb19

SHA256
3267279461be7397ef6e2afe61f9396e42475577f8c76648dbcae1b831b6fd3e

SHA512
d7d16d0956300680f1431193d35ff22ec1789c712aa34570e67d6690de4f276fa539486d7b96ca5e52d9206be4bb732e31f978a8ce83d116afdb8db39fffe6c6

Download Submit
C:\Program Files (x86)\Sentry\SA\Sysmon64.exe
Filesize
4.2MB

MD5
70b29632de85b610b5918b6fe0084333

SHA1
d5bb8d8a27052b68ec8952a35ef145bb3ba2cb19

SHA256
3267279461be7397ef6e2afe61f9396e42475577f8c76648dbcae1b831b6fd3e

SHA512
d7d16d0956300680f1431193d35ff22ec1789c712aa34570e67d6690de4f276fa539486d7b96ca5e52d9206be4bb732e31f978a8ce83d116afdb8db39fffe6c6

Download Submit
C:\Program Files (x86)\Sentry\SA\System.Memory.dll
Filesize
137KB

MD5
6fb95a357a3f7e88ade5c1629e2801f8

SHA1
19bf79600b716523b5317b9a7b68760ae5d55741

SHA256
8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7

SHA512
293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0

Download Submit
C:\Program Files (x86)\Sentry\SA\System.Runtime.CompilerServices.Unsafe.dll
Filesize
16KB

MD5
da04a75ddc22118ed24e0b53e474805a

SHA1
2d68c648a6a6371b6046e6c3af09128230e0ad32

SHA256
66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74

SHA512
26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8

Download Submit
C:\Program Files (x86)\Sentry\SA\ZstdNet.dll
Filesize
28KB

MD5
a261a10179fc33cc7c548830832e3ca2

SHA1
e804128ed18ea308d3130c5e7112715ad8903703

SHA256
6cb57c7b6c15e59dbded96d61ce922678529563ed8285f3cd851857fae599b71

SHA512
244e87ecc65d1d431dc7f97076ea53c54baef0eadbc8d413a51c4b7a780c7b9c2c63cb3e1a9dbb5cd90ee218dd9e9f29c114632b0ca4645b91c178185e86d1b3

Download Submit
C:\Program Files (x86)\Sentry\SA\config.xml
Filesize
124KB

MD5
18979278c56e93079e7e48f33fd38f67

SHA1
0006570f84b41b81c89d6df382ef793daccc13ec

SHA256
e4c2b8b0dc708bc41fc1ba73c41e79ef34454609291454dbb8e939e1a05f5d40

SHA512
ef7b109e1a26ad91676b2002700ab13b03a9f028267aa76cdef64a2f1cb0b5d162c86497990b1e696d1f6efca11aa6ce155b4bdd87628b32bfc2f3665edd184b

Download Submit
C:\Program Files (x86)\Sentry\SA\sentryagent.exe
Filesize
986KB

MD5
1f1a4445eea40e209ab4004485442fc9

SHA1
c4e6fd2b14c0ede680ed1cd710ad704a8744e511

SHA256
039d3ad8fce2249ca97b599bfe7a2bd3279819f6d6e9754bcbcd73d9c2a92d40

SHA512
b914343498657a6af94434245c064ff7bf8a36c78d48738b9c52a47480526af9f90f9b64f3050df53c693b0e08bd8b0a7e1a0c93578d4525641283272bc59218

Download Submit
C:\Program Files (x86)\Sentry\SA\sentryagent.exe
Filesize
986KB

MD5
1f1a4445eea40e209ab4004485442fc9

SHA1
c4e6fd2b14c0ede680ed1cd710ad704a8744e511

SHA256
039d3ad8fce2249ca97b599bfe7a2bd3279819f6d6e9754bcbcd73d9c2a92d40

SHA512
b914343498657a6af94434245c064ff7bf8a36c78d48738b9c52a47480526af9f90f9b64f3050df53c693b0e08bd8b0a7e1a0c93578d4525641283272bc59218

Download Submit
C:\Program Files (x86)\Sentry\SA\sentryagent.exe.config
Filesize
505B

MD5
a81add0e2fa1cb7b5e2cb4eef045b0a3

SHA1
150df3469ebcfd13143091868ec8801760f539c3

SHA256
f0a7ee916109df3d7bc5cd7aff67631b491e58d5b4ee64ded5143da7fef5db5d

SHA512
b5d12c804d60bf7f7de4a1b28223e246d3403da75a5f0273f2f52d9b34c838b2726c888ca05649eca9baf0200ab3bbd2b9d6805e7b30183cba4e9a8b21cdfd51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize
765B

MD5
d4a3ec1ea5b0d68a77473e547883fe3a

SHA1
192b440f6f37e3a9e503d3a152a8d71826b9476e

SHA256
033565c02acc84e15079d67238d9e34adb739ad374492e3e9f1ee9122200f262

SHA512
49b805cd205940d642ddd4cf9a18b4c951e45e5f89ae2f70da6e3a79b333610d9bdce05c9951fcfd498efad3767ec3e813f8843ec8d025e8f22690f8b201cdca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_DDCB2DD85990061C1CEA5347464E8D24
Filesize
637B

MD5
9b0f141bc891947dc8d663a82c5078c0

SHA1
d32a47d49264db5d1dcc537ec58c3cd5e5cc015b

SHA256
7269a7d055bcde9e1188a52000edfcaaf69947e2f177f9c1e391d76f8b6b814f

SHA512
635869873e8fa4cbf293496b06d79d3d65782caea2a79544e5f9ce26290589627e1365f2bb496b1a5daadb1f75ff3bee5c1fb2247ebd4114068f7d6fc5aaa904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize
1KB

MD5
8a136fb17bbbaeecd7ad8f3378d6a1fc

SHA1
db4f50914ecc3dcf530f37771fd88ec71e4b12be

SHA256
21868ebb658ac7a86059168b09c9e6607d9896446cc6e2c7603236293f7cef35

SHA512
251092408c254758e329d9ccddeea3896f25b7b308094db9d0e5a85ee0ecadfdd97950a89d38f64ee20581d43a4500ea288ab93aab1e8f17f0562971c7057c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize
484B

MD5
32fe3ac48a89e7d962b5fa4c5db7142f

SHA1
6fa3f805fccb0f975a5995f33e0364e5d0a6342f

SHA256
98992c39ba16dae2f7f18be26dcfc91e4e8c7ff617905b87de959711483e7bc1

SHA512
8156bae1927686340a278e7c7aa070b55020b67e7801592eaa07e990ad07214704c92b7ede8012086dad0011ee5e59ea565c1637b8045c4e0d19bca0221467ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
73362f10078adb8559b08739a0df1349

SHA1
3d05b20115c4d538ec657c71bd36922de4819659

SHA256
5814bab50252d15eaf9a1caa4d810374455dd89839f973523d70e5d31f14a079

SHA512
e998758fbf75f37c4c7de3cf1322304f798eac58e5a20b6fdfd94fe1e0f7cf3d8e7aa9b209ab7caecb9a56399dbdf75fdaeffa7b3c95ef7db72c6414750713dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_DDCB2DD85990061C1CEA5347464E8D24
Filesize
492B

MD5
2c53adbf839d2545dcc7801f1fc4a771

SHA1
d75270a551389d09d2b5ba6fc62df837e223d946

SHA256
8d2c2aaae51fb2ae0787e34ace9c05627839ab82cd59598c0097f6dfceff9833

SHA512
35a6200cb04667e784d100f768ad3c66b9e0a49f2889a217bd2e5c87f83a534a9060eb3b68634db20ff311b4a8851ac41a74b8fa3b729cbaecd3156372728edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize
482B

MD5
5f36d7d5ba78d71c94baaa16418c609b

SHA1
d15562db733fb98a8f784f8cb34d0993765c4572

SHA256
c8e9a8cdd0a4b57ac08d4f97685fb93ea40832c92a0099dece23a48419c16bc4

SHA512
9b281eda5e2bbb75d59622e1047a573b5cd32249a11d2bb00f252c437bbc97c881d98c7f26830b49fcda8b201899217893ee5249cc454ff4006f692930aea945

Download Submit
C:\Users\Admin\AppData\Local\Temp\CFGC218.tmp
Filesize
152B

MD5
df6640211847a5b71f62b8187994ea38

SHA1
07c26fac7b1d538464497e6ca47b6ca8b465b8ba

SHA256
7d5f1726f0d15597fdd0fbcf8c27fd2ce668d80ebc39ca56f569f06957d510fb

SHA512
5530133a0992e2e956e10edccf02672eb410381bcdb7a6f0d46a78a6206141c9e9e63f7462c4ed83ddd9a3bb2b1f59627dca1a0b18ce8c9aea436ea17938f75f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1F9D.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI2143.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AF8.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Windows\Installer\6cbdf3.msi
Filesize
6.5MB

MD5
ba9f849e3c6e57316548367f0f6a444b

SHA1
34b80863cddfd512be800f366f282eb58fdfc640

SHA256
dc2c8c8369c3dee48feb6b43b5467f22e6a0c939257207828104ed8d94b154d2

SHA512
93c324b2849e9642de25370d3e73f246384f00c2ef49c2d624f495447b856e4a74911066779650a35249bd8518cf4b4944c168982c3613f29f6a9405b74aa21d

Download Submit
C:\Windows\Installer\MSIC046.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Windows\Installer\MSIC046.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Windows\Installer\MSIC259.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Windows\Installer\MSICC2C.tmp
Filesize
113KB

MD5
8fa4088a730b967d85df562fd5ef7d5e

SHA1
629db9229f4a4a691e14f38f4dbffba157fa1ce9

SHA256
cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36

SHA512
1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize
230B

MD5
7c7e4851d9646fcfc8ecc30a0386593d

SHA1
7631be350d69a2b980f83026151fa49c57ae0047

SHA256
a515dc1e13881341203a9c125d663d505c2cdc6beeffce704a6c04a0822191b2

SHA512
1db436bcdb0c298933c6c862c355843d9b4d7dad38267b5722ef54ca76a20f83b3a78e63d48a30917edd22798273c3c0250f2c3423ac1a6804ae2ede27ae9eb6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
6ce19163f5ffc3315b97d8a52a55c44f

SHA1
c759f01a14bc91953d352d78d4a4338dc8c8b5d7

SHA256
2f9d2c1d9e34a5a026ff973c3ba569db82356fdad47a579d95f0416956e7f591

SHA512
cbd3de4e8cc6e96070b2e89186032842bc61d3778d80bf71ed6307242e09f006456d1ce356da567582ec0602888a6b6e6fcbf1181ab0126fdeafe7885f7ff3af

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
06d100ab82bfd74e26ff34298194552b

SHA1
ad8df6efddec55b40ce05175096d372396695ed6

SHA256
603e8671e1e5f7ec956292813535c91ade8bcd59480d87aea2b8d58a33c1293a

SHA512
5fd85ad609437b5b312dce95d77f265fbd5869c09e7c47327ad3c13b227037526fe1efdaa9845aebd3e9a1159b93c0c961e3e3f4fdc7035d85fca2e7190d5f63

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
54eb11d3ec2009e9770c5fbd5dab8f0a

SHA1
b6d5f4f1dfc77c537667a6df5e54da1786153844

SHA256
702d334b2cc604986e2e78213372b3ded41b2680ea5bd29bf7fbe58e11aba35c

SHA512
6d527283dc3eaecd8a46cd33e0f86a287a730d9473165411378e217c552c792e0e3b82e2a867f35042397a1006dd76f61aca63971be0a846ea9267b04609ae3b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
caa458775b13902830c5e339c2ff82f0

SHA1
7c1e7e5ed97671ac21edb3e78911b803a0f118c9

SHA256
cf878149b7fe84cc5cf182f575ef2c2b43250468a9fade5c3c4229438ad2ff2f

SHA512
3940977fb557aa19099dc63a1567e28774b66f00287c2c8cfe2c25ec49917dd2fc11e742919ad0dd34628f87d3809e4bb10a484287e3a638976f83dece9710ac

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
e45085172d06041e3a916596fdb53859

SHA1
4c83c2705a72737b08e53b2e2e72261116dff69a

SHA256
9ff8f7e2b32700a5aa7d28b77b435ba81434283cc288d63c7af64421103b94f1

SHA512
40e73273b990125f280fd4567ebde733143a8dd3c80a03a437f5ed2d96ea22b27427dc9f74385fb233cdf6e6fd54506a6a0681c6b51e9a32b03368fb5bcadb4e

Download Submit
C:\Windows\Sysmon64.exe
Filesize
4.2MB

MD5
70b29632de85b610b5918b6fe0084333

SHA1
d5bb8d8a27052b68ec8952a35ef145bb3ba2cb19

SHA256
3267279461be7397ef6e2afe61f9396e42475577f8c76648dbcae1b831b6fd3e

SHA512
d7d16d0956300680f1431193d35ff22ec1789c712aa34570e67d6690de4f276fa539486d7b96ca5e52d9206be4bb732e31f978a8ce83d116afdb8db39fffe6c6

Download Submit
C:\Windows\TEMP\MANE5BE.tmp
Filesize
96KB

MD5
5d699d195a1eda5e3fb50274de6d14c2

SHA1
258d00c6abaf6dac2bfef8f6eefbd5a11ba159b5

SHA256
1980ee94e68bbcebbb5a73c42830437f518f01ac12e1f2a7dbb131ab80018883

SHA512
867dd3367c7ff4330d7bfa1cb540aa10a114ad6524328d102510c7f2fd37b589ef99387c70c110438c35a779ae06cb8c8c4a98b1c574e35156a331b46f06ddfa

Download Submit
C:\Windows\TEMP\MANE716.tmp
Filesize
96KB

MD5
5d699d195a1eda5e3fb50274de6d14c2

SHA1
258d00c6abaf6dac2bfef8f6eefbd5a11ba159b5

SHA256
1980ee94e68bbcebbb5a73c42830437f518f01ac12e1f2a7dbb131ab80018883

SHA512
867dd3367c7ff4330d7bfa1cb540aa10a114ad6524328d102510c7f2fd37b589ef99387c70c110438c35a779ae06cb8c8c4a98b1c574e35156a331b46f06ddfa

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Core.dll
Filesize
1.5MB

MD5
ef9915bc36b80a289f732b4fff4000e7

SHA1
fc4e5b725e3ad825b7372c877498f752a4961c77

SHA256
2c7598133925ea63ac61c43dddaf3b7e0de59122564bd9c42d3363a530ebc427

SHA512
8742e19f5d8dea1247bf63f751c9b82a193a8fb1a449222df0c1b1f8e86e685b22c4141e035bad2e6dd87e77445fa2bbd7a1948e35e3f45f70ddfec06853945a

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Core.dll
Filesize
1.5MB

MD5
ef9915bc36b80a289f732b4fff4000e7

SHA1
fc4e5b725e3ad825b7372c877498f752a4961c77

SHA256
2c7598133925ea63ac61c43dddaf3b7e0de59122564bd9c42d3363a530ebc427

SHA512
8742e19f5d8dea1247bf63f751c9b82a193a8fb1a449222df0c1b1f8e86e685b22c4141e035bad2e6dd87e77445fa2bbd7a1948e35e3f45f70ddfec06853945a

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Core.dll
Filesize
1.5MB

MD5
ef9915bc36b80a289f732b4fff4000e7

SHA1
fc4e5b725e3ad825b7372c877498f752a4961c77

SHA256
2c7598133925ea63ac61c43dddaf3b7e0de59122564bd9c42d3363a530ebc427

SHA512
8742e19f5d8dea1247bf63f751c9b82a193a8fb1a449222df0c1b1f8e86e685b22c4141e035bad2e6dd87e77445fa2bbd7a1948e35e3f45f70ddfec06853945a

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Core.dll
Filesize
1.5MB

MD5
ef9915bc36b80a289f732b4fff4000e7

SHA1
fc4e5b725e3ad825b7372c877498f752a4961c77

SHA256
2c7598133925ea63ac61c43dddaf3b7e0de59122564bd9c42d3363a530ebc427

SHA512
8742e19f5d8dea1247bf63f751c9b82a193a8fb1a449222df0c1b1f8e86e685b22c4141e035bad2e6dd87e77445fa2bbd7a1948e35e3f45f70ddfec06853945a

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Kinesis.dll
Filesize
115KB

MD5
83ab5a05fde27136563d1c016be16bd3

SHA1
fa7e9402496abc4b31eb70801dae376e6acc78e9

SHA256
62464a81a6c64c2beeed738dcd57f2cf2449c993694e894402106213f06edc6e

SHA512
4eff62c7727999c216fb35af3323bb623fd8c68cd5c838cc586b36bd14be9c01f808af7e11d9b0646e1e3ddd88d4c9123f7cc144118ecfa918a7f58662309957

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Kinesis.dll
Filesize
115KB

MD5
83ab5a05fde27136563d1c016be16bd3

SHA1
fa7e9402496abc4b31eb70801dae376e6acc78e9

SHA256
62464a81a6c64c2beeed738dcd57f2cf2449c993694e894402106213f06edc6e

SHA512
4eff62c7727999c216fb35af3323bb623fd8c68cd5c838cc586b36bd14be9c01f808af7e11d9b0646e1e3ddd88d4c9123f7cc144118ecfa918a7f58662309957

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Kinesis.dll
Filesize
115KB

MD5
83ab5a05fde27136563d1c016be16bd3

SHA1
fa7e9402496abc4b31eb70801dae376e6acc78e9

SHA256
62464a81a6c64c2beeed738dcd57f2cf2449c993694e894402106213f06edc6e

SHA512
4eff62c7727999c216fb35af3323bb623fd8c68cd5c838cc586b36bd14be9c01f808af7e11d9b0646e1e3ddd88d4c9123f7cc144118ecfa918a7f58662309957

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Kinesis.dll
Filesize
115KB

MD5
83ab5a05fde27136563d1c016be16bd3

SHA1
fa7e9402496abc4b31eb70801dae376e6acc78e9

SHA256
62464a81a6c64c2beeed738dcd57f2cf2449c993694e894402106213f06edc6e

SHA512
4eff62c7727999c216fb35af3323bb623fd8c68cd5c838cc586b36bd14be9c01f808af7e11d9b0646e1e3ddd88d4c9123f7cc144118ecfa918a7f58662309957

Download Submit
\Program Files (x86)\Sentry\SA\AdluminCommon.dll
Filesize
26KB

MD5
c7698d14156331bd4fe57b936ff1a1dc

SHA1
5aa451a5a26ba382e3b693927c3f13a59467a958

SHA256
87233077d7da0c215ecab66993fe55a3a3d62f7cde8e1ba579977d5a65dd5b0e

SHA512
c5fe522accf9f14c973715f2da5540f1c914cf6e24beae12f439f5aa24fc75ad523fcd035b2181787eee3d161f2696e6b16bb63fabadcf12eb1f12ee01b2548a

Download Submit
\Program Files (x86)\Sentry\SA\AdluminCommon.dll
Filesize
26KB

MD5
c7698d14156331bd4fe57b936ff1a1dc

SHA1
5aa451a5a26ba382e3b693927c3f13a59467a958

SHA256
87233077d7da0c215ecab66993fe55a3a3d62f7cde8e1ba579977d5a65dd5b0e

SHA512
c5fe522accf9f14c973715f2da5540f1c914cf6e24beae12f439f5aa24fc75ad523fcd035b2181787eee3d161f2696e6b16bb63fabadcf12eb1f12ee01b2548a

Download Submit
\Program Files (x86)\Sentry\SA\AdluminCommon.dll
Filesize
26KB

MD5
c7698d14156331bd4fe57b936ff1a1dc

SHA1
5aa451a5a26ba382e3b693927c3f13a59467a958

SHA256
87233077d7da0c215ecab66993fe55a3a3d62f7cde8e1ba579977d5a65dd5b0e

SHA512
c5fe522accf9f14c973715f2da5540f1c914cf6e24beae12f439f5aa24fc75ad523fcd035b2181787eee3d161f2696e6b16bb63fabadcf12eb1f12ee01b2548a

Download Submit
\Program Files (x86)\Sentry\SA\AdluminCommon.dll
Filesize
26KB

MD5
c7698d14156331bd4fe57b936ff1a1dc

SHA1
5aa451a5a26ba382e3b693927c3f13a59467a958

SHA256
87233077d7da0c215ecab66993fe55a3a3d62f7cde8e1ba579977d5a65dd5b0e

SHA512
c5fe522accf9f14c973715f2da5540f1c914cf6e24beae12f439f5aa24fc75ad523fcd035b2181787eee3d161f2696e6b16bb63fabadcf12eb1f12ee01b2548a

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\Microsoft.Win32.TaskScheduler.dll
Filesize
326KB

MD5
6faa5bc69ea08d067b6b454918af3f69

SHA1
8e5ea5cf270aef4331291805a3e96a8fdbca0dd2

SHA256
6928bf7bb271eacf64ed826b46597f73111867009720167c070e214488c4c445

SHA512
f98c7cc55746f562c4ed0896f51d351bfe1ed309f3f2b3722bd424f50cb76b99264667a8b951eece7e49e29fcb73053963ef47ca4268377d714f5e94937b5299

Download Submit
\Program Files (x86)\Sentry\SA\Microsoft.Win32.TaskScheduler.dll
Filesize
326KB

MD5
6faa5bc69ea08d067b6b454918af3f69

SHA1
8e5ea5cf270aef4331291805a3e96a8fdbca0dd2

SHA256
6928bf7bb271eacf64ed826b46597f73111867009720167c070e214488c4c445

SHA512
f98c7cc55746f562c4ed0896f51d351bfe1ed309f3f2b3722bd424f50cb76b99264667a8b951eece7e49e29fcb73053963ef47ca4268377d714f5e94937b5299

Download Submit
\Program Files (x86)\Sentry\SA\Sysmon64.exe
Filesize
4.2MB

MD5
70b29632de85b610b5918b6fe0084333

SHA1
d5bb8d8a27052b68ec8952a35ef145bb3ba2cb19

SHA256
3267279461be7397ef6e2afe61f9396e42475577f8c76648dbcae1b831b6fd3e

SHA512
d7d16d0956300680f1431193d35ff22ec1789c712aa34570e67d6690de4f276fa539486d7b96ca5e52d9206be4bb732e31f978a8ce83d116afdb8db39fffe6c6

Download Submit
\Program Files (x86)\Sentry\SA\Sysmon64.exe
Filesize
4.2MB

MD5
70b29632de85b610b5918b6fe0084333

SHA1
d5bb8d8a27052b68ec8952a35ef145bb3ba2cb19

SHA256
3267279461be7397ef6e2afe61f9396e42475577f8c76648dbcae1b831b6fd3e

SHA512
d7d16d0956300680f1431193d35ff22ec1789c712aa34570e67d6690de4f276fa539486d7b96ca5e52d9206be4bb732e31f978a8ce83d116afdb8db39fffe6c6

Download Submit
\Program Files (x86)\Sentry\SA\System.Memory.dll
Filesize
137KB

MD5
6fb95a357a3f7e88ade5c1629e2801f8

SHA1
19bf79600b716523b5317b9a7b68760ae5d55741

SHA256
8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7

SHA512
293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0

Download Submit
\Program Files (x86)\Sentry\SA\System.Memory.dll
Filesize
137KB

MD5
6fb95a357a3f7e88ade5c1629e2801f8

SHA1
19bf79600b716523b5317b9a7b68760ae5d55741

SHA256
8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7

SHA512
293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0

Download Submit
\Program Files (x86)\Sentry\SA\ZstdNet.dll
Filesize
28KB

MD5
a261a10179fc33cc7c548830832e3ca2

SHA1
e804128ed18ea308d3130c5e7112715ad8903703

SHA256
6cb57c7b6c15e59dbded96d61ce922678529563ed8285f3cd851857fae599b71

SHA512
244e87ecc65d1d431dc7f97076ea53c54baef0eadbc8d413a51c4b7a780c7b9c2c63cb3e1a9dbb5cd90ee218dd9e9f29c114632b0ca4645b91c178185e86d1b3

Download Submit
\Program Files (x86)\Sentry\SA\ZstdNet.dll
Filesize
28KB

MD5
a261a10179fc33cc7c548830832e3ca2

SHA1
e804128ed18ea308d3130c5e7112715ad8903703

SHA256
6cb57c7b6c15e59dbded96d61ce922678529563ed8285f3cd851857fae599b71

SHA512
244e87ecc65d1d431dc7f97076ea53c54baef0eadbc8d413a51c4b7a780c7b9c2c63cb3e1a9dbb5cd90ee218dd9e9f29c114632b0ca4645b91c178185e86d1b3

Download Submit
\Program Files (x86)\Sentry\SA\sentryagent.exe
Filesize
986KB

MD5
1f1a4445eea40e209ab4004485442fc9

SHA1
c4e6fd2b14c0ede680ed1cd710ad704a8744e511

SHA256
039d3ad8fce2249ca97b599bfe7a2bd3279819f6d6e9754bcbcd73d9c2a92d40

SHA512
b914343498657a6af94434245c064ff7bf8a36c78d48738b9c52a47480526af9f90f9b64f3050df53c693b0e08bd8b0a7e1a0c93578d4525641283272bc59218

Download Submit
\Program Files (x86)\Sentry\SA\sentryagent.exe
Filesize
986KB

MD5
1f1a4445eea40e209ab4004485442fc9

SHA1
c4e6fd2b14c0ede680ed1cd710ad704a8744e511

SHA256
039d3ad8fce2249ca97b599bfe7a2bd3279819f6d6e9754bcbcd73d9c2a92d40

SHA512
b914343498657a6af94434245c064ff7bf8a36c78d48738b9c52a47480526af9f90f9b64f3050df53c693b0e08bd8b0a7e1a0c93578d4525641283272bc59218

Download Submit
\Users\Admin\AppData\Local\Temp\MSI1F9D.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
\Users\Admin\AppData\Local\Temp\MSI2143.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
\Windows\Installer\MSIC046.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
\Windows\Installer\MSIC259.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
\Windows\Installer\MSICC2C.tmp
Filesize
113KB

MD5
8fa4088a730b967d85df562fd5ef7d5e

SHA1
629db9229f4a4a691e14f38f4dbffba157fa1ce9

SHA256
cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36

SHA512
1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2

Download Submit
memory/512-260-0x0000000003740000-0x0000000003798000-memory.dmp

Filesize
352KB

Download
memory/512-494-0x00000000034C0000-0x00000000034CE000-memory.dmp

Filesize
56KB

Download
memory/512-261-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/512-235-0x0000000004120000-0x00000000042A8000-memory.dmp

Filesize
1.5MB

Download
memory/512-220-0x00000000007C0000-0x00000000007E4000-memory.dmp

Filesize
144KB

Download
memory/512-221-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/512-211-0x0000000000CC0000-0x0000000000D02000-memory.dmp

Filesize
264KB

Download
memory/512-208-0x0000000000CC0000-0x0000000000D02000-memory.dmp

Filesize
264KB

Download
memory/512-205-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/512-268-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/512-201-0x0000000000520000-0x0000000000562000-memory.dmp

Filesize
264KB

Download
memory/512-197-0x00000000008B0000-0x00000000009A8000-memory.dmp

Filesize
992KB

Download
memory/512-505-0x0000000004960000-0x0000000004A0E000-memory.dmp

Filesize
696KB

Download
memory/512-498-0x0000000003A00000-0x0000000003A26000-memory.dmp

Filesize
152KB

Download
memory/512-504-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/512-500-0x0000000003900000-0x0000000003908000-memory.dmp

Filesize
32KB

Download
memory/512-501-0x0000000004960000-0x0000000004A0E000-memory.dmp

Filesize
696KB

Download
memory/512-503-0x00000000038F0000-0x00000000038FA000-memory.dmp

Filesize
40KB

Download
memory/1360-194-0x0000000000C10000-0x0000000000C50000-memory.dmp

Filesize
256KB

Download
memory/1360-193-0x0000000004970000-0x0000000004A68000-memory.dmp

Filesize
992KB

Download