4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/05/2023, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe
Size

7.6MB
MD5

b47f314ea27a55736bf8cd9a9168dc60
SHA1

dbcc6cf2edd87282e813603030e0ad50a555aecc
SHA256

4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959
SHA512

9495dee9a7725eca12574d895958ba4887586773d10f94e5436a4f6658ce765cdd1f0d1c15468f5eb7f5de07fec326f1bf04efdf750b1cc1561a8fd215d5a02c
SSDEEP

196608:tgOGUhZDG+Y2Ml+z2WQEZSI25s1e1AQnQDOvd:tgOvXMl82WQEUdKsAQny4

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ComputerZService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ComputerZService.exe

Executes dropped EXE 2 IoCs

pid	Process
1636	360DrvMgr.exe
2032	ComputerZService.exe

Loads dropped DLL 27 IoCs

pid	Process
908	4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
1636	360DrvMgr.exe
2032	ComputerZService.exe
1636	360DrvMgr.exe
2032	ComputerZService.exe
2032	ComputerZService.exe
2032	ComputerZService.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
2032	ComputerZService.exe
2032	ComputerZService.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	ComputerZService.exe
File opened (read-only)	\??\W:	ComputerZService.exe
File opened (read-only)	\??\Y:	ComputerZService.exe
File opened (read-only)	\??\H:	ComputerZService.exe
File opened (read-only)	\??\J:	ComputerZService.exe
File opened (read-only)	\??\L:	ComputerZService.exe
File opened (read-only)	\??\O:	ComputerZService.exe
File opened (read-only)	\??\A:	ComputerZService.exe
File opened (read-only)	\??\B:	ComputerZService.exe
File opened (read-only)	\??\E:	ComputerZService.exe
File opened (read-only)	\??\F:	ComputerZService.exe
File opened (read-only)	\??\U:	ComputerZService.exe
File opened (read-only)	\??\X:	ComputerZService.exe
File opened (read-only)	\??\Z:	ComputerZService.exe
File opened (read-only)	\??\Q:	ComputerZService.exe
File opened (read-only)	\??\R:	ComputerZService.exe
File opened (read-only)	\??\G:	ComputerZService.exe
File opened (read-only)	\??\M:	ComputerZService.exe
File opened (read-only)	\??\N:	ComputerZService.exe
File opened (read-only)	\??\P:	ComputerZService.exe
File opened (read-only)	\??\I:	ComputerZService.exe
File opened (read-only)	\??\K:	ComputerZService.exe
File opened (read-only)	\??\T:	ComputerZService.exe
File opened (read-only)	\??\V:	ComputerZService.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	360DrvMgr.exe
File opened for modification	\??\PhysicalDrive0	ComputerZService.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	ComputerZService.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	ComputerZService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	1636	WerFault.exe	29

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	ComputerZService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ComputerZService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	ComputerZService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	ComputerZService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	ComputerZService.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	360DrvMgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	360DrvMgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\360DrvMgr.exe = "8000"	360DrvMgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE	360DrvMgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE\360DrvMgr.exe = "8000"	360DrvMgr.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	ComputerZService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	ComputerZService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	ComputerZService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	ComputerZService.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2032	ComputerZService.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
460	Process not Found
460	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeRestorePrivilege	2032	ComputerZService.exe
Token: SeRestorePrivilege	2032	ComputerZService.exe
Token: SeRestorePrivilege	2032	ComputerZService.exe
Token: SeRestorePrivilege	2032	ComputerZService.exe
Token: SeRestorePrivilege	2032	ComputerZService.exe
Token: SeRestorePrivilege	2032	ComputerZService.exe
Token: SeRestorePrivilege	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe
Token: SeLoadDriverPrivilege	1636	360DrvMgr.exe
Token: 33	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe
Token: 33	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe
Token: 33	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe
Token: 33	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe
Token: 33	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe
Token: 33	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe
Token: 33	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe
Token: 33	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe
Token: 33	2032	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2032	ComputerZService.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1636	360DrvMgr.exe
1636	360DrvMgr.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 908	1220	4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe	28
PID 1220 wrote to memory of 908	1220	4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe	28
PID 1220 wrote to memory of 908	1220	4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe	28
PID 1220 wrote to memory of 908	1220	4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe	28
PID 908 wrote to memory of 1636	908	4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe	29
PID 908 wrote to memory of 1636	908	4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe	29
PID 908 wrote to memory of 1636	908	4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe	29
PID 908 wrote to memory of 1636	908	4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe	29
PID 1636 wrote to memory of 2032	1636	360DrvMgr.exe	30
PID 1636 wrote to memory of 2032	1636	360DrvMgr.exe	30
PID 1636 wrote to memory of 2032	1636	360DrvMgr.exe	30
PID 1636 wrote to memory of 2032	1636	360DrvMgr.exe	30
PID 1636 wrote to memory of 944	1636	360DrvMgr.exe	33
PID 1636 wrote to memory of 944	1636	360DrvMgr.exe	33
PID 1636 wrote to memory of 944	1636	360DrvMgr.exe	33
PID 1636 wrote to memory of 944	1636	360DrvMgr.exe	33

C:\Users\Admin\AppData\Local\Temp\4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe
"C:\Users\Admin\AppData\Local\Temp\4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe
  "C:\Users\Admin\AppData\Local\Temp\4459704437071c72aead7341202a8ecd459d6f34bd5937ad349bc926a69e7959.exe" -sfxwaitall:0 "C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZService.exe
      "C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZService.exe"
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Writes to the Master Boot Record (MBR)
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 1944
      4⤵
      Loads dropped DLL
      Program crash
      PID:944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
b5fcc55cffd66f38d548e8b63206c5e6

SHA1
79db08ababfa33a4f644fa8fe337195b5aba44c7

SHA256
7730df1165195dd5bb6b40d6e519b4ce07aceb03601a77bca6535d31698d4ca1

SHA512
aaa17175e90dbca04f0fa753084731313e70119fef7d408b41ff4170116ab24eaee0bd05dca2cc43464b1ee920819e5ce6f6e750d97e3c4fc605f01e7ff9c649

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360Base.dll

Filesize
900KB

MD5
a73cf0457df35fab74ef3393d2766667

SHA1
c123e15967e7ab980eba5431a6993e646500befd

SHA256
df411ebc1b4a652a3822de0cebd5a48151abb3dd99c8c3d15f858401b27243fd

SHA512
faee2c8c3caf31ee2cceefadff4c442ef3aaed36fabf61a4217e1ba13b315808f09b575b5789ef7cc342cb16219afb4a1c4e7f7686ea8d079c9d7dd9ee782b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe

Filesize
762KB

MD5
aaa3aab403ff02947c0b20472e40af4e

SHA1
b63acf58aeb317fbfb253ad6ad8ffb53ce1ecc75

SHA256
2ffb6d0703e990e5b2cbeee5378e94cf53e35c56b99c412bf888e0b7aad9affa

SHA512
876f92457a10b5b3e0814f10b431bf26b781fb39210b568f88e0a3098bb8e31e2f5dcf7ae293b132e42f1e8b0dc51fd92637e054a426b567ec6d41c7277e54b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe

Filesize
762KB

MD5
aaa3aab403ff02947c0b20472e40af4e

SHA1
b63acf58aeb317fbfb253ad6ad8ffb53ce1ecc75

SHA256
2ffb6d0703e990e5b2cbeee5378e94cf53e35c56b99c412bf888e0b7aad9affa

SHA512
876f92457a10b5b3e0814f10b431bf26b781fb39210b568f88e0a3098bb8e31e2f5dcf7ae293b132e42f1e8b0dc51fd92637e054a426b567ec6d41c7277e54b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360LibDrvmgr.dat

Filesize
1KB

MD5
5c49c76eab7f4cb98161b028f56fef0d

SHA1
ee1694139f30b991dbc1f0d26af691976e462cc7

SHA256
d261b133220d0878de4d2151e71c5acb1802314b023c751a1e55fe83bff9d928

SHA512
7c8b68df7e774c9a9fb5adf6a5616ee5ce222bb6b6f2f0c2bb72ca660efa916e7c2b0084ce4b47064043f5ccaec2cc5b81bd302cddc3be8d11b2ca2a3368d8c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360NetBase.dll

Filesize
1.4MB

MD5
14c6b4bbd31f6fd13530bc941cc71d1a

SHA1
ce4e38ac82a54f64d318507ddc28f9ffbb378f0f

SHA256
401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5

SHA512
c16d525f1d3fc098b4d6c8b8a872a9013ef2f945f27af73ed7826f61a2b80d756ae5348105432909eccc71f03834cd1301f87fa5a0107e0c7137f5c8e3a3cc95

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZ.set

Filesize
65B

MD5
2d190642e5162c95e649f0032cf66dae

SHA1
262f8e1e5fff6784f31eb1a33b72e91405595297

SHA256
54a58179f47494502dd6750e2dba0008fd08958f5945346bbd8af818f52a6b3b

SHA512
6e5aa767f214c86bd1f7216ef4203931019efb7f11900d755bd409329576e4a4d6bf458b62676feab7093c9734a486e759af012a1a4bd0d1d0b246b1f10f88d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZ2.dll

Filesize
229KB

MD5
a75f38215a115f9260b58cdd935d7d81

SHA1
dbb7d9d7e69cd5f2f4cda49bebc0fd922316a866

SHA256
102459b35d0b36f915b2cafc2e083d95f4e042815c732a2520dfb646efae4cd1

SHA512
3eeacb82ed9e61d9dc8fec13c2f87fd07b90a5052dd1a3482ee4cdb5122db77587078e7966bf72d73b776973bac09f53f37081f4af0828f1a914c0cd31d03ce9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZ5.dll

Filesize
197KB

MD5
d8308aa7cc08c3a56c9187029db56702

SHA1
f8a1b97e321660d814d4d01f03911f6da0caed9d

SHA256
850bb1419ab0c93d524284a6c9c15db69a1e5328e9f84f06bb27ba5efb8a65b8

SHA512
0a6c757b3e5cfaf2de92e4f402dc97306a551244501d97a099ac2a586c7501f087fe7c82c8a81e95b4fea851a0690733c116345360b5dbeb343966fdbda08baa

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZService.exe

Filesize
1.1MB

MD5
66bed313b2a1d83113ced5c4297c0abc

SHA1
bfc0ca5ca11b5e9e0a84c5a25fb3fb7bfc8cc5eb

SHA256
b6ce0f204ed6f92ed8949c12cff5ac63f003adcbeb6e744ab81f7ac10d18e23f

SHA512
8ad3abfd830e4d500be988bc0c771cb7537fbfcdae15dbe44b82cdeabbbeef6b523ae3c0038c0026c7937289ba9bc526ecbe640cc1757a1552d4f3555a3746d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZService.exe

Filesize
1.1MB

MD5
66bed313b2a1d83113ced5c4297c0abc

SHA1
bfc0ca5ca11b5e9e0a84c5a25fb3fb7bfc8cc5eb

SHA256
b6ce0f204ed6f92ed8949c12cff5ac63f003adcbeb6e744ab81f7ac10d18e23f

SHA512
8ad3abfd830e4d500be988bc0c771cb7537fbfcdae15dbe44b82cdeabbbeef6b523ae3c0038c0026c7937289ba9bc526ecbe640cc1757a1552d4f3555a3746d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZ_HardwareDll.dll

Filesize
8.5MB

MD5
2bcee702e76853c61a3621e410521a20

SHA1
824a186e0f1d77692b416877c18d867885dc2dca

SHA256
14f5ffec3b83ed5831f7cd046552b9b224a6ec2613643f85c8cebfdf72df80d5

SHA512
f20fec854d0399d57e58b2056063be9414a0714c8938e914fbbab6cd1fc2eac09fb3919359eaee83284b60923f38252c417ce430c081dbf4bcfbf2c176fa20e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\DataMgr.dll

Filesize
664KB

MD5
af1cc0d945bceb82863195d11ad9827e

SHA1
215884e6188ebf94b73bffbff7e040e376954874

SHA256
18d8c74199c73a226436b3cbde6ce232b8aa30dabdc0dbb64e9dc52c18fa0a05

SHA512
39f1e822ea1b0f1ac292533df058977ece4386b7636256a4158f65c9f1e6ad05cc1c91f0edb19af03fe9b757661348256b667d285243db55404c42ea3e3d3daf

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\DownloadMgr.dll

Filesize
431KB

MD5
9df1215e8ff502a448f5e03555b62b95

SHA1
fe7f3fe364634879a155ec2abbdf2abe302412a5

SHA256
dbe9efd63ce1b628a2a96457d0b26d48e7ae96a564a413e0e641f81caa48fc1f

SHA512
4e28a52b761a67f2d0affe73df423092d319f772ef7d79d544c32737b7c5bddb3680b2ddf9a7de6a25adc62d23579ae8a7472f3e8b45d79eb52fa05e0ced3000

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\DrvMgrUI.dll

Filesize
2.5MB

MD5
76d802e69cf6898a1f533cf1db481276

SHA1
af4e32c8f98bbfe4fe4ac4e5e4aa5def7b485f4b

SHA256
f2a58ccfe37237bc8d0641f11fd9c69db3cfa595ebbd1bb206289eba8039d159

SHA512
1f501f416e50ec30a2e427605f3e0fce51daf67d1fe4cc1a4ba91ab3960c81037f5f966354229cc4e12543257b6d597f0ed3da7d8553b8a256fc5ca60b4b830f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\DrvmgrCore.dll

Filesize
1.2MB

MD5
d05a967e7f6ba5c4bcb4e8bd7f148061

SHA1
241c246153885a419f1fe4dab0639ac144e57c32

SHA256
76d6e20231be330caf4be260ec0071f4183241a20ae58521086fe4de81bb409b

SHA512
541ab45df6b4706214bca0b3099aea0b49b7630ad8bbe7454ea7a0216b7d8bb379f2263edecbd3d563898457a4d33ab9365a46a62f3d1f944403e2a7c39ca4ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\MiniUI.dll

Filesize
901KB

MD5
043365f793b1672fc80aaebde3b22929

SHA1
be526a544e7af66b573b29ee7100374e9deb9a1f

SHA256
2bf36c7813e8410e2ef442158e4089f5c5fa512684848f421cd4b08f1eca1d23

SHA512
efb94e1447842254992f67ad2bcc8ebd1862894019e612d680a3b69a4ec9aaef787bddd155775842baf225b9dea05feaef37db26808fc8516851f995a0b62530

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\PDown.dll

Filesize
230KB

MD5
48a849ff04150b2ec0836ab6bb32590a

SHA1
1f52bbcd5d124de15c27cf5ea84e14cb9a87f6a3

SHA256
ded09df700ef458322b6160edd39adb103c03cef3c6ffbce2ee096ce1fd33d62

SHA512
b0b23e540102b16c4ed9ac05f1ac353bf0d19e0c2b0880cec1fa2e9292030e1c5a75694176ac428c7de55588cf503ab36643d2db8c1fec3543daf3aeeb53a680

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ScriptExecute.exe

Filesize
520KB

MD5
eea4fbb86da8e1081d0d70f02c632f1f

SHA1
0d92de64f4749843136aaf00b35528096d4cdfeb

SHA256
516da8a4a7aeee54231386f6695559046e5d48c7ccb101bd0af14f2f8f5b0e80

SHA512
43b3b7e36701bcdbb3d7ee89c84ee2a38e7e157f19ea5257cebb626c6321db15d59ddb4f42de61e6d9658fa3771689253c2c435b423f91d9695cb71fa6302e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\config\config.xml

Filesize
978B

MD5
583e167ba709fec11044409c6b09d04f

SHA1
27b363d8b5dee2df351a5d41e6f14b6156db190f

SHA256
ea5f4faf853767718beef85023fcd9e13cca2127ebb3c17331903779db2916a0

SHA512
bebb16e99340d9264b7ae4cfd1562243a8cef688d3585968046c68020f19de587668485017f74368c20b686f5543bb319cc02665a3cdbb890eb47ffa4ce2a20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\config\defaultskin\defaultskin.ui

Filesize
156KB

MD5
0cc06e728803d0cdeedda92e04313e6c

SHA1
62e897041bdbf18ca65f6c452abcb557e17c0ded

SHA256
3fb6414e92be15821c674a6e72295e75747e9734c827ac14e85479d4720f2b33

SHA512
72afb68bf2078e459cf2e37481c61ff172dd224f5b089bf9903b0c55660aecfdcb98622c0b04fe88edae0e2e25c0eb640cffafc7343bbe5d67ef137397678936

Download Submit
C:\Users\Admin\AppData\Local\Temp\360DrvMgr\config\defaultskin\miniui.xml

Filesize
8KB

MD5
1c7fad425e4dc4787174876b6725c5de

SHA1
6bf7f9afb666636bea1cef7eca6ebc32f4b344a2

SHA256
ee451d9f3d84226bcd456f193e1e79ebfbd1f24b961b25770c40df93ee7ca494

SHA512
ab02ca7851e6a859244edea31b3cf931a14937ec9ad2274c49a1aedb5a258360f653d7d5e76b9c6166633c4c284db9be277ae584d89641a99da3c77564f8b57d

Download Submit
C:\Users\Admin\AppData\Roaming\360DrvMgr\Config.ini

Filesize
44B

MD5
5b4a431dcb216d13f365560463ae0e27

SHA1
5870343319f01c77267845040e9d6baa5cae73b3

SHA256
a96645cf19af1af24f5888af2d531482081ff42da6e01515128353847a25d0a7

SHA512
d5c37521f40ae352a4acb07b9b2ddbffdcd57b4cc6b39e7f3eff13783c4bd482bd17085513ab164ffb2295e4304d30e21c9437117a8ee4d172fb38ac49fd8e86

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\360Base.dll

Filesize
900KB

MD5
a73cf0457df35fab74ef3393d2766667

SHA1
c123e15967e7ab980eba5431a6993e646500befd

SHA256
df411ebc1b4a652a3822de0cebd5a48151abb3dd99c8c3d15f858401b27243fd

SHA512
faee2c8c3caf31ee2cceefadff4c442ef3aaed36fabf61a4217e1ba13b315808f09b575b5789ef7cc342cb16219afb4a1c4e7f7686ea8d079c9d7dd9ee782b90

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\360Base.dll

Filesize
900KB

MD5
a73cf0457df35fab74ef3393d2766667

SHA1
c123e15967e7ab980eba5431a6993e646500befd

SHA256
df411ebc1b4a652a3822de0cebd5a48151abb3dd99c8c3d15f858401b27243fd

SHA512
faee2c8c3caf31ee2cceefadff4c442ef3aaed36fabf61a4217e1ba13b315808f09b575b5789ef7cc342cb16219afb4a1c4e7f7686ea8d079c9d7dd9ee782b90

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe

Filesize
762KB

MD5
aaa3aab403ff02947c0b20472e40af4e

SHA1
b63acf58aeb317fbfb253ad6ad8ffb53ce1ecc75

SHA256
2ffb6d0703e990e5b2cbeee5378e94cf53e35c56b99c412bf888e0b7aad9affa

SHA512
876f92457a10b5b3e0814f10b431bf26b781fb39210b568f88e0a3098bb8e31e2f5dcf7ae293b132e42f1e8b0dc51fd92637e054a426b567ec6d41c7277e54b4

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe

Filesize
762KB

MD5
aaa3aab403ff02947c0b20472e40af4e

SHA1
b63acf58aeb317fbfb253ad6ad8ffb53ce1ecc75

SHA256
2ffb6d0703e990e5b2cbeee5378e94cf53e35c56b99c412bf888e0b7aad9affa

SHA512
876f92457a10b5b3e0814f10b431bf26b781fb39210b568f88e0a3098bb8e31e2f5dcf7ae293b132e42f1e8b0dc51fd92637e054a426b567ec6d41c7277e54b4

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe

Filesize
762KB

MD5
aaa3aab403ff02947c0b20472e40af4e

SHA1
b63acf58aeb317fbfb253ad6ad8ffb53ce1ecc75

SHA256
2ffb6d0703e990e5b2cbeee5378e94cf53e35c56b99c412bf888e0b7aad9affa

SHA512
876f92457a10b5b3e0814f10b431bf26b781fb39210b568f88e0a3098bb8e31e2f5dcf7ae293b132e42f1e8b0dc51fd92637e054a426b567ec6d41c7277e54b4

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe

Filesize
762KB

MD5
aaa3aab403ff02947c0b20472e40af4e

SHA1
b63acf58aeb317fbfb253ad6ad8ffb53ce1ecc75

SHA256
2ffb6d0703e990e5b2cbeee5378e94cf53e35c56b99c412bf888e0b7aad9affa

SHA512
876f92457a10b5b3e0814f10b431bf26b781fb39210b568f88e0a3098bb8e31e2f5dcf7ae293b132e42f1e8b0dc51fd92637e054a426b567ec6d41c7277e54b4

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe

Filesize
762KB

MD5
aaa3aab403ff02947c0b20472e40af4e

SHA1
b63acf58aeb317fbfb253ad6ad8ffb53ce1ecc75

SHA256
2ffb6d0703e990e5b2cbeee5378e94cf53e35c56b99c412bf888e0b7aad9affa

SHA512
876f92457a10b5b3e0814f10b431bf26b781fb39210b568f88e0a3098bb8e31e2f5dcf7ae293b132e42f1e8b0dc51fd92637e054a426b567ec6d41c7277e54b4

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe

Filesize
762KB

MD5
aaa3aab403ff02947c0b20472e40af4e

SHA1
b63acf58aeb317fbfb253ad6ad8ffb53ce1ecc75

SHA256
2ffb6d0703e990e5b2cbeee5378e94cf53e35c56b99c412bf888e0b7aad9affa

SHA512
876f92457a10b5b3e0814f10b431bf26b781fb39210b568f88e0a3098bb8e31e2f5dcf7ae293b132e42f1e8b0dc51fd92637e054a426b567ec6d41c7277e54b4

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\360NetBase.dll

Filesize
1.4MB

MD5
14c6b4bbd31f6fd13530bc941cc71d1a

SHA1
ce4e38ac82a54f64d318507ddc28f9ffbb378f0f

SHA256
401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5

SHA512
c16d525f1d3fc098b4d6c8b8a872a9013ef2f945f27af73ed7826f61a2b80d756ae5348105432909eccc71f03834cd1301f87fa5a0107e0c7137f5c8e3a3cc95

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZ2.dll

Filesize
229KB

MD5
a75f38215a115f9260b58cdd935d7d81

SHA1
dbb7d9d7e69cd5f2f4cda49bebc0fd922316a866

SHA256
102459b35d0b36f915b2cafc2e083d95f4e042815c732a2520dfb646efae4cd1

SHA512
3eeacb82ed9e61d9dc8fec13c2f87fd07b90a5052dd1a3482ee4cdb5122db77587078e7966bf72d73b776973bac09f53f37081f4af0828f1a914c0cd31d03ce9

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZ5.dll

Filesize
197KB

MD5
d8308aa7cc08c3a56c9187029db56702

SHA1
f8a1b97e321660d814d4d01f03911f6da0caed9d

SHA256
850bb1419ab0c93d524284a6c9c15db69a1e5328e9f84f06bb27ba5efb8a65b8

SHA512
0a6c757b3e5cfaf2de92e4f402dc97306a551244501d97a099ac2a586c7501f087fe7c82c8a81e95b4fea851a0690733c116345360b5dbeb343966fdbda08baa

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZService.exe

Filesize
1.1MB

MD5
66bed313b2a1d83113ced5c4297c0abc

SHA1
bfc0ca5ca11b5e9e0a84c5a25fb3fb7bfc8cc5eb

SHA256
b6ce0f204ed6f92ed8949c12cff5ac63f003adcbeb6e744ab81f7ac10d18e23f

SHA512
8ad3abfd830e4d500be988bc0c771cb7537fbfcdae15dbe44b82cdeabbbeef6b523ae3c0038c0026c7937289ba9bc526ecbe640cc1757a1552d4f3555a3746d6

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZ_HardwareDll.dll

Filesize
8.5MB

MD5
2bcee702e76853c61a3621e410521a20

SHA1
824a186e0f1d77692b416877c18d867885dc2dca

SHA256
14f5ffec3b83ed5831f7cd046552b9b224a6ec2613643f85c8cebfdf72df80d5

SHA512
f20fec854d0399d57e58b2056063be9414a0714c8938e914fbbab6cd1fc2eac09fb3919359eaee83284b60923f38252c417ce430c081dbf4bcfbf2c176fa20e9

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZ_HardwareDll.dll

Filesize
8.5MB

MD5
2bcee702e76853c61a3621e410521a20

SHA1
824a186e0f1d77692b416877c18d867885dc2dca

SHA256
14f5ffec3b83ed5831f7cd046552b9b224a6ec2613643f85c8cebfdf72df80d5

SHA512
f20fec854d0399d57e58b2056063be9414a0714c8938e914fbbab6cd1fc2eac09fb3919359eaee83284b60923f38252c417ce430c081dbf4bcfbf2c176fa20e9

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZ_HardwareDll.dll

Filesize
8.5MB

MD5
2bcee702e76853c61a3621e410521a20

SHA1
824a186e0f1d77692b416877c18d867885dc2dca

SHA256
14f5ffec3b83ed5831f7cd046552b9b224a6ec2613643f85c8cebfdf72df80d5

SHA512
f20fec854d0399d57e58b2056063be9414a0714c8938e914fbbab6cd1fc2eac09fb3919359eaee83284b60923f38252c417ce430c081dbf4bcfbf2c176fa20e9

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\DataMgr.dll

Filesize
664KB

MD5
af1cc0d945bceb82863195d11ad9827e

SHA1
215884e6188ebf94b73bffbff7e040e376954874

SHA256
18d8c74199c73a226436b3cbde6ce232b8aa30dabdc0dbb64e9dc52c18fa0a05

SHA512
39f1e822ea1b0f1ac292533df058977ece4386b7636256a4158f65c9f1e6ad05cc1c91f0edb19af03fe9b757661348256b667d285243db55404c42ea3e3d3daf

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\DownloadMgr.dll

Filesize
431KB

MD5
9df1215e8ff502a448f5e03555b62b95

SHA1
fe7f3fe364634879a155ec2abbdf2abe302412a5

SHA256
dbe9efd63ce1b628a2a96457d0b26d48e7ae96a564a413e0e641f81caa48fc1f

SHA512
4e28a52b761a67f2d0affe73df423092d319f772ef7d79d544c32737b7c5bddb3680b2ddf9a7de6a25adc62d23579ae8a7472f3e8b45d79eb52fa05e0ced3000

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\DownloadMgr.dll

Filesize
431KB

MD5
9df1215e8ff502a448f5e03555b62b95

SHA1
fe7f3fe364634879a155ec2abbdf2abe302412a5

SHA256
dbe9efd63ce1b628a2a96457d0b26d48e7ae96a564a413e0e641f81caa48fc1f

SHA512
4e28a52b761a67f2d0affe73df423092d319f772ef7d79d544c32737b7c5bddb3680b2ddf9a7de6a25adc62d23579ae8a7472f3e8b45d79eb52fa05e0ced3000

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\DownloadMgr.dll

Filesize
431KB

MD5
9df1215e8ff502a448f5e03555b62b95

SHA1
fe7f3fe364634879a155ec2abbdf2abe302412a5

SHA256
dbe9efd63ce1b628a2a96457d0b26d48e7ae96a564a413e0e641f81caa48fc1f

SHA512
4e28a52b761a67f2d0affe73df423092d319f772ef7d79d544c32737b7c5bddb3680b2ddf9a7de6a25adc62d23579ae8a7472f3e8b45d79eb52fa05e0ced3000

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\DrvMgrUI.dll

Filesize
2.5MB

MD5
76d802e69cf6898a1f533cf1db481276

SHA1
af4e32c8f98bbfe4fe4ac4e5e4aa5def7b485f4b

SHA256
f2a58ccfe37237bc8d0641f11fd9c69db3cfa595ebbd1bb206289eba8039d159

SHA512
1f501f416e50ec30a2e427605f3e0fce51daf67d1fe4cc1a4ba91ab3960c81037f5f966354229cc4e12543257b6d597f0ed3da7d8553b8a256fc5ca60b4b830f

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\DrvMgrUI.dll

Filesize
2.5MB

MD5
76d802e69cf6898a1f533cf1db481276

SHA1
af4e32c8f98bbfe4fe4ac4e5e4aa5def7b485f4b

SHA256
f2a58ccfe37237bc8d0641f11fd9c69db3cfa595ebbd1bb206289eba8039d159

SHA512
1f501f416e50ec30a2e427605f3e0fce51daf67d1fe4cc1a4ba91ab3960c81037f5f966354229cc4e12543257b6d597f0ed3da7d8553b8a256fc5ca60b4b830f

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\DrvMgrUI.dll

Filesize
2.5MB

MD5
76d802e69cf6898a1f533cf1db481276

SHA1
af4e32c8f98bbfe4fe4ac4e5e4aa5def7b485f4b

SHA256
f2a58ccfe37237bc8d0641f11fd9c69db3cfa595ebbd1bb206289eba8039d159

SHA512
1f501f416e50ec30a2e427605f3e0fce51daf67d1fe4cc1a4ba91ab3960c81037f5f966354229cc4e12543257b6d597f0ed3da7d8553b8a256fc5ca60b4b830f

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\DrvmgrCore.dll

Filesize
1.2MB

MD5
d05a967e7f6ba5c4bcb4e8bd7f148061

SHA1
241c246153885a419f1fe4dab0639ac144e57c32

SHA256
76d6e20231be330caf4be260ec0071f4183241a20ae58521086fe4de81bb409b

SHA512
541ab45df6b4706214bca0b3099aea0b49b7630ad8bbe7454ea7a0216b7d8bb379f2263edecbd3d563898457a4d33ab9365a46a62f3d1f944403e2a7c39ca4ca

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\DrvmgrCore.dll

Filesize
1.2MB

MD5
d05a967e7f6ba5c4bcb4e8bd7f148061

SHA1
241c246153885a419f1fe4dab0639ac144e57c32

SHA256
76d6e20231be330caf4be260ec0071f4183241a20ae58521086fe4de81bb409b

SHA512
541ab45df6b4706214bca0b3099aea0b49b7630ad8bbe7454ea7a0216b7d8bb379f2263edecbd3d563898457a4d33ab9365a46a62f3d1f944403e2a7c39ca4ca

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\DrvmgrCore.dll

Filesize
1.2MB

MD5
d05a967e7f6ba5c4bcb4e8bd7f148061

SHA1
241c246153885a419f1fe4dab0639ac144e57c32

SHA256
76d6e20231be330caf4be260ec0071f4183241a20ae58521086fe4de81bb409b

SHA512
541ab45df6b4706214bca0b3099aea0b49b7630ad8bbe7454ea7a0216b7d8bb379f2263edecbd3d563898457a4d33ab9365a46a62f3d1f944403e2a7c39ca4ca

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\MiniUI.dll

Filesize
901KB

MD5
043365f793b1672fc80aaebde3b22929

SHA1
be526a544e7af66b573b29ee7100374e9deb9a1f

SHA256
2bf36c7813e8410e2ef442158e4089f5c5fa512684848f421cd4b08f1eca1d23

SHA512
efb94e1447842254992f67ad2bcc8ebd1862894019e612d680a3b69a4ec9aaef787bddd155775842baf225b9dea05feaef37db26808fc8516851f995a0b62530

Download Submit
\Users\Admin\AppData\Local\Temp\360DrvMgr\pdown.dll

Filesize
230KB

MD5
48a849ff04150b2ec0836ab6bb32590a

SHA1
1f52bbcd5d124de15c27cf5ea84e14cb9a87f6a3

SHA256
ded09df700ef458322b6160edd39adb103c03cef3c6ffbce2ee096ce1fd33d62

SHA512
b0b23e540102b16c4ed9ac05f1ac353bf0d19e0c2b0880cec1fa2e9292030e1c5a75694176ac428c7de55588cf503ab36643d2db8c1fec3543daf3aeeb53a680

Download Submit
memory/1636-166-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/1636-274-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/2032-177-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2032-271-0x00000000021B0000-0x00000000021E7000-memory.dmp

Filesize
220KB

Download
memory/2032-275-0x00000000021B0000-0x00000000021E7000-memory.dmp

Filesize
220KB

Download