7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8

Analysis

max time kernel
143s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-05-2023 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe
Size

977KB
MD5

dec770c92c91d7320ce4863affb310f4
SHA1

3add3880121e96207b3a7073999eabde466d8e02
SHA256

7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8
SHA512

7301f0a686326da6f948a04aa3adc5cc2ed4fbf2e19f5ad93106e4771e9f3d9a161f1f3f754429ef30aa8cb306090bd45dfac09068012fd22905e0a3d183cb18
SSDEEP

24576:xqd3Wqy5ZH2u7VyIb8NjMg2DjozicfyGmALYNsOPzmjHtXv:xqRDQZH2u7db8NjFyEzicc3sYzmjHVv

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\DriverGenius.ExE	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\DriverGenius.ExE	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\DriverGenius.ExE	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\DriverGenius.ExE	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\DriverGenius.ExE	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\DriverGenius.ExE	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\DriverGenius.ExE	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\DriverGenius.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

DriverGenius.exe

pid process

268 DriverGenius.exe

pid	process
268	DriverGenius.exe

Loads dropped DLL 9 IoCs

Processes:

7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exeDriverGenius.exe

pid	process
2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe
2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe
268	DriverGenius.exe
268	DriverGenius.exe
268	DriverGenius.exe
268	DriverGenius.exe
268	DriverGenius.exe
268	DriverGenius.exe
268	DriverGenius.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DriverGenius.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DriverGenius.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DriverGenius.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK	DriverGenius.exe

Modifies registry class 64 IoCs

Processes:

DriverGenius.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07189400-00F2-11D5-802D-0060082AE372}\TypeLib\ = "{DB797681-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DB797691-40E0-11D2-9BD5-0060082AE372}\ProxyStubClsid32	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C836511-BB70-11D2-A5A7-00105A9C91C6}\TypeLib\ = "{DB797681-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DriverGenius\DefaultICO\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DriverGenius.exe,0"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CC6FD600-EE1D-11D4-801A-0060082AE372}	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC6FD600-EE1D-11D4-801A-0060082AE372}\TypeLib\ = "{DB797681-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB797691-40E0-11D2-9BD5-0060082AE372}	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C836511-BB70-11D2-A5A7-00105A9C91C6}\TypeLib	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}\Verb\1\ = "Free &Support, 0, 2"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DB797681-40E0-11D2-9BD5-0060082AE372}\5.0	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DB797681-40E0-11D2-9BD5-0060082AE372}\5.0\0	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31C2DDD0-B692-11D4-BFE3-0060082AE372}\ProxyStubClsid32	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07189400-00F2-11D5-802D-0060082AE372}\ProxyStubClsid32	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XceedSoftware.XceedZip.5\CLSID\ = "{DB797690-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC4831F-8C1F-434E-9F80-7F1B5B0036E0}\TypeLib\Version = "5.0"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}\TypeLib\ = "{DB797681-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}\MiscStatus	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}\Control	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}\Insertable	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC4831F-8C1F-434E-9F80-7F1B5B0036E0}\TypeLib\Version = "5.0"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4C836511-BB70-11D2-A5A7-00105A9C91C6}\TypeLib\ = "{DB797681-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{05D56700-EB90-11D2-A5CD-00105A9C91C6}\ = "IXceedCompression__0401"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}\ = "Xceed Zip Control v5.0"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31C2DDD1-B692-11D4-BFE3-0060082AE372}\ = "IXceedZipItem__0405"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31C2DDD2-B692-11D4-BFE3-0060082AE372}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99C11080-CD22-11D4-BFFA-0060082AE372}	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BAA1401E-3F5F-47A4-870B-431D602D2488}\TypeLib\ = "{DB797681-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB79768F-40E0-11D2-9BD5-0060082AE372}\ = "IXceedZip__0400"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31C2DDD0-B692-11D4-BFE3-0060082AE372}\ = "IXceedZip__0402"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31C2DDD1-B692-11D4-BFE3-0060082AE372}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DB797691-40E0-11D2-9BD5-0060082AE372}\TypeLib	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4C836511-BB70-11D2-A5A7-00105A9C91C6}\TypeLib	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}\Programmable	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}\MiscStatus\1	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}\MiscStatus\1\ = "132497"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC4831F-8C1F-434E-9F80-7F1B5B0036E0}\ProxyStubClsid32	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31C2DDD2-B692-11D4-BFE3-0060082AE372}\ProxyStubClsid32	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31C2DDD2-B692-11D4-BFE3-0060082AE372}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99C11080-CD22-11D4-BFFA-0060082AE372}\TypeLib\ = "{DB797681-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XceedSoftware.XceedZip\ = "Xceed Zip Control v5.0"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05D56700-EB90-11D2-A5CD-00105A9C91C6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DB797681-40E0-11D2-9BD5-0060082AE372}\5.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0CECD40-EB84-11D2-A5CD-00105A9C91C6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC4831F-8C1F-434E-9F80-7F1B5B0036E0}	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC4831F-8C1F-434E-9F80-7F1B5B0036E0}\TypeLib\ = "{DB797681-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dif	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}\TypeLib	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BAA1401E-3F5F-47A4-870B-431D602D2488}\ = "IXceedZip"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CC6FD600-EE1D-11D4-801A-0060082AE372}\ProxyStubClsid32	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C836511-BB70-11D2-A5A7-00105A9C91C6}\ProxyStubClsid32	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XceedSoftware.XceedCompression\CLSID	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77243A10-00F3-11D5-802D-0060082AE372}\TypeLib	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{07189400-00F2-11D5-802D-0060082AE372}\TypeLib\Version = "5.0"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XceedSoftware.XceedZip	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XceedSoftware.XceedCompression.5\ = "Xceed Compression Control v5.0"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BAA1401E-3F5F-47A4-870B-431D602D2488}	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A0CECD40-EB84-11D2-A5CD-00105A9C91C6}\TypeLib\Version = "5.0"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC4831F-8C1F-434E-9F80-7F1B5B0036E0}\ = "IXceedZipItem"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DB797691-40E0-11D2-9BD5-0060082AE372}\TypeLib\Version = "5.0"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XceedSoftware.XceedZip\CurVer	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}\TypeLib\ = "{DB797681-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31C2DDD0-B692-11D4-BFE3-0060082AE372}	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB797691-40E0-11D2-9BD5-0060082AE372}\TypeLib\ = "{DB797681-40E0-11D2-9BD5-0060082AE372}"	DriverGenius.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77243A10-00F3-11D5-802D-0060082AE372}\ = "IXceedCompression"	DriverGenius.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

696 regedit.exe

pid	process
696	regedit.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exeDriverGenius.exe

description	pid	process
Token: SeRestorePrivilege	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe
Token: SeBackupPrivilege	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe
Token: SeBackupPrivilege	268	DriverGenius.exe
Token: SeRestorePrivilege	268	DriverGenius.exe
Token: SeRestorePrivilege	268	DriverGenius.exe
Token: SeRestorePrivilege	268	DriverGenius.exe
Token: SeRestorePrivilege	268	DriverGenius.exe
Token: SeRestorePrivilege	268	DriverGenius.exe
Token: SeRestorePrivilege	268	DriverGenius.exe
Token: SeRestorePrivilege	268	DriverGenius.exe
Token: SeRestorePrivilege	268	DriverGenius.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DriverGenius.exe

pid process

268 DriverGenius.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

DriverGenius.exe

pid process

268 DriverGenius.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DriverGenius.exe

pid process

268 DriverGenius.exe

pid	process
268	DriverGenius.exe

pid	process
268	DriverGenius.exe

pid	process
268	DriverGenius.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe

description	pid	process	target process
PID 2032 wrote to memory of 696	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	regedit.exe
PID 2032 wrote to memory of 696	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	regedit.exe
PID 2032 wrote to memory of 696	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	regedit.exe
PID 2032 wrote to memory of 696	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	regedit.exe
PID 2032 wrote to memory of 696	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	regedit.exe
PID 2032 wrote to memory of 696	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	regedit.exe
PID 2032 wrote to memory of 696	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	regedit.exe
PID 2032 wrote to memory of 268	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	DriverGenius.exe
PID 2032 wrote to memory of 268	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	DriverGenius.exe
PID 2032 wrote to memory of 268	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	DriverGenius.exe
PID 2032 wrote to memory of 268	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	DriverGenius.exe
PID 2032 wrote to memory of 268	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	DriverGenius.exe
PID 2032 wrote to memory of 268	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	DriverGenius.exe
PID 2032 wrote to memory of 268	2032	7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe	DriverGenius.exe

C:\Users\Admin\AppData\Local\Temp\7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe
"C:\Users\Admin\AppData\Local\Temp\7a161736bbfef09ddaf0ac6b4e0c2d5c405b990c326d6b0bfe220d313d72a3e8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" /s regGB.reg
2⤵
- Runs .reg file with regedit
PID:696

C:\Users\Admin\AppData\Local\Temp\DriverGenius.exe
"C:\Users\Admin\AppData\Local\Temp\DriverGenius.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DriverGenius.ExE

Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverGenius.ExE

Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverGenius.exe

Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Register.key

Filesize
382B

MD5
275a25c8d4e0ceeaea2a3b747860e2a3

SHA1
e9f819f13c45fe2ebfa3c2ac745ff1e42ee34b48

SHA256
5129ce4e3452402ecce8e094a14946c1501b44dabf2c9efdae9c889fe6f8d0a7

SHA512
977f466f196cabb5c6cdc6595dd8e3a778c50be48c6450b29b9e3a3529a9e27b30269023b6a1f37f88a3a891e248822cb65808502ebf63e8f6566381423d2471

Download Submit
C:\Users\Admin\AppData\Local\Temp\XceedZip.dll

Filesize
212KB

MD5
053428bf756a64ad57b253fe0e4773b4

SHA1
0834e785be130dbaf70cbf5b2f6ff9884efd5276

SHA256
924d66e6a440be9c78ce020540d4bb37454b4f6a7d8a2e63749ada1d990d6cfc

SHA512
30f35064adb0dbf9e5d7b02e6fca9d9516ea26dd4705b2e7cb2d8e29dbc47d4398a32728034640167cceda97f27c1470d7cf06052b80c04348289c087b84bcb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\regGB.reg

Filesize
1KB

MD5
b9c2108bc717726aca52271ae5b35134

SHA1
c861ed81d7603d03519abf1ea771feae7218b392

SHA256
f59ae1bc8976939fd78fd7b9a6fb9d97d52803aa6625f313be1c0138c4c991dd

SHA512
2fe853df320926f3ac2d72a39fb93ee4d1c6c82ac066f637318e2477b0170b9b0567b0b8da6e09c392ba42e21b44e8f20c3c1c76e84ed7015c29b26b9c388cfa

Download Submit
\Users\Admin\AppData\Local\Temp\DriverGenius.ExE

Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
\Users\Admin\AppData\Local\Temp\DriverGenius.ExE

Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
\Users\Admin\AppData\Local\Temp\DriverGenius.ExE

Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
\Users\Admin\AppData\Local\Temp\DriverGenius.ExE

Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
\Users\Admin\AppData\Local\Temp\DriverGenius.ExE

Filesize
770KB

MD5
740e300006a510f82add5f49c1a12ab5

SHA1
5ed94f2271d510f5861f766770129ca630ba4f2f

SHA256
b9195eb8127a72e98d86dfc898faba323f225beef3e5803602198cd0410e4119

SHA512
43a3e061b0313ec3329ffcb22dc6de839acadafae55b2f84d171d3d3ac7a9e9739da702755b62f753ec3259d6d2b18a4d8d982253cc41d12546089a5d202e1f6

Download Submit
\Users\Admin\AppData\Local\Temp\XceedZip.dll

Filesize
212KB

MD5
053428bf756a64ad57b253fe0e4773b4

SHA1
0834e785be130dbaf70cbf5b2f6ff9884efd5276

SHA256
924d66e6a440be9c78ce020540d4bb37454b4f6a7d8a2e63749ada1d990d6cfc

SHA512
30f35064adb0dbf9e5d7b02e6fca9d9516ea26dd4705b2e7cb2d8e29dbc47d4398a32728034640167cceda97f27c1470d7cf06052b80c04348289c087b84bcb5

Download Submit
\Users\Admin\AppData\Local\Temp\XceedZip.dll

Filesize
212KB

MD5
053428bf756a64ad57b253fe0e4773b4

SHA1
0834e785be130dbaf70cbf5b2f6ff9884efd5276

SHA256
924d66e6a440be9c78ce020540d4bb37454b4f6a7d8a2e63749ada1d990d6cfc

SHA512
30f35064adb0dbf9e5d7b02e6fca9d9516ea26dd4705b2e7cb2d8e29dbc47d4398a32728034640167cceda97f27c1470d7cf06052b80c04348289c087b84bcb5

Download Submit
\Users\Admin\AppData\Local\Temp\XceedZip.dll

Filesize
212KB

MD5
053428bf756a64ad57b253fe0e4773b4

SHA1
0834e785be130dbaf70cbf5b2f6ff9884efd5276

SHA256
924d66e6a440be9c78ce020540d4bb37454b4f6a7d8a2e63749ada1d990d6cfc

SHA512
30f35064adb0dbf9e5d7b02e6fca9d9516ea26dd4705b2e7cb2d8e29dbc47d4398a32728034640167cceda97f27c1470d7cf06052b80c04348289c087b84bcb5

Download Submit
\Users\Admin\AppData\Local\Temp\XceedZip.dll

Filesize
212KB

MD5
053428bf756a64ad57b253fe0e4773b4

SHA1
0834e785be130dbaf70cbf5b2f6ff9884efd5276

SHA256
924d66e6a440be9c78ce020540d4bb37454b4f6a7d8a2e63749ada1d990d6cfc

SHA512
30f35064adb0dbf9e5d7b02e6fca9d9516ea26dd4705b2e7cb2d8e29dbc47d4398a32728034640167cceda97f27c1470d7cf06052b80c04348289c087b84bcb5

Download Submit
memory/268-89-0x0000000067670000-0x00000000676EE000-memory.dmp

Filesize
504KB

Download
memory/268-90-0x0000000002F00000-0x0000000002F02000-memory.dmp

Filesize
8KB

Download
memory/268-93-0x0000000067670000-0x00000000676EE000-memory.dmp

Filesize
504KB

Download
memory/268-94-0x0000000000400000-0x0000000000586000-memory.dmp

Filesize
1.5MB

Download
memory/2032-67-0x0000000000240000-0x0000000000263000-memory.dmp

Filesize
140KB

Download
memory/2032-82-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download
memory/2032-68-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/2032-77-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2032-66-0x0000000000240000-0x0000000000263000-memory.dmp

Filesize
140KB

Download
memory/2032-65-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download