0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b

Analysis

max time kernel
650s
max time network
509s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2023 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe
Size

80.5MB
MD5

5d084b1901f13e46b747fcc82f7e10b1
SHA1

1635f3678d02291c5a5b78df8c429e273cca0b30
SHA256

0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b
SHA512

d1a7e269925b50ecd44b97ed39372a918896a4e976c6b9ab09ae948a27af15205cb3c5aee698d80844096c293910d61e402120758e9a46c1def576e8a0d15f7b
SSDEEP

1572864:i0mBl123uKwMxmeK6GyXHdUoIL95a426hwN/T1xF6GXtayb5tBLGUOtFohz:33uKwFF6ubNhG1xgGXXtBaUzB

Score

8^/10

agilenet persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exemsiexec.exe

flow pid process

17 4576 msiexec.exe
101 4988 msiexec.exe
106 4988 msiexec.exe

flow	pid	process
17	4576	msiexec.exe
101	4988	msiexec.exe
106	4988	msiexec.exe

Drops file in Drivers directory 3 IoCs

Processes:

MsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\SETC157.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETC157.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\monblanking.sys	MsiExec.exe

Registers new Print Monitor 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

spoolsv.exespoolsv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\novaPDF Port Monitor\Ports\GoToPrintAssistPort	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\novaPDF Port Monitor\Driver = "novamn8.dll"	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\GoToMyPC Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\novaPDF Port Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\novaPDF Port Monitor\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\GoToMyPC Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\novaPDF Port Monitor\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\novaPDF Port Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe

Obfuscated with Agile.Net obfuscator 4 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/1400-1130-0x0000000000560000-0x0000000000570000-memory.dmp	agile_net
behavioral2/memory/1400-1133-0x0000000019CB0000-0x0000000019CC2000-memory.dmp	agile_net
behavioral2/memory/1400-1134-0x0000000019F30000-0x0000000019F70000-memory.dmp	agile_net
behavioral2/memory/1400-1135-0x0000000001360000-0x000000000136C000-memory.dmp	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe

Drops file in System32 directory 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exeMsiExec.exeMsiExec.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\novaem8.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_amd64_727881fda5cf7db0\amd64\novaemex8.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\nova8X86.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET476.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{97a53111-77ee-d849-aee7-fd51ed429619}\g2pvdd.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFD13.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFE8D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_amd64_727881fda5cf7db0\amd64\novaem8.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\nova8.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_amd64_727881fda5cf7db0\amd64\novaim8.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\g2pvdd.inf_amd64_9181842230506d98\g2pvdd.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFC06.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET497.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_x86_727881fda5cf7db0\i386\novaemex8.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_x86_727881fda5cf7db0\i386\novasv8.dll	DrvInst.exe
File opened for modification	C:\Windows\system32\DRVSTORE	MsiExec.exe
File created	C:\Windows\system32\gotomon_x64.dll	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{97a53111-77ee-d849-aee7-fd51ed429619}\SETC743.tmp	DrvInst.exe
File created	C:\Windows\system32\novamn8.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_amd64_727881fda5cf7db0\amd64\novapr8.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_amd64_727881fda5cf7db0\nova8.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\novaemex8.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_x86_727881fda5cf7db0\i386\novaem8.exe	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET496.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET498.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\novasv8.dll	DrvInst.exe
File opened for modification	C:\Windows\system32\gotomon_x64.dll	MsiExec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{97a53111-77ee-d849-aee7-fd51ed429619}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFCC3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\novaem8.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_amd64_727881fda5cf7db0\amd64\novasv8.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET476.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET498.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_x86_727881fda5cf7db0\i386\novaim8.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\rdvgwddmdx11.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\SET453.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET475.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\SETFF3B.tmp	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\monblankin_36BCAB857E8A8CBC57146D819C5BB68CC4472E13\monblanking.inf	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\novacl8.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_x86_727881fda5cf7db0\i386\novaem8.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\virtualdisplayadapter.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFC06.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\novapr8.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\c_display.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{97a53111-77ee-d849-aee7-fd51ed429619}\SETC753.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{97a53111-77ee-d849-aee7-fd51ed429619}\SETC764.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET463.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\g2pcredprovider.dll	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFBF5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nova8.inf_amd64_727881fda5cf7db0\amd64\novaemex8.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\novaemex8.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET4B9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET4BA.tmp	DrvInst.exe
File created	C:\Windows\system32\DRVSTORE\monblankin_36BCAB857E8A8CBC57146D819C5BB68CC4472E13\monblanking.cat	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\g2pvdd.inf_amd64_9181842230506d98\g2pvdd.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\novacl8.exe	DrvInst.exe

Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

g2tray.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName g2tray.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	g2tray.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\Softland\novaPDF 8\Editor\hr\ActivationClientLibrary.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\vi\ActivationClientLibrary.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\Ops.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\AgileDotNet.VMRuntime.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\de\PrinterManager.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\fr\NovaPDFUtils.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\ro\Startup.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\en\ActivationClientLibrary.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\lt\ActivationClientLibrary.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\Startup.exe	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\ko\ProfileManager.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\CryptUtil.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\LayoutEditor.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\vi\StartupDo.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\zh-CN\WAFramework.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\Kit\i386\novacl8.exe	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\DeactivationClient.exe	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\da\NovaPDFUtils.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\ko\NovaPDFUtils.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\lt\PrinterManager.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\nl\WAFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GoToMyPC\x64\g2pvdd.cat	msiexec.exe
File created	C:\Program Files (x86)\GoToMyPC\x64\monblanking.inf	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\da\ActivationClientLibrary.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\Kit\nova8.inf	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\NovaImportx86.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\en\WAFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GoToMyPC\GoToMyPCCrashHandler.exe	msiexec.exe
File created	C:\Program Files (x86)\GoToMyPC\x64\g2pvdd.inf	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\hr\DeactivationClientLibrary.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\Kit\i386\novaemex8.exe	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\tr\LayoutEditor.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\en\NovaPDFComponent.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\ro\NovaPDFComponent.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\tr\DeactivationClientLibrary.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\DeactivationClientLibrary.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\ko\LayoutEditor.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Server\x86\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\Kit\nova8x86.cat	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\AgileDotNetRT.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\Microsoft.Windows.Shell.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\da\WAFramework.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\id\ActivationClientLibrary.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\vi\ActivationClientLibrary.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\Ops.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\de\WAFramework.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\SharedResourceDictionary.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\zh-CN\PrinterManager.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\AgileDotNet.VMRuntime.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\Kit\nova8x64.cat	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\Microsoft.Windows.Shell.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\cs\PrinterManager.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\pt-BR\StartupDo.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\cs\Startup.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\sk\WAFramework.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\AgileDotNetRT.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\nl\LayoutEditor.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\de\NovaPDFComponent.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\tr\NovaPDFUtils.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\sk\NovaPDFUtils.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GoToMyPC\g2tray.exe	msiexec.exe
File created	C:\Program Files (x86)\GoToMyPC\PrintWiz_en-us.ini	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Editor\da\DeactivationClientLibrary.resources.dll	msiexec.exe
File created	C:\Program Files\Softland\novaPDF 8\Driver\Kit\i386\novaem8.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeDrvInst.exesvchost.exerundll32.exeDrvInst.exerundll32.exeDrvInst.exeMsiExec.exeMsiExec.exe

description	ioc	process
File created	C:\Windows\Installer\{9969E88A-AF6D-4DB8-B737-684B34EB8703}\ICON_ID_GOTOMYPC	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC323.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBF6.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIF8D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{57414DD3-55A7-4D2E-916F-2F1407AABE91}\DoIcon.ACC28440_DBF2_4762_B900_A720EA521CA2.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{57414DD3-55A7-4D2E-916F-2F1407AABE91}\PrinterIcon.ACC28440_DBF2_4762_B900_A720EA521CA2.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a4f5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA66C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\e58a4fc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{57414DD3-55A7-4D2E-916F-2F1407AABE91}\NovaIcon.ACC28440_DBF2_4762_B900_A720EA521CA2.ico	msiexec.exe
File created	C:\Windows\Installer\e58a4f5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEFA.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a4f8.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI69D7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{9969E88A-AF6D-4DB8-B737-684B34EB8703}\ICON_ID_GOTOMYPC	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	rundll32.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\Installer\e58a4fc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA3A.tmp	msiexec.exe
File created	C:\Windows\Installer\{57414DD3-55A7-4D2E-916F-2F1407AABE91}\NovaIcon.ACC28440_DBF2_4762_B900_A720EA521CA2.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC46C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE849.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE693.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1A9E9E77-B29B-47C6-ADEB-9E7D6F7A08CE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4BB.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a4f7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F08.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{57414DD3-55A7-4D2E-916F-2F1407AABE91}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB74.tmp	msiexec.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI869.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{1A9E9E77-B29B-47C6-ADEB-9E7D6F7A08CE}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIBD48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB50.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIEBC6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC325.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDFF.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a4fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a4f8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC04.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9969E88A-AF6D-4DB8-B737-684B34EB8703}	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e58a4ff.msi	msiexec.exe
File created	C:\Windows\Installer\{57414DD3-55A7-4D2E-916F-2F1407AABE91}\DoIcon.ACC28440_DBF2_4762_B900_A720EA521CA2.ico	msiexec.exe
File created	C:\Windows\Installer\{57414DD3-55A7-4D2E-916F-2F1407AABE91}\PrinterIcon.ACC28440_DBF2_4762_B900_A720EA521CA2.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6590.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF9B.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI1750.tmp	msiexec.exe

Executes dropped EXE 9 IoCs

Processes:

g2svc.exeg2svc.exeg2svc.exeg2comm.exeg2pre.exeg2tray.exenovapdfs.exesqlite3.exesqlite3.exe

pid process

3984 g2svc.exe
1628 g2svc.exe
4404 g2svc.exe
4380 g2comm.exe
3528 g2pre.exe
2560 g2tray.exe
1400 novapdfs.exe
3936 sqlite3.exe
4056 sqlite3.exe

pid	process
3984	g2svc.exe
1628	g2svc.exe
4404	g2svc.exe
4380	g2comm.exe
3528	g2pre.exe
2560	g2tray.exe
1400	novapdfs.exe
3936	sqlite3.exe
4056	sqlite3.exe

Loads dropped DLL 40 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exenovapdfs.exespoolsv.exeMsiExec.exeMsiExec.exespoolsv.exe

pid	process
3380	MsiExec.exe
3296	MsiExec.exe
1412	MsiExec.exe
1412	MsiExec.exe
1412	MsiExec.exe
3296	MsiExec.exe
3296	MsiExec.exe
1412	MsiExec.exe
1996
1996
1996
1996
1996
1412	MsiExec.exe
3296	MsiExec.exe
3380	MsiExec.exe
4704	MsiExec.exe
4072	MsiExec.exe
4072	MsiExec.exe
4072	MsiExec.exe
1468	MsiExec.exe
3848	MsiExec.exe
3848	MsiExec.exe
1400	novapdfs.exe
1468	MsiExec.exe
1468	MsiExec.exe
1468	MsiExec.exe
1264	spoolsv.exe
1264	spoolsv.exe
1264	spoolsv.exe
1264	spoolsv.exe
1468	MsiExec.exe
1468	MsiExec.exe
4072	MsiExec.exe
3600	MsiExec.exe
3376	MsiExec.exe
2276	spoolsv.exe
2276	spoolsv.exe
2276	spoolsv.exe
2276	spoolsv.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

MsiExec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B6F824A-21BF-4147-A014-827DA4893903}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B6F824A-21BF-4147-A014-827DA4893903}\InprocServer32\ = "C:\\Windows\\system32\\g2pcredprovider.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B6F824A-21BF-4147-A014-827DA4893903}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exeDrvInst.exespoolsv.exespoolsv.exeDrvInst.exeDrvInst.exeMsiExec.exevssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000036d9561f42561000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000036d95610000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900036d9561000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000036d956100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000036d956100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07C9EF18-AAB1-43EF-8617-74434E4FA18}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07C9EF18-AAB1-43EF-8617-74434E4FA18}\AppName = "novacl8.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07C9EF18-AAB1-43EF-8617-74434E4FA18}\AppPath = "C:\\Windows\\System32\\spool\\drivers\\x64\\3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07C9EF18-AAB1-43EF-8617-74434E4FA18}\Policy = "3"	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exemsiexec.exespoolsv.exeDrvInst.exespoolsv.exeDrvInst.exeg2pre.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers\DevModePerUser	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\GoToMyPC Print Assistant = "winspool,Ne03:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\Shims\EnableOverlays	g2pre.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	g2pre.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers\ConvertUserDevModesCount	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeg2svc.exeMsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\SourceList\LastUsedSource = "n;1;C:\\Program Files (x86)\\GoToMyPC\\PDFPrinterSetup\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoToMyPC.StartHereLoader.1\CLSID	g2svc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A88E9699D6FA8BD47B7386B443BE7830\ProductFeaturex64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77E9E9A1B92B6C74DABEE9D7F6A780EC\ProductName = "novaPDF 8 Printer Driver"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DCF93E3BBE556B1429BEC4A500C00734	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BE717152-DFB4-4b6c-85C4-2B7C6B5D117C}\LocalService = "GoToMyPC"	g2svc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\Version = "386076270"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\PackageCode = "3DD414757A55E2D419F6F24170AAEB19"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\SourceList\PackageName = "GoToMyPCSetup_x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77E9E9A1B92B6C74DABEE9D7F6A780EC\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BE717152-DFB4-4b6c-85C4-2B7C6B5D117C}\ = "GoToMyPC"	g2svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoToMyPC.StartHereLoader\CLSID	g2svc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoToMyPC.StartHereLoader.1\ = "StartHereLoader"	g2svc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\ProductIcon = "C:\\Windows\\Installer\\{9969E88A-AF6D-4DB8-B737-684B34EB8703}\\ICON_ID_GOTOMYPC"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4D35A00D0B0B10944BA78997B4E04FE5\A88E9699D6FA8BD47B7386B443BE7830	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\GoToMyPC\\G2P_3694\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77E9E9A1B92B6C74DABEE9D7F6A780EC\Version = "134611886"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B6F824A-21BF-4147-A014-827DA4893903}\InprocServer32\ = "C:\\Windows\\system32\\g2pcredprovider.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B6F824A-21BF-4147-A014-827DA4893903}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\\g2svc.exe	g2svc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoToMyPC.StartHereLoader\ = "StartHereLoader"	g2svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\66A366C7CB3523D8BAF1AF49207F8C83\3DD414757A55E2D419F6F24170AAEB19	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\ProductName = "GoToMyPC Print Assistant"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\Version = "134611886"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B6F824A-21BF-4147-A014-827DA4893903}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC79D7F8-2A04-4B81-AE23-8AB2993EC440}\ = "StartHereLoader"	g2svc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\ProductName = "GoToMyPC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\77E9E9A1B92B6C74DABEE9D7F6A780EC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77E9E9A1B92B6C74DABEE9D7F6A780EC\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77E9E9A1B92B6C74DABEE9D7F6A780EC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC79D7F8-2A04-4B81-AE23-8AB2993EC440}\AppID = "{BE717152-DFB4-4b6c-85C4-2B7C6B5D117C}"	g2svc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC79D7F8-2A04-4B81-AE23-8AB2993EC440}\ProgID\ = "GoToMyPC.StartHereLoader.1"	g2svc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A88E9699D6FA8BD47B7386B443BE7830\ProductFeaturex86	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3DD414757A55E2D419F6F24170AAEB19\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\77E9E9A1B92B6C74DABEE9D7F6A780EC\NovaApps = "Complete"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\77E9E9A1B92B6C74DABEE9D7F6A780EC\ProgramFilesFeature = "Complete"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DCF93E3BBE556B1429BEC4A500C00734\77E9E9A1B92B6C74DABEE9D7F6A780EC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\Language = "9"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B6F824A-21BF-4147-A014-827DA4893903}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC79D7F8-2A04-4B81-AE23-8AB2993EC440}\VersionIndependentProgID\ = "GoToMyPC.StartHereLoader"	g2svc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoToMyPC.StartHereLoader\CLSID\ = "{CC79D7F8-2A04-4B81-AE23-8AB2993EC440}"	g2svc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A88E9699D6FA8BD47B7386B443BE7830\SourceList\Net\1 = "C:\\ProgramData\\GoToMyPC\\G2P_3694\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3DD414757A55E2D419F6F24170AAEB19\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\\{BE717152-DFB4-4b6c-85C4-2B7C6B5D117C}	g2svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC79D7F8-2A04-4B81-AE23-8AB2993EC440}\LocalServer32	g2svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC79D7F8-2A04-4B81-AE23-8AB2993EC440}\VersionIndependentProgID	g2svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4D35A00D0B0B10944BA78997B4E04FE5	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msiexec.exe

pid process

4988 msiexec.exe
4988 msiexec.exe
4988 msiexec.exe
4988 msiexec.exe
4988 msiexec.exe
4988 msiexec.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

672

pid	process
4988	msiexec.exe
4988	msiexec.exe
4988	msiexec.exe
4988	msiexec.exe
4988	msiexec.exe
4988	msiexec.exe

pid	process
672

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4576	msiexec.exe
Token: SeSecurityPrivilege	4988	msiexec.exe
Token: SeCreateTokenPrivilege	4576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4576	msiexec.exe
Token: SeLockMemoryPrivilege	4576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4576	msiexec.exe
Token: SeMachineAccountPrivilege	4576	msiexec.exe
Token: SeTcbPrivilege	4576	msiexec.exe
Token: SeSecurityPrivilege	4576	msiexec.exe
Token: SeTakeOwnershipPrivilege	4576	msiexec.exe
Token: SeLoadDriverPrivilege	4576	msiexec.exe
Token: SeSystemProfilePrivilege	4576	msiexec.exe
Token: SeSystemtimePrivilege	4576	msiexec.exe
Token: SeProfSingleProcessPrivilege	4576	msiexec.exe
Token: SeIncBasePriorityPrivilege	4576	msiexec.exe
Token: SeCreatePagefilePrivilege	4576	msiexec.exe
Token: SeCreatePermanentPrivilege	4576	msiexec.exe
Token: SeBackupPrivilege	4576	msiexec.exe
Token: SeRestorePrivilege	4576	msiexec.exe
Token: SeShutdownPrivilege	4576	msiexec.exe
Token: SeDebugPrivilege	4576	msiexec.exe
Token: SeAuditPrivilege	4576	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4576	msiexec.exe
Token: SeChangeNotifyPrivilege	4576	msiexec.exe
Token: SeRemoteShutdownPrivilege	4576	msiexec.exe
Token: SeUndockPrivilege	4576	msiexec.exe
Token: SeSyncAgentPrivilege	4576	msiexec.exe
Token: SeEnableDelegationPrivilege	4576	msiexec.exe
Token: SeManageVolumePrivilege	4576	msiexec.exe
Token: SeImpersonatePrivilege	4576	msiexec.exe
Token: SeCreateGlobalPrivilege	4576	msiexec.exe
Token: SeCreateTokenPrivilege	4576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4576	msiexec.exe
Token: SeLockMemoryPrivilege	4576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4576	msiexec.exe
Token: SeMachineAccountPrivilege	4576	msiexec.exe
Token: SeTcbPrivilege	4576	msiexec.exe
Token: SeSecurityPrivilege	4576	msiexec.exe
Token: SeTakeOwnershipPrivilege	4576	msiexec.exe
Token: SeLoadDriverPrivilege	4576	msiexec.exe
Token: SeSystemProfilePrivilege	4576	msiexec.exe
Token: SeSystemtimePrivilege	4576	msiexec.exe
Token: SeProfSingleProcessPrivilege	4576	msiexec.exe
Token: SeIncBasePriorityPrivilege	4576	msiexec.exe
Token: SeCreatePagefilePrivilege	4576	msiexec.exe
Token: SeCreatePermanentPrivilege	4576	msiexec.exe
Token: SeBackupPrivilege	4576	msiexec.exe
Token: SeRestorePrivilege	4576	msiexec.exe
Token: SeShutdownPrivilege	4576	msiexec.exe
Token: SeDebugPrivilege	4576	msiexec.exe
Token: SeAuditPrivilege	4576	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4576	msiexec.exe
Token: SeChangeNotifyPrivilege	4576	msiexec.exe
Token: SeRemoteShutdownPrivilege	4576	msiexec.exe
Token: SeUndockPrivilege	4576	msiexec.exe
Token: SeSyncAgentPrivilege	4576	msiexec.exe
Token: SeEnableDelegationPrivilege	4576	msiexec.exe
Token: SeManageVolumePrivilege	4576	msiexec.exe
Token: SeImpersonatePrivilege	4576	msiexec.exe
Token: SeCreateGlobalPrivilege	4576	msiexec.exe
Token: SeCreateTokenPrivilege	4576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4576	msiexec.exe
Token: SeLockMemoryPrivilege	4576	msiexec.exe

Suspicious use of FindShellTrayWindow 37 IoCs

Processes:

msiexec.exeg2tray.exe

pid	process
4576	msiexec.exe
4576	msiexec.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe

Suspicious use of SendNotifyMessage 35 IoCs

Processes:

g2tray.exe

pid	process
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe
2560	g2tray.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

g2tray.exe

pid process

2560 g2tray.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exemsiexec.exesvchost.exemsiexec.exeg2svc.exeg2comm.exe

description	pid	process	target process
PID 4824 wrote to memory of 4576	4824	0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe	msiexec.exe
PID 4824 wrote to memory of 4576	4824	0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe	msiexec.exe
PID 4824 wrote to memory of 4576	4824	0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe	msiexec.exe
PID 4988 wrote to memory of 3380	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 3380	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 3380	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 2528	4988	msiexec.exe	srtasks.exe
PID 4988 wrote to memory of 2528	4988	msiexec.exe	srtasks.exe
PID 4988 wrote to memory of 3296	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 3296	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 1412	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 1412	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 1412	4988	msiexec.exe	MsiExec.exe
PID 808 wrote to memory of 1580	808	svchost.exe	DrvInst.exe
PID 808 wrote to memory of 1580	808	svchost.exe	DrvInst.exe
PID 4988 wrote to memory of 3984	4988	msiexec.exe	g2svc.exe
PID 4988 wrote to memory of 3984	4988	msiexec.exe	g2svc.exe
PID 4988 wrote to memory of 3984	4988	msiexec.exe	g2svc.exe
PID 4576 wrote to memory of 1628	4576	msiexec.exe	g2svc.exe
PID 4576 wrote to memory of 1628	4576	msiexec.exe	g2svc.exe
PID 4576 wrote to memory of 1628	4576	msiexec.exe	g2svc.exe
PID 4404 wrote to memory of 4380	4404	g2svc.exe	g2comm.exe
PID 4404 wrote to memory of 4380	4404	g2svc.exe	g2comm.exe
PID 4404 wrote to memory of 4380	4404	g2svc.exe	g2comm.exe
PID 4380 wrote to memory of 3528	4380	g2comm.exe	g2pre.exe
PID 4380 wrote to memory of 3528	4380	g2comm.exe	g2pre.exe
PID 4380 wrote to memory of 3528	4380	g2comm.exe	g2pre.exe
PID 4380 wrote to memory of 2560	4380	g2comm.exe	g2tray.exe
PID 4380 wrote to memory of 2560	4380	g2comm.exe	g2tray.exe
PID 4380 wrote to memory of 2560	4380	g2comm.exe	g2tray.exe
PID 4824 wrote to memory of 1316	4824	0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe	msiexec.exe
PID 4824 wrote to memory of 1316	4824	0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe	msiexec.exe
PID 4824 wrote to memory of 1316	4824	0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe	msiexec.exe
PID 4988 wrote to memory of 4704	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 4704	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 4072	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 4072	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 4072	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 1468	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 1468	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 2796	4988	msiexec.exe	rundll32.exe
PID 4988 wrote to memory of 2796	4988	msiexec.exe	rundll32.exe
PID 808 wrote to memory of 4368	808	svchost.exe	DrvInst.exe
PID 808 wrote to memory of 4368	808	svchost.exe	DrvInst.exe
PID 4988 wrote to memory of 4784	4988	msiexec.exe	rundll32.exe
PID 4988 wrote to memory of 4784	4988	msiexec.exe	rundll32.exe
PID 808 wrote to memory of 4260	808	svchost.exe	DrvInst.exe
PID 808 wrote to memory of 4260	808	svchost.exe	DrvInst.exe
PID 4988 wrote to memory of 3848	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 3848	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 3848	4988	msiexec.exe	MsiExec.exe
PID 4824 wrote to memory of 752	4824	0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe	msiexec.exe
PID 4824 wrote to memory of 752	4824	0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe	msiexec.exe
PID 4824 wrote to memory of 752	4824	0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe	msiexec.exe
PID 4988 wrote to memory of 3600	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 3600	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 3376	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 3376	4988	msiexec.exe	MsiExec.exe
PID 4988 wrote to memory of 3936	4988	msiexec.exe	sqlite3.exe
PID 4988 wrote to memory of 3936	4988	msiexec.exe	sqlite3.exe
PID 4988 wrote to memory of 3936	4988	msiexec.exe	sqlite3.exe
PID 4988 wrote to memory of 4056	4988	msiexec.exe	sqlite3.exe
PID 4988 wrote to memory of 4056	4988	msiexec.exe	sqlite3.exe
PID 4988 wrote to memory of 4056	4988	msiexec.exe	sqlite3.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe
"C:\Users\Admin\AppData\Local\Temp\0753ad3ab09da170e8ed74c05bedd1efbeb772768dea6c54f976b0932a51df6b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\ProgramData\GoToMyPC\G2P_3694\GoToMyPCSetup_x64.msi" REINSTALLMODE=dmus /l*v "C:\Users\Admin\AppData\Local\Temp\G2_3694\GoToMyPC_Installation.log"G2P_REINSTALL="YES"
2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4576

C:\Program Files (x86)\GoToMyPC\g2svc.exe
"C:\Program Files (x86)\GoToMyPC\g2svc.exe"
3⤵
- Executes dropped EXE
PID:1628

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Program Files (x86)\GoToMyPC\PDFPrinterSetup\novaPDF8PrinterDriver(x64).msi"/qn REINSTALLMODE=dmus
2⤵
PID:1316

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Program Files (x86)\GoToMyPC\PDFPrinterSetup\novaPDF8OEM(x64).msi"/qn REINSTALLMODE=dmus
2⤵
PID:752

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding BF8A562AB2EB66418C415FD236512DE5 C
2⤵
- Loads dropped DLL
PID:3380

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:2528

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding C698F04111215A8D0A9D7AF9C41AB5E5
2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Loads dropped DLL
- Registers COM server for autorun
- Checks SCSI registry key(s)
- Modifies registry class
PID:3296

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 652CF7158A83FE88A3C8923B192666B6
2⤵
- Drops file in System32 directory
- Loads dropped DLL
PID:1412

C:\Program Files (x86)\GoToMyPC\g2svc.exe
"C:\Program Files (x86)\GoToMyPC\g2svc.exe" install_auto
2⤵
- Executes dropped EXE
- Modifies registry class
PID:3984

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 1E287C22B60439AE095C24BD52A11D55
2⤵
- Loads dropped DLL
PID:4704

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2FEBB5475A4540F731E90D91C993C19A
2⤵
- Loads dropped DLL
PID:4072

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 9DF36E847954AF968EED1B6257318024 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:1468

C:\Windows\system32\rundll32.exe
rundll32 printui.dll,PrintUIEntry /ia /m "novaPDF 8" /K /h "x64" /v 3 /f "nova8.inf"
2⤵
- Drops file in Windows directory
PID:2796

C:\Windows\system32\rundll32.exe
rundll32 printui.dll,PrintUIEntry /ia /m "novaPDF 8" /K /h "x86" /v 3 /f "nova8.inf"
2⤵
- Drops file in Windows directory
PID:4784

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 420CAB04669E6A01F9D1311529682867 E Global\MSI0000
2⤵
- Drops file in Windows directory
- Loads dropped DLL
PID:3848

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 71FD0F0B7BC519DDC08EB0DC4168A5F1 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:3600

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 43A22C259253F967F38B5D22FC9A6457
2⤵
- Loads dropped DLL
PID:3376

C:\Program Files\Softland\novaPDF 8\Driver\sqlite3.exe
"C:\Program Files\Softland\novaPDF 8\Driver\sqlite3.exe" "C:\ProgramData\Softland\novaPDF 8\nPdfOem8_120576\nPdfOem8_120576.db" "ALTER TABLE Preset ADD FileTimeLastSave INTEGER DEFAULT 130758123204020800;"
2⤵
- Executes dropped EXE
PID:3936

C:\Program Files\Softland\novaPDF 8\Driver\sqlite3.exe
"C:\Program Files\Softland\novaPDF 8\Driver\sqlite3.exe" "C:\ProgramData\Softland\novaPDF 8\nPdfOem8_120576\nPdfOem8_120576.db" "UPDATE DatabaseInfo SET DBVersion=3 WHERE NOT DBVersion>2"
2⤵
- Executes dropped EXE
PID:4056

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e0c9e217-640b-7f48-a2dc-fe6cd14472c8}\g2pvdd.inf" "9" "4b1eb11b3" "0000000000000148" "WinSta0\Default" "0000000000000100" "208" "C:\Program Files (x86)\GoToMyPC\x64"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1580

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9b5917fb-bdc4-5947-8539-f16ea6801995}\nova8.inf" "9" "45817112b" "0000000000000148" "WinSta0\Default" "0000000000000100" "208" "c:\program files\softland\novapdf 8\driver\kit"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4368

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d2976809-23b3-fa46-ae24-d3de52129e1a}\nova8.inf" "0" "45817112b" "000000000000014C" "WinSta0\Default" "0000000000000160" "208" "c:\program files\softland\novapdf 8\driver\kit"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4260

C:\Program Files (x86)\GoToMyPC\g2svc.exe
"C:\Program Files (x86)\GoToMyPC\g2svc.exe" "Start=service"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404

C:\Program Files (x86)\GoToMyPC\g2comm.exe
"C:\Program Files (x86)\GoToMyPC\g2comm.exe" "Plugin=G2PreLaunch&Dir=C:\Program Files (x86)\GoToMyPC&Path=g2pre.exe&ServiceName=GoToMyPC&ServiceFile=C:\Program Files (x86)\GoToMyPC\g2svc.exe&IsService=true&StartID={CC79D7F8-2A04-4B81-AE23-8AB2993EC440}&Start=service"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380

C:\Program Files (x86)\GoToMyPC\g2pre.exe
"C:\Program Files (x86)\GoToMyPC\g2pre.exe" "StartID={8F2F24CF-DD65-44C2-895D-FBC2150B434A}&Debug=Off&Stat=On&StatDb=On&Index=0"
3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3528

C:\Program Files (x86)\GoToMyPC\g2tray.exe
"C:\Program Files (x86)\GoToMyPC\g2tray.exe" "StartID={CC79D7F8-2A04-4B81-AE23-8AB2993EC440}&Debug=Off&Stat=On&StatDb=On&Index=0"
3⤵
- Checks system information in the registry
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2560

C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe
"C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Registers new Print Monitor
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1264

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Registers new Print Monitor
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58a4f6.rbs
Filesize
1.6MB

MD5
f7a671282adada9ace111a30c654f7c0

SHA1
ad05091f1051a207f0a017168d8468b36a2e50fd

SHA256
0ac6bf221277cc722e4f7cc25092b29837cbcbd846c2f8bbc6abc32843cd2722

SHA512
8a85d0547d1b4b9344f812eaa4a246f004c8b32eb720a14d0869170e701e26f1896fac5bfdea6645e19d94c9f35d6e3b5d80ba8af7686fdc3d5f4b6fdf05cd33

Download Submit
C:\Config.Msi\e58a4fa.rbs
Filesize
1.2MB

MD5
7fca08fbfd5acd0b08ed7c51cc51a2c4

SHA1
ff3e8e5fa2077431903c25152ac4da6ab071e86d

SHA256
aacce7e97643af3b212e07668ec26164c85b2b95ba77ee1f1d1be657268eb046

SHA512
723e505ff9c7aefd4159c95b8da139f79ab21f846534c811dae3a5eb50415ca45a2e1a3d6eeba8776e7f14945128f7c9d95f2633cf0d6f557490b645fae4f92e

Download Submit
C:\Config.Msi\e58a4fe.rbs
Filesize
288KB

MD5
957a93e6e9218c7550138e151e3c4318

SHA1
5155658a4380e204fdef6e06c74ca041600331f0

SHA256
85f7a179cb0cf5faf0a12550525d79b3f5f8e7e9fd9f674023c69796251ed528

SHA512
cc335217f2bef4269ac17c192d82f04a29340a66b4c91083f7eed4ef15e707f69c7292807337470006fe78b7482902447dc8532656dda34975c97804617e2e94

Download Submit
C:\PROGRA~2\GoToMyPC\x64\g2pvdd.cat
Filesize
11KB

MD5
191feb461eff88f87fc11d37248538b1

SHA1
a175e906ca120d59be1a44e138e100d812eb7a40

SHA256
2933939c0e35c3020e66806ceded577ed01bc31111f207fd43b31294b67e2274

SHA512
ed46c858fb80b2abdfa2f821c6ef14a3199e4d6a2839646aefd0c038dea810cef96d3ff15a83a2d54b87a30295335b729ee3fe46c77a8599d9dcacfb53c92f2a

Download Submit
C:\PROGRA~2\GoToMyPC\x64\g2pvdd.dll
Filesize
146KB

MD5
bced35f016745daf251944f8797a7723

SHA1
bec7c58ffd00394a7f3e9130e3e21bd27c8f2a71

SHA256
8112b63bebb294a68b4ab8866e9cdd9a3356736ba173625c88860054fcd8ae2d

SHA512
27a81ef3aa46f7ee6d7714f7e99e98a7f739297f071d26003933e4802b883c9ff9a55d67df87fc38fb9e265f876c24b11a23d3e82d79ba1707a61b72e6282cd0

Download Submit
C:\Program Files (x86)\GoToMyPC\G2PrintUPDDriver_x64.dll
Filesize
154KB

MD5
882250c2ce8399560788c9c09614c0ba

SHA1
ef7f330f1466994385b5be99665474f4c4ab8a93

SHA256
7c50640bdd76204b5470f5c64a4066d5be86d03c4e8a895ed1e4af455c570ebe

SHA512
830e93b1d646b5b21daeaf4b4893d0861f8e257582db5ecba2f4c37a351781658af8cce824a0575d53173afc3960d53a6c75075876d58a2c9be6dd0fe73c301c

Download Submit
C:\Program Files (x86)\GoToMyPC\G2PrintUPDUI_x64.dll
Filesize
208KB

MD5
210c13831fa52a359b431c1dead20f2b

SHA1
34325b24fb5cdc46e5fd5d1ca1b53df56885576d

SHA256
2948080f05e64fbc42487f0e796f6c78cb52b2a3c788d2843a2b6a0e6cd1bd6e

SHA512
0c9666ffb331520e53cff69ebbd83c6654ddda867a7185503e5290eec0d3f131b62aaffaefc02fb9f0287603e0e582ec5a35980a94c880f515c3d9d0cdc79833

Download Submit
C:\Program Files (x86)\GoToMyPC\GoToPrintProcessor_x64.dll
Filesize
116KB

MD5
b0e4925100965c5b5353bf57706da5fb

SHA1
db21d47dd2888faa2352967eae39e5e51a20a129

SHA256
f3487b14c65ddc977f01e4de5803d68a78b6026b316a41e8cd79a3488a0a03fc

SHA512
88e843ac54fd69f12e90039814626c619b4d6e53e46ebfd2051b7f945f564cc88caaf9997060a26fe5355206fce683c51fc18b8e6f06742c7348a495357730b8

Download Submit
C:\Program Files (x86)\GoToMyPC\PDFPrinterSetup\novaPDF8PrinterDriver(x64).msi
Filesize
20.1MB

MD5
386d15284beeaf11690ba062b3af49cd

SHA1
872bb3387ce3608676443547f69bbc9e8c11f1cd

SHA256
66d098e8fc776c6015fc21bee14182d716dbb7a29dd747bddb51b11409b777e5

SHA512
2fbf0cca13221cd4da521388e0e689058901d8e2feb8674893624fd7812a6fa69472b0790b76dd25907be26139dcefe708c1aae1edc1ff429befa9ab829ba6ff

Download Submit
C:\Program Files (x86)\GoToMyPC\ResourceHost_en_us.dll
Filesize
4.4MB

MD5
37a398879e3fcbde12b0cad6ba5b33ca

SHA1
77b089d60afcc5824f867abc79fede0f962448a2

SHA256
b22ba26012fc865b86a530ec1d6b49cf4e1ff89d4ced17dea764e4445fffbfae

SHA512
3b1878715c24d03abd38707e4b31d1aaa488de266239121729d2ae4f429c93a8bb5c604be68f6867f80b4fa79bf8f35f0e228f6bd37333c06bfa04b2da89efce

Download Submit
C:\Program Files (x86)\GoToMyPC\g2comm.exe
Filesize
5.6MB

MD5
096dc42bf4a1395e0671bc6a45b279f6

SHA1
49c148f874cb008d46a105fbe07f13c8a91c8aeb

SHA256
085f0c0b2ba680dae63b340ff8980b8a6023674b97672052ab2d04af34b10006

SHA512
dfa1bcc056c854c53f356bd3b5d989da6d4b1213cea99ab0ad3c8713e35fedaad0f084b184074b23f683db1e2bad629f02720e88836c565fa47b7ad4e523da6c

Download Submit
C:\Program Files (x86)\GoToMyPC\g2pre.exe
Filesize
3.6MB

MD5
2a448ad5ededfcc7ff36b3b61770f38f

SHA1
91de8245c33ff153043bdc7218dd72df4c21653f

SHA256
1a75c6fd03015f6422934033572afbf39cd48c1ba69fb9925de9e4bb965880b7

SHA512
5f330698db352bd44233e8998b127651b1507630d57934c79f7f9cf2950c8d4d09eb87412695d557bdd430e4532ef8b38d346a0735970eca3be1269d27369d31

Download Submit
C:\Program Files (x86)\GoToMyPC\g2svc.exe
Filesize
2.8MB

MD5
2b2556dbea3c66bffab41d8e0b3a9ce4

SHA1
aa0869c88319c42a05839554f32699d672643136

SHA256
62c05f999b69d5bd0d1b3fd9eafbd50398c4884de33733aac96444ef4ffcffea

SHA512
b5efff4657d1e2f9edf1c4d27215cee2bc4b247f976d7097ffaa1f3724067d0c0b3c725851c093b863cda64b2f92c18fb5caa5359ccb6576a0042c2e956fb10e

Download Submit
C:\Program Files (x86)\GoToMyPC\g2svc.exe
Filesize
2.8MB

MD5
2b2556dbea3c66bffab41d8e0b3a9ce4

SHA1
aa0869c88319c42a05839554f32699d672643136

SHA256
62c05f999b69d5bd0d1b3fd9eafbd50398c4884de33733aac96444ef4ffcffea

SHA512
b5efff4657d1e2f9edf1c4d27215cee2bc4b247f976d7097ffaa1f3724067d0c0b3c725851c093b863cda64b2f92c18fb5caa5359ccb6576a0042c2e956fb10e

Download Submit
C:\Program Files (x86)\GoToMyPC\g2svc.exe
Filesize
2.8MB

MD5
2b2556dbea3c66bffab41d8e0b3a9ce4

SHA1
aa0869c88319c42a05839554f32699d672643136

SHA256
62c05f999b69d5bd0d1b3fd9eafbd50398c4884de33733aac96444ef4ffcffea

SHA512
b5efff4657d1e2f9edf1c4d27215cee2bc4b247f976d7097ffaa1f3724067d0c0b3c725851c093b863cda64b2f92c18fb5caa5359ccb6576a0042c2e956fb10e

Download Submit
C:\Program Files (x86)\GoToMyPC\g2svc.exe
Filesize
2.8MB

MD5
2b2556dbea3c66bffab41d8e0b3a9ce4

SHA1
aa0869c88319c42a05839554f32699d672643136

SHA256
62c05f999b69d5bd0d1b3fd9eafbd50398c4884de33733aac96444ef4ffcffea

SHA512
b5efff4657d1e2f9edf1c4d27215cee2bc4b247f976d7097ffaa1f3724067d0c0b3c725851c093b863cda64b2f92c18fb5caa5359ccb6576a0042c2e956fb10e

Download Submit
C:\Program Files (x86)\GoToMyPC\g2tray.exe
Filesize
6.4MB

MD5
0f7dd1b6ac0fa71487526bede288d694

SHA1
87ae0a695b2c90f2c39a21293ceb9c4da443915e

SHA256
32ae01338dc96aaa761fba8eb22957c1a909c57e3c72a04218905ff6200c205b

SHA512
bdd7e84ec027f40cf6a9a48c51cc286d58144b9874b75b55d8bb661fdf72f4a715bfbb3ce61f146d5865cd0d2deffc9b92abed699b355a60ae967cd2fd9e8f0a

Download Submit
C:\Program Files (x86)\GoToMyPC\gotomon_x64.dll
Filesize
195KB

MD5
8dbabe92e70643b21c730671b73f4e56

SHA1
5f0ad1fb4dbd35823797402e95bafceac7bf9754

SHA256
0ced1376d4839482ae9c00bee981ba55224cb29e65998a73edc52a967ea434d2

SHA512
7781c90f9510383149897ae91d3f868b404347145d12c1c0f2607d8f4c5fb7f8ce4afcc77980d3c9bb6dad0fec7d711cbad0e44e36a24b03deb4ff85498ee258

Download Submit
C:\Program Files (x86)\GoToMyPC\x64\g2pcredprovider.dll
Filesize
2.9MB

MD5
a2b21d8c0c9ef182594df3c80624c31f

SHA1
0518750a570d93b1afeb67ad0efe9ff80e15ab83

SHA256
d72cf02b5a651bcfee5b8e014f108129dbda7127caf3982e8396f5de367425a2

SHA512
fdbb770f4ad17998bb308193cc62e6c6c4936112b8577e841a7b7fccc078cb1e309d2211798f014d7d34185aaf8bb669a5f3a067dbb880ab424f25351da4205a

Download Submit
C:\Program Files (x86)\GoToMyPC\x64\g2pvdd.inf
Filesize
3KB

MD5
9e8441dbeeff234f1dc2b10ff11dda17

SHA1
ab7e594ae1302f0dbdac66ea9ecdbabad8522b0d

SHA256
16ba4dfeab265dc56a0f8f6d69c908ca78f4a6137dc953bfebb4019ae5b174f6

SHA512
25660eab1ecb1a6e5d9e570f8de05ec7de135142ea6c30c7436226e2568ff2516494da39605acf39ab415ce2f0983c300ed92de97260029642b188c0ceca80b1

Download Submit
C:\Program Files (x86)\GoToMyPC\x64\monblanking.cat
Filesize
10KB

MD5
eef44920de40c5adc31a708c80ac8705

SHA1
36bcab857e8a8cbc57146d819c5bb68cc4472e13

SHA256
06b9c0a8e17a4938750c092eb8ab7a2b27de23635bb74750e9e3ffefc88b0d3b

SHA512
f4b235cc3d6e250bcf0b011d72a5abdcac513fe81ee71f7865885b9e8539339a4ec0eaef33debe9a96f6523acfecdf94d46a01f66cc2c00d744c0d624a93052d

Download Submit
C:\Program Files (x86)\GoToMyPC\x64\monblanking.inf
Filesize
1KB

MD5
a3837f76ef084b53388026652890188f

SHA1
048994294ec61fadda84b54c7a6abefe7085222a

SHA256
0eaab2e137a1440af550f1212dca8d1139c8f3c4414d397519d36903de8f2bf2

SHA512
42a92494578b098efe46c00af595ae379f079095f7d55e24c6b7ad274115c5bc3ce1ada6a7f7bafe784209cd320a251110b7fe3e0ca68a9730ddb37a034fb0af

Download Submit
C:\Program Files (x86)\GoToMyPC\x64\monblanking.sys
Filesize
46KB

MD5
804049e5f38c8eba058c8db055a3ce50

SHA1
e2fa106976c37934d795c49ee87b91477543fb50

SHA256
460282cf142563abd6b34ff3493164a6e27dd00eb004114ef4306822d7fce302

SHA512
2c75081cf764c7ebf2dead90d42c8cc27f8b3098a17146998f85233236d70f4b71c542c721ad387e1c76f33ffe2dc245deae5eeff2f416eaf3eb31505c9529ba

Download Submit
C:\ProgramData\GoToMyPC\G2P_3694\GoToMyPC.cab
Filesize
77.4MB

MD5
6417c150d53432a74e090cb1a9b4f604

SHA1
a338139f62f081321ae5ffc0cc1db71d82825d23

SHA256
e8832e4e9a75efc74a713b279b3ecf27b46d5176b6e81171d1eb0853f83691c0

SHA512
7b9be69722b0e3953ededd1bb47f190a9010a277506f8283f4d99fb8511fd824fc71c46e7f11cececcf031da9cfbd3dd61dd5a7733614d6ce647cfbec4572ff3

Download Submit
C:\ProgramData\GoToMyPC\G2P_3694\GoToMyPCSetup_x64.msi
Filesize
1.7MB

MD5
a7fc3ded2c4fbed4fc1032c7cd3981b3

SHA1
a98c3b5ca22787def3555aeea69e0f07f5a2ab8d

SHA256
f21dd1c4325d0a87618d1de201875ae2d7cbf92324d9d55e5735f8a670de9bf9

SHA512
63a7e969e83bc90be81753b3399b345acf4104f8a8d98f8074fea29b81af38a3c68ae81b647c4fc5f5c568177f64aa9a2e498c2a6abaff6e245b0c0a48d3287f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize
471B

MD5
148e3562638f2c96b8874aa41d14ae26

SHA1
207ade70538f30dd8a5dc9ad0a4085e2a12abaab

SHA256
b6d18b670477b1d51bc07e691f71646c9cebc08a419bd368ddf905725e139221

SHA512
f5250892e3e2c3854048f64b5ed13c8829cc11aba72605355afa69c00ca5d166cfe6602ea74f88a3c499827bbfce9c769a5a69de051c6982f690a301702f44c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA
Filesize
727B

MD5
059b0319f8375f5afea0651c85c2ee8d

SHA1
16d64125d2af4b7e81c70e6e2c6599a89bdb237d

SHA256
5e243e3bf8c8914f1a93afc130060e28f7c8b845a45d6fb0ea5e97e90ef707eb

SHA512
0d5b7a37a7af3a7ce35ca0d8cf571f8a3b9fe00a70d8204f608fb162650a5f06a6369eda79b2ab7f7e26508de946670fa2d14dbf3b35d493f1b260d35ef2f045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize
727B

MD5
d4910663f25959581d039aef029beb03

SHA1
339a25b2823058b927acd5e077575109c1e0ee9e

SHA256
a8f561f3bd934c679de1e5357cee9dded36a58bf684c743cbf671c4f7244c537

SHA512
28ee8c0753ee611cc071af901453d08f2d8204a23e8c993d35b21900ab3837462a4fea8a8128903f4f7fef604dbe10ee0c6987d2756d93aacf8be8c709829778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize
400B

MD5
aec53b033ebc021b5339146361827140

SHA1
2f34a8f7da1f80a62a678ad0c80bc0a53b7ec162

SHA256
16da8b9d8cb1f5a8e25d5098944785a3c8b9dec8765424794ea48fb163ff82d7

SHA512
6de4007c1231660b9a5e97e60f6716a9af8f257361d90581ea5fa78ecf2f4db8bb0e326e6d42fad8f149fe4e2363829d84fa734acc3a71a923df7b9ce263cbc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA
Filesize
408B

MD5
cb48847c84cf8c521e933b664189282f

SHA1
46fd1d5b124d7227ba4cd6e427c096af8a4ede6a

SHA256
6c35a4c17f7ec830d37a9630c56d1fe1a625ca3941c3b9849e409d220dbc765f

SHA512
2b54dacc07de2739128259ed3e28962edf2a47834d2f02a3eda9b625beab0997bd0f7822e028331f934124ffc74fdc38c2271f4d0705d79fcb3eb5cdc69d956a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize
412B

MD5
50e947dfd529a56917bf9a1a3e684f60

SHA1
ba15c3979b7317eabdba422f7ec1e6c6f5c00b52

SHA256
7faaa3e7041431c0abc2e077a6006dcef45f3554d94e4ee1adc4f7307e8c96e0

SHA512
2c055b8e0c5f202db8f42abd0c9ac0156e3c3706c8aa40715b095298379367b111e99aed7f51658c44737fb9427337e289d17104525acfec86e5f63dd99afafd

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2_3694\GoToMyPC_Installation.log
Filesize
44KB

MD5
c4171e4082a919f731866b85db9a99ab

SHA1
551e78d8432af84615d2c39317e0916c86c4cc44

SHA256
548398c80f6080d63f59bf9a20fb7a36a75c1b5cf8b445360c948820b2e7a353

SHA512
d7037ad0a714c9903126461739cdf2ba9715ec020b58d14aa3bc787b0b0923d2c70917b47999a3573f16208d81677de47962acf0f94746886c5a052c2a59a6c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2_3694\log8292.tmp\GoToMyPC_Setup.log
Filesize
1KB

MD5
7cac4037a4d059c977e010ee20af4d39

SHA1
0ddde17e568c54f8cace0b28195090c760ec5e4b

SHA256
77570d69acb2bbcbc1732d054916b527ee2848c0c9b20fdce301853172cecbd2

SHA512
9b6225d48fc36252472bf088c3d64a33d11bed61df8c63f945fe30f7026f8f7904e713d405d978385c93ace5c1929d150296a99ba6f23428f65f9b4f2b354350

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2_3694\log8292.tmp\GoToMyPC_Setup.log
Filesize
5KB

MD5
b1300799d69ff7a856d36f08942c6fe3

SHA1
e2cf6c07f645de2bd47e851203493678c116e38d

SHA256
2b6b7c958e5cee42483d225c4fdf76260ff34af2bf3e89efaabc968ad4c8f0af

SHA512
a207242a0c2d23186831889ecb4a1178acbd967e4b3948b6d49439802ae63528a892ddaad79bcf47e9e93964574448da7fba69a74500ec2a73f87df6237ef28b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI902F.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI902F.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSICD5E.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSICD5E.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\novaPDF_8_20230607173604_CustomActions.log
Filesize
555B

MD5
101a51199c73e60abe636333284af030

SHA1
f480f09e742d1fb4cb6ae9fdc937f85427c5c845

SHA256
7e446059caf55bd83fa2afeabb75046bc50b2e2e625c2c15fd09c7f7b6c59efa

SHA512
27db5af40cf8d3731d6a317aaffae81b6019677ac76062d90a95ae586dceea5aeb881b2eb32b1e1a3f853ce0230904947bd1f88af0b4d7cf7a10a116049d1bb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\novaPDF_8_20230607173616_ManagePortMonitor.log
Filesize
414B

MD5
e97a70e00116ee458b1796f43c70181e

SHA1
be5a565493459f38dbe28c48f66785d676fd3884

SHA256
a8e66219272207474dc437bec832b2fd2c30fac9dae0279ef0c80ebf5921e7b4

SHA512
6e3d1b2af8839452e5c47609748cb4e47973587db4287301dd635b3650627e800b7f1f5419927cb3d5280b4dea81352c5a82650c8ccb119910e8d5053b851f2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\novaPDF_8_20230607173639_ManagePortMonitor.log
Filesize
414B

MD5
3e2bed278b70ede52506b0ccbf9a8dbe

SHA1
0288cb31cddb48fe8e0611d39e45f947dc6b2799

SHA256
72bc31013216aebd744810178f37751c20a52c49bf3af528f5761a1a573b6b11

SHA512
b74cdd46c39a7f5246eba398d9c7975f44fcc4c4a9a46cd55383bf9e8f6f7ebe50c2f64eab2c792a85d676d9fc9bbda065338173e27b0c1fec03ac62f257a245

Download Submit
C:\Users\Admin\AppData\Local\Temp\novaPDF_8_20230607173703_ManagePortMonitor.log
Filesize
1KB

MD5
721f90704fe13c9a9d21123d69ae51e4

SHA1
558a831f7918c81e6de3134acb1d24f8a5592cf6

SHA256
bd6cb16fa84c3aac77ec9bdc2bc1066d462924cc75e5a9b211f1db1611f6e6e1

SHA512
90bf1d1496e5964abc458f6019a410e2cb19e32f0e858e6d8d78b671e314de752b28ecf220e84fb1533e5295fa112dc455e0fb51b37ec90c88131b9c609221e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{E0C9E~1\g2pvdd.cat
Filesize
11KB

MD5
191feb461eff88f87fc11d37248538b1

SHA1
a175e906ca120d59be1a44e138e100d812eb7a40

SHA256
2933939c0e35c3020e66806ceded577ed01bc31111f207fd43b31294b67e2274

SHA512
ed46c858fb80b2abdfa2f821c6ef14a3199e4d6a2839646aefd0c038dea810cef96d3ff15a83a2d54b87a30295335b729ee3fe46c77a8599d9dcacfb53c92f2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{E0C9E~1\g2pvdd.dll
Filesize
146KB

MD5
bced35f016745daf251944f8797a7723

SHA1
bec7c58ffd00394a7f3e9130e3e21bd27c8f2a71

SHA256
8112b63bebb294a68b4ab8866e9cdd9a3356736ba173625c88860054fcd8ae2d

SHA512
27a81ef3aa46f7ee6d7714f7e99e98a7f739297f071d26003933e4802b883c9ff9a55d67df87fc38fb9e265f876c24b11a23d3e82d79ba1707a61b72e6282cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{e0c9e217-640b-7f48-a2dc-fe6cd14472c8}\g2pvdd.inf
Filesize
3KB

MD5
9e8441dbeeff234f1dc2b10ff11dda17

SHA1
ab7e594ae1302f0dbdac66ea9ecdbabad8522b0d

SHA256
16ba4dfeab265dc56a0f8f6d69c908ca78f4a6137dc953bfebb4019ae5b174f6

SHA512
25660eab1ecb1a6e5d9e570f8de05ec7de135142ea6c30c7436226e2568ff2516494da39605acf39ab415ce2f0983c300ed92de97260029642b188c0ceca80b1

Download Submit
C:\Windows\Installer\MSI69D7.tmp
Filesize
177KB

MD5
6e987021151bf80c9bc04fda8b836fb3

SHA1
a18bc58d54dd486431a5412fb14e386355928da9

SHA256
d1f714e5a680e857c4bcae8d67cbb775328d7f795d4585311b5c1b71e65fcf2c

SHA512
dd8154d6a6cfa8bbdde96bb72268bd83450a8cf808ee03b490e3b68530b1a5b5580d4164bc38abf6dd9e0eecfc44a7b40d4a06b9fdafe08ba2b51eef19670a4b

Download Submit
C:\Windows\Installer\MSI869.tmp
Filesize
127KB

MD5
4028017cc6109a517fbe0ed0f3688375

SHA1
9e15ced2d087e92b2132344aaee858e0539b2518

SHA256
0f1ade434d25c305cdd2d63a8391be1fa2cd9bd64e0e407ec61c08e6003f6b25

SHA512
d74381bccd75da794fb4b6732810b0be9361eecdc56250c11f28b69268e25153ba8fd4cb916215e48db450bdeb311512868df1f42bc1ba3902b2ea915d282fa7

Download Submit
C:\Windows\Installer\MSIA66C.tmp
Filesize
397KB

MD5
b372bfb795923c7704481585166b8678

SHA1
8b65a74688513a916c842e27d76070e39b682211

SHA256
b1e5ea886e2a6be03ba308c003b886de6bee84f9944b3ba11ec8ce1be7df79a5

SHA512
de03a664c7db087c67f5de0da519b2f4550d752d8b42e8f3fbfbf897e0d0169ce37d305bb48bd2937a4b826a4cea0caaa59e38e688d5626de4bdce844baf367a

Download Submit
C:\Windows\Installer\MSIA66C.tmp
Filesize
397KB

MD5
b372bfb795923c7704481585166b8678

SHA1
8b65a74688513a916c842e27d76070e39b682211

SHA256
b1e5ea886e2a6be03ba308c003b886de6bee84f9944b3ba11ec8ce1be7df79a5

SHA512
de03a664c7db087c67f5de0da519b2f4550d752d8b42e8f3fbfbf897e0d0169ce37d305bb48bd2937a4b826a4cea0caaa59e38e688d5626de4bdce844baf367a

Download Submit
C:\Windows\Installer\MSIA6DB.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIA6DB.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIBDFF.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIBDFF.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIBDFF.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIBEFA.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIBEFA.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIC0A1.tmp
Filesize
397KB

MD5
b372bfb795923c7704481585166b8678

SHA1
8b65a74688513a916c842e27d76070e39b682211

SHA256
b1e5ea886e2a6be03ba308c003b886de6bee84f9944b3ba11ec8ce1be7df79a5

SHA512
de03a664c7db087c67f5de0da519b2f4550d752d8b42e8f3fbfbf897e0d0169ce37d305bb48bd2937a4b826a4cea0caaa59e38e688d5626de4bdce844baf367a

Download Submit
C:\Windows\Installer\MSIC0A1.tmp
Filesize
397KB

MD5
b372bfb795923c7704481585166b8678

SHA1
8b65a74688513a916c842e27d76070e39b682211

SHA256
b1e5ea886e2a6be03ba308c003b886de6bee84f9944b3ba11ec8ce1be7df79a5

SHA512
de03a664c7db087c67f5de0da519b2f4550d752d8b42e8f3fbfbf897e0d0169ce37d305bb48bd2937a4b826a4cea0caaa59e38e688d5626de4bdce844baf367a

Download Submit
C:\Windows\Installer\MSIC0F0.tmp
Filesize
397KB

MD5
b372bfb795923c7704481585166b8678

SHA1
8b65a74688513a916c842e27d76070e39b682211

SHA256
b1e5ea886e2a6be03ba308c003b886de6bee84f9944b3ba11ec8ce1be7df79a5

SHA512
de03a664c7db087c67f5de0da519b2f4550d752d8b42e8f3fbfbf897e0d0169ce37d305bb48bd2937a4b826a4cea0caaa59e38e688d5626de4bdce844baf367a

Download Submit
C:\Windows\Installer\MSIC0F0.tmp
Filesize
397KB

MD5
b372bfb795923c7704481585166b8678

SHA1
8b65a74688513a916c842e27d76070e39b682211

SHA256
b1e5ea886e2a6be03ba308c003b886de6bee84f9944b3ba11ec8ce1be7df79a5

SHA512
de03a664c7db087c67f5de0da519b2f4550d752d8b42e8f3fbfbf897e0d0169ce37d305bb48bd2937a4b826a4cea0caaa59e38e688d5626de4bdce844baf367a

Download Submit
C:\Windows\Installer\MSIC0F0.tmp
Filesize
397KB

MD5
b372bfb795923c7704481585166b8678

SHA1
8b65a74688513a916c842e27d76070e39b682211

SHA256
b1e5ea886e2a6be03ba308c003b886de6bee84f9944b3ba11ec8ce1be7df79a5

SHA512
de03a664c7db087c67f5de0da519b2f4550d752d8b42e8f3fbfbf897e0d0169ce37d305bb48bd2937a4b826a4cea0caaa59e38e688d5626de4bdce844baf367a

Download Submit
C:\Windows\Installer\MSIC323.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIC323.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIC325.tmp
Filesize
207KB

MD5
73abefc90c6f6b47a09a1b9b2295d94b

SHA1
ae9e338cc6ce623c18d8b6a45aa6876084b663cd

SHA256
1825336697ef5db92a118c07f0075d96d19308f4836d68d48ba32f0336813b3c

SHA512
5ef2b57481b1be2ec3e7034c38a49f74d4b02ae66e557f611ee43f775f286387615fcb6dc072975d749c1754e4804059d07734ca80d4604fb5769db0bf6f268b

Download Submit
C:\Windows\Installer\MSIC46C.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIC46C.tmp
Filesize
220KB

MD5
d3c7010bc04b37671e22541470695269

SHA1
278fd2f7bfd6aba607f31caaf3058173cc9289e4

SHA256
c1f2a02004c56cae7da82bda35c0e8862160e969ea8ba64498ef2fcfca3132c6

SHA512
dea5af39c112f60fba68f1917ff83cb339662f524b9628139f5fced22bc0e1c983be5d2abb430a22f737ef7385b269967ffd964eb3b66fb2a4ec699c7a088ce1

Download Submit
C:\Windows\Installer\MSIC4BB.tmp
Filesize
397KB

MD5
b372bfb795923c7704481585166b8678

SHA1
8b65a74688513a916c842e27d76070e39b682211

SHA256
b1e5ea886e2a6be03ba308c003b886de6bee84f9944b3ba11ec8ce1be7df79a5

SHA512
de03a664c7db087c67f5de0da519b2f4550d752d8b42e8f3fbfbf897e0d0169ce37d305bb48bd2937a4b826a4cea0caaa59e38e688d5626de4bdce844baf367a

Download Submit
C:\Windows\Installer\MSIC4BB.tmp
Filesize
397KB

MD5
b372bfb795923c7704481585166b8678

SHA1
8b65a74688513a916c842e27d76070e39b682211

SHA256
b1e5ea886e2a6be03ba308c003b886de6bee84f9944b3ba11ec8ce1be7df79a5

SHA512
de03a664c7db087c67f5de0da519b2f4550d752d8b42e8f3fbfbf897e0d0169ce37d305bb48bd2937a4b826a4cea0caaa59e38e688d5626de4bdce844baf367a

Download Submit
C:\Windows\Installer\e58a4f5.msi
Filesize
1.7MB

MD5
a7fc3ded2c4fbed4fc1032c7cd3981b3

SHA1
a98c3b5ca22787def3555aeea69e0f07f5a2ab8d

SHA256
f21dd1c4325d0a87618d1de201875ae2d7cbf92324d9d55e5735f8a670de9bf9

SHA512
63a7e969e83bc90be81753b3399b345acf4104f8a8d98f8074fea29b81af38a3c68ae81b647c4fc5f5c568177f64aa9a2e498c2a6abaff6e245b0c0a48d3287f

Download Submit
C:\Windows\Installer\e58a4fb.msi
Filesize
20.1MB

MD5
386d15284beeaf11690ba062b3af49cd

SHA1
872bb3387ce3608676443547f69bbc9e8c11f1cd

SHA256
66d098e8fc776c6015fc21bee14182d716dbb7a29dd747bddb51b11409b777e5

SHA512
2fbf0cca13221cd4da521388e0e689058901d8e2feb8674893624fd7812a6fa69472b0790b76dd25907be26139dcefe708c1aae1edc1ff429befa9ab829ba6ff

Download Submit
C:\Windows\Installer\e58a4fc.msi
Filesize
6.5MB

MD5
523a7932c9471832d71a306206d5991d

SHA1
49da1bee87d4f7d592fc8d3e596e7e93c8e8a580

SHA256
e90f9e45e9410f44170687daa846db5fdbd07188f20a1a6cd02208aa2c1e170e

SHA512
85c8317df366d30f4bdffa6cfd4577e0c6e82a869dae08f4c11ca5d3f02ebc101a7004e53273f229a90fa787c48ffeff470907e7c122aa3646c65f5c0d8165dd

Download Submit
C:\Windows\Installer\{57414DD3-55A7-4D2E-916F-2F1407AABE91}\PrinterIcon.ACC28440_DBF2_4762_B900_A720EA521CA2.ico
Filesize
304KB

MD5
c030699f155c9ac9f67fd9a4e0d4845b

SHA1
fbe6aedd77273f73bc4e4acfa824ac85cbdbb21a

SHA256
5423a8b77d51abc5ca464d9241fc767eb6d261ef58f333d103808b4e62f1df27

SHA512
0ccdf1e1f517d04b10d17c53a879bc651344601a8699f57b5d209bfe4c1b4ef36f5e351f867e9b89797ee04677b896435b2c12ccd4c729f3dca7461d32ec23db

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
Filesize
146KB

MD5
046a4f7a7a14cf37b172a58445eebc9f

SHA1
f455bbda013150274df4cf45e4ec141c809418c6

SHA256
02407364248fa56e6c86df16b70f4c94a3cecdcb310d7471ef395572c43ac170

SHA512
788c159a2781b379695b6ff55693a2d5c497d5ee83989ab92fe026a77e2129c4409bfda7664f773b318a970c31d28913ce8bd5b2ecbb88e4360c73134ded0074

Download Submit
C:\Windows\System32\DRVSTORE\monblankin_36BCAB857E8A8CBC57146D819C5BB68CC4472E13\monblanking.sys
Filesize
46KB

MD5
804049e5f38c8eba058c8db055a3ce50

SHA1
e2fa106976c37934d795c49ee87b91477543fb50

SHA256
460282cf142563abd6b34ff3493164a6e27dd00eb004114ef4306822d7fce302

SHA512
2c75081cf764c7ebf2dead90d42c8cc27f8b3098a17146998f85233236d70f4b71c542c721ad387e1c76f33ffe2dc245deae5eeff2f416eaf3eb31505c9529ba

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\SETFF3A.tmp
Filesize
11KB

MD5
5665a6a11df159e4c5221ebb4f357fd0

SHA1
814aecf394f329d8f54bda2dd57b2040516931ad

SHA256
4bda94abcbaab23cda1db1d5cd25092fc448107a86a7f427b95f7f69fc5568c3

SHA512
d480ae3e935d070553758bf71784fc98bf68ce8224167ffd649e4724ed52584fc73415c17f5d2ad73f4309b1789a18da5f81560bf7a50dae3735b72fc2e3256e

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\SETFF3B.tmp
Filesize
1KB

MD5
aca184b6c71aed60d90a309e75074351

SHA1
8c7e25e79ee3e007c11c5c8543df937f07a6759b

SHA256
759093ef6aea54f05f8ac242281b462f16807c603e0431a009d3683920ba7b96

SHA512
428d1b7da4ab73a215aba0a8116cf7195dee40f250effc72b7715ecf0bc738af0048eeba50833626f31998c6becb10e9906e340e35dfec0c404e26c510fc57bd

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFBF5.tmp
Filesize
1.8MB

MD5
580c078410750969a02b1a14c609c2b3

SHA1
508ca23e9b569265fd818806958a8887900b7f6a

SHA256
07107efbc8cb16b4aec4838a538ea9b55c887b4e70d4eeac6f378b595f54dcfe

SHA512
c6898f8c767b9254fb11136ee49e379d1a246d6aa7ca8ffded39655215e0003d6cdadd5924591b136906977879505e196e78d885cf0c83150957df2677277936

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFC06.tmp
Filesize
687KB

MD5
dcd2d32cbe8467a34f66fa55aa529615

SHA1
3c48cb710cf84039ea70b42f5e34695ff383c748

SHA256
cafe6cb7344e48f4e44f2c0020ca969db42463d2ab972872464977ca945c3748

SHA512
ce68eb25fdd6e2029d6a2e57de0d2d27787fe44447d8cff5e716fa118d0633c48601cbfe128ee6804d02c992485eb078a152b8d1da421deb549e143403e3804c

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFC16.tmp
Filesize
5.3MB

MD5
e1f771245a39bba516ff3bf3c66ee64d

SHA1
7d5dd3e6f04bfb733cb5f0e8d68ed4c8f5e0bb91

SHA256
1e49382cf5b87a3b008a468d8fed55ad09afec6b370ee14c535e4bf9cc4c44fd

SHA512
acc802b5b41a740befee63707a39a20b44c4b3b4877a67e1560fa113005b1ca5f1ec6172da00803752c8b3f75b2b98b863ed2f90fdadef389facb1ba4fcf616e

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFCC3.tmp
Filesize
103KB

MD5
8886b6731c511235c19e0721a6667e36

SHA1
77d472eb9a54e9ec1f474e6e94865301f04d5909

SHA256
73c29efed41375853f251b4588a8bc89fcc8f1acd0615950ced965dd0f74d0e1

SHA512
749da343aac81382c99d18a9233039c1550ddc8e986d153e344f5b53cbe1eb9809a93cc2d41f5e62ccddde9d302e1233fffeaa7526af7ca8136871bc71df3c7d

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFCE4.tmp
Filesize
489KB

MD5
45852f60cf4626f24407195aefb74410

SHA1
442d5d66c776fac758056e358507d6d999d77ad4

SHA256
b70249517ab4b82d5c22c80fd6cfcf40c85cb0f905371c0936078eb614d721aa

SHA512
6ee20610b66493c46059827d7b08782a20c9ed1c9a0f8e28dd2831a5c6090dd5d519e66fbf876d7ca0f325c77149568956912937e8718ab84dfbde81f069e250

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFD13.tmp
Filesize
1.1MB

MD5
169bdfa679ed0a12d68a44f592b67981

SHA1
8de3731c4d3b22faf2acf4abf1cb5c2c919ec361

SHA256
85a847406b1ddeb5b21bbcde32c38547c62fcd546a2f9fb818a1470432c6bb2d

SHA512
64735de43ebb9b64a86c6e38082a67ec2058dfe0adecfad1aafac421605d4dd87f81f70cf35a9a6ee49c338d0a283140df5e062d6159cc6fa45b1b4096721d00

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFD72.tmp
Filesize
701KB

MD5
93d1094cf00b999f4a1cba707401f99a

SHA1
cd0dbec095d5222bdd98fdb7674c1935d3f2d7d5

SHA256
922cf785a564276ee9f5e076fdc9b981cf334ed2f2ea8dcda2276daf5a0d4742

SHA512
cdb7ccd3787e52b3ad0e7ebeb149caaee4314391c9d9e342d1ff57be5e37d034b7a8a34762df274e5162d3d4795b88bcde58b2fa7f39b5ca3deb0af257b2121f

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFE5E.tmp
Filesize
2.1MB

MD5
4c5d7c52428a4d94a2b490a4d2abedff

SHA1
0918161c4b35e9a35b2fd5318be52b3845cfb8e0

SHA256
5b337137fef3363c138933d7963c3f25776c6b31c62d661112a89aa5c83dff84

SHA512
974a9fb0d005bf39d72d71b144ee90f07842788785d7a9f07381a803d58232c1de6fdabd67289b7d0104ea3f0cf0f7fd769f38bf3c465b1286ab3e5da506ed14

Download Submit
C:\Windows\System32\DriverStore\Temp\{0e57efc4-b05a-0a49-9933-43b5d88cff54}\amd64\SETFE8D.tmp
Filesize
89KB

MD5
eea16b0ee1d3da4e1185f260c192a3f1

SHA1
8090b22ab85c8b7ea5bf17838c4fdc5c04b5b94d

SHA256
d8dc1cf8eafa26b71ec86dd931af5a6fbcb00b7c6fde04ad536fc3d42c67d421

SHA512
16c405a19e02ae295a2520a5965ffbca154a0b17a48c32edd756364a1cf68771a414714839aaeede33858082e0db08833d62f439a658d85a6aa28381f3555707

Download Submit
C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\SET452.tmp
Filesize
11KB

MD5
2f00396c36805926e5ae1e5fbe142abe

SHA1
0a5557d188992d429adb733ffffb2d7261dfacd8

SHA256
1f5913975e0a8fa9beb7909cb4d8b60d2a34f47263a59b3ab95658a3354524b7

SHA512
084492b1aee8892746acc72331a0dae5fc8ab8d88a3b0b45f6ad5637adbee61c0e5a642a9ea1d5c9aa8a32079bf770d6297b8763d33884f8707f44ee800a5ba1

Download Submit
C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET463.tmp
Filesize
2.1MB

MD5
748d1ffd3834929239134acc9d6e6c88

SHA1
a1fac723d4be4345aede690eb09eba9865f8b734

SHA256
d89f50444a2c6155d3950cced2a63c9d2e1585af527389b65a2bc2a86dc52b6a

SHA512
2f0aaf403b510c36a23e70b5dcd2fa4713deab2440d526f3cdc8a9b1d1ec4d403e30a8b55f13bc94db2a591ec84103ca8cfc3651706c08af002697c5ffd4c49b

Download Submit
C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET474.tmp
Filesize
89KB

MD5
95fde5207c5454e6a6a023f608c37c2f

SHA1
77b4a42104ebfa74eaff88baf632a7dd02da442d

SHA256
5a3a09b78ae6c3f80809d60aeaa2a9268353d4d619a214c623104f03315eb872

SHA512
56b9de51cb7af70265fce27489c6f473e41b96b8ed63714e9f279e0d87f871c42b2796f47bb6a90a625eb76005a1a0fa88edd832fc32382036f742bb37c1af2e

Download Submit
C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET475.tmp
Filesize
1.8MB

MD5
af1cc19d60a1bb94b48d72c4d08a050c

SHA1
e3cb69ed210c8785bbee6b8079285ce4dcd9ec46

SHA256
ea910fa0411258f87019777375353f590258e4d50b9ecdb065fed2ff62c010ab

SHA512
84bbb7e9cb90560c229b292f138785f2c058c1ce89ade1331e5b5eed32872c93c3c48ac6641a633389bec2d28d8f4582a8d12295e80935782d0cc066bdcdd11b

Download Submit
C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET476.tmp
Filesize
663KB

MD5
20d0a7e6d416cdbb1ed12119d4790695

SHA1
3954b15c1d34a584c0ed5d2f0793b5e7c34e47ec

SHA256
78356e998374bdd61783f741bb4046a78ada7715a653414a6c2e615a4256369c

SHA512
33b53e39703d359c0ea9f50d83ebc0396dee744abe7d9e01247050521dd95e77c780f80405c2380061a618a96776893bdd8067d6719aa6cce81ccad98f1259d4

Download Submit
C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET496.tmp
Filesize
1.1MB

MD5
a74a7d5d52fb370524b36ac029b63115

SHA1
f5a1b1693c2d62f0c631f60da8f2f968d8bea803

SHA256
ce79d8abd11e8734791fc84475ae87864257843d76919522368619f4a02b7b84

SHA512
d8a6b491deb988e39d4994cb900e1a62430a683e8b106b8e8b596c6405005f1c2134093e3e6ffad2dd34d6107997f97c30cff4bfd2b4fc349e59c77e681a08ea

Download Submit
C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET497.tmp
Filesize
103KB

MD5
e6c4f143f7222a85ce387e62d0761cba

SHA1
93ef43e4ab9292f55cb7f2d19ddf27f593cd58b2

SHA256
0ea2d55daa72b06f10f8d79b4e2e5bc8d96bd23f13c41745efbac580f92f16f4

SHA512
07820cfb9bcb4ae8b13788c4beb9082dc00c82d62d9e7ca8ca8b0b51cd10253b693c35b5f89640080fb0b0527339708c0d5268cbcab37a4ba73285971ac9c3aa

Download Submit
C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET498.tmp
Filesize
430KB

MD5
79f3a7bd572dd033d61ab00112bc24ef

SHA1
0eac70e5b4f268c39b30ab23c177ef409fd75bdc

SHA256
dd5e4cb83d334819bf628948877d1ed9f284c49f7c634b19b9e27dab82e08b06

SHA512
21873fa863febc7fb42ada26f7ffe0e36158567f380283e2131ba971fbd0b923d23b7a1254e2ab1cc4ec5e32ac091210816bad8a05bfd0e7f70249a397691ee2

Download Submit
C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET4B9.tmp
Filesize
867KB

MD5
9d95efc23a577817bc81d3faddad976e

SHA1
108546f6161fc4ffa160527a9f6d4848e88eec30

SHA256
4e0831da88b64d8a5943779a59838f70ac0bd084cbd19ffba6db379957b42d2a

SHA512
66ae6c9dce38d36af6751601c7b3f6d6e1b7968f80f01bb2c36e658922a15340ddf054f091059b08ea8a4633ac2a8cfc350c1893cd1614577f75763f45a80390

Download Submit
C:\Windows\System32\DriverStore\Temp\{7a1b2f20-378f-e04b-83c1-f5429ec4070a}\i386\SET4BA.tmp
Filesize
602KB

MD5
f518f8ad06e4647b7520d03503d7b264

SHA1
ea0afdfbb4179048f4d25adb27c513750edd2a4d

SHA256
122f64967cef3b41dfac52c592b26d3cf58dc29923078a56458a092710ba7d7d

SHA512
68ae98d8875a1a93a44eac0d0f16062a3e4ff494c811b0c1ca9ec70fd48dc855ab224d05ad96d9ca4229e8fe77b8c4996b927031b0ea02c4573e32af6b5916a9

Download Submit
C:\Windows\System32\DriverStore\Temp\{97a53111-77ee-d849-aee7-fd51ed429619}\SETC743.tmp
Filesize
11KB

MD5
191feb461eff88f87fc11d37248538b1

SHA1
a175e906ca120d59be1a44e138e100d812eb7a40

SHA256
2933939c0e35c3020e66806ceded577ed01bc31111f207fd43b31294b67e2274

SHA512
ed46c858fb80b2abdfa2f821c6ef14a3199e4d6a2839646aefd0c038dea810cef96d3ff15a83a2d54b87a30295335b729ee3fe46c77a8599d9dcacfb53c92f2a

Download Submit
C:\Windows\System32\DriverStore\Temp\{97a53111-77ee-d849-aee7-fd51ed429619}\SETC753.tmp
Filesize
146KB

MD5
bced35f016745daf251944f8797a7723

SHA1
bec7c58ffd00394a7f3e9130e3e21bd27c8f2a71

SHA256
8112b63bebb294a68b4ab8866e9cdd9a3356736ba173625c88860054fcd8ae2d

SHA512
27a81ef3aa46f7ee6d7714f7e99e98a7f739297f071d26003933e4802b883c9ff9a55d67df87fc38fb9e265f876c24b11a23d3e82d79ba1707a61b72e6282cd0

Download Submit
C:\Windows\System32\DriverStore\Temp\{97a53111-77ee-d849-aee7-fd51ed429619}\SETC764.tmp
Filesize
3KB

MD5
9e8441dbeeff234f1dc2b10ff11dda17

SHA1
ab7e594ae1302f0dbdac66ea9ecdbabad8522b0d

SHA256
16ba4dfeab265dc56a0f8f6d69c908ca78f4a6137dc953bfebb4019ae5b174f6

SHA512
25660eab1ecb1a6e5d9e570f8de05ec7de135142ea6c30c7436226e2568ff2516494da39605acf39ab415ce2f0983c300ed92de97260029642b188c0ceca80b1

Download Submit
C:\Windows\System32\gotomon_x64.dll
Filesize
195KB

MD5
8dbabe92e70643b21c730671b73f4e56

SHA1
5f0ad1fb4dbd35823797402e95bafceac7bf9754

SHA256
0ced1376d4839482ae9c00bee981ba55224cb29e65998a73edc52a967ea434d2

SHA512
7781c90f9510383149897ae91d3f868b404347145d12c1c0f2607d8f4c5fb7f8ce4afcc77980d3c9bb6dad0fec7d711cbad0e44e36a24b03deb4ff85498ee258

Download Submit
C:\Windows\System32\spool\prtprocs\x64\GoToPrintProcessor_x64.dll
Filesize
116KB

MD5
b0e4925100965c5b5353bf57706da5fb

SHA1
db21d47dd2888faa2352967eae39e5e51a20a129

SHA256
f3487b14c65ddc977f01e4de5803d68a78b6026b316a41e8cd79a3488a0a03fc

SHA512
88e843ac54fd69f12e90039814626c619b4d6e53e46ebfd2051b7f945f564cc88caaf9997060a26fe5355206fce683c51fc18b8e6f06742c7348a495357730b8

Download Submit
C:\Windows\System32\spool\prtprocs\x64\GoToPrintProcessor_x64.dll
Filesize
116KB

MD5
b0e4925100965c5b5353bf57706da5fb

SHA1
db21d47dd2888faa2352967eae39e5e51a20a129

SHA256
f3487b14c65ddc977f01e4de5803d68a78b6026b316a41e8cd79a3488a0a03fc

SHA512
88e843ac54fd69f12e90039814626c619b4d6e53e46ebfd2051b7f945f564cc88caaf9997060a26fe5355206fce683c51fc18b8e6f06742c7348a495357730b8

Download Submit
C:\Windows\System32\spool\prtprocs\x64\GoToPrintProcessor_x64.dll
Filesize
116KB

MD5
b0e4925100965c5b5353bf57706da5fb

SHA1
db21d47dd2888faa2352967eae39e5e51a20a129

SHA256
f3487b14c65ddc977f01e4de5803d68a78b6026b316a41e8cd79a3488a0a03fc

SHA512
88e843ac54fd69f12e90039814626c619b4d6e53e46ebfd2051b7f945f564cc88caaf9997060a26fe5355206fce683c51fc18b8e6f06742c7348a495357730b8

Download Submit
C:\Windows\System32\spool\prtprocs\x64\GoToPrintProcessor_x64.dll
Filesize
116KB

MD5
b0e4925100965c5b5353bf57706da5fb

SHA1
db21d47dd2888faa2352967eae39e5e51a20a129

SHA256
f3487b14c65ddc977f01e4de5803d68a78b6026b316a41e8cd79a3488a0a03fc

SHA512
88e843ac54fd69f12e90039814626c619b4d6e53e46ebfd2051b7f945f564cc88caaf9997060a26fe5355206fce683c51fc18b8e6f06742c7348a495357730b8

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
e703d059e572c5bf22e1985cbbd14d24

SHA1
1524bfdd5a3b1517f63abc95450ab594494ccfb0

SHA256
30bc65d81569b62f6f2dcffa4429847e3247309e2f8eb64d9bde73cd73a21656

SHA512
76e8922f55d12e6cc47ad9a91bef1d75625f203b823d33505f9b0fba45773b7f43b1254bc75595973d0346a117cb468dacd71a2af117eb7bbfbd8d82a91aaabc

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\Volume{61956d03-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5bb5ee13-60be-4bb2-83f1-754864025624}_OnDiskSnapshotProp
Filesize
5KB

MD5
1b36c10cc58f35c377998303a0946f74

SHA1
1392e9ff7fb27c5d918d583890994fd5b4e8a081

SHA256
37d652d50344ac902029c0f2436473be5f7bdd2b2652c8252a7bc7d56d52036d

SHA512
72e62069c3ee714bcdec149f8d0a5b6e8f698f10114ff0c441ab3ff7d544c3d330bf88e2bfb1cd97a4fe6ec9a4f65f4d12d3d7090ed1999e547e15703ea81aef

Download Submit
memory/1264-1173-0x0000000002530000-0x0000000002550000-memory.dmp

Filesize
128KB

Download
memory/1400-1148-0x0000000019D20000-0x0000000019D30000-memory.dmp

Filesize
64KB

Download
memory/1400-1149-0x00007FFA3C2A0000-0x00007FFA3C2C4000-memory.dmp

Filesize
144KB

Download
memory/1400-1135-0x0000000001360000-0x000000000136C000-memory.dmp

Filesize
48KB

Download
memory/1400-1133-0x0000000019CB0000-0x0000000019CC2000-memory.dmp

Filesize
72KB

Download
memory/1400-1132-0x00007FFA3C2A0000-0x00007FFA3C2C4000-memory.dmp

Filesize
144KB

Download
memory/1400-1131-0x00007FFA2D2B0000-0x00007FFA2D3FE000-memory.dmp

Filesize
1.3MB

Download
memory/1400-1130-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/1400-1134-0x0000000019F30000-0x0000000019F70000-memory.dmp

Filesize
256KB

Download
memory/1400-1137-0x000000001A520000-0x000000001A55C000-memory.dmp

Filesize
240KB

Download
memory/1400-1136-0x0000000019CD0000-0x0000000019CE2000-memory.dmp

Filesize
72KB

Download
memory/2276-1277-0x0000000002330000-0x0000000002350000-memory.dmp

Filesize
128KB

Download
memory/3936-1296-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4056-1297-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download