cc8884209d49144b756c86a3a65385307c06415776863eeec0746438ff8d3e36

Resubmissions

30/06/2023, 00:41

230630-a19g3age9t 8

30/06/2023, 00:37

230630-ayfrzaff67 6

Analysis

max time kernel
109s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vega X_94306.exe
Size

8.7MB
MD5

d95304d22479d196942a8e188113884c
SHA1

f9f88c60a21b7348dd4732134862b80eb324be60
SHA256

cc8884209d49144b756c86a3a65385307c06415776863eeec0746438ff8d3e36
SHA512

67ad51defe3912434e6c1e9002027517e30c1ff7ddf6592bef10bb14c232b96a234520d92b6666bb9f6cae74a6caa2bb02b7c6c708925dbdc17782a04eeb472a
SSDEEP

196608:yIIQxYuxFeQFrqNYaG59Fa9FVDNWXVkHo/EZb:rI0PFLrqNYv529PDNs2Ho/EZb

Score

8^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00060000000231ab-436.dat	upx
behavioral2/memory/5044-444-0x0000000000BD0000-0x00000000010FB000-memory.dmp	upx
behavioral2/memory/4448-445-0x0000000000A00000-0x0000000000F2B000-memory.dmp	upx
behavioral2/memory/4804-446-0x0000000000BD0000-0x00000000010FB000-memory.dmp	upx
behavioral2/memory/2136-480-0x0000000000BD0000-0x00000000010FB000-memory.dmp	upx
behavioral2/memory/3928-484-0x0000000000BD0000-0x00000000010FB000-memory.dmp	upx

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	GenericSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	GenericSetup.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\D:	35k33x3q.jxv.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\F:	35k33x3q.jxv.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\D:	35k33x3q.jxv.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\F:	35k33x3q.jxv.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Control Panel\International\Geo\Nation	GenericSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\Control Panel\International\Geo\Nation	Vega X_94306.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Executes dropped EXE 13 IoCs

pid	Process
5088	setup94306.exe
3536	GenericSetup.exe
4576	setup94306.exe
3344	GenericSetup.exe
3660	OfferInstaller.exe
5044	35k33x3q.jxv.exe
4804	35k33x3q.jxv.exe
4448	35k33x3q.jxv.exe
2136	35k33x3q.jxv.exe
3928	35k33x3q.jxv.exe
5640	Assistant_100.0.4815.21_Setup.exe_sfx.exe
5976	assistant_installer.exe
6000	assistant_installer.exe

Loads dropped DLL 46 IoCs

pid	Process
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3344	GenericSetup.exe
3344	GenericSetup.exe
3344	GenericSetup.exe
3344	GenericSetup.exe
3344	GenericSetup.exe
3344	GenericSetup.exe
3344	GenericSetup.exe
3344	GenericSetup.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
3660	OfferInstaller.exe
5044	35k33x3q.jxv.exe
4804	35k33x3q.jxv.exe
4448	35k33x3q.jxv.exe
2136	35k33x3q.jxv.exe
3928	35k33x3q.jxv.exe
5976	assistant_installer.exe
5976	assistant_installer.exe
6000	assistant_installer.exe
6000	assistant_installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5944	5424	WerFault.exe	122

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings	Vega X_94306.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe

Modifies system certificate store 2 TTPs 16 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	GenericSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0400000001000000100000004be2c99196650cf40e5a9392a00afeb20f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d4190000000100000010000000fa46ce7cbb85cfb4310075313a09ee052000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	OfferInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4	GenericSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	GenericSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4	OfferInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 5c000000010000000400000000080000190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd940400000001000000100000004be2c99196650cf40e5a9392a00afeb22000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	OfferInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	35k33x3q.jxv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	GenericSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	GenericSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	35k33x3q.jxv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	35k33x3q.jxv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	35k33x3q.jxv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	GenericSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	GenericSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	GenericSetup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	35k33x3q.jxv.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Vega X.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2140	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
3536	GenericSetup.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe
4700	Vega X_94306.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	GenericSetup.exe
Token: SeDebugPrivilege	3660	OfferInstaller.exe
Token: SeDebugPrivilege	4960	firefox.exe
Token: SeDebugPrivilege	4960	firefox.exe
Token: SeDebugPrivilege	4960	firefox.exe
Token: SeDebugPrivilege	5424	Vega X.exe
Token: SeShutdownPrivilege	6136	unregmp2.exe
Token: SeCreatePagefilePrivilege	6136	unregmp2.exe
Token: SeShutdownPrivilege	3748	wmplayer.exe
Token: SeCreatePagefilePrivilege	3748	wmplayer.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4960	firefox.exe
4960	firefox.exe
4960	firefox.exe
4960	firefox.exe
4960	firefox.exe
4960	firefox.exe
3748	wmplayer.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4960	firefox.exe
4960	firefox.exe
4960	firefox.exe
4960	firefox.exe
4960	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4700	Vega X_94306.exe
4700	Vega X_94306.exe
3536	GenericSetup.exe
4960	firefox.exe
4960	firefox.exe
4960	firefox.exe
4960	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 5088	4700	Vega X_94306.exe	87
PID 4700 wrote to memory of 5088	4700	Vega X_94306.exe	87
PID 4700 wrote to memory of 5088	4700	Vega X_94306.exe	87
PID 5088 wrote to memory of 3536	5088	setup94306.exe	88
PID 5088 wrote to memory of 3536	5088	setup94306.exe	88
PID 5088 wrote to memory of 3536	5088	setup94306.exe	88
PID 4700 wrote to memory of 4576	4700	Vega X_94306.exe	93
PID 4700 wrote to memory of 4576	4700	Vega X_94306.exe	93
PID 4700 wrote to memory of 4576	4700	Vega X_94306.exe	93
PID 4576 wrote to memory of 3344	4576	setup94306.exe	94
PID 4576 wrote to memory of 3344	4576	setup94306.exe	94
PID 4576 wrote to memory of 3344	4576	setup94306.exe	94
PID 3536 wrote to memory of 3660	3536	GenericSetup.exe	97
PID 3536 wrote to memory of 3660	3536	GenericSetup.exe	97
PID 3536 wrote to memory of 3660	3536	GenericSetup.exe	97
PID 4700 wrote to memory of 2140	4700	Vega X_94306.exe	98
PID 4700 wrote to memory of 2140	4700	Vega X_94306.exe	98
PID 4700 wrote to memory of 2140	4700	Vega X_94306.exe	98
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 5060 wrote to memory of 4960	5060	firefox.exe	103
PID 4960 wrote to memory of 1428	4960	firefox.exe	104
PID 4960 wrote to memory of 1428	4960	firefox.exe	104
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105
PID 4960 wrote to memory of 1600	4960	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Vega X_94306.exe
"C:\Users\Admin\AppData\Local\Temp\Vega X_94306.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\setup94306.exe
  C:\Users\Admin\AppData\Local\setup94306.exe hhwnd=720964 hreturntoinstaller hextras=id:3edef7f19b9beb4-US-qVYDg
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.exe
    .\GenericSetup.exe hhwnd=720964 hreturntoinstaller hextras=id:3edef7f19b9beb4-US-qVYDg
    3⤵
    - Checks for any installed AV software in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\OfferInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\OfferInstaller.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      PID:3660
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\35k33x3q.jxv.exe" --silent --otd="utm.medium:apb,utm.source:lavasoft,utm.campaign:lavasoftOPTOUT:ES_NA_63053a73342f17647bd2cec5""
        5⤵
        
        PID:792
      - C:\Users\Admin\AppData\Local\Temp\35k33x3q.jxv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\35k33x3q.jxv.exe" --silent --otd="utm.medium:apb,utm.source:lavasoft,utm.campaign:lavasoftOPTOUT:ES_NA_63053a73342f17647bd2cec5"
        6⤵
        Enumerates connected drives
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\35k33x3q.jxv.exe
        
        C:\Users\Admin\AppData\Local\Temp\35k33x3q.jxv.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=100.0.4815.30 --initial-client-data=0x2f8,0x2fc,0x300,0x2d4,0x304,0x6c87d178,0x6c87d188,0x6c87d194
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\35k33x3q.jxv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\35k33x3q.jxv.exe" --version
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\35k33x3q.jxv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\35k33x3q.jxv.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5044 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230630004256" --session-guid=f1fd7bd5-54a7-4546-99dc-9687ee41ce7b --server-tracking-blob=ZGQxZmZkNjljZWM2MjdjMWY3MTFiNDg2NmU1MzU0YTJjMTc1NDc2ZGY5NDgyNzUwYjEzYzQ2MTc4MTUxMjU4Njp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPUxBVkFTT0ZUJnV0bV9tZWRpdW09YXBiJnV0bV9jYW1wYWlnbj1sYXZhc29mdE9QVE9VVCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY4ODA4NTc1Ni42MzM4IiwidXRtIjp7ImNhbXBhaWduIjoibGF2YXNvZnRPUFRPVVQ6RVNfTkFfNjMwNTNhNzMzNDJmMTc2NDdiZDJjZWM1IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibGF2YXNvZnQifSwidXVpZCI6IjNhNDEzNTkwLTMxNjktNDBmOC04ZDc0LTNmZTY1ZWRhOWFhMCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=8C05000000000000
        7⤵
        Enumerates connected drives
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\35k33x3q.jxv.exe
        
        C:\Users\Admin\AppData\Local\Temp\35k33x3q.jxv.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=100.0.4815.30 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x2f4,0x6bd6d178,0x6bd6d188,0x6bd6d194
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202306300042561\assistant\Assistant_100.0.4815.21_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202306300042561\assistant\Assistant_100.0.4815.21_Setup.exe_sfx.exe"
        7⤵
        Executes dropped EXE
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202306300042561\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202306300042561\assistant\assistant_installer.exe" --version
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202306300042561\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202306300042561\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=100.0.4815.21 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x90e8a0,0x90e8b0,0x90e8bc
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6000
- C:\Users\Admin\AppData\Local\setup94306.exe
  C:\Users\Admin\AppData\Local\setup94306.exe hready
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.exe
    .\GenericSetup.exe hready
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3344
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2140

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4960.0.1262434808\902693702" -parentBuildID 20221007134813 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {489890a3-d77f-4d32-8cb9-53ff83bdc747} 4960 "\\.\pipe\gecko-crash-server-pipe.4960" 1932 16911716558 gpu
    3⤵
    PID:1428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4960.1.1925931079\730332667" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b243d859-2abe-434b-af28-110d87e4fb6b} 4960 "\\.\pipe\gecko-crash-server-pipe.4960" 2332 16903772558 socket
    3⤵
    PID:1600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4960.2.578197450\1925177144" -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 3128 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {418e9341-f664-4808-b48a-e732fd4326a7} 4960 "\\.\pipe\gecko-crash-server-pipe.4960" 3104 16914407658 tab
    3⤵
    PID:1324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4960.3.1072805937\289890793" -childID 2 -isForBrowser -prefsHandle 2488 -prefMapHandle 2484 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fa4c4af-a687-4dc2-94f0-ae931367749b} 4960 "\\.\pipe\gecko-crash-server-pipe.4960" 1372 16903771658 tab
    3⤵
    PID:1788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4960.4.1035420964\827531284" -childID 3 -isForBrowser -prefsHandle 3724 -prefMapHandle 3728 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c3edd08-3f0f-4862-a22b-cd60dc1f2feb} 4960 "\\.\pipe\gecko-crash-server-pipe.4960" 3716 16914521258 tab
    3⤵
    PID:1756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4960.7.56989135\601956614" -childID 6 -isForBrowser -prefsHandle 5832 -prefMapHandle 5828 -prefsLen 26874 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df2703df-6a58-44bc-9b24-aeaf6d7fc62d} 4960 "\\.\pipe\gecko-crash-server-pipe.4960" 5844 1691842b458 tab
    3⤵
    PID:5624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4960.6.1840826564\1583776810" -childID 5 -isForBrowser -prefsHandle 5544 -prefMapHandle 5548 -prefsLen 26874 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5329e514-1b0f-4a3e-9826-e3e523a0bda7} 4960 "\\.\pipe\gecko-crash-server-pipe.4960" 5628 1691842b158 tab
    3⤵
    PID:5616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4960.5.2070481445\1850755794" -childID 4 -isForBrowser -prefsHandle 5240 -prefMapHandle 3452 -prefsLen 26874 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43723290-a259-4dc2-a476-cea7d3eee783} 4960 "\\.\pipe\gecko-crash-server-pipe.4960" 5384 1691042e858 tab
    3⤵
    PID:5608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6044

C:\Users\Admin\Desktop\Vega X\Vega X.exe
"C:\Users\Admin\Desktop\Vega X\Vega X.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 3544
  2⤵
  - Program crash
  PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5424 -ip 5424
1⤵
PID:5932

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:5980
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    PID:5548
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:5552
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\StopClose.wax
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3748
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  PID:4644
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:6136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1696

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ApproveRequest.gif
1⤵
PID:4680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4680 CREDAT:17410 /prefetch:2
  2⤵
  PID:4852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_5F5F520ABA6509FB550A7DDEB645B50F

Filesize
1KB

MD5
2dff2883a80ad9602a175a97287974fb

SHA1
c2366a60b63c0cd1bcbd571912fef2ae9fddb9b3

SHA256
73635432b7db8d3d96190a5181e726f3beeb048e01f8f154bcfe77f5d6734b48

SHA512
d1272f2478200f914e743a25ba192d84ec78872fa5c03489fb93a0b70db3e21b479a65ecc51de30d1249c8f102c2cc73f90570f481b2a641241707ef0af369a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_5F5F520ABA6509FB550A7DDEB645B50F

Filesize
520B

MD5
6ac06f8ca6d80d3036efe721cb2cfe8c

SHA1
012e1fdec0f850dea3d746c282ccde9d6ac92a21

SHA256
c58b523c346d6a9d29140ddcc3678f9153b41d9340a2e9a2656090abec5f9a87

SHA512
8eb9a1a89cd7107d00306dfa2bf583aeb410882b6e146c6a6435fcb1a88d3feff79fde533e05cd95b09f63ecc2d128dc7e4c22b9d0d7bc8c0710d7b62f0d9828

Download Submit
C:\Users\Admin\AppData\Local\Adaware\OfferInstaller.exe_Url_vpqbdsatqobmizieh3ddlyyzun4bi5y3\6.9.0.0\user.config

Filesize
798B

MD5
c76d70d8440a273c2b2a2764f33323b8

SHA1
3fe51b13b029129c5a491000f5ddd9b4019e81c1

SHA256
8f6658dfb498d9bc831670dffd055d850d327a2defd82e1f24416316b037135d

SHA512
9b70d62bd9edecbfa6cf6ee6c2d912247929b64fa8bd104a7275ffe977091ccc9e3bffa1ad7e93ae2b094c601e5876948d2c0b7e8ece759cf914bc4abf2575fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GenericSetup.exe.log

Filesize
621B

MD5
ad1a8f8d9ea2fe08bd64dd13d6ad450e

SHA1
46a4f5c0e86bedd8f94bdfa0e75005809fc3299b

SHA256
a70ec63df01049ca33e9e9ba171b339b71dc26d88dfbfdf31c15d22cb7bec5e4

SHA512
3bfa4bfedc2ca9922ecc85d7793c5cb47d285f0c4f98e555136f678498c86cf8c6664b3da099e1dd5a01c8151bf643c6a957268e281768b567dc4f5295c5d62c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
768KB

MD5
7163bfab3a6b9dc5e545b49318fa1704

SHA1
e82c84366125493f876df0ddbf4b637df64b1f88

SHA256
4152a20e642a8f2e089147a787220863f729437184b362a6191cc08a40551956

SHA512
3dc7c2e792a3a1b284817b3d921d3ea3dde1edaa4e29775f9f68fb983d813d59eb965765c65d2e06105b66ec4811231949865f8d5cae4bc0dfa3d913ecb206eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0b3n2faz.default-release\activity-stream.discovery_stream.json.tmp

Filesize
162KB

MD5
1f00b5560722f44b794b8ea5d9d09540

SHA1
2fbedc28299fd8481a2ad9eab65d9acd9a36c833

SHA256
1fd0af7530ba29eeb1f46bbc8870671e33782859b67e85d9f33563f3b5274f81

SHA512
bbb44a4ee021890d2a8100bdfdd3d0787f17696cc57dd6c25a6600b34e987ccb5ebf19d66a529c1cae80f134a96a70f54ae52c881e9f35e2fda0f71d6aa83162

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\35k33x3q.jxv.exe

Filesize
2.7MB

MD5
d3f8ae9f7506f368f58fc25d81f0f8f8

SHA1
22a38927854441196867b12e5a0af0ce34a6720c

SHA256
b5d1877b6d5f756ca744ea32f064678b4d22b1642397831042b2d4a8997f1dbe

SHA512
6aca6543316723d0e8ae153d73db092f1c78a0d410f383fa3db33bf93b4a416060ec337e2276d4a455ca589520a72bf6b4200d168b8c529ac8be7205891b12f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202306300042561\additional_file0.tmp

Filesize
2.4MB

MD5
79ef7e63ffe3005c8edacaa49e997bdc

SHA1
9a236cb584c86c0d047ce55cdda4576dd40b027e

SHA256
388a4c959063e7edf133058e2cf797574bed808776a7c9a0307aaeb718ff7bd1

SHA512
59ee17f0f452617bcd1a4e42947310c52c21e88d31f1d6a09ebdb6ab400fcb1f997627a0f97fa185e58683d65a45425f8a7ec698f63a84d91c838e0f7e899094

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202306300042561\opera_package

Filesize
92.6MB

MD5
39408723bedb911b60d17f6698b14fa3

SHA1
336f983411188944a5689528fafb53385c04bb01

SHA256
6841babf1eca53e41750227bf282c4d3a4ed8a38a386bae11bfd2b26a86c6794

SHA512
6f0fe39147f1bc6df0414add2c844fde286df1ae408d80af67faee7d604eb369e4510f6846f4cdece3e9cbb987a97a0a9757165cca452786a3a84f96c6c6d014

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\DynActsBLL.dll

Filesize
25KB

MD5
c7151d4057d2b91da27bfab58415dd81

SHA1
bb945c91cdfb0960e785fb5a40b27d25fad448e5

SHA256
4263a69119ae27e65b3bf25e1552c89e1ff2dbf0fbd6865cbd69a95cf851d81b

SHA512
c1f0cb4dee96274fc700d65665690fe5f0075a4fcf9b0b0d12700908225c002efb8311bd8137984cdaffe978936d32a111c5153da8c1784a7f1b7d6204a28f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.LastScreen.dll

Filesize
31KB

MD5
3319432d3a694a481f5672fa9eb743d0

SHA1
99bff8f4941eb3cee3e0a7cb86b89eda1df07bf9

SHA256
768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693

SHA512
7f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.LastScreen.dll

Filesize
31KB

MD5
3319432d3a694a481f5672fa9eb743d0

SHA1
99bff8f4941eb3cee3e0a7cb86b89eda1df07bf9

SHA256
768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693

SHA512
7f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.LastScreen.dll

Filesize
31KB

MD5
3319432d3a694a481f5672fa9eb743d0

SHA1
99bff8f4941eb3cee3e0a7cb86b89eda1df07bf9

SHA256
768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693

SHA512
7f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.dll

Filesize
6.8MB

MD5
4d65e6eb25db2ce61f4a7a48d9f6082a

SHA1
130abbae19f227b0ef4f278e90398b3b3c7c2eff

SHA256
1e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a

SHA512
b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.dll

Filesize
6.8MB

MD5
4d65e6eb25db2ce61f4a7a48d9f6082a

SHA1
130abbae19f227b0ef4f278e90398b3b3c7c2eff

SHA256
1e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a

SHA512
b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.dll

Filesize
6.8MB

MD5
4d65e6eb25db2ce61f4a7a48d9f6082a

SHA1
130abbae19f227b0ef4f278e90398b3b3c7c2eff

SHA256
1e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a

SHA512
b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.exe

Filesize
25KB

MD5
85b0a721491803f8f0208a1856241562

SHA1
90beb8d419b83bd76924826725a14c03b3e6533f

SHA256
18be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345

SHA512
8ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.exe

Filesize
25KB

MD5
85b0a721491803f8f0208a1856241562

SHA1
90beb8d419b83bd76924826725a14c03b3e6533f

SHA256
18be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345

SHA512
8ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.exe

Filesize
25KB

MD5
85b0a721491803f8f0208a1856241562

SHA1
90beb8d419b83bd76924826725a14c03b3e6533f

SHA256
18be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345

SHA512
8ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\GenericSetup.exe.config

Filesize
814B

MD5
fd63ee3928edd99afc5bdf17e4f1e7b6

SHA1
1b40433b064215ea6c001332c2ffa093b1177875

SHA256
2a2ddbdc4600e829ad756fd5e84a79c0401fa846ad4f2f2fb235b410e82434a9

SHA512
1925cde90ee84db1e5c15fa774ee5f10fa368948df7643259b03599ad58cfce9d409fd2cd752ff4cbca60b4bbe92b184ff92a0c6e8b78849c4497d38266bd3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\HtmlAgilityPack.dll

Filesize
149KB

MD5
7874850410e21b5f48bfe34174fb318c

SHA1
19522b1b9d932aa89df580c73ef629007ec32b6f

SHA256
c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1

SHA512
dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\HtmlAgilityPack.dll

Filesize
149KB

MD5
7874850410e21b5f48bfe34174fb318c

SHA1
19522b1b9d932aa89df580c73ef629007ec32b6f

SHA256
c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1

SHA512
dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\HtmlAgilityPack.dll

Filesize
149KB

MD5
7874850410e21b5f48bfe34174fb318c

SHA1
19522b1b9d932aa89df580c73ef629007ec32b6f

SHA256
c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1

SHA512
dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\MyDownloader.Core.dll

Filesize
56KB

MD5
f931e960cc4ed0d2f392376525ff44db

SHA1
1895aaa8f5b8314d8a4c5938d1405775d3837109

SHA256
1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

SHA512
7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\MyDownloader.Extension.dll

Filesize
168KB

MD5
28f1996059e79df241388bd9f89cf0b1

SHA1
6ad6f7cde374686a42d9c0fcebadaf00adf21c76

SHA256
c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

SHA512
9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\Newtonsoft.Json.dll

Filesize
476KB

MD5
3c4d2f6fd240dc804e10bbb5f16c6182

SHA1
30d66e6a1ead9541133bad2c715c1971ae943196

SHA256
1f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e

SHA512
0657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\Ninject.dll

Filesize
133KB

MD5
ce80365e2602b7cff0222e0db395428c

SHA1
50c9625eda1d156c9d7a672839e9faaea1dffdbd

SHA256
3475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5

SHA512
5ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\Ninject.dll

Filesize
133KB

MD5
ce80365e2602b7cff0222e0db395428c

SHA1
50c9625eda1d156c9d7a672839e9faaea1dffdbd

SHA256
3475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5

SHA512
5ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\Ninject.dll

Filesize
133KB

MD5
ce80365e2602b7cff0222e0db395428c

SHA1
50c9625eda1d156c9d7a672839e9faaea1dffdbd

SHA256
3475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5

SHA512
5ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\OfferInstaller.exe

Filesize
27KB

MD5
2537635bcf851b0faaafc2b0c8eab06a

SHA1
1124433a701fb5e30b73c0fe901d78fd475a5460

SHA256
41f443757912fbadaff9d07c9dfc46a0078d20a512fb10e0a6fec454eea62f5b

SHA512
9f4a2c580be3dfc25a4ceb9aebc759fbabd6c218cc0777d9f07980edc30808bd03f3487bf9dd636513b5ad34f8547c762f6a0749de1019c5d0b94ef76b15e68c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\OfferInstaller.exe.config

Filesize
313B

MD5
67ed4edc1d47444b046ad77f68cb2801

SHA1
15d183fc00e868e96e2b5f671bdf5b75678d7474

SHA256
c9dd581b481e198c4e83db6be03bec4bac64c02c6c6f9e3051c23c3df6f1301e

SHA512
f0beef571b8753c7f32a3e7b3716cdf782026268102510b4a6b0631036b8653d2087ab7b7489931c2cb35c1995bcf6eb7530a049d1f89f372282ceb46d402b76

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\de\GenericSetup.resources.dll

Filesize
17KB

MD5
b597e0a66eac08849cb8ca80f9f2e8b4

SHA1
a0405075964c52945c69c8e9d321ce74b39d63d3

SHA256
b0c5246b10d5dfaf55b2112910c1ca11815f066c2854eecd326c657a7e46ad57

SHA512
4e983f9d781abfc9d40360767e856bbbe5f7673e35a7176e6c85a92f63c7bb3b17445b274672808e78cb13c8055caf3ca9154f19ca7be8cec8b4434124a423da

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\es\GenericSetup.resources.dll

Filesize
16KB

MD5
be272836941982a1a22473e27976766e

SHA1
f1ff4d69c805497bb9254df081b4c316844071ee

SHA256
971ae92220940ac6fbbd2ae155138c348de9ce2e6927fc83d48e27bbd988f3cd

SHA512
523d602b44417838c00448061562576ad87eb9e355fa1137c38fb4b9a860081e5b0e5a69c6899717e10854af2f63f56b1d82faf753fc299b525e0dbe34ebd247

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\fr\GenericSetup.resources.dll

Filesize
17KB

MD5
2cf788bac39113080f6ec4d54fb77720

SHA1
3c6e5dedd0b319ac940b49bb407f9ccaae6f6d7e

SHA256
403c4f149bede7ac73a2ff40a3e30e57c9e98ea24cff6121cda04e9ac38f13d8

SHA512
e7d2cbb430ad7c8a8d7f0526255f6bb35d6ff0214ebfaa663c9ca8d21914d029ddb7105ae1ed992bc3bc6615ef0b43c57195f3eba7004121a7aa3e0abe0ed3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\it\GenericSetup.resources.dll

Filesize
16KB

MD5
cedcf18bbabc93400beeb3f26022ac15

SHA1
975be24d7d9d788d23a578a6cf3f0de30224124b

SHA256
7b8ea36bf4afbe6d62623ba85239a6a57dbb710e067786bc0b67b6bdcb245c9b

SHA512
de38d30f313007b11535e1e4054dd132f889e88da1083ec51b1a94597da60030a04a3285f5d80e2a3637c81c5b22cedb7fc58207695ee5afe142c2695f0405dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\pt\GenericSetup.resources.dll

Filesize
16KB

MD5
b537a58b5ee8605d890fc46d0b6918c5

SHA1
06f38521367a13529df8e67bad88754fa517a137

SHA256
e529c65d0b4ff015109016d2567a511f56d04da4c8cf917c0490272220913ca2

SHA512
ff54a2ad53791780cb8a2797f3dd7e009d0c263e516ed4dd3d415ab124f4f90255af63a2e9cb8ee3a5d8b0afb7065e3a3ec12ab48c23d3435332aadab5e12f17

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E112596\ru\GenericSetup.resources.dll

Filesize
18KB

MD5
7ea51496582b5b25fd9e6db9de6d1b8d

SHA1
50654a76676458916bc08e7121d7a161e852366e

SHA256
ad97150baedb7406086e2bed93e121a0cbf40459643c3ad3a0669b659d5ff2c2

SHA512
5a4099f7e7e576691b6cde4783702fdc52154388ab3c1361fa3567a9a900c08f2e9e6569c53d9df7469e26c78511a63ff682a0e464d9098844fcba036f814a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\DynActsBLL.dll

Filesize
25KB

MD5
c7151d4057d2b91da27bfab58415dd81

SHA1
bb945c91cdfb0960e785fb5a40b27d25fad448e5

SHA256
4263a69119ae27e65b3bf25e1552c89e1ff2dbf0fbd6865cbd69a95cf851d81b

SHA512
c1f0cb4dee96274fc700d65665690fe5f0075a4fcf9b0b0d12700908225c002efb8311bd8137984cdaffe978936d32a111c5153da8c1784a7f1b7d6204a28f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\DynActsBLL.dll

Filesize
25KB

MD5
c7151d4057d2b91da27bfab58415dd81

SHA1
bb945c91cdfb0960e785fb5a40b27d25fad448e5

SHA256
4263a69119ae27e65b3bf25e1552c89e1ff2dbf0fbd6865cbd69a95cf851d81b

SHA512
c1f0cb4dee96274fc700d65665690fe5f0075a4fcf9b0b0d12700908225c002efb8311bd8137984cdaffe978936d32a111c5153da8c1784a7f1b7d6204a28f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\DynActsBLL.dll

Filesize
25KB

MD5
c7151d4057d2b91da27bfab58415dd81

SHA1
bb945c91cdfb0960e785fb5a40b27d25fad448e5

SHA256
4263a69119ae27e65b3bf25e1552c89e1ff2dbf0fbd6865cbd69a95cf851d81b

SHA512
c1f0cb4dee96274fc700d65665690fe5f0075a4fcf9b0b0d12700908225c002efb8311bd8137984cdaffe978936d32a111c5153da8c1784a7f1b7d6204a28f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.LastScreen.dll

Filesize
31KB

MD5
3319432d3a694a481f5672fa9eb743d0

SHA1
99bff8f4941eb3cee3e0a7cb86b89eda1df07bf9

SHA256
768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693

SHA512
7f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.LastScreen.dll

Filesize
31KB

MD5
3319432d3a694a481f5672fa9eb743d0

SHA1
99bff8f4941eb3cee3e0a7cb86b89eda1df07bf9

SHA256
768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693

SHA512
7f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.LastScreen.dll

Filesize
31KB

MD5
3319432d3a694a481f5672fa9eb743d0

SHA1
99bff8f4941eb3cee3e0a7cb86b89eda1df07bf9

SHA256
768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693

SHA512
7f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.LastScreen.dll

Filesize
31KB

MD5
3319432d3a694a481f5672fa9eb743d0

SHA1
99bff8f4941eb3cee3e0a7cb86b89eda1df07bf9

SHA256
768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693

SHA512
7f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.LastScreen.dll

Filesize
31KB

MD5
3319432d3a694a481f5672fa9eb743d0

SHA1
99bff8f4941eb3cee3e0a7cb86b89eda1df07bf9

SHA256
768b4eb487e2dc8bcb8ec6221734ca69dce7f522d7640cc2a547f95296509693

SHA512
7f2a1c6c8d9d135b9e00e04f715c9b6b8ba12cb317f7b78ee3efbe3e426a99afce022306eb5bf02fe51c13857d3943b2b009b10b9cc96683e6bcbca1f9045c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.dll

Filesize
6.8MB

MD5
4d65e6eb25db2ce61f4a7a48d9f6082a

SHA1
130abbae19f227b0ef4f278e90398b3b3c7c2eff

SHA256
1e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a

SHA512
b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.dll

Filesize
6.8MB

MD5
4d65e6eb25db2ce61f4a7a48d9f6082a

SHA1
130abbae19f227b0ef4f278e90398b3b3c7c2eff

SHA256
1e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a

SHA512
b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.dll

Filesize
6.8MB

MD5
4d65e6eb25db2ce61f4a7a48d9f6082a

SHA1
130abbae19f227b0ef4f278e90398b3b3c7c2eff

SHA256
1e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a

SHA512
b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.dll

Filesize
6.8MB

MD5
4d65e6eb25db2ce61f4a7a48d9f6082a

SHA1
130abbae19f227b0ef4f278e90398b3b3c7c2eff

SHA256
1e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a

SHA512
b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.dll

Filesize
6.8MB

MD5
4d65e6eb25db2ce61f4a7a48d9f6082a

SHA1
130abbae19f227b0ef4f278e90398b3b3c7c2eff

SHA256
1e2e26d769d69f6b06cad2f2fec81a125e4f3d14aee969357784fb533d80b89a

SHA512
b0842b4fc07dd332c53f56f1337b32064dad7a15663397655b73061bf3d61b44ecdd47ed626b92e69383cfaa41a9c70d4a18ece79fdbab2daf1d06adb1be4bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.exe

Filesize
25KB

MD5
85b0a721491803f8f0208a1856241562

SHA1
90beb8d419b83bd76924826725a14c03b3e6533f

SHA256
18be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345

SHA512
8ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.exe

Filesize
25KB

MD5
85b0a721491803f8f0208a1856241562

SHA1
90beb8d419b83bd76924826725a14c03b3e6533f

SHA256
18be33f7c9f28b0a514f3f40983f452f476470691b1be4f2aba5ba5e06c6a345

SHA512
8ff86e4b4d9cb5e2e88826a822457cb863262e3b73645c0c3309f13fb496997e53005ebe1825c6f92463c6642ec9abc6bbe359b35410b0621649b8d3aaf66c71

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\GenericSetup.exe.config

Filesize
814B

MD5
fd63ee3928edd99afc5bdf17e4f1e7b6

SHA1
1b40433b064215ea6c001332c2ffa093b1177875

SHA256
2a2ddbdc4600e829ad756fd5e84a79c0401fa846ad4f2f2fb235b410e82434a9

SHA512
1925cde90ee84db1e5c15fa774ee5f10fa368948df7643259b03599ad58cfce9d409fd2cd752ff4cbca60b4bbe92b184ff92a0c6e8b78849c4497d38266bd3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\HtmlAgilityPack.dll

Filesize
149KB

MD5
7874850410e21b5f48bfe34174fb318c

SHA1
19522b1b9d932aa89df580c73ef629007ec32b6f

SHA256
c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1

SHA512
dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\HtmlAgilityPack.dll

Filesize
149KB

MD5
7874850410e21b5f48bfe34174fb318c

SHA1
19522b1b9d932aa89df580c73ef629007ec32b6f

SHA256
c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1

SHA512
dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\HtmlAgilityPack.dll

Filesize
149KB

MD5
7874850410e21b5f48bfe34174fb318c

SHA1
19522b1b9d932aa89df580c73ef629007ec32b6f

SHA256
c6250da15c349033de9b910c3dc10a156e47d69ec7e2076ce9011af7f3d885d1

SHA512
dad611ca9779b594aad7898261cc7ef0db500850eb81560c04d5d938ae4e2338e786773f63f59aab6564ad13acb4800f1862a2189803cc8cc8ad26a368f25eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\MyDownloader.Core.dll

Filesize
56KB

MD5
f931e960cc4ed0d2f392376525ff44db

SHA1
1895aaa8f5b8314d8a4c5938d1405775d3837109

SHA256
1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

SHA512
7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\MyDownloader.Core.dll

Filesize
56KB

MD5
f931e960cc4ed0d2f392376525ff44db

SHA1
1895aaa8f5b8314d8a4c5938d1405775d3837109

SHA256
1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

SHA512
7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\MyDownloader.Core.dll

Filesize
56KB

MD5
f931e960cc4ed0d2f392376525ff44db

SHA1
1895aaa8f5b8314d8a4c5938d1405775d3837109

SHA256
1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

SHA512
7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\MyDownloader.Core.dll

Filesize
56KB

MD5
f931e960cc4ed0d2f392376525ff44db

SHA1
1895aaa8f5b8314d8a4c5938d1405775d3837109

SHA256
1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

SHA512
7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\MyDownloader.Core.dll

Filesize
56KB

MD5
f931e960cc4ed0d2f392376525ff44db

SHA1
1895aaa8f5b8314d8a4c5938d1405775d3837109

SHA256
1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

SHA512
7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\MyDownloader.Extension.dll

Filesize
168KB

MD5
28f1996059e79df241388bd9f89cf0b1

SHA1
6ad6f7cde374686a42d9c0fcebadaf00adf21c76

SHA256
c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

SHA512
9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\MyDownloader.Extension.dll

Filesize
168KB

MD5
28f1996059e79df241388bd9f89cf0b1

SHA1
6ad6f7cde374686a42d9c0fcebadaf00adf21c76

SHA256
c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

SHA512
9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\MyDownloader.Extension.dll

Filesize
168KB

MD5
28f1996059e79df241388bd9f89cf0b1

SHA1
6ad6f7cde374686a42d9c0fcebadaf00adf21c76

SHA256
c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

SHA512
9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\MyDownloader.Extension.dll

Filesize
168KB

MD5
28f1996059e79df241388bd9f89cf0b1

SHA1
6ad6f7cde374686a42d9c0fcebadaf00adf21c76

SHA256
c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

SHA512
9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\MyDownloader.Extension.dll

Filesize
168KB

MD5
28f1996059e79df241388bd9f89cf0b1

SHA1
6ad6f7cde374686a42d9c0fcebadaf00adf21c76

SHA256
c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

SHA512
9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\Newtonsoft.Json.dll

Filesize
476KB

MD5
3c4d2f6fd240dc804e10bbb5f16c6182

SHA1
30d66e6a1ead9541133bad2c715c1971ae943196

SHA256
1f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e

SHA512
0657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\Newtonsoft.Json.dll

Filesize
476KB

MD5
3c4d2f6fd240dc804e10bbb5f16c6182

SHA1
30d66e6a1ead9541133bad2c715c1971ae943196

SHA256
1f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e

SHA512
0657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\Newtonsoft.Json.dll

Filesize
476KB

MD5
3c4d2f6fd240dc804e10bbb5f16c6182

SHA1
30d66e6a1ead9541133bad2c715c1971ae943196

SHA256
1f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e

SHA512
0657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\Newtonsoft.Json.dll

Filesize
476KB

MD5
3c4d2f6fd240dc804e10bbb5f16c6182

SHA1
30d66e6a1ead9541133bad2c715c1971ae943196

SHA256
1f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e

SHA512
0657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\Newtonsoft.Json.dll

Filesize
476KB

MD5
3c4d2f6fd240dc804e10bbb5f16c6182

SHA1
30d66e6a1ead9541133bad2c715c1971ae943196

SHA256
1f7a328eb4fa73df5d2996202f5dab02530b0339458137774c72731b9f85ca2e

SHA512
0657f0ab1d7fc9730d4bf6b8c8373f512d57a34063bcfa1f93a803b0afe2a93219da5dc679414dd155956bd696cb7547fc09663f8891eb9b03d9c93b3c1fe95d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\Ninject.dll

Filesize
133KB

MD5
ce80365e2602b7cff0222e0db395428c

SHA1
50c9625eda1d156c9d7a672839e9faaea1dffdbd

SHA256
3475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5

SHA512
5ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\Ninject.dll

Filesize
133KB

MD5
ce80365e2602b7cff0222e0db395428c

SHA1
50c9625eda1d156c9d7a672839e9faaea1dffdbd

SHA256
3475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5

SHA512
5ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\Ninject.dll

Filesize
133KB

MD5
ce80365e2602b7cff0222e0db395428c

SHA1
50c9625eda1d156c9d7a672839e9faaea1dffdbd

SHA256
3475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5

SHA512
5ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\Ninject.dll

Filesize
133KB

MD5
ce80365e2602b7cff0222e0db395428c

SHA1
50c9625eda1d156c9d7a672839e9faaea1dffdbd

SHA256
3475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5

SHA512
5ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\Ninject.dll

Filesize
133KB

MD5
ce80365e2602b7cff0222e0db395428c

SHA1
50c9625eda1d156c9d7a672839e9faaea1dffdbd

SHA256
3475dd6f1612e984573276529d8147029d6bfa55d41bef2577b3aa601d2fbbe5

SHA512
5ea1de091a108143bb74fccdb4f0553f72613e58d8551fff51ce1aab34636c856758719dfa1a0e4cc833acb8e75729793dede65c4562e1aa3f68ec50463d36f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\OfferInstaller.exe

Filesize
27KB

MD5
2537635bcf851b0faaafc2b0c8eab06a

SHA1
1124433a701fb5e30b73c0fe901d78fd475a5460

SHA256
41f443757912fbadaff9d07c9dfc46a0078d20a512fb10e0a6fec454eea62f5b

SHA512
9f4a2c580be3dfc25a4ceb9aebc759fbabd6c218cc0777d9f07980edc30808bd03f3487bf9dd636513b5ad34f8547c762f6a0749de1019c5d0b94ef76b15e68c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\OfferInstaller.exe

Filesize
27KB

MD5
2537635bcf851b0faaafc2b0c8eab06a

SHA1
1124433a701fb5e30b73c0fe901d78fd475a5460

SHA256
41f443757912fbadaff9d07c9dfc46a0078d20a512fb10e0a6fec454eea62f5b

SHA512
9f4a2c580be3dfc25a4ceb9aebc759fbabd6c218cc0777d9f07980edc30808bd03f3487bf9dd636513b5ad34f8547c762f6a0749de1019c5d0b94ef76b15e68c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E3DDAB6\OfferInstaller.exe.config

Filesize
313B

MD5
67ed4edc1d47444b046ad77f68cb2801

SHA1
15d183fc00e868e96e2b5f671bdf5b75678d7474

SHA256
c9dd581b481e198c4e83db6be03bec4bac64c02c6c6f9e3051c23c3df6f1301e

SHA512
f0beef571b8753c7f32a3e7b3716cdf782026268102510b4a6b0631036b8653d2087ab7b7489931c2cb35c1995bcf6eb7530a049d1f89f372282ceb46d402b76

Download Submit
C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1688085739\Resources\OfferPage.html

Filesize
1KB

MD5
5f29b47126c45d119442ad3b896f74eb

SHA1
801a4e5b7d01f81c9c398b4d8d9a5f49e5269eef

SHA256
4e85074502c0267e04b324cdbb46df644e040513e94dd13c6625fb2e039c9a3f

SHA512
81ddcda6399365ad83689b14d22488137b88a80988eeed40ff1678fc387cb098227f520514a3d1a2a213efb4a8f435d87f40647bbe35a273c8d277d2c639c18e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1688085739\Resources\tis\Config.tis

Filesize
291B

MD5
bf5328e51e8ab1211c509b5a65ab9972

SHA1
480dfb920e926d81bce67113576781815fbd1ea4

SHA256
98f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b

SHA512
92bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928

Download Submit
C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1688085739\app.ico

Filesize
766B

MD5
4003efa6e7d44e2cbd3d7486e2e0451a

SHA1
a2a9ab4a88cd4732647faa37bbdf726fd885ea1e

SHA256
effd42c5e471ea3792f12538bf7c982a5cda4d25bfbffaf51eed7e09035f4508

SHA512
86e71ca8ca3e62949b44cfbc7ffa61d97b6d709fc38216f937a026fb668fbb1f515bac2f25629181a82e3521dafa576cac959d2b527d9cc9eb395e50d64c1198

Download Submit
C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1688085739\sciter32.dll

Filesize
5.6MB

MD5
b431083586e39d018e19880ad1a5ce8f

SHA1
3bbf957ab534d845d485a8698accc0a40b63cedd

SHA256
b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b

SHA512
7805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2306300042558354448.dll

Filesize
4.5MB

MD5
4b146aa3131b906c67f7a39b78e5badd

SHA1
dd1e64405e49bace92fcd2949a161122f2b09d9a

SHA256
c239d7b43d454f53e0e9a936514d25b08bdad8aa272a77a31312516ab141adad

SHA512
69167aa92c4b5c0703b899ba74dd0a8d24cb03ddb17f61b08fe6a543eb11af1d05d50d2258f09fc622c7b76324bf63b5ff1b6c46a5241d211ce4e03f9d0fed60

Download Submit
C:\Users\Admin\AppData\Local\setup94306.exe

Filesize
3.1MB

MD5
369acf60d8b5ed6168c74955ee04654f

SHA1
1753fff63efa6ed5ad30ede6b959261ac67dd13e

SHA256
3ff8ec8f9f27a27f414a90bfed5b7f5a3c118b33cf0f80aeb7026e0a53e26632

SHA512
2582b3b4525321fece978710403e4bd4dd6e9f0869de1fec784e4e79ac98e8c6498a601c9db45d5af4f1b99e3a2cc07b9e3ec18144e18ce82b41eb64ce4eb643

Download Submit
C:\Users\Admin\AppData\Local\setup94306.exe

Filesize
3.1MB

MD5
369acf60d8b5ed6168c74955ee04654f

SHA1
1753fff63efa6ed5ad30ede6b959261ac67dd13e

SHA256
3ff8ec8f9f27a27f414a90bfed5b7f5a3c118b33cf0f80aeb7026e0a53e26632

SHA512
2582b3b4525321fece978710403e4bd4dd6e9f0869de1fec784e4e79ac98e8c6498a601c9db45d5af4f1b99e3a2cc07b9e3ec18144e18ce82b41eb64ce4eb643

Download Submit
C:\Users\Admin\AppData\Local\setup94306.exe

Filesize
3.1MB

MD5
369acf60d8b5ed6168c74955ee04654f

SHA1
1753fff63efa6ed5ad30ede6b959261ac67dd13e

SHA256
3ff8ec8f9f27a27f414a90bfed5b7f5a3c118b33cf0f80aeb7026e0a53e26632

SHA512
2582b3b4525321fece978710403e4bd4dd6e9f0869de1fec784e4e79ac98e8c6498a601c9db45d5af4f1b99e3a2cc07b9e3ec18144e18ce82b41eb64ce4eb643

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs-1.js

Filesize
6KB

MD5
b1266e521d12a0848efdb713f9363183

SHA1
7ecfd9b967bfd681ff85246009792be24734a434

SHA256
9aaed8f2b0713a8a5340e4d0cc0df67a663840891125cf5618bd41a163277815

SHA512
5e0cdd8a5efe862f3e94a460ca964b9ff24039c7901ef87827b1760afe155b143a95d290a425d4f976bd0a21acc30d8d65ad8e653bb2e5ffd03bfe80ddb7749b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs-1.js

Filesize
7KB

MD5
4001620ac79f3713f8f973ec54407535

SHA1
cc0f5677f2e93586685f73d53271b5e729035fc5

SHA256
f3e79647e15f850786d987a502ffd00be6006adf445f27c384a1c757a73d4e58

SHA512
0a5a97e4aed01939a3adb1757e01033005d7eebd7f8706a70152462455e79c404f36060abff5fa2d40dc5b8218bb89cfbc2271ce191a0b8df9ddfd6ea2aaf53c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\prefs.js

Filesize
6KB

MD5
952e3584a0cd691d8ab722228c936308

SHA1
0f501ff21467696707935b019744e91607f87145

SHA256
f8f16cc1d094c035573506c533f7832c11fb83930ab1838c4200efab50a66d6f

SHA512
f289ca21fbdd68219755cbf504ff220267f4bb025c6ce03db5fc8dd5f87ec72bf6d0b5fa5faaf66a443db0f13daa3fdc5e98d43fc905468c4c80fa13bfb8ffd0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0b3n2faz.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
37491037258e77d6a6dd7abeb6d50525

SHA1
7cb41c588bedb8353c2c9010a276e04a873e8da5

SHA256
fcc357018a18b8850dfbd68116272a0f01d3bbd7f1da972b4e865c43068cfb40

SHA512
4efd6452852589d2311d7857176101bd80a9b62223995b8e4591aac6162854e5c6c1570672893b726fa4e62aa340fadea74c75a6500d496b6dd5193b888dc104

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
9b218c58d564c0f43723a20837f13acc

SHA1
cf446e4d53a73e41cd1f7ae5fafae3acd4788bd4

SHA256
e1f1724ad9727396c49a8f7ffd200b963b90e34a0844ca5f74fcc913eead1061

SHA512
ea49cd8ee89d338eccf976072300f71640d4527cc78a5d44b432034b78b75f2f053d57861ad4c4a816313931b7542138dabad60f939ed4b0410b93e514ef7c98

Download Submit
C:\Users\Admin\Downloads\Vega X.HdHWj0ri.zip.part

Filesize
11.5MB

MD5
26bbb64a0908228f994647ba66767da2

SHA1
4a0c4066ecf61ffe66d4bb3a1f4dd7383d299f2d

SHA256
48f18cb65416d26b2a747efdda6819a7e29d75e34267f3d42aa54b9950f4e8b6

SHA512
33a153b5892a653119f67e058fe99f4cdd9d57468e576482e6afcdb6a3a9fa57d657a95c64ee9d0453e764eb8308decf8ded56ae4f34b8c884cd815437864b1a

Download Submit
memory/2136-480-0x0000000000BD0000-0x00000000010FB000-memory.dmp

Filesize
5.2MB

Download
memory/3536-200-0x0000000004EA0000-0x0000000004EC8000-memory.dmp

Filesize
160KB

Download
memory/3536-206-0x0000000004F70000-0x0000000004F9C000-memory.dmp

Filesize
176KB

Download
memory/3536-232-0x00000000066F0000-0x000000000676C000-memory.dmp

Filesize
496KB

Download
memory/3536-215-0x00000000051F0000-0x0000000005256000-memory.dmp

Filesize
408KB

Download
memory/3536-192-0x0000000004A80000-0x0000000004A8C000-memory.dmp

Filesize
48KB

Download
memory/3536-219-0x00000000054E0000-0x00000000054F2000-memory.dmp

Filesize
72KB

Download
memory/3536-257-0x0000000005D60000-0x0000000005D8E000-memory.dmp

Filesize
184KB

Download
memory/3536-207-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/3536-247-0x0000000007050000-0x00000000070E2000-memory.dmp

Filesize
584KB

Download
memory/3536-188-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/3536-355-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/3536-196-0x0000000005550000-0x0000000005C2A000-memory.dmp

Filesize
6.9MB

Download
memory/3536-234-0x0000000007320000-0x00000000078C4000-memory.dmp

Filesize
5.6MB

Download
memory/3660-375-0x0000000005070000-0x0000000005080000-memory.dmp

Filesize
64KB

Download
memory/3660-379-0x00000000011A0000-0x00000000011AA000-memory.dmp

Filesize
40KB

Download
memory/3660-368-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download
memory/3660-414-0x0000000005070000-0x0000000005080000-memory.dmp

Filesize
64KB

Download
memory/3660-412-0x00000000070A0000-0x00000000070AA000-memory.dmp

Filesize
40KB

Download
memory/3748-752-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-755-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-776-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3748-767-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3748-768-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/3748-762-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-763-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3748-761-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-758-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-760-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-759-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-757-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-756-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-771-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3748-754-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-753-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-746-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3748-750-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-745-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-751-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3748-749-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3748-748-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3748-747-0x0000000003010000-0x0000000003020000-memory.dmp

Filesize
64KB

Download
memory/3748-779-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-778-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3748-743-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/3748-744-0x0000000003000000-0x0000000003010000-memory.dmp

Filesize
64KB

Download
memory/3928-484-0x0000000000BD0000-0x00000000010FB000-memory.dmp

Filesize
5.2MB

Download
memory/4448-445-0x0000000000A00000-0x0000000000F2B000-memory.dmp

Filesize
5.2MB

Download
memory/4804-446-0x0000000000BD0000-0x00000000010FB000-memory.dmp

Filesize
5.2MB

Download
memory/5044-444-0x0000000000BD0000-0x00000000010FB000-memory.dmp

Filesize
5.2MB

Download
memory/5424-632-0x0000000005DD0000-0x0000000005DF2000-memory.dmp

Filesize
136KB

Download
memory/5424-629-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/5424-643-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/5424-637-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/5424-636-0x0000000005F10000-0x0000000005F2E000-memory.dmp

Filesize
120KB

Download
memory/5424-635-0x0000000067950000-0x00000000682D8000-memory.dmp

Filesize
9.5MB

Download
memory/5424-634-0x0000000006840000-0x0000000006841000-memory.dmp

Filesize
4KB

Download
memory/5424-633-0x00000000069D0000-0x0000000006B56000-memory.dmp

Filesize
1.5MB

Download
memory/5424-655-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/5424-631-0x0000000005D50000-0x0000000005DC6000-memory.dmp

Filesize
472KB

Download
memory/5424-630-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/5424-652-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/5424-628-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/5424-624-0x000000000A2B0000-0x000000000A2BE000-memory.dmp

Filesize
56KB

Download
memory/5424-623-0x000000000A2F0000-0x000000000A328000-memory.dmp

Filesize
224KB

Download
memory/5424-622-0x000000000A2A0000-0x000000000A2A8000-memory.dmp

Filesize
32KB

Download
memory/5424-596-0x0000000008F50000-0x000000000900A000-memory.dmp

Filesize
744KB

Download
memory/5424-583-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/5424-572-0x0000000000AB0000-0x00000000011E8000-memory.dmp

Filesize
7.2MB

Download
memory/5424-653-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/5424-654-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download