058adb3c51411c048b89491fed3a09d7ccbdbe3c2d52bc82fe3cbcce5bcfa1ac

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SirixStation-enjoypumarkets1.9.49688.0_JC.msi
Size

13.4MB
MD5

75640d92963192670524067d9fb1b560
SHA1

699e708155a657e177d031701424fc26d8b2d8e9
SHA256

058adb3c51411c048b89491fed3a09d7ccbdbe3c2d52bc82fe3cbcce5bcfa1ac
SHA512

c4f4164577fcb46eb7def6231a1b0ac217ec67bf5df56707ccfe90831b275693341c27706f8c43786eb4bd6e37560a7a7fd24b19427feb2465b86144acf5c6e0
SSDEEP

393216:lpkokD0t6CmGeTrSJPk1HulyI1CMoCQqvV:lpuAPaSJPkJulyI15nQqvV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

SIRIX Station by enjoypumarkets.exe

pid process

1344 SIRIX Station by enjoypumarkets.exe

Loads dropped DLL 26 IoCs

Processes:

SIRIX Station by enjoypumarkets.exe

pid	process
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

3 2172 msiexec.exe
5 2172 msiexec.exe
7 2172 msiexec.exe

flow	pid	process
3	2172	msiexec.exe
5	2172	msiexec.exe
7	2172	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 25 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\SIRIX Station By enjoypumarkets.exe	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\de\FluentValidation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\DevExpress.Xpf.Themes.DesktopTraderTheme.v13.2.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\DevExpress.Xpf.Themes.DesktopTraderLight.v13.2.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.TechnicalServices.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\es\Leverate.DesktopTrader.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\he\Leverate.DesktopTrader.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.Trading.PlatrofmServer.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\it\FluentValidation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\fr\Leverate.DesktopTrader.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.Gui.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\fr\FluentValidation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\es\FluentValidation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\ru\Leverate.DesktopTrader.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.TechIndicators.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\tr\FluentValidation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\pl\FluentValidation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\ar\Leverate.DesktopTrader.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\ru\FluentValidation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\zh-Hans\Leverate.DesktopTrader.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\nl\FluentValidation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\pt\FluentValidation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\tr\Leverate.DesktopTrader.Core.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\sv\FluentValidation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\SIRIX Station By enjoypumarkets\zh\Leverate.DesktopTrader.Core.resources.dll	msiexec.exe

Drops file in Windows directory 12 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f76d7b9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB34.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AB89B7FF-6B0F-4A7C-9EB5-EB64076A6327}\SirixStationExeIcon	msiexec.exe
File created	C:\Windows\Installer\{AB89B7FF-6B0F-4A7C-9EB5-EB64076A6327}\SirixStationExeIcon	msiexec.exe
File created	C:\Windows\Installer\f76d7bc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76d7ba.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f76d7b9.msi	msiexec.exe
File created	C:\Windows\Installer\f76d7ba.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\ProductName = "SIRIX Station By enjoypumarkets"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A83596CFBB3E70F4282FC6FC9948918F\FF7B98BAF0B6C7A4E95BBE4670A63672	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FF7B98BAF0B6C7A4E95BBE4670A63672	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\Version = "17416692"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FF7B98BAF0B6C7A4E95BBE4670A63672\F_FullApplication	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\PackageCode = "121F036D5343DB941BC8F211F4FC8B5E"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A83596CFBB3E70F4282FC6FC9948918F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\SourceList\PackageName = "SirixStation-enjoypumarkets1.9.49688.0_JC.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\ProductIcon = "C:\\Windows\\Installer\\{AB89B7FF-6B0F-4A7C-9EB5-EB64076A6327}\\SirixStationExeIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF7B98BAF0B6C7A4E95BBE4670A63672\AuthorizedLUAApp = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

msiexec.exeSIRIX Station by enjoypumarkets.exe

pid process

2304 msiexec.exe
2304 msiexec.exe
1344 SIRIX Station by enjoypumarkets.exe

pid	process
2304	msiexec.exe
2304	msiexec.exe
1344	SIRIX Station by enjoypumarkets.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2172	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeSecurityPrivilege	2304	msiexec.exe
Token: SeCreateTokenPrivilege	2172	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2172	msiexec.exe
Token: SeLockMemoryPrivilege	2172	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2172	msiexec.exe
Token: SeMachineAccountPrivilege	2172	msiexec.exe
Token: SeTcbPrivilege	2172	msiexec.exe
Token: SeSecurityPrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeLoadDriverPrivilege	2172	msiexec.exe
Token: SeSystemProfilePrivilege	2172	msiexec.exe
Token: SeSystemtimePrivilege	2172	msiexec.exe
Token: SeProfSingleProcessPrivilege	2172	msiexec.exe
Token: SeIncBasePriorityPrivilege	2172	msiexec.exe
Token: SeCreatePagefilePrivilege	2172	msiexec.exe
Token: SeCreatePermanentPrivilege	2172	msiexec.exe
Token: SeBackupPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeShutdownPrivilege	2172	msiexec.exe
Token: SeDebugPrivilege	2172	msiexec.exe
Token: SeAuditPrivilege	2172	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2172	msiexec.exe
Token: SeChangeNotifyPrivilege	2172	msiexec.exe
Token: SeRemoteShutdownPrivilege	2172	msiexec.exe
Token: SeUndockPrivilege	2172	msiexec.exe
Token: SeSyncAgentPrivilege	2172	msiexec.exe
Token: SeEnableDelegationPrivilege	2172	msiexec.exe
Token: SeManageVolumePrivilege	2172	msiexec.exe
Token: SeImpersonatePrivilege	2172	msiexec.exe
Token: SeCreateGlobalPrivilege	2172	msiexec.exe
Token: SeBackupPrivilege	2440	vssvc.exe
Token: SeRestorePrivilege	2440	vssvc.exe
Token: SeAuditPrivilege	2440	vssvc.exe
Token: SeBackupPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2448	DrvInst.exe
Token: SeRestorePrivilege	2448	DrvInst.exe
Token: SeRestorePrivilege	2448	DrvInst.exe
Token: SeRestorePrivilege	2448	DrvInst.exe
Token: SeRestorePrivilege	2448	DrvInst.exe
Token: SeRestorePrivilege	2448	DrvInst.exe
Token: SeRestorePrivilege	2448	DrvInst.exe
Token: SeLoadDriverPrivilege	2448	DrvInst.exe
Token: SeLoadDriverPrivilege	2448	DrvInst.exe
Token: SeLoadDriverPrivilege	2448	DrvInst.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

msiexec.exeSIRIX Station by enjoypumarkets.exe

pid	process
2172	msiexec.exe
2172	msiexec.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

SIRIX Station by enjoypumarkets.exe

pid	process
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe
1344	SIRIX Station by enjoypumarkets.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 2304 wrote to memory of 1344	2304	msiexec.exe	SIRIX Station by enjoypumarkets.exe
PID 2304 wrote to memory of 1344	2304	msiexec.exe	SIRIX Station by enjoypumarkets.exe
PID 2304 wrote to memory of 1344	2304	msiexec.exe	SIRIX Station by enjoypumarkets.exe
PID 2304 wrote to memory of 1344	2304	msiexec.exe	SIRIX Station by enjoypumarkets.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SirixStation-enjoypumarkets1.9.49688.0_JC.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2172

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304

C:\Program Files (x86)\SIRIX Station By enjoypumarkets\SIRIX Station by enjoypumarkets.exe
"C:\Program Files (x86)\SIRIX Station By enjoypumarkets\SIRIX Station by enjoypumarkets.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1344

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005BC" "00000000000005C8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76d7bb.rbs

Filesize
14KB

MD5
b931130a0b5966eea3e4e9f925e4ffef

SHA1
c04a58d586294900eb82e1533d2bca23eb2df2de

SHA256
e513fa335f745400de972e789d803637f5ab19edd885bb9d17e99de88eac9bdb

SHA512
a5aafa53b8cf878d173937ef8453f273f249eab39bb4d0a2b2301ddbff2ea802dc08297ab099ca877a1077656f62b5c68eda549d534a34d16bf06eed69120bb4

Download Submit
C:\Program Files (x86)\SIRIX Station By enjoypumarkets\DevExpress.Xpf.Themes.DesktopTraderTheme.v13.2.dll

Filesize
2.6MB

MD5
51ec2eafc9f435cd77eb5894db27c104

SHA1
fda35bbaa220a0740ddbc2739b86be74f8540255

SHA256
3c0baca2fe4c3315410a37434f532d76cc0498e2ce12033e411a0cb7bb443919

SHA512
2b2533ca9a151415682dc407f6757c30eef102f4760ed0138264316b9a3a50c88699f63a950b4687e49865ecfd93de85cc841bbfa3cca34f5adc3bcc868626ea

Download Submit
C:\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.Gui.dll

Filesize
3.0MB

MD5
39e7ba45e5e079d555827fc98c9dbf22

SHA1
0c68062baeaab291d026757187b5d23165c9b6b3

SHA256
7d3e329b81877accc091ee073f597151fdb7eef28843832cd0965c631f72041f

SHA512
3c9e97e39253cf33d17bc56dc161f4881665dd1ac220731dcf71acb8389242b2c7c23db23c899ecb4d9feb46537d75b81703b969d83c9edd258a0f10b584e1a5

Download Submit
C:\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.TechIndicators.dll

Filesize
26KB

MD5
c48c550a8aa74f8c26fb2e3ac9d88cc2

SHA1
beaf98fd7212a76e91a4c34ff83db0b546e065b3

SHA256
fc15514079ba6fba57b826914ee9e820b1bd0ae82e026c124fe5d6b1537b6ba7

SHA512
b05b9498a46dbb48b9351c9f82514982672a2163f0a735a0e2839cc27e13ac358b98042f63b5489172ce74959ea672b2ed98bf7e74d45f04df4ea1f23256dfca

Download Submit
C:\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.TechnicalServices.dll

Filesize
277KB

MD5
ffa76f01731ba162a660fc20d546e0a9

SHA1
e0647d6176ee2419cc3d469d17d02653dd041a96

SHA256
8003a074ab76178ad9fba50950eb0d811ded5cb5f73e7402ea8b43951545d2d7

SHA512
95c004a0e710979ef2693cbeb5334686ac7de91b65b92cb7a375b4ece400da9b75c3ce39e90961b280884f3dc50ae10b5a3b15cb87517586fac566bfc0360a1a

Download Submit
C:\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.Trading.PlatrofmServer.Common.dll

Filesize
87KB

MD5
3790ea60557aefadcc7e36dd9a1820a8

SHA1
bfe2b1d0ed7c72ed4b6a2b53bbffbbe391bb929a

SHA256
e4ca3379bcf5a61f10268a87e8a3643c07966f55a7513eda082d7cedc0fae38c

SHA512
6183fb7a1af447f8837579751943493a8593a2955389bc1711a338edb4b804d4e2b3b85876b1a4e325f3c8ad4780ab31ba4fdb57824c8e0ea8788561b9a01eb2

Download Submit
C:\Program Files (x86)\SIRIX Station By enjoypumarkets\SIRIX Station By enjoypumarkets.exe

Filesize
10.8MB

MD5
d135dd1893a503ddace4b0bbbd1a990a

SHA1
f49b102b81742d18c13686df6b3c3c4367556f68

SHA256
5c609156433729a517d8416a8bf325a3706bbeebd9c211ef91644412c1b926d1

SHA512
9b5eaf711a97a7c812d2defa9031809248f4498770a57413b22881d3bdc17902c67ba2ef31a31e112552ce86a715339ea4375864c65732754436607fcb364810

Download Submit
C:\Program Files (x86)\SIRIX Station By enjoypumarkets\SIRIX Station By enjoypumarkets.exe

Filesize
10.8MB

MD5
d135dd1893a503ddace4b0bbbd1a990a

SHA1
f49b102b81742d18c13686df6b3c3c4367556f68

SHA256
5c609156433729a517d8416a8bf325a3706bbeebd9c211ef91644412c1b926d1

SHA512
9b5eaf711a97a7c812d2defa9031809248f4498770a57413b22881d3bdc17902c67ba2ef31a31e112552ce86a715339ea4375864c65732754436607fcb364810

Download Submit
C:\Program Files (x86)\SIRIX Station By enjoypumarkets\SIRIX Station by enjoypumarkets.exe

Filesize
10.8MB

MD5
d135dd1893a503ddace4b0bbbd1a990a

SHA1
f49b102b81742d18c13686df6b3c3c4367556f68

SHA256
5c609156433729a517d8416a8bf325a3706bbeebd9c211ef91644412c1b926d1

SHA512
9b5eaf711a97a7c812d2defa9031809248f4498770a57413b22881d3bdc17902c67ba2ef31a31e112552ce86a715339ea4375864c65732754436607fcb364810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
765B

MD5
fd23736f1ad84053bc8e70d26fa10c58

SHA1
2f7fbd1fd8f4e793048b452e824ba01547677d8b

SHA256
31e506ecbff411eba9ce3eb262568587450ee129fd7c7911e6e77a2bd59c2ec0

SHA512
1e8a4f6835fecd05fb42eca435cf21eac8f81df99953f236bb74a708bc077f25689286c950baa7c32912d7f8b84061dfa200a64167174662ccdb1dfe14dda564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_EE51B9471E2B50108A915B77B94DC0B7

Filesize
637B

MD5
0a9cbb0bb1a734f023ffcad08a81e043

SHA1
0ec04dac43c27fbb704b01eb7777ddaa514c9d64

SHA256
7ca8df20eb65e6248d56fb5f377aaded6c4b6d78259b0f6153ed50bf6cd9c783

SHA512
139f8cea5a49d19ace574c86e233550cf0c94f2c566d3767e1bd4bb3efd43a29ca2783c889d9b9acf4ecfb4efd5d4dd60466553076b45753d9277fd423e8d10d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
fd2cdf2dd8eca4ee331e90045a044fe2

SHA1
158f7fdce37e7c7c85b6d58a53db4f5ceafc5c75

SHA256
8986eb81e93a6c6ece0d7f4423f5aed2e991dab60c707978231d35a9d5686480

SHA512
5a75efe876c8a6c0c95eec5928314578206088365bda36310e9e2602cc03e8e0cfb4d9bfec9b2caa7e8705703d0070f4024cca2c6091826f8f18bd0e08aee44b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Filesize
484B

MD5
c3d7a2f095b5d7647c4b4d24931d3d96

SHA1
22d6ec6e73db2c437966c1437cd9714555175b5f

SHA256
95b1c060ea012d6ff06d3b3cb23e0647e702660c6b0e500d4efb24fbbe73b798

SHA512
4e9dfb033a8b1e7a31daea46776578e65aae16c1081bae52e01c3091c171e7742323d267ad38ac949933c1798e7036940a5a7e45e00479764198eecd42ad0637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_EE51B9471E2B50108A915B77B94DC0B7

Filesize
484B

MD5
a45fe7950704e258b3ac041d8d9a1723

SHA1
36baefaa162fd0c958dfeab3d7c347f97e1f6c7b

SHA256
b7dcc17f6c206a9ef0f023e35afc06fefc26592686b20fdcb8f6af24dd45f2a7

SHA512
9eb62b408887fc1b345d0403f97aec8fbe4c5e2537e323dd82742d020423e03ce4f92506e59dafcde63a607cf6e3d83262abea2966c5d039addf386cb8dd6acc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35f56d7abd4a645edaa2fdd487994b2c

SHA1
1904dfba7c85bc28c34711cfbee4c7e3a4042364

SHA256
572fd8095ad7cf7b7a25a7e02ceba727e9d95c45882114aa73affba6a72bae61

SHA512
b9adc2765973dcb3298ff75f17720bebe6fbf80b259b51d63a9d47e57d3ed2e3d4e60b1a39e7b9592f728f552cb74ccd0e59bb130da6f7bdc1518611eb140594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
745c42043f9750de27da78b954138f6a

SHA1
e12f88aeef84b854d04aa1b1f6f6cfc3eab52a4c

SHA256
5e1f9eb51956e0d261ee72c5ffaabd35f3f909c02dd1d1e4d308871bd7031979

SHA512
d69cc9fb84cb9aef335d3598df9c3142c9d2b5e683707851913df376ee56f20f8d6edec695aa7cdfe9f4b285cd9764b06e769f9e20b6cb15631a93d3c104cb6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C5E.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4C80.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\863354e234682a73c76a9b0fb4235333.dll

Filesize
194KB

MD5
67035229191d3bbbb33ff3fe2c5dd54b

SHA1
9ee1ad86c376769af3e48fd05c23af97578a5d6d

SHA256
3a65181e0c2e7eaf2c87504e6005fb34311e630b5d7a3130992bf4e981be3a86

SHA512
ac0a90581a3e3a87e41812eac925e22ce7eb77d2eb157eeb4ef025ad7e519dd3e678dd650a0cf21e11be4d0a211f04477ca581739ac159ca4e162ae5141a2d68

Download Submit
C:\Windows\Installer\f76d7b9.msi

Filesize
13.4MB

MD5
75640d92963192670524067d9fb1b560

SHA1
699e708155a657e177d031701424fc26d8b2d8e9

SHA256
058adb3c51411c048b89491fed3a09d7ccbdbe3c2d52bc82fe3cbcce5bcfa1ac

SHA512
c4f4164577fcb46eb7def6231a1b0ac217ec67bf5df56707ccfe90831b275693341c27706f8c43786eb4bd6e37560a7a7fd24b19427feb2465b86144acf5c6e0

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\DevExpress.Xpf.Themes.DesktopTraderTheme.v13.2.dll

Filesize
2.6MB

MD5
51ec2eafc9f435cd77eb5894db27c104

SHA1
fda35bbaa220a0740ddbc2739b86be74f8540255

SHA256
3c0baca2fe4c3315410a37434f532d76cc0498e2ce12033e411a0cb7bb443919

SHA512
2b2533ca9a151415682dc407f6757c30eef102f4760ed0138264316b9a3a50c88699f63a950b4687e49865ecfd93de85cc841bbfa3cca34f5adc3bcc868626ea

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\DevExpress.Xpf.Themes.DesktopTraderTheme.v13.2.dll

Filesize
2.6MB

MD5
51ec2eafc9f435cd77eb5894db27c104

SHA1
fda35bbaa220a0740ddbc2739b86be74f8540255

SHA256
3c0baca2fe4c3315410a37434f532d76cc0498e2ce12033e411a0cb7bb443919

SHA512
2b2533ca9a151415682dc407f6757c30eef102f4760ed0138264316b9a3a50c88699f63a950b4687e49865ecfd93de85cc841bbfa3cca34f5adc3bcc868626ea

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\DevExpress.Xpf.Themes.DesktopTraderTheme.v13.2.dll

Filesize
2.6MB

MD5
51ec2eafc9f435cd77eb5894db27c104

SHA1
fda35bbaa220a0740ddbc2739b86be74f8540255

SHA256
3c0baca2fe4c3315410a37434f532d76cc0498e2ce12033e411a0cb7bb443919

SHA512
2b2533ca9a151415682dc407f6757c30eef102f4760ed0138264316b9a3a50c88699f63a950b4687e49865ecfd93de85cc841bbfa3cca34f5adc3bcc868626ea

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\DevExpress.Xpf.Themes.DesktopTraderTheme.v13.2.dll

Filesize
2.6MB

MD5
51ec2eafc9f435cd77eb5894db27c104

SHA1
fda35bbaa220a0740ddbc2739b86be74f8540255

SHA256
3c0baca2fe4c3315410a37434f532d76cc0498e2ce12033e411a0cb7bb443919

SHA512
2b2533ca9a151415682dc407f6757c30eef102f4760ed0138264316b9a3a50c88699f63a950b4687e49865ecfd93de85cc841bbfa3cca34f5adc3bcc868626ea

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.Gui.dll

Filesize
3.0MB

MD5
39e7ba45e5e079d555827fc98c9dbf22

SHA1
0c68062baeaab291d026757187b5d23165c9b6b3

SHA256
7d3e329b81877accc091ee073f597151fdb7eef28843832cd0965c631f72041f

SHA512
3c9e97e39253cf33d17bc56dc161f4881665dd1ac220731dcf71acb8389242b2c7c23db23c899ecb4d9feb46537d75b81703b969d83c9edd258a0f10b584e1a5

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.Gui.dll

Filesize
3.0MB

MD5
39e7ba45e5e079d555827fc98c9dbf22

SHA1
0c68062baeaab291d026757187b5d23165c9b6b3

SHA256
7d3e329b81877accc091ee073f597151fdb7eef28843832cd0965c631f72041f

SHA512
3c9e97e39253cf33d17bc56dc161f4881665dd1ac220731dcf71acb8389242b2c7c23db23c899ecb4d9feb46537d75b81703b969d83c9edd258a0f10b584e1a5

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.TechIndicators.dll

Filesize
26KB

MD5
c48c550a8aa74f8c26fb2e3ac9d88cc2

SHA1
beaf98fd7212a76e91a4c34ff83db0b546e065b3

SHA256
fc15514079ba6fba57b826914ee9e820b1bd0ae82e026c124fe5d6b1537b6ba7

SHA512
b05b9498a46dbb48b9351c9f82514982672a2163f0a735a0e2839cc27e13ac358b98042f63b5489172ce74959ea672b2ed98bf7e74d45f04df4ea1f23256dfca

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.TechIndicators.dll

Filesize
26KB

MD5
c48c550a8aa74f8c26fb2e3ac9d88cc2

SHA1
beaf98fd7212a76e91a4c34ff83db0b546e065b3

SHA256
fc15514079ba6fba57b826914ee9e820b1bd0ae82e026c124fe5d6b1537b6ba7

SHA512
b05b9498a46dbb48b9351c9f82514982672a2163f0a735a0e2839cc27e13ac358b98042f63b5489172ce74959ea672b2ed98bf7e74d45f04df4ea1f23256dfca

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.TechnicalServices.dll

Filesize
277KB

MD5
ffa76f01731ba162a660fc20d546e0a9

SHA1
e0647d6176ee2419cc3d469d17d02653dd041a96

SHA256
8003a074ab76178ad9fba50950eb0d811ded5cb5f73e7402ea8b43951545d2d7

SHA512
95c004a0e710979ef2693cbeb5334686ac7de91b65b92cb7a375b4ece400da9b75c3ce39e90961b280884f3dc50ae10b5a3b15cb87517586fac566bfc0360a1a

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.DesktopTrader.TechnicalServices.dll

Filesize
277KB

MD5
ffa76f01731ba162a660fc20d546e0a9

SHA1
e0647d6176ee2419cc3d469d17d02653dd041a96

SHA256
8003a074ab76178ad9fba50950eb0d811ded5cb5f73e7402ea8b43951545d2d7

SHA512
95c004a0e710979ef2693cbeb5334686ac7de91b65b92cb7a375b4ece400da9b75c3ce39e90961b280884f3dc50ae10b5a3b15cb87517586fac566bfc0360a1a

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.Trading.PlatrofmServer.Common.dll

Filesize
87KB

MD5
3790ea60557aefadcc7e36dd9a1820a8

SHA1
bfe2b1d0ed7c72ed4b6a2b53bbffbbe391bb929a

SHA256
e4ca3379bcf5a61f10268a87e8a3643c07966f55a7513eda082d7cedc0fae38c

SHA512
6183fb7a1af447f8837579751943493a8593a2955389bc1711a338edb4b804d4e2b3b85876b1a4e325f3c8ad4780ab31ba4fdb57824c8e0ea8788561b9a01eb2

Download Submit
\Program Files (x86)\SIRIX Station By enjoypumarkets\Leverate.Trading.PlatrofmServer.Common.dll

Filesize
87KB

MD5
3790ea60557aefadcc7e36dd9a1820a8

SHA1
bfe2b1d0ed7c72ed4b6a2b53bbffbbe391bb929a

SHA256
e4ca3379bcf5a61f10268a87e8a3643c07966f55a7513eda082d7cedc0fae38c

SHA512
6183fb7a1af447f8837579751943493a8593a2955389bc1711a338edb4b804d4e2b3b85876b1a4e325f3c8ad4780ab31ba4fdb57824c8e0ea8788561b9a01eb2

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\248330ff1f7dcfd26a41e0b3044452e9.dll

Filesize
45KB

MD5
6f67f021eda1a2ed6846242188db5095

SHA1
be1eee6125da7c9d5da8c74399284e939b195544

SHA256
92074bd461915449a87f878c0325f4bfe7b797a5bb12d7c4a491e00e58a19151

SHA512
c237b89c5408fcfed1a9657480f653fcbfe7676c2aebaa6c713d243241624aecf08cd3f0c19601ac67fe52bc62d0c121a2a0a0f5d304a7f9def7255ef481b588

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\248330ff1f7dcfd26a41e0b3044452e9.dll

Filesize
45KB

MD5
6f67f021eda1a2ed6846242188db5095

SHA1
be1eee6125da7c9d5da8c74399284e939b195544

SHA256
92074bd461915449a87f878c0325f4bfe7b797a5bb12d7c4a491e00e58a19151

SHA512
c237b89c5408fcfed1a9657480f653fcbfe7676c2aebaa6c713d243241624aecf08cd3f0c19601ac67fe52bc62d0c121a2a0a0f5d304a7f9def7255ef481b588

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\863354e234682a73c76a9b0fb4235333.dll

Filesize
194KB

MD5
67035229191d3bbbb33ff3fe2c5dd54b

SHA1
9ee1ad86c376769af3e48fd05c23af97578a5d6d

SHA256
3a65181e0c2e7eaf2c87504e6005fb34311e630b5d7a3130992bf4e981be3a86

SHA512
ac0a90581a3e3a87e41812eac925e22ce7eb77d2eb157eeb4ef025ad7e519dd3e678dd650a0cf21e11be4d0a211f04477ca581739ac159ca4e162ae5141a2d68

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\863354e234682a73c76a9b0fb4235333.dll

Filesize
194KB

MD5
67035229191d3bbbb33ff3fe2c5dd54b

SHA1
9ee1ad86c376769af3e48fd05c23af97578a5d6d

SHA256
3a65181e0c2e7eaf2c87504e6005fb34311e630b5d7a3130992bf4e981be3a86

SHA512
ac0a90581a3e3a87e41812eac925e22ce7eb77d2eb157eeb4ef025ad7e519dd3e678dd650a0cf21e11be4d0a211f04477ca581739ac159ca4e162ae5141a2d68

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\863354e234682a73c76a9b0fb4235333.dll

Filesize
194KB

MD5
67035229191d3bbbb33ff3fe2c5dd54b

SHA1
9ee1ad86c376769af3e48fd05c23af97578a5d6d

SHA256
3a65181e0c2e7eaf2c87504e6005fb34311e630b5d7a3130992bf4e981be3a86

SHA512
ac0a90581a3e3a87e41812eac925e22ce7eb77d2eb157eeb4ef025ad7e519dd3e678dd650a0cf21e11be4d0a211f04477ca581739ac159ca4e162ae5141a2d68

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\863354e234682a73c76a9b0fb4235333.dll

Filesize
194KB

MD5
67035229191d3bbbb33ff3fe2c5dd54b

SHA1
9ee1ad86c376769af3e48fd05c23af97578a5d6d

SHA256
3a65181e0c2e7eaf2c87504e6005fb34311e630b5d7a3130992bf4e981be3a86

SHA512
ac0a90581a3e3a87e41812eac925e22ce7eb77d2eb157eeb4ef025ad7e519dd3e678dd650a0cf21e11be4d0a211f04477ca581739ac159ca4e162ae5141a2d68

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\89a83f52debea8c508da2f233c74c350.dll

Filesize
1.6MB

MD5
3bb0b61a4da446e60b7edce2fbcf52ea

SHA1
10839c1f60df954abd29020bb1f2af8d73650e7a

SHA256
b786b1a218b0a2b2151c8dbcceeec4ef873a668c43bcb15ee1182e299ad5f0f4

SHA512
ffd84765fbeb323baab18924730ca8d70b9787d5709675f990e37a127f45c8326e5ebbf0c3a729cd418c3724f9057e6025057599959b2e6188af37f9da321c10

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\89a83f52debea8c508da2f233c74c350.dll

Filesize
1.6MB

MD5
3bb0b61a4da446e60b7edce2fbcf52ea

SHA1
10839c1f60df954abd29020bb1f2af8d73650e7a

SHA256
b786b1a218b0a2b2151c8dbcceeec4ef873a668c43bcb15ee1182e299ad5f0f4

SHA512
ffd84765fbeb323baab18924730ca8d70b9787d5709675f990e37a127f45c8326e5ebbf0c3a729cd418c3724f9057e6025057599959b2e6188af37f9da321c10

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\8c2c4d8e470d84876c7603b3afce38a6.dll

Filesize
116KB

MD5
3abbb099e77e91a358be9f6805457ce4

SHA1
d9c5d4cd58ffcf8f90625ae512659465107da3eb

SHA256
91a48c7a7aafa7deb5d18d5c9bfce6ea3f629d9e07571388e967b30651cdcece

SHA512
1ba98011a8dc99984064115192c372ee87acd280eb45003f1631410bdf8f84483e14fd2cb4c8ee9643607e4b2c038aa6b01430fe373d9d225ee3fc2f7dc8b7e3

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\8c2c4d8e470d84876c7603b3afce38a6.dll

Filesize
116KB

MD5
3abbb099e77e91a358be9f6805457ce4

SHA1
d9c5d4cd58ffcf8f90625ae512659465107da3eb

SHA256
91a48c7a7aafa7deb5d18d5c9bfce6ea3f629d9e07571388e967b30651cdcece

SHA512
1ba98011a8dc99984064115192c372ee87acd280eb45003f1631410bdf8f84483e14fd2cb4c8ee9643607e4b2c038aa6b01430fe373d9d225ee3fc2f7dc8b7e3

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\a34b23f7b6239c1d92c55209eb456207.dll

Filesize
163KB

MD5
f4af16eb7702ee0a2c7b1254a8cf1ced

SHA1
fbda72a3b98c39c06ff2822cc3ba648c9135779d

SHA256
eb98491e0056bb1f8a42b2529ab283b4cd9d57bcf814c7306368938152b60a14

SHA512
86127758e4854c83c745ca5d6286e57503c814db465b7f74dec928894a0c4f5a51a0d6647462e6359b3f45ca1db1bbd10e527a84048baad299ad4916f66cd35d

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\a34b23f7b6239c1d92c55209eb456207.dll

Filesize
163KB

MD5
f4af16eb7702ee0a2c7b1254a8cf1ced

SHA1
fbda72a3b98c39c06ff2822cc3ba648c9135779d

SHA256
eb98491e0056bb1f8a42b2529ab283b4cd9d57bcf814c7306368938152b60a14

SHA512
86127758e4854c83c745ca5d6286e57503c814db465b7f74dec928894a0c4f5a51a0d6647462e6359b3f45ca1db1bbd10e527a84048baad299ad4916f66cd35d

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\a4bc67905fb52af7e783a6aa60c3d0f6.dll

Filesize
456KB

MD5
52a398fe71a30bdc4edbcfac6f852a47

SHA1
704c593819f603948c5d3afe527226ff73d15c94

SHA256
8eee5213313f54cbddc6fe5519f56fe3b0239b70a62a9497284e524efcf46866

SHA512
11470e0452cf783595d93882b8a7aa79be8852fe24597e5172e7e5d7a3e7a6e82296863a0e0afaeedc98fe7d5e905216d09783f7d411f38e36a5434933d61e10

Download Submit
\Users\Admin\AppData\Local\Temp\d3bb8e4e8722ddc0e46007272afa2e18\a4bc67905fb52af7e783a6aa60c3d0f6.dll

Filesize
456KB

MD5
52a398fe71a30bdc4edbcfac6f852a47

SHA1
704c593819f603948c5d3afe527226ff73d15c94

SHA256
8eee5213313f54cbddc6fe5519f56fe3b0239b70a62a9497284e524efcf46866

SHA512
11470e0452cf783595d93882b8a7aa79be8852fe24597e5172e7e5d7a3e7a6e82296863a0e0afaeedc98fe7d5e905216d09783f7d411f38e36a5434933d61e10

Download Submit
memory/1344-162-0x0000000005D10000-0x0000000005E30000-memory.dmp

Filesize
1.1MB

Download
memory/1344-167-0x00000000007F0000-0x0000000000826000-memory.dmp

Filesize
216KB

Download
memory/1344-187-0x0000000005BF0000-0x0000000005C14000-memory.dmp

Filesize
144KB

Download
memory/1344-186-0x0000000000FA0000-0x0000000000FAA000-memory.dmp

Filesize
40KB

Download
memory/1344-193-0x0000000007950000-0x0000000007AEE000-memory.dmp

Filesize
1.6MB

Download
memory/1344-185-0x0000000006100000-0x0000000006146000-memory.dmp

Filesize
280KB

Download
memory/1344-200-0x0000000005530000-0x0000000005554000-memory.dmp

Filesize
144KB

Download
memory/1344-184-0x00000000055D0000-0x0000000005610000-memory.dmp

Filesize
256KB

Download
memory/1344-183-0x00000000006E0000-0x00000000006F0000-memory.dmp

Filesize
64KB

Download
memory/1344-207-0x0000000006070000-0x000000000607C000-memory.dmp

Filesize
48KB

Download
memory/1344-206-0x0000000005560000-0x000000000556E000-memory.dmp

Filesize
56KB

Download
memory/1344-182-0x0000000000680000-0x000000000068E000-memory.dmp

Filesize
56KB

Download
memory/1344-180-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download
memory/1344-208-0x00000000075E0000-0x0000000007712000-memory.dmp

Filesize
1.2MB

Download
memory/1344-209-0x000000000A590000-0x000000000AAD6000-memory.dmp

Filesize
5.3MB

Download
memory/1344-210-0x00000000062C0000-0x00000000062E0000-memory.dmp

Filesize
128KB

Download
memory/1344-211-0x0000000006610000-0x0000000006624000-memory.dmp

Filesize
80KB

Download
memory/1344-212-0x000000000B000000-0x000000000B1C6000-memory.dmp

Filesize
1.8MB

Download
memory/1344-213-0x0000000007AF0000-0x0000000007AFE000-memory.dmp

Filesize
56KB

Download
memory/1344-218-0x0000000007B50000-0x0000000007B62000-memory.dmp

Filesize
72KB

Download
memory/1344-181-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download
memory/1344-179-0x0000000005330000-0x000000000537C000-memory.dmp

Filesize
304KB

Download
memory/1344-221-0x0000000007B80000-0x0000000007B96000-memory.dmp

Filesize
88KB

Download
memory/1344-175-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/1344-226-0x0000000007D40000-0x0000000007D70000-memory.dmp

Filesize
192KB

Download
memory/1344-174-0x0000000005E30000-0x0000000005EF4000-memory.dmp

Filesize
784KB

Download
memory/1344-229-0x0000000008B80000-0x0000000008C02000-memory.dmp

Filesize
520KB

Download
memory/1344-230-0x0000000008C00000-0x0000000008C2E000-memory.dmp

Filesize
184KB

Download
memory/1344-234-0x0000000008C60000-0x0000000008C7C000-memory.dmp

Filesize
112KB

Download
memory/1344-188-0x000000000AEA0000-0x000000000AF62000-memory.dmp

Filesize
776KB

Download
memory/1344-161-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/1344-160-0x00000000003C0000-0x0000000000410000-memory.dmp

Filesize
320KB

Download
memory/1344-238-0x0000000008D40000-0x0000000008D48000-memory.dmp

Filesize
32KB

Download
memory/1344-239-0x000000000A3C0000-0x000000000A3D0000-memory.dmp

Filesize
64KB

Download
memory/1344-240-0x000000000AB90000-0x000000000ABDE000-memory.dmp

Filesize
312KB

Download
memory/1344-241-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/1344-242-0x000000000AC00000-0x000000000AC0A000-memory.dmp

Filesize
40KB

Download
memory/1344-243-0x000000000ADF0000-0x000000000AE1C000-memory.dmp

Filesize
176KB

Download
memory/1344-244-0x000000000AC60000-0x000000000AC6C000-memory.dmp

Filesize
48KB

Download
memory/1344-157-0x0000000000CB0000-0x0000000000D28000-memory.dmp

Filesize
480KB

Download
memory/1344-248-0x000000000CEA0000-0x000000000D138000-memory.dmp

Filesize
2.6MB

Download
memory/1344-252-0x000000000C4A0000-0x000000000C7BC000-memory.dmp

Filesize
3.1MB

Download
memory/1344-253-0x00000000055D0000-0x0000000005610000-memory.dmp

Filesize
256KB

Download
memory/1344-251-0x00000000055D0000-0x0000000005610000-memory.dmp

Filesize
256KB

Download
memory/1344-152-0x00000000058F0000-0x0000000005BEA000-memory.dmp

Filesize
3.0MB

Download
memory/1344-148-0x00000000055D0000-0x0000000005610000-memory.dmp

Filesize
256KB

Download
memory/1344-147-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/1344-146-0x0000000001110000-0x0000000001BDC000-memory.dmp

Filesize
10.8MB

Download
memory/1344-254-0x000000000C7C0000-0x000000000C8D8000-memory.dmp

Filesize
1.1MB

Download
memory/1344-255-0x000000000C8E0000-0x000000000C9C8000-memory.dmp

Filesize
928KB

Download
memory/1344-257-0x000000000B500000-0x000000000B51E000-memory.dmp

Filesize
120KB

Download
memory/1344-264-0x000000000D140000-0x000000000D2F6000-memory.dmp

Filesize
1.7MB

Download
memory/1344-266-0x000000000B5A0000-0x000000000B5D8000-memory.dmp

Filesize
224KB

Download
memory/1344-267-0x000000000B5E0000-0x000000000B5F0000-memory.dmp

Filesize
64KB

Download
memory/1344-280-0x000000000D510000-0x000000000D5A2000-memory.dmp

Filesize
584KB

Download
memory/1344-281-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download
memory/1344-282-0x00000000055D0000-0x0000000005610000-memory.dmp

Filesize
256KB

Download
memory/1344-283-0x000000000F830000-0x000000000F98C000-memory.dmp

Filesize
1.4MB

Download
memory/1344-284-0x000000000A580000-0x000000000A581000-memory.dmp

Filesize
4KB

Download
memory/1344-287-0x00000000055D0000-0x0000000005610000-memory.dmp

Filesize
256KB

Download