Analysis
-
max time kernel
590s -
max time network
763s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
31/12/2023, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
RogueKiller_setup.exe
Resource
win11-20231215-en
windows11-21h2-x64
27 signatures
1800 seconds
General
-
Target
RogueKiller_setup.exe
-
Size
45.6MB
-
MD5
cfecd53411665143798a57b8986c46dc
-
SHA1
156213b283a4785cb703faf2cbf5652ef534e36d
-
SHA256
c6ba4aed326371d060de64f65b0093af955059b75fbe1f07975d9065bb14a459
-
SHA512
3e2417f5555d692a7ecd9872be83c35f8ef1b0abdae29ea3f75b59902dc8cd762b53bff2ccb768eade33caf0d5977000f8e05d6baa554c93c52353c9d52108f2
-
SSDEEP
786432:KHrkPtFKzg9pIv/VuicHlALX1hnyRgZBqFZCcOvz/hGkpjbgi7WP7ywDcgiMjizi:KsIz4aVhcqbS4BqFpOvz/tpj8P7yw9Oi
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\truesight.sys RogueKiller64.exe File created C:\Windows\system32\drivers\truesight.sys RogueKillerSvc.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TrueSight\ImagePath = "\\??\\C:\\Windows\\System32\\drivers\\truesight.sys" RogueKillerSvc.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TrueSight\ImagePath = "\\??\\C:\\Windows\\System32\\drivers\\truesight.sys" RogueKiller64.exe -
Executes dropped EXE 4 IoCs
pid Process 2276 RogueKiller_setup.tmp 5784 RogueKillerSvc.exe 2716 RogueKillerSvc.exe 1400 RogueKiller64.exe -
Loads dropped DLL 2 IoCs
pid Process 2276 RogueKiller_setup.tmp 244 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32\ = "C:\\Program Files\\RogueKiller\\roguekillershell.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: RogueKiller64.exe File opened (read-only) \??\X: RogueKiller_setup.tmp File opened (read-only) \??\F: RogueKillerSvc.exe File opened (read-only) \??\D: RogueKiller64.exe File opened (read-only) \??\E: RogueKiller64.exe File opened (read-only) \??\K: RogueKiller64.exe File opened (read-only) \??\U: RogueKiller64.exe File opened (read-only) \??\Z: RogueKiller64.exe File opened (read-only) \??\E: RogueKiller_setup.tmp File opened (read-only) \??\w: RogueKiller_setup.tmp File opened (read-only) \??\V: RogueKillerSvc.exe File opened (read-only) \??\N: RogueKillerSvc.exe File opened (read-only) \??\D: RogueKillerSvc.exe File opened (read-only) \??\T: RogueKillerSvc.exe File opened (read-only) \??\V: RogueKillerSvc.exe File opened (read-only) \??\E: RogueKillerSvc.exe File opened (read-only) \??\M: RogueKillerSvc.exe File opened (read-only) \??\H: RogueKiller64.exe File opened (read-only) \??\J: RogueKiller_setup.tmp File opened (read-only) \??\S: RogueKiller_setup.tmp File opened (read-only) \??\G: RogueKillerSvc.exe File opened (read-only) \??\Q: RogueKiller64.exe File opened (read-only) \??\P: RogueKiller_setup.tmp File opened (read-only) \??\I: RogueKillerSvc.exe File opened (read-only) \??\X: RogueKillerSvc.exe File opened (read-only) \??\G: RogueKiller64.exe File opened (read-only) \??\B: RogueKillerSvc.exe File opened (read-only) \??\X: RogueKillerSvc.exe File opened (read-only) \??\O: RogueKiller_setup.tmp File opened (read-only) \??\H: RogueKiller_setup.tmp File opened (read-only) \??\T: RogueKillerSvc.exe File opened (read-only) \??\w: RogueKillerSvc.exe File opened (read-only) \??\Y: RogueKillerSvc.exe File opened (read-only) \??\L: RogueKiller64.exe File opened (read-only) \??\T: RogueKiller64.exe File opened (read-only) \??\P: RogueKillerSvc.exe File opened (read-only) \??\N: RogueKillerSvc.exe File opened (read-only) \??\R: RogueKillerSvc.exe File opened (read-only) \??\O: RogueKiller64.exe File opened (read-only) \??\L: RogueKiller_setup.tmp File opened (read-only) \??\D: RogueKillerSvc.exe File opened (read-only) \??\V: RogueKiller_setup.tmp File opened (read-only) \??\M: RogueKiller64.exe File opened (read-only) \??\Z: RogueKillerSvc.exe File opened (read-only) \??\B: RogueKillerSvc.exe File opened (read-only) \??\K: RogueKillerSvc.exe File opened (read-only) \??\R: RogueKiller_setup.tmp File opened (read-only) \??\A: RogueKillerSvc.exe File opened (read-only) \??\K: RogueKillerSvc.exe File opened (read-only) \??\F: RogueKillerSvc.exe File opened (read-only) \??\H: RogueKillerSvc.exe File opened (read-only) \??\V: RogueKiller64.exe File opened (read-only) \??\Q: RogueKillerSvc.exe File opened (read-only) \??\O: RogueKillerSvc.exe File opened (read-only) \??\Y: RogueKiller_setup.tmp File opened (read-only) \??\S: RogueKillerSvc.exe File opened (read-only) \??\U: RogueKillerSvc.exe File opened (read-only) \??\I: RogueKillerSvc.exe File opened (read-only) \??\I: RogueKiller64.exe File opened (read-only) \??\R: RogueKiller64.exe File opened (read-only) \??\I: RogueKiller_setup.tmp File opened (read-only) \??\M: RogueKiller_setup.tmp File opened (read-only) \??\N: RogueKiller_setup.tmp File opened (read-only) \??\H: RogueKillerSvc.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 RogueKiller_setup.tmp File opened for modification \??\PhysicalDrive0 RogueKillerSvc.exe File opened for modification \??\PhysicalDrive0 RogueKillerSvc.exe File opened for modification \??\PhysicalDrive0 RogueKiller64.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\RogueKiller\is-FCGU4.tmp RogueKiller_setup.tmp File opened for modification C:\Program Files\RogueKiller\RogueKillerShell.dll RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\is-CNP2D.tmp RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\is-9GAME.tmp RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\is-MJ24O.tmp RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\is-NP6MH.tmp RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\is-TGLNE.tmp RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\is-P825I.tmp RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\is-2DU47.tmp RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\is-HTGOR.tmp RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\unins000.msg RogueKiller_setup.tmp File opened for modification C:\Program Files\RogueKiller\unins000.dat RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\unins000.dat RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\is-RH60C.tmp RogueKiller_setup.tmp File created C:\Program Files\RogueKiller\is-1RQ78.tmp RogueKiller_setup.tmp -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Adlice Software RogueKillerSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed RogueKiller64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE RogueKillerSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKiller Anti-Malware\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460b00190364437a5a645152186e4b6a5641195a461a02030d25042f1b31051d67220a3f180251585e4f070a04350a5c70645152186e4b6a5641195a444d140800230c1b25271011502b342e1f135c19100013124a7c4f5258687b52186e4b6a5641195a444f41491d250715192f2e11592d032f2904571b06030449526609111637145e326e4b6a5641195a444f414b48641a1312211219672d04271b1457131016435148321d051f687b52186e4b6a5641195a444f41491d250715192f2e114d3d1f251b3e5515070e150207281c5240642a2f14444b6a5641195a444f414b48664d020e3453481835616a5641195a444f414b48664f505a64515059230e684c414d08110a4d6148664f505a645152186e4b6a5641195a460c0d0218361d1f0e664b525e2f0739134d335a444f414b48664f505a645152186e4b6812004d1b3b03040a03191f021f32141c4c270424545b191c0503120e444c4f505a645152186e4b6a5641195a444f430f0725031f192f5348183a193f134d335a444f414b48664f505a645152186e4b68120e5a160b0c0a340e2903141f360250026e30405641195a444f414b48664f505a645152186e4b6a54220326383a120e1a35332c2a31131e512d3716320e5a0f090a0f1f1b64437a5a645152186e4b6a5641195a444f414b48664f5058074b2e641b182f04126526250b0c02061a33341527041f5d201f39544d335a444f414b48664f505a645152186e4b6a5641195827553d373d350a0209182d335c2302242a3d6913071b14190d354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3731021b5b6c47405641195a444f414b48664f505a645152186e4b6a54220326383a120e1a35332c3b201c1b5612371c1f055c15174d6b4b48664f505a645152186e4b6a564119274865414b48664f505a645152186e4b6a56411b1c0d1d121f372a0e0514271950026e0d2b1a125c70444f414b48664f505a6451524562616a5641195a444f414b48664f520927101c562b19684c414270444f414b48664f505a645152186e4b6a54004b190c06170e1b6455500e36041714444b6a5641195a444f414b48664f505a6453134a25497056154b0f01436b4b48664f505a645152186e4b6a56411958000612001b6455500e36041714444b6a5641195a444f414b48664f505a6453164a271d2f04121b40441b131e0d6a65505a645152186e4b6a5641195a444f41490e2f0315093d02065d23497056154b0f01436b4b48664f505a645152186e4b6a564119580c00121f1b19091916215348183a193f134d335a444f414b48664f505a645152186e4b681b00550a014d5b4b0e2703031f687b52186e4b6a5641195a444f414b48664f52152a2e165d230a24123e5b1b070406190733011425371213566c516a02134c1f4865414b48664f505a645152186e4b6a56411b0a1600020e1b350a03587e51064a3b0e667c41195a444f414b48664f505a645152186c192f11084a0e1616435148321d051f687b52186e4b6a5641195a444f414b48664f52092719175c3b072f123e5b1b070406190733011425371213566c516a02134c1f4865414b48664f505a645152186e4b6a56411b09011d17020b231c52406405004d2b47405641195a444f414b48664f505a6451521a3a0a391d121b40441b131e0d6a65505a645152186e4b6a5641195a444f41491d250715192f5348183a193f134d335a444f414b48664f505a645152186e4b6800084b0f173015041c27032f0f341d1d592a34291e0e5019014d5b4b4a2703071b3d025014444b6a5641195a444f414b48664f505a6453055d2c3428040e4e09011d124952661b020f215d78186e4b6a5641195a444f414b48664f505833181c5c211c39545b190e161a044762664f505a645152186e4b6a5641195a444d1606016455500e360417326e4b6a5641195a444f414b483b65505a645152186e4b375a6b195a444f414b48664d030e2505074b6c516a0d6b195a444f414b48664f505a6453174d220a1517025a1f141b040f4a7c4f161b28021714444b6a5641195a444f414b48664d1c1b37052d5d3b072b290958090c4d5b4b4a64437a5a645152186e4b6a5641195a461b090a062d1c2f0a251617673d0325010f1b40441b131e0d4c4f505a645152186e16405641195a19651c RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs RogueKiller64.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455501c251d015d62616a5641195a444f414b48664f5216250206672b1e26173e511b1707435148644d5c70645152186e4b6a5641195a444d150309280403253410155d111822191657585e4f070a04350a7a5a645152186e4b6a0b6b195a444f1c6115 RogueKillerSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKiller Anti-Malware\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455501c251d015d62616a5641195a444f414b48664f5216250206672b1e26173e511b1707435148644d5c70645152186e4b6a5641195a444d150309280403253410155d111822191657585e4f15191d2365505a645152186e4b377c41195a44126b16 RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust RogueKiller64.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000a55d887e1d3cda01 RogueKiller64.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKiller Anti-Malware\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455501c251d015d62616a5641195a444f414b48664f5216250206672b1e26173e511b1707435148644d5c70645152186e4b6a5641195a444d150309280403253410155d111822191657585e4f070a04350a7a5a645152186e4b6a0b6b195a444f1c6115 RogueKiller64.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKiller Anti-Malware\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b110102033733065240641713543d0e667c41195a444f414b48664f505a6619134b11192f00085c0d010b435148200e1c09215d78186e4b6a5641195a444f414b4a2a0e1e1d3110155d6c516a47510a494865414b48664f505a645152186e492617124d25170c000537220e041f664b520862616a5641195a444f414b48664f52142b051b5e27082b020856141730040509240315587e51064a3b0e667c41195a444f414b48664f505a6603175a3c0a24123e5a15091f00051119011117215348186c49667c41195a444f414b48664f505a6603175a3c0a24123e49080b08130a0519011117215348186c49667c41195a444f414b48664f505a660211502b0f3f1a045d25170c0005372f01041f360713546c516a464d335a444f414b48664f505a6451504b2d032f1214551f0030120809283019143014004e2f0715150e4c14104d5b4b586a65505a645152186e4b6a56411958170c090e0c3303151e1b02115920342318155c08120e0d341c2f0215587e514214444b6a5641195a444f414b48664d03192c14164d220e2e29125a1b0a30151218234d4a5a745d78186e4b6a5641195a444f414b4a35071516282e17403a0e24050856144655411f1a330a5c70645152186e4b6a5641195a444d150e042302150e360850026e1f3803041570444f414b48664f505a6451521a3a032f1b041b40444d050a1a2d4d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455501c251d015d62616a5641195a444f414b48664f5216250206672b1e26173e511b1707435148644d5c70645152186e4b6a5641195a444d150309280403253410155d111822191657585e4f15191d2365505a645152186e4b377c41195a44126b16 RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached RogueKiller64.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKiller Anti-Malware\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b110102033733065240641713543d0e667c41195a444f414b48664f505a6619134b11192f00085c0d010b435148200e1c09215d78186e4b6a5641195a444f414b4a2a0e1e1d3110155d6c516a47510a494865414b48664f505a645152186e492617124d25170c000537220e041f664b52097d587e4e540b49525c59595b7e5f404a745d78186e4b6a5641195a444f414b4a28000413221811593a02251812661f0a0e03070d6455500e36041714444b6a5641195a444f414b48664d021f260313562a3429190c491b0a163e05092b0a524064535014444b6a5641195a444f414b48664d021f260313562a343a040e5e0805023e05092b0a524064535014444b6a5641195a444f414b48664d03192c14164d220e2e29125a1b0a3008051c231d061b285348187e47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e672d043f18151b40445f4d6148664f505a645152186e4b6a54125a12010b14070d22300319251f2d51201f2f041758163b1b08060d6455504a687b52186e4b6a5641195a444f41491b2507151e311d175c111829170f660e1d1f044952665f5c70645152186e4b6a5641195a444d12030d2a032f1f3c0517563d02251843035a101d140e444c4f505a645152186e4b6a56411b0e010304060d321d09587e51064a3b0e667c41195a444f414b48664f505a66051a5d230e684c411b1e051d0a49444c4f505a645152186e4b6a56411b0f0707040803190e050e2b2e1e593b05291e43035a020e0d180d6a65505a645152186e4b6a56411958110c090e0b2d30131b271917672a023813024d151616435148644d5c70645152186e4b6a5641195a444d140800230c1b25271011502b342f18005b16014d5b4b0e2703031f687b52186e4b6a5641195a444f41491d250715192f2e115723063f18084d034655411f1a330a5c70645152186e4b6a5641195a444d140800230c1b252704014c2106151a0e5a1b10060e051b64555021195d78186e4b6a5641195a444f414b4a341b00587e5109326e4b6a5641195a444f414b48664f505a66101f5d6c516a02134c1f4865414b48664f505a645152186e4b6a56411b190806111b1a291b5240641713543d0e667c41195a444f414b48664f505a645152186c0f2b02006616010e0a3418340a061f2a051b5720497056075816170a4d6148664f505a645152186e4b6a5641195a460b0e0804290c1b587e51064a3b0e667c41195a444f414b48664f505a645152186c0f25150d56190f30070404220a0209664b5263444b6a5641195a444f414b48664f505a645152186e49094c3d652f170a1318341a3f051828181164122f251514541f0a1b1249444c4f505a645152186e4b6a5641195a444f414b48664d3340182d274b2b19392a3d781e09060f37340200130f29141c4c3d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371626085a0e111d04184a6a65505a645152186e4b6a5641195a444f414b48664f52397e2d2e6d3d0e38053d653b00020805341a2205092d125014444b6a5641195a444f414b48664f505a645152186e49094c3d652f170a1318341a2e14172d1f2e6418022e130e4a586e4f414b48664f505a645152186e4b6a563c1570444f414b48664f505a645152186e4b6a54075008171b3e070933011312664b525e2f0739136b195a444f414b48664f505a640c5e326e4b6a5641195a444f414b48641c131b2a1f174a6c516a0d6b195a444f414b48664f505a645152186e492b04025113120a124952661b020f215d78186e4b6a5641195a444f414b48664f50582503191a744b3e04145c566e4f414b48664f505a645152186e4b6a56435d131704124952661b020f215d78186e4b6a5641195a444f414b48664f505820031b4e2b1939545b190e161a044762664f505a645152186e4b6a5641195a444d070204231c090930141f1a744b3e04145c566e4f414b48664f505a645152186e4b6a56435115171b12340e2f0315587e51064a3b0e667c41195a444f414b48664f505a645152186c062b1a115c585e4f070a04350a5c70645152186e4b6a5641195a444f414b4864001e2520141f59200f1514005a11031d0e1e0622300319251f50026e1f3803041570444f414b48664f505a645152186e4b6a54114b15070a12180d354d4a5a3003075d62616a5641195a444f414b48664f505a6451504a2b0c2305154b034655411f1a330a5c70645152186e4b6a5641195a444f414b48641c1312211507542b0f1514005a11031d0e1e0622300319251f50026e1f3803041570444f414b48664f505a645152186e4b6a54125c081206020e1b6455500e36041714444b6a5641195a444f414b48664f505a645306593d0039545b190e161a044762664f505a645152186e4b6a5641195a444d140800230c1b587e51064a3b0e667c41195a444f414b48664f505a645152186c1d2304144a251000150a04191a00162b1016672d03251f025c585e4f430a04310e0909665d78186e4b6a5641195a444f414b48664f5058331410672c192501125c08174d5b4b1c341a15564e5152186e4b6a5641195a444f414b48664d07132a151d4f3d497056154b0f01436b4b48664f505a645152186e4b6a564119581302084952661b020f217b52186e4b6a5641195a444f411662664f505a645152183347405641195a444f414b4a351b110e310250026e10405641195a444f414b48664f505821041e59110a291504490e010b435148200e1c09215d78186e4b6a5641195a444f414b4a2a0e030e1b1407542f3422171251585e4f4349444c4f505a645152186e4b6a56411b0e0c0e0f001b191f111d212e0150211c24545b190e161a046148664f505a64515245444b6a5641447019 RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKillerSVC RogueKillerSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b110102033733065240641713543d0e667c41195a444f414b48664f505a6619134b11192f00085c0d010b435148200e1c09215d78186e4b6a5641195a444f414b4a2a0e1e1d3110155d6c516a47510a494865414b48664f505a645152186e492617124d25170c000537220e041f664b520862616a5641195a444f414b48664f52142b051b5e27082b020856141730040509240315587e51064a3b0e667c41195a444f414b48664f505a6603175a3c0a24123e5a15091f00051119011117215348186c49667c41195a444f414b48664f505a6603175a3c0a24123e49080b08130a0519011117215348186c49667c41195a444f414b48664f505a660211502b0f3f1a045d25170c0005372f01041f360713546c516a464d335a444f414b48664f505a6451504b2d032f1214551f0030120809283019143014004e2f0715150e4c14104d5b4b586a65505a645152186e4b6a56411958170c090e0c3303151e1b02115920342318155c08120e0d341c2f0215587e514214444b6a5641195a444f414b48664d03192c14164d220e2e29125a1b0a30151218234d4a5a745d78186e4b6a5641195a444f414b4a35071516282e17403a0e24050856144655411f1a330a5c70645152186e4b6a5641195a444d150e042302150e360850026e1f3803041570444f414b48664f505a6451521a3a032f1b041b40444d050a1a2d4d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455501c251d015d62616a5641195a444f414b48664f5216250206672b1e26173e511b1707435148644d5c70645152186e4b6a5641195a444d150309280403253410155d111822191657585e4f15191d2365505a645152186e4b377c41195a44126b16 RogueKillerSvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates RogueKiller64.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b3e04145c70444f414b48664f505a6451524562616a5641195a444f414b48664f520927101c562b19684c414270444f414b48664f505a645152186e4b6a54004b190c06170e1b6455500e36041714444b6a5641195a444f414b48664f505a6453134a25497056154b0f01436b4b48664f505a645152186e4b6a56411958000612001b6455500e36041714444b6a5641195a444f414b48664f505a6453164a271d2f04121b40441b131e0d6a65505a645152186e4b6a5641195a444f41490e2f0315093d02065d23497056154b0f01436b4b48664f505a645152186e4b6a564119580c00121f1b19091916215348183a193f134d335a444f414b48664f505a645152186e4b681b00550a014d5b4b0e2703031f687b52186e4b6a5641195a444f414b48664f52152a2e165d230a24123e5b1b070406190733011425371213566c516a02134c1f4865414b48664f505a645152186e4b6a56411b0a1600020e1b350a03587e51064a3b0e667c41195a444f414b48664f505a645152186c192f11084a0e1616435148321d051f687b52186e4b6a5641195a444f414b48664f52092719175c3b072f123e5b1b070406190733011425371213566c516a02134c1f4865414b48664f505a645152186e4b6a56411b09011d17020b231c52406405004d2b47405641195a444f414b48664f505a6451521a3a0a391d121b40441b131e0d6a65505a645152186e4b6a5641195a444f41491d250715192f5348183a193f134d335a444f414b48664f505a645152186e4b6800084b0f173015041c27032f0f341d1d592a34291e0e5019014d5b4b4a2703071b3d025014444b6a5641195a444f414b48664f505a6453055d2c3428040e4e09011d124952661b020f215d78186e4b6a5641195a444f414b48664f505833181c5c211c39545b190e161a044762664f505a645152186e4b6a5641195a444d1606016455500e360417326e4b6a5641195a444f414b483b65505a645152186e4b375a6b195a444f414b48664d030e2505074b6c516a0d6b195a444f414b48664f505a6453174d220a1517025a1f141b040f4a7c4f161b28021714444b6a5641195a444f414b48664d1c1b37052d5d3b072b290958090c4d5b4b4a64437a5a645152186e4b6a5641195a461b090a062d1c2f0a251617673d0325010f1b40440900071b2365505a645152186e4b377c41195a44126b16 RogueKillerSvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKiller Anti-Malware RogueKiller64.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates RogueKiller64.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{4E77131D-3629-431C-9818-C5679DC83E81} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000072218d7e1d3cda01 RogueKiller64.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460b00190364437a5a645152186e4b6a5641195a461a02030d25042f1b31051d67220a3f180251585e4f070a04350a5c70645152186e4b6a5641195a444d140800230c1b25271011502b342e1f135c19100013124a7c4f5258687b52186e4b6a5641195a444f41491d250715192f2e11592d032f2904571b06030449526609111637145e326e4b6a5641195a444f414b48641a1312211219672d04271b1457131016435148321d051f687b52186e4b6a5641195a444f41491d250715192f2e114d3d1f251b3e5515070e150207281c5240642a2f14444b6a5641195a444f414b48664d020e3453481835616a5641195a444f414b48664f505a64515059230e684c414d08110a4d6148664f505a645152186e4b6a5641195a460c0d0218361d1f0e664b525e2f0739134d335a444f414b48664f505a645152186e4b6812004d1b3b03040a03191f021f32141c4c270424545b191c0503120e444c4f505a645152186e4b6a5641195a444f430f0725031f192f5348183a193f134d335a444f414b48664f505a645152186e4b68120e5a160b0c0a340e2903141f360250026e30405641195a444f414b48664f505a645152186e4b6a54220326383a120e1a35332c2a31131e512d3716320e5a0f090a0f1f1b64437a5a645152186e4b6a5641195a444f414b48664f5058074b2e641b182f04126526250b0c02061a33341527041f5d201f39544d335a444f414b48664f505a645152186e4b6a5641195827553d373d350a0209182d335c2302242a3d6913071b14190d354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3731021b5b6c47405641195a444f414b48664f505a645152186e4b6a54220326383a120e1a35332c3b201c1b5612371c1f055c15174d6b4b48664f505a645152186e4b6a564119274865414b48664f505a645152186e4b6a56411b1c0d1d121f372a0e0514271950026e0d2b1a125c70444f414b48664f505a6451524562616a5641195a444f414b48664f520927101c562b19684c414270444f414b48664f505a645152186e4b6a54004b190c06170e1b6455500e36041714444b6a5641195a444f414b48664f505a6453134a25497056154b0f01436b4b48664f505a645152186e4b6a56411958000612001b6455500e36041714444b6a5641195a444f414b48664f505a6453164a271d2f04121b40441b131e0d6a65505a645152186e4b6a5641195a444f41490e2f0315093d02065d23497056154b0f01436b4b48664f505a645152186e4b6a564119580c00121f1b19091916215348183a193f134d335a444f414b48664f505a645152186e4b681b00550a014d5b4b0e2703031f687b52186e4b6a5641195a444f414b48664f52152a2e165d230a24123e5b1b070406190733011425371213566c516a02134c1f4865414b48664f505a645152186e4b6a56411b0a1600020e1b350a03587e51064a3b0e667c41195a444f414b48664f505a645152186c192f11084a0e1616435148321d051f687b52186e4b6a5641195a444f414b48664f52092719175c3b072f123e5b1b070406190733011425371213566c516a02134c1f4865414b48664f505a645152186e4b6a56411b09011d17020b231c52406405004d2b47405641195a444f414b48664f505a6451521a3a0a391d121b40441b131e0d6a65505a645152186e4b6a5641195a444f41491d250715192f5348183a193f134d335a444f414b48664f505a645152186e4b6800084b0f173015041c27032f0f341d1d592a34291e0e5019014d5b4b4a2703071b3d025014444b6a5641195a444f414b48664f505a6453055d2c3428040e4e09011d124952661b020f215d78186e4b6a5641195a444f414b48664f505833181c5c211c39545b190e161a044762664f505a645152186e4b6a5641195a444d1606016455500e360417326e4b6a5641195a444f414b483b65505a645152186e4b375a6b195a444f414b48664d030e2505074b6c516a0d6b195a444f414b48664f505a6453174d220a1517025a1f141b040f4a7c4f161b28021714444b6a5641195a444f414b48664d1c1b37052d5d3b072b290958090c4d5b4b4a64437a5a645152186e4b6a5641195a461b090a062d1c2f0a251617673d0325010f1b40441b131e0d4c4f505a645152186e16405641195a19651c RogueKillerSvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKillerSVC RogueKillerSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople RogueKiller64.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b112b4d335a444f414b48664f505a645152186e4b6810084b0910300d0a1d280c18587e51064a3b0e405641195a444f414b48664f5007687b52186e4b6a5641195a444f41491b250e1e14210350026e10405641195a444f414b48664f505a6451521a2f19291e084f1f174d5b4b1c341a15564e5152186e4b6a5641195a444f414b48664d11082f5348183a193f134d335a444f414b48664f505a645152186e4b6812084a11174d5b4b1c341a15564e5152186e4b6a5641195a444f414b48664d14082d07174a3d497056154b0f01436b4b48664f505a645152186e4b6a5641195802060d0e1b3f1c041f295348183a193f134d335a444f414b48664f505a645152186e4b681e0e4a0e1730070204234d4a5a3003075d62616a5641195a444f414b48664f505a645150552f073a1343035a020e0d180d6a65505a645152186e4b6a5641195a444f4149072830141f29101c5c11092b150a5e080b1a0f0f37350c1114664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493a040e5a1f171c04184a7c4f040831145e326e4b6a5641195a444f414b48664f505a6603175f27183e04181b40441b131e0d6a65505a645152186e4b6a5641195a444f41491b2507151e311d175c11092b150a5e080b1a0f0f37350c1114664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493913134f13070a124952661b020f215d78186e4b6a5641195a444f414b48664f5058301001533d497056154b0f01436b4b48664f505a645152186e4b6a56411958110c090e0b2d4d4a5a3003075d62616a5641195a444f414b48664f505a6451504e27193f053e4d15100e0d341d36031f1b202e11502102291343035a460e0d1c093f1c52564e5152186e4b6a5641195a444f414b48664d071f262e104a211c3913134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a31061e1e2b06011a744b3e04145c566e4f414b48664f505a645152186e4b6a56434e170d4d5b4b1c341a1570645152186e4b6a5641195a44126b4b48664f505a64510f14444b6a5641195a444f43181c271b0509664b5243444b6a5641195a444f414b48664d150f28102d592d082f06155c1e4655410d092a1c15564e5152186e4b6a5641195a444f430709351b2f1f311d1367260a391e43035a464d4d6148664f505a645152186e4b6a5415511b0a041234182708152537191d4f20497056075816170a6b4b48664f505a64510f326e4b6a561c3307 RogueKillerSvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a0229123250326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455501c251d015d62616a5641195a444f414b48664f5216250206672b1e26173e511b1707435148644d5c70645152186e4b6a5641195a444d150309280403253410155d111822191657585e4f15191d2365505a645152186e4b377c41195a44126b16 RogueKillerSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot RogueKiller64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates RogueKiller64.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\ = "RogueKiller Shell Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\adlrk\shell\open RogueKiller_setup.tmp Key created \REGISTRY\USER\S-1-5-21-3213149797-706813642-929964373-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\adlrk\shell RogueKiller_setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\adlrk\shell\open\command RogueKiller_setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AllFileSystemObjects\shellex\ContextMenuHandlers\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\ = "RogueKiller Shell Handler" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\adlrk RogueKiller_setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adlrk\URL Protocol RogueKiller_setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32\ = "C:\\Program Files\\RogueKiller\\roguekillershell.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adlrk\shell\open\command\ = "\"C:\\Program Files\\RogueKiller\\RogueKiller64.exe\" \"%1\"" RogueKiller_setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7} regsvr32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1400 RogueKiller64.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2276 RogueKiller_setup.tmp 2276 RogueKiller_setup.tmp 2276 RogueKiller_setup.tmp 2276 RogueKiller_setup.tmp 2276 RogueKiller_setup.tmp 2276 RogueKiller_setup.tmp 2276 RogueKiller_setup.tmp 2276 RogueKiller_setup.tmp 2276 RogueKiller_setup.tmp 2276 RogueKiller_setup.tmp 2716 RogueKillerSvc.exe 2716 RogueKillerSvc.exe 2716 RogueKillerSvc.exe 2716 RogueKillerSvc.exe 2716 RogueKillerSvc.exe 2716 RogueKillerSvc.exe 2716 RogueKillerSvc.exe 2716 RogueKillerSvc.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1400 RogueKiller64.exe 5256 taskmgr.exe -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 2716 RogueKillerSvc.exe 2716 RogueKillerSvc.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2276 RogueKiller_setup.tmp Token: SeRestorePrivilege 2276 RogueKiller_setup.tmp Token: SeTakeOwnershipPrivilege 2276 RogueKiller_setup.tmp Token: SeDebugPrivilege 2276 RogueKiller_setup.tmp Token: SeDebugPrivilege 2276 RogueKiller_setup.tmp Token: SeRestorePrivilege 2276 RogueKiller_setup.tmp Token: SeTakeOwnershipPrivilege 2276 RogueKiller_setup.tmp Token: SeRestorePrivilege 2276 RogueKiller_setup.tmp Token: SeTakeOwnershipPrivilege 2276 RogueKiller_setup.tmp Token: SeDebugPrivilege 5784 RogueKillerSvc.exe Token: SeDebugPrivilege 5784 RogueKillerSvc.exe Token: SeRestorePrivilege 5784 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 5784 RogueKillerSvc.exe Token: SeDebugPrivilege 5784 RogueKillerSvc.exe Token: SeDebugPrivilege 5784 RogueKillerSvc.exe Token: SeDebugPrivilege 2716 RogueKillerSvc.exe Token: SeDebugPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeDebugPrivilege 2716 RogueKillerSvc.exe Token: SeDebugPrivilege 2716 RogueKillerSvc.exe Token: SeDebugPrivilege 2716 RogueKillerSvc.exe Token: SeDebugPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeDebugPrivilege 2716 RogueKillerSvc.exe Token: SeDebugPrivilege 2716 RogueKillerSvc.exe Token: SeDebugPrivilege 5784 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe Token: SeRestorePrivilege 2716 RogueKillerSvc.exe Token: SeTakeOwnershipPrivilege 2716 RogueKillerSvc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2276 RogueKiller_setup.tmp 1400 RogueKiller64.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1400 RogueKiller64.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 1400 RogueKiller64.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe 5256 taskmgr.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5784 RogueKillerSvc.exe 5308 MiniSearchHost.exe 1400 RogueKiller64.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3168 wrote to memory of 2276 3168 RogueKiller_setup.exe 82 PID 3168 wrote to memory of 2276 3168 RogueKiller_setup.exe 82 PID 3168 wrote to memory of 2276 3168 RogueKiller_setup.exe 82 PID 2276 wrote to memory of 5784 2276 RogueKiller_setup.tmp 85 PID 2276 wrote to memory of 5784 2276 RogueKiller_setup.tmp 85 PID 2716 wrote to memory of 1400 2716 RogueKillerSvc.exe 91 PID 2716 wrote to memory of 1400 2716 RogueKillerSvc.exe 91 PID 1400 wrote to memory of 244 1400 RogueKiller64.exe 93 PID 1400 wrote to memory of 244 1400 RogueKiller64.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe"C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\is-237TM.tmp\RogueKiller_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-237TM.tmp\RogueKiller_setup.tmp" /SL5="$3026A,47471103,136192,C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files\RogueKiller\RogueKillerSvc.exe"C:\Program Files\RogueKiller\RogueKillerSvc.exe" -accept_eula3⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5784
-
-
-
C:\Program Files\RogueKiller\RogueKillerSvc.exe"C:\Program Files\RogueKiller\RogueKillerSvc.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files\RogueKiller\RogueKiller64.exe-minimize2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\RogueKiller\roguekillershell.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:244
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5308
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3528
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:4376
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵PID:1420
-
C:\Program Files\RogueKiller\unins000.exe"C:\Program Files\RogueKiller\unins000.exe"1⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Program Files\RogueKiller\unins000.exe" /FIRSTPHASEWND=$204842⤵PID:2448
-
C:\Program Files\RogueKiller\RogueKillerSvc.exe"C:\Program Files\RogueKiller\RogueKillerSvc.exe" -uninstall3⤵PID:5460
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\RogueKiller\RogueKillerShell.dll"3⤵PID:4372
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\RogueKiller\RogueKillerShell.dll"4⤵PID:5816
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5970467b7ce0e5f19a6e66eb3de896ec2
SHA1b2531885e87d07cba693e133af63014d59c5af02
SHA256c098c3eae97ff22933e4c42423219b4b2a72e184238cffa2d15f7f37485b4aa5
SHA5125df2c9cec63599c9154700167d817a396d508c850a5b6baa0209bff49ca811ff8b9c2a640df839c6d1ea3a6c2e5d3d77046838d3ab65373dde02eba931b414d8
-
Filesize
64KB
MD525898bdfd2bef88a274a00f09dd541cf
SHA1be06bb553373eee4136c83ffa3fca3a2eee2eea9
SHA2565512b2c517debb48361e4854ecb5b95f19b94ea7ebbd3976e6a5e40a27b0fccb
SHA5124b7773678a12b9a74eb469fd90832d294fba6ccee153459acbe02a0c10062128caf889d944934cba2ba66bd9f554260fffde8898fa4a3a045a0ff0e1fa79578b
-
Filesize
11.1MB
MD5a0ea18a38d9462f6fe3764de6121a826
SHA17b19fd8521cce8f6cc7aaff6d8a62411aa0588ed
SHA2568dbca66c36eb9f26c55b73f417e495150b5914f8971eaacf7ab747b8a1575bea
SHA512b9227374ae9485c520008c4f2b74dc7eb0cc3e4482f89b667000538cbeb7328f08d0254394882bfb15f6a3f7068dcaf8f5205bcf0a84d182e6020a6e80f0bfb6
-
Filesize
771KB
MD5390b172a2cdeff161a2eadc2aadd5359
SHA1df79a7c6899df52c726bd76e43dabe257ab05b07
SHA256569dc86ffc9596ff669703c237700ef2a31fa8f2bc4abe07a8a4d3ebcde225af
SHA512d4c3c526269508ed5f5e2beff9c659f0c05ba287c1c7d74000f73b4d170324fe724293ae3bf5931b27a08e7dd1daa08e3cb1f536e3be6b89eb26b701565b6e00
-
Filesize
355KB
MD54cdf91d22819de8f9fef445c4d89f8dc
SHA1c0692d27e568f5da77e1dac41e805ecba253366c
SHA2563b5251e4a24732fd9b36a40d7a67ac90d2cede05cc400671722fb88f2b9cf911
SHA5125e97d435adb4dcd5ec770cb6cd8d806449a9492c8bf04bbe66d5582ce833055921ca7997cc51f252c9c0edc1860fc8d8b0ba6a1ffdac90c84797b91d2143773a
-
Filesize
5.2MB
MD5da7cd055f5770bb1ece06a48f1feb0a4
SHA199ace31503068945461aabb715ffa1179d6d0ebf
SHA256e3012908b3b1468997b81a682a7b95d3acb0d0995d362032764cd5f88073da6c
SHA5122fbf319304bdc2a96a0070f0e2c35df60b2701595984052370277f91d2449bb34339c519c538a49d3e6cc92c10ea644e69733d8315b4f798832394302cde2168
-
Filesize
3.5MB
MD58e795d031bbd47e78b2094dafcb15387
SHA116b41003d393a1cb5cf29a598077dfdea5cfb1b1
SHA256232ba7cb1988bf48d4a25f07db4c938611b4c105a019896998e80ed0d1671d92
SHA512c53b90a10c6cfc0a28df6c430b73b9e09bc9513d9aae658d6d4802a974252816ae30b1c9c9796d91f933fc1ece9d83a1c224df8901e25743112b1762785a7714
-
Filesize
1.4MB
MD58adb86c1b3268d1f203105580355df3b
SHA17f0ae15af4ddfc310be4aa3b28d96a0877b02d4c
SHA2561ba3639e84a99898183702704e9549f686789566821b330bd3f7b73583cff228
SHA5129baf55010e24f03813cf8f82b2d9012646b26c41215e28a4969936b7918ccfdda84ea1407772f1dd5de9f15107ea98725ce80abded6a84a073ed23ac95485a9c
-
Filesize
873KB
MD54284550c92b696b8849362168e396e19
SHA14325da4b139fb488b62e227817c0a518e6853009
SHA2569467f1959517b2de6c04ed1812581df523666812b6520d91190fd23b813d25d7
SHA51248cad29c83b9900448a84f8e1fd347e859f57bdefc79b587accf8510fbdcb1d3a17ea435c71f8184439c5aa411f85909c9a909cc82b9721de5c3b9653861324c
-
Filesize
92KB
MD53c6bd06d77f6d3f7dfd67bb13a0c7967
SHA103fcb0d3893f79257999781de0607716e5060014
SHA256907016177de1999361696e14798d17737bca93eaf85dc89fbf409ca59467e64e
SHA512ecca6bde15674d6823cc5c100fd5533734007f6a57655529d66398a3386810b83790c14d24a0ac2edb44473035eff5bbb44b79b9c24d082c7a6ca11e57ee5cf8
-
Filesize
17KB
MD5caff2dc9e22aec36648cd0513d3e003a
SHA1832680b848dd9b4b7ab232c3cea41d3a30ca67a6
SHA2565231bbfbe9ffa1800fc53a45640536d07030525c7660d5d87bcff61f783c48b7
SHA51215a1de68054760574858388aeb35b27a24aa175970563f3239fe4799cbaf326a5691d8d913b26cc89fbb939436703bd24ce25061ae7663a2304219a0e816d06c
-
Filesize
11KB
MD52019efb38eb66ed6eca1747ce0e0a7dc
SHA18e92db2383410d767e3ac26e90b6b52c3ae0255d
SHA256d816931a62cb3bc09ff5d8326d33dbe7c6129c3e804321dfd6c57f5ba93fb715
SHA5123618352b8201d76b62a57fe6b9e64edf159253ba48401f120978bb9d9abfce7d18c51dc98465f12068f712f7f40d5c664d5117715838fd0ce4e4bf9a394f6824
-
Filesize
28KB
MD56098703c19645aa674c44a860aa8c99e
SHA102872814c4f0795704ec2132c13174a88e930a71
SHA256fdc7ce8a19dd6dfea411498b6d4ff0ca6c55375c05a2f4cc92505f1f39fba512
SHA512988fe3914421ff3d8e80d2bbf51c68f07781b6d7e9ab3e5d1e744bb0f730c581c1b78032fa183fd4b2d19ebb4f7792175bce6fe0001eae89fff4e47fbba2c045
-
Filesize
5KB
MD5ecc6df2f91637e129f0aa649cb9d900a
SHA15dfdb2f46f7710de0c218708d4c923082a8a549f
SHA2565dd1596490b5205084104d5120c609b80439277b81eb5772b4bcfa3e78f8eca7
SHA5125a794be7b53a4733fbdb92bfa6cf86f4a63c3ee1e93902d56e62d92fc591c5168a007f47e8a31cbb06671885aae100aaeae390194a8c0a628c4b3de13905e373
-
Filesize
8KB
MD5d91a971b76a5ed639ec53e9050279c72
SHA14c6de91f6341a10245360e18dc11090b56706021
SHA2564ae1921238acb7ecc6169b39ccc5db4192de17af2a384146c0b2091bb870c89f
SHA51292d09691f210c62fa74aa0503a2a0b88c6d3625c35503a6e3cb3b0c675b763aa9f0934f8bf1865ba9b30a2cc4e0ad562b0ddecf2294c37ea300ab0c7ee264b67
-
Filesize
2KB
MD5c402d9753e6a06c2d1e3fdfcf85f75f9
SHA12a05ad0b707018c280e787966ebfd511093f9a43
SHA2569e6df6dc051ae4fc9be7f88feb73e500741bbbb33d1e2af981118211b140a618
SHA51249c5870c80818ee36f734a95e6d6e7d523fdfbdefc3edca11162eb8033e7748a4a5f6bca5f75aabf633dfbfff466b83974c27afce8a475787a6889ab66fd52cc
-
Filesize
1KB
MD52a919ab52d3ec025a73fa8311c20db1c
SHA1c5439d858d95d711b83cf249eb91e3d32fff9769
SHA256356c3ce1eb2038d87fb7b92bae86d05e45870dc8dd54f4e2eddc002973785c4c
SHA512bc200d0b47e39ff051448282ef93e187c3e45acd555ac0f0c2b6b6850d195a926d6c751984cdb9ddea150fccc09f10ba9f6d4a04554730d5e95b102a5516e97d
-
Filesize
816KB
MD5a56322fc4d86a207656ad55e24d7472f
SHA175c7fb4e651bcc862194aa96bbbee880bac4e938
SHA2560c6e1f5a23f0ed1614489c859e3fd20a5da69042275fe1ce9e079f869ca85a1d
SHA51231fce8b1d58ee3a695e2caa30ee7b6497e9722f89dc8ae041c726c59164e91d95265290c251623069958ffa152236ac560efb0bfb1c74518d26e98f1dafff647
-
Filesize
381KB
MD523b6a48e8c96f61fd11a01f28a5cf380
SHA1044ef84f1bfdd57bee3b44542cfc9393e1af7bf5
SHA256bd6819d5db0662e9aa8a6b1028640f6f87ace783daf27f37d5a6e02c60281453
SHA5123e60b39273a79bd92017ed3157dfea7c0ad7061d619ecbd337718099a6402354762d18c7f318092295cf71b89857bfe223c2a0f0b9a0db614b284cb8820d0af4
-
Filesize
65KB
MD58b541ae0c4b8f4ac1f93cb6d5a41c5f2
SHA1d06fe69b543d3f0affcbeee233cc6c8d558ed119
SHA256f913fc639da60aca8bc2b2eb5c6fa93a88d50d9cac7cc811ab60d59026dc1a7e
SHA51262140f0620fe698732f6627fe79882957aaa0df8aa90fe5881e651c56668d8f50384831ff47269a7eb813b6d2b8a8dae14154035c33a50a697cbc6a2eedac856
-
Filesize
342KB
MD5ab5523ccd0943e0ff5dea1fcdf51fe58
SHA1c6d87ab55cbd56c25d7afaec1a27a63f263674b9
SHA25630ace25c44a409b5b3319e7b39ba927fe97ffbce02b8a200d487637e2d2c1422
SHA512a47354f55282963ffcae3c0cda0ca86a411bfc4dbfd7bfda0e31ceff96ae5c8d032d3cd1242b8ac4fc23eeede715b2870d4edc1eaaf4e400145c5035c35a8a3f
-
Filesize
92KB
MD5654ed0749b4d480a8c04f3214b7525c1
SHA16c97e4ec43dad7ff86a5e3deee42377c71c4b677
SHA2569cb47de5ebe3c69d177534136f71c1a736bc174acea9436dabcb7dfbb06b07b7
SHA5121764b96e380818309eca0a4397fe16298a833630b33bc334ff03bb39d6a24a8d9b3b07d4dc68fb81af4b076d4bc7f9be1ddb374046438d8a07c1dc16d1d212e6
-
Filesize
32B
MD5557a2af2f0863980a354ce9b8ffc80e6
SHA166d5362c894b84beacea8dfd5d040ca1fbdc16dc
SHA2567c8bc2a86e123d1556c0f7478e774f34500a5f005f0126e00b6bb54d3eb070d5
SHA5122273656a6a4c8aac6bdec2a6aa47c751f31ecca0b0ff8eaaae353557be8cdace592398f6952f318bdd2364f9dbc2909dfe3f817517d013cfb1ff68a903626a30
-
Filesize
15B
MD5faba9d79bceed5ec3d3f5c3aae8b1e30
SHA1dc3d1d79d4199b259e52264c87c243107f3e0256
SHA2565d10ea790b9458c94384ff5eb4bfe04069053bacc87347cc0e831950f7eb931b
SHA512a8a9ca3977697457af152f3a37a356483c123caf23db12225eab150800cecade1ec468dfeb684a6befeefe0e067db6232df2e4e5d9b69b735425b676d0d2dfca
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5ac12a83f9054e8dd7f7a2940b188b50d
SHA1b28d1584e12dabf36f832cf839a7ed2a6cd6f0e9
SHA2561696c89a8b3d41f600ad37dd9bfb311c01cf24330b41ef0f15d3949d733de35a
SHA512f9c7a84ae2ab4b9f530abd02537e390f0d0dd646e61aaeb1142c167331e849cb1ae49a22e3a1f8ee6834aa08385a83c3a7a4eb1af8f1c564a2f6c84aa2c101c4
-
Filesize
784KB
MD579fc0c200d150def1d8abc50b21dbb7c
SHA1f4adc9c05e7debf9a22ba354e0ab1221d5a5e27f
SHA256459db6129ab3788a2a2d607bc3a4d88ba031766237bbc5ac4adc6de0fc13bf01
SHA512e47067253247ccba739b27203e49089e453892217493ba7f082ea9d77bde64a04ca7d48666c20bb335a756fc31ffa838e19a6395c5084b8df751bb1375d72576
-
Filesize
5.0MB
MD593f4ba58bd3698fca5eb53c5bc9192a9
SHA1e6d0b4558584ccebb769cb9935bb52f007da7ab4
SHA256c31f7dd18e1d8a5ad5bcfe25e6b7521314c5f4ed6ad40b55d4342289ddfa62cb
SHA5125af38492d83b7b16687118c74ce50cb76c7664e1ce2f0eab84a7ca82d89d2cb29ebe3ec89c98968b4f3723afb9edd94c6f32a4f246378f9ef41d767cb48ad552
-
Filesize
600KB
MD5e36ab6f79a758dfc9acb6ae476ef994c
SHA195643c6b14146c2ca2910af1873573c58f74b8c6
SHA256bb3b3a60336fb790d1d826cc7b283b1d6870f1ae2327ad13952dbb74eb62027e
SHA512d1952b29fc7b3468874dc0e4a428aabec00833eed5940518a8d36acb598f90ddbb0af1a366ca0a7c2eec2c06dfc1bbdb96dd0c9bdab0c0ab9f201d850f3689ff
-
Filesize
906B
MD5764810ebdeb78662a14608cc82f8e1bf
SHA1f361f329c20a120ff47bb0dc585e1b846b5dc58d
SHA2569384b52a66579c98bf02d51b27d39441063ebee9ca5d47b9395b5b3f20e217c9
SHA5124af23542063098affe796fb6e2e6fc3704dcd8d6541b94038c03caab6b7c3e939d39e2de9649e7a157e16c1ff1fd052db069288f3f426b0ac2a9105762a942ed
-
Filesize
92KB
MD52282c4f195eb5d8dae72e46df5058605
SHA1f81094af9c66968e63fe8806217a8a1fc5f05ae1
SHA2565b82c03886c1388fef5dfa6e281b36abdd27dcd5c3f6bc3ae98738e308d6b31c
SHA51215608ca3f4e1faa39ba1ab05604d27c9b2f43c4e22f61b24d8cc52762826dc2f6f9025e14dc5e1248c83beaaf3875b2df2a166248a1cf53e2cefe8ae6f79629b
-
Filesize
52KB
MD5c555b977ed786b4dff8627ed64c58f63
SHA148d7b0bd5e3d89b94aeb09f443f87442fbee9ce8
SHA2563079c59d84064199bdd48fc590c04e4b9471f99b6d07ad0f542cb09081dfa408
SHA512d5231f529a20ae834a09cb03e84e08888a9581beb47d8dbbcd8e23d3ac8c2328cf0fd6401a29d6c2b107021d65e9b89a92d7f88d47640c45e0275938807246c5