a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267

Analysis

max time kernel
240s
max time network
366s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RogueKiller_setup.exe
Size

46.1MB
MD5

f73c7f375dee046fe26f52cb39214eac
SHA1

70216eb745fff95cef74eb9ae2b62572c6aadc3c
SHA256

a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267
SHA512

58cc2918e143891103c3211aacdc6c0eaf323c66488d6a789a19986a7c99f89be3d84756c72efcc007a1ac64771a10d44fa0c810fdef1778a4851a7f3b6fba08
SSDEEP

786432:YpUjx1LGoEbAdS0merPKjhgeRxWs5I0RbPRbeSC4Uu3o7slDfzPIgdjnAdo0/2fx:YpaKoW0CerPcieRPFNBDCN0nQgX0/2fx

Score

8^/10

bootkit discovery persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\truesight.sys	RogueKiller64.exe
File created	C:\Windows\system32\drivers\truesight.sys	RogueKillerSvc.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TrueSight\ImagePath = "\\??\\C:\\Windows\\System32\\drivers\\truesight.sys"	RogueKillerSvc.exe

Executes dropped EXE 5 IoCs

pid	Process
1252	RogueKiller_setup.tmp
2900	RogueKillerSvc.exe
480	Process not Found
1628	RogueKillerSvc.exe
1660	RogueKiller64.exe

Loads dropped DLL 15 IoCs

pid	Process
2068	RogueKiller_setup.exe
1252	RogueKiller_setup.tmp
1252	RogueKiller_setup.tmp
1252	RogueKiller_setup.tmp
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1252	RogueKiller_setup.tmp
2900	RogueKillerSvc.exe
2900	RogueKillerSvc.exe
1628	RogueKillerSvc.exe
1628	RogueKillerSvc.exe
2368	regsvr32.exe
1196	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32\ = "C:\\Program Files\\RogueKiller\\roguekillershell.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	RogueKiller_setup.tmp
File opened (read-only)	\??\N:	RogueKiller_setup.tmp
File opened (read-only)	\??\H:	RogueKiller64.exe
File opened (read-only)	\??\O:	RogueKiller64.exe
File opened (read-only)	\??\S:	RogueKiller64.exe
File opened (read-only)	\??\U:	RogueKiller_setup.tmp
File opened (read-only)	\??\V:	RogueKillerSvc.exe
File opened (read-only)	\??\S:	RogueKillerSvc.exe
File opened (read-only)	\??\J:	RogueKiller_setup.tmp
File opened (read-only)	\??\O:	RogueKiller_setup.tmp
File opened (read-only)	\??\w:	RogueKillerSvc.exe
File opened (read-only)	\??\I:	RogueKillerSvc.exe
File opened (read-only)	\??\K:	RogueKillerSvc.exe
File opened (read-only)	\??\I:	RogueKillerSvc.exe
File opened (read-only)	\??\L:	RogueKiller64.exe
File opened (read-only)	\??\M:	RogueKillerSvc.exe
File opened (read-only)	\??\Z:	RogueKillerSvc.exe
File opened (read-only)	\??\F:	RogueKillerSvc.exe
File opened (read-only)	\??\D:	RogueKiller64.exe
File opened (read-only)	\??\K:	RogueKiller64.exe
File opened (read-only)	\??\F:	RogueKillerSvc.exe
File opened (read-only)	\??\Q:	RogueKillerSvc.exe
File opened (read-only)	\??\O:	RogueKillerSvc.exe
File opened (read-only)	\??\Y:	RogueKillerSvc.exe
File opened (read-only)	\??\T:	RogueKiller_setup.tmp
File opened (read-only)	\??\Y:	RogueKiller_setup.tmp
File opened (read-only)	\??\A:	RogueKillerSvc.exe
File opened (read-only)	\??\G:	RogueKillerSvc.exe
File opened (read-only)	\??\E:	RogueKiller_setup.tmp
File opened (read-only)	\??\I:	RogueKiller_setup.tmp
File opened (read-only)	\??\F:	RogueKiller64.exe
File opened (read-only)	\??\G:	RogueKiller64.exe
File opened (read-only)	\??\P:	RogueKiller64.exe
File opened (read-only)	\??\T:	RogueKillerSvc.exe
File opened (read-only)	\??\I:	RogueKiller64.exe
File opened (read-only)	\??\K:	RogueKillerSvc.exe
File opened (read-only)	\??\R:	RogueKillerSvc.exe
File opened (read-only)	\??\V:	RogueKiller64.exe
File opened (read-only)	\??\L:	RogueKillerSvc.exe
File opened (read-only)	\??\X:	RogueKillerSvc.exe
File opened (read-only)	\??\D:	RogueKillerSvc.exe
File opened (read-only)	\??\L:	RogueKillerSvc.exe
File opened (read-only)	\??\K:	RogueKiller_setup.tmp
File opened (read-only)	\??\J:	RogueKillerSvc.exe
File opened (read-only)	\??\A:	RogueKiller_setup.tmp
File opened (read-only)	\??\B:	RogueKiller_setup.tmp
File opened (read-only)	\??\w:	RogueKiller_setup.tmp
File opened (read-only)	\??\J:	RogueKiller64.exe
File opened (read-only)	\??\B:	RogueKiller64.exe
File opened (read-only)	\??\E:	RogueKiller64.exe
File opened (read-only)	\??\P:	RogueKiller_setup.tmp
File opened (read-only)	\??\J:	RogueKillerSvc.exe
File opened (read-only)	\??\Z:	RogueKiller_setup.tmp
File opened (read-only)	\??\T:	RogueKiller64.exe
File opened (read-only)	\??\H:	RogueKillerSvc.exe
File opened (read-only)	\??\Q:	RogueKiller64.exe
File opened (read-only)	\??\D:	RogueKillerSvc.exe
File opened (read-only)	\??\N:	RogueKillerSvc.exe
File opened (read-only)	\??\A:	RogueKiller64.exe
File opened (read-only)	\??\Y:	RogueKiller64.exe
File opened (read-only)	\??\B:	RogueKillerSvc.exe
File opened (read-only)	\??\B:	RogueKillerSvc.exe
File opened (read-only)	\??\Z:	RogueKiller64.exe
File opened (read-only)	\??\R:	RogueKillerSvc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	RogueKiller_setup.tmp
File opened for modification	\??\PhysicalDrive0	RogueKillerSvc.exe
File opened for modification	\??\PhysicalDrive0	RogueKillerSvc.exe
File opened for modification	\??\PhysicalDrive0	RogueKiller64.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	RogueKillerSvc.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\RogueKiller\is-BUBAJ.tmp	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\is-9QIOK.tmp	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\is-SPG3I.tmp	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\unins000.dat	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\is-MNC8R.tmp	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\is-QUNSG.tmp	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\is-JNEQK.tmp	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\is-N0KKT.tmp	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\is-QVUT4.tmp	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\is-IESM4.tmp	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\is-DNDTP.tmp	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\unins000.msg	RogueKiller_setup.tmp
File opened for modification	C:\Program Files\RogueKiller\unins000.dat	RogueKiller_setup.tmp
File created	C:\Program Files\RogueKiller\is-UDA99.tmp	RogueKiller_setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58E2F6F1-D693-11EE-A1AD-46837A41B3D6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	RogueKillerSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKiller Anti-Malware\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a023e083d50326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455500e36041714444b6a5641195a444f414b48664d1c1b37052d5d3b072b290958090c4d5b4b4a64437a5a645152186e4b6a5641195a461b090a062d1c2f0a251617673d0325010f1b40441b131e0d4c4f505a645152186e16405641195a19651c	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000a04c1666a06ada01	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	RogueKillerSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a023e083d50326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455500e36041714444b6a5641195a444f414b48664d1c1b37052d5d3b072b290958090c4d5b4b4a64437a5a645152186e4b6a5641195a461b090a062d1c2f0a251617673d0325010f1b40441b131e0d4c4f505a645152186e16405641195a19651c	RogueKillerSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{08244EE6-92F0-47F2-9FC9-929BAA2E7235} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000e0e81666a06ada01	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	RogueKillerSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	RogueKillerSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKillerSVC	RogueKillerSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{920E6DB1-9907-4370-B3A0-BAFC03D81399} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000090251666a06ada01	RogueKiller64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	RogueKiller64.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name = "RogueKiller64.exe"	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKiller Anti-Malware	RogueKiller64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software	RogueKillerSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000090251666a06ada01	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{16F3DD56-1AF5-4347-846D-7C10C4192619} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000090251666a06ada01	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	RogueKillerSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a023e083d50326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455500e36041714444b6a5641195a444f414b48664d1c1b37052d5d3b072b290958090c4d5b4b4a64437a5a645152186e4b6a5641195a461b090a062d1c2f0a251617673d0325010f1b40440900071b2365505a645152186e4b377c41195a44126b16	RogueKillerSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKiller Anti-Malware\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a023e083d50326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455500e36041714444b6a5641195a444f414b48664d1c1b37052d5d3b072b290958090c4d5b4b4a64437a5a645152186e4b6a5641195a461b090a062d1c2f0a251617673d0325010f1b40440900071b2365505a645152186e4b377c41195a44126b16	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	RogueKiller64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	RogueKillerSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a023e083d50326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b110102033733065240641713543d0e667c41195a444f414b48664f505a6619134b11192f00085c0d010b435148200e1c09215d78186e4b6a5641195a444f414b4a2a0e1e1d3110155d6c516a47510a494865414b48664f505a645152186e492617124d25170c000537220e041f664b520862616a5641195a444f414b48664f52142b051b5e27082b020856141730040509240315587e51064a3b0e667c41195a444f414b48664f505a6603175a3c0a24123e5a15091f00051119011117215348186c49667c41195a444f414b48664f505a6603175a3c0a24123e49080b08130a0519011117215348186c49667c41195a444f414b48664f505a660211502b0f3f1a045d25170c0005372f01041f360713546c516a464d335a444f414b48664f505a6451504b2d032f1214551f0030120809283019143014004e2f0715150e4c14104d5b4b586a65505a645152186e4b6a56411958170c090e0c3303151e1b02115920342318155c08120e0d341c2f0215587e514214444b6a5641195a444f414b48664d03192c14164d220e2e29125a1b0a30151218234d4a5a745d78186e4b6a5641195a444f414b4a35071516282e17403a0e24050856144655411f1a330a5c70645152186e4b6a5641195a444d150e042302150e360850026e1f3803041570444f414b48664f505a6451521a3a032f1b041b40444d050a1a2d4d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455500e36041714444b6a5641195a444f414b48664d1c1b37052d5d3b072b290958090c4d5b4b4a64437a5a645152186e4b6a5641195a461b090a062d1c2f0a251617673d0325010f1b40441b131e0d4c4f505a645152186e16405641195a19651c	RogueKillerSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a023e083d50326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b3e04145c70444f414b48664f505a6451524562616a5641195a444f414b48664f520927101c562b19684c414270444f414b48664f505a645152186e4b6a54004b190c06170e1b6455500e36041714444b6a5641195a444f414b48664f505a6453134a25497056154b0f01436b4b48664f505a645152186e4b6a56411958000612001b6455500e36041714444b6a5641195a444f414b48664f505a6453164a271d2f04121b40441b131e0d6a65505a645152186e4b6a5641195a444f41490e2f0315093d02065d23497056154b0f01436b4b48664f505a645152186e4b6a564119580c00121f1b19091916215348183a193f134d335a444f414b48664f505a645152186e4b681b00550a014d5b4b0e2703031f687b52186e4b6a5641195a444f414b48664f52152a2e165d230a24123e5b1b070406190733011425371213566c516a02134c1f4865414b48664f505a645152186e4b6a56411b0a1600020e1b350a03587e51064a3b0e667c41195a444f414b48664f505a645152186c192f11084a0e1616435148321d051f687b52186e4b6a5641195a444f414b48664f52092719175c3b072f123e5b1b070406190733011425371213566c516a02134c1f4865414b48664f505a645152186e4b6a56411b09011d17020b231c52406405004d2b47405641195a444f414b48664f505a6451521a3a0a391d121b40441b131e0d6a65505a645152186e4b6a5641195a444f41491d250715192f5348183a193f134d335a444f414b48664f505a645152186e4b6800084b0f173015041c27032f0f341d1d592a34291e0e5019014d5b4b4a2703071b3d025014444b6a5641195a444f414b48664f505a6453055d2c3428040e4e09011d124952661b020f215d78186e4b6a5641195a444f414b48664f505833181c5c211c39545b190e161a044762664f505a645152186e4b6a5641195a444d1606016455500e360417326e4b6a5641195a444f414b483b65505a645152186e4b375a6b195a444f414b48664d030e2505074b6c516a0d6b195a444f414b48664f505a6453174d220a1517025a1f141b040f4a7c4f040831145e326e4b6a5641195a444f414b4864031109302e174d220a151e004a12465541494a6a65505a645152186e4b6a5641195810070005033530001b23142d4b26043d1843035a020e0d180d4c4f505a645152186e16405641195a19651c	RogueKillerSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000c0291466a06ada01	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99FD978C-D287-4F50-827F-B2C658EDA8E7} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000f09e1466a06ada01	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a023e083d50326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460c0d0e09344d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b112b4d335a444f414b48664f505a645152186e4b6810084b0910300d0a1d280c18587e51064a3b0e405641195a444f414b48664f5007687b52186e4b6a5641195a444f41491b250e1e14210350026e10405641195a444f414b48664f505a6451521a2f19291e084f1f174d5b4b1c341a15564e5152186e4b6a5641195a444f414b48664d11082f5348183a193f134d335a444f414b48664f505a645152186e4b6812084a11174d5b4b1c341a15564e5152186e4b6a5641195a444f414b48664d14082d07174a3d497056154b0f01436b4b48664f505a645152186e4b6a5641195802060d0e1b3f1c041f295348183a193f134d335a444f414b48664f505a645152186e4b681e0e4a0e1730070204234d4a5a3003075d62616a5641195a444f414b48664f505a645150552f073a1343035a020e0d180d6a65505a645152186e4b6a5641195a444f4149072830141f29101c5c11092b150a5e080b1a0f0f37350c1114664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493a040e5a1f171c04184a7c4f040831145e326e4b6a5641195a444f414b48664f505a6603175f27183e04181b40441b131e0d6a65505a645152186e4b6a5641195a444f41491b2507151e311d175c11092b150a5e080b1a0f0f37350c1114664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493913134f13070a124952661b020f215d78186e4b6a5641195a444f414b48664f5058301001533d497056154b0f01436b4b48664f505a645152186e4b6a56411958110c090e0b2d4d4a5a3003075d62616a5641195a444f414b48664f505a6451504e27193f053e4d15100e0d341d36031f1b202e11502102291343035a460e0d1c093f1c52564e5152186e4b6a5641195a444f414b48664d071f262e104a211c3913134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a31061e1e2b06011a744b3e04145c566e4f414b48664f505a645152186e4b6a56434e170d4d5b4b1c341a1570645152186e4b6a5641195a44126b4b48664f505a64510f14444b6a5641195a444f43181c271b0509664b5243444b6a5641195a444f414b48664d150f28102d592d082f06155c1e4655411f1a330a5c70645152186e4b6a5641195a444d0d0a1b3230150f28102d502f1822545b195846436b4b48664f505a645152186e4b68020958140f1c3e1b09210a2f092c1e05566c516a100055090165414b48664f505a640c78186e4b6a0b6b44	RogueKillerSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKiller Anti-Malware\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a023e083d50326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b110102033733065240641713543d0e667c41195a444f414b48664f505a6619134b11192f00085c0d010b435148200e1c09215d78186e4b6a5641195a444f414b4a2a0e1e1d3110155d6c516a47510a494865414b48664f505a645152186e492617124d25170c000537220e041f664b520862616a5641195a444f414b48664f52142b051b5e27082b020856141730040509240315587e51064a3b0e667c41195a444f414b48664f505a6603175a3c0a24123e5a15091f00051119011117215348186c49667c41195a444f414b48664f505a6603175a3c0a24123e49080b08130a0519011117215348186c49667c41195a444f414b48664f505a660211502b0f3f1a045d25170c0005372f01041f360713546c516a464d335a444f414b48664f505a6451504b2d032f1214551f0030120809283019143014004e2f0715150e4c14104d5b4b586a65505a645152186e4b6a56411958170c090e0c3303151e1b02115920342318155c08120e0d341c2f0215587e514214444b6a5641195a444f414b48664d03192c14164d220e2e29125a1b0a30151218234d4a5a745d78186e4b6a5641195a444f414b4a35071516282e17403a0e24050856144655411f1a330a5c70645152186e4b6a5641195a444d150e042302150e360850026e1f3803041570444f414b48664f505a6451521a3a032f1b041b40444d050a1a2d4d5c70645152186e4b6a5641195a444d140800230c1b252504065711072b030f5a124655410d092a1c15564e5152186e4b6a5641195a444f431e0b2e0a13111b12135b260e1512084b1f071b0e191164555058665d78186e4b6a5641195a444f414b4a330c181f271a2d5b2f0822133e5c14050d0d0e4a7c4f161b28021714444b6a5641195a444f414b48664d05192c1411531108251b0c4c140d1b184952661b020f215d78186e4b6a5641195a444f414b4a330c181f271a2d5b3b183e190c66160b0c001f01290103587e51296562616a5641195a444f414b48664f5208300150026e10405641195a444f414b48664f505a6451521a2f062f545b190e161a044762664f505a645152186e4b6a5641195a444d020701361f021530534818280a2605041570444f414b48664f505a645152186e4b6a5405580e05300d0e092d300008210717563a02251843035a020e0d180d6a65505a645152186e4b6a5641195a444f41490c290c1c15271a50026e1f3803041570444f414b48664f505a645152186e4b6a54055619080002003720001c1e2103011a744b117c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c26140410542708162a255619110204051c354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3e2b1207552b053e05431570444f414b48664f505a645152186e4b6a5641195a462c5b3734131c1508372d2e792a0623183d652a0d0c151e1a231c52564e5152186e4b6a5641195a444f414b48664f505a6453310212371f05044b093833200f052f012c26090401512d49667c41195a444f414b48664f505a645152186e4b6a56437a40383334180d341c2c2605151f5120371620085d1f0b1c436148664f505a645152186e4b6a5641195a39436b4b48664f505a645152186e4b6a56411958020613181c1903110f2a121a1a744b2c170d4a1f6e4f414b48664f505a645152183347405641195a444f414b48664f505837121356200e38545b19016e4f414b48664f505a645152186e4b6a564358080707081d0d354d4a5a3003075d62616a5641195a444f414b48664f505a645150593c00684c414d08110a4d6148664f505a645152186e4b6a5641195a460b081803354d4a5a3003075d62616a5641195a444f414b48664f505a6451505c3c023c13134a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a20061c1f3708014c2b06684c414d08110a4d6148664f505a645152186e4b6a5641195a46070e181c35301613281450026e1f3803041570444f414b48664f505a645152186e4b6a540c5816140a435148200e1c09215d78186e4b6a5641195a444f414b48664f50582b1f2d5c2b062b18056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958141d0e080d351c1509664b524c3c1e2f5a6b195a444f414b48664f505a645152186e493813065009101d184952661b020f215d78186e4b6a5641195a444f414b48664f505837121a5d2a1e2613056618050c0a0c1a291a1e1e1b02115920497056154b0f01436b4b48664f505a645152186e4b6a56411958170a131d01250a03587e51064a3b0e667c41195a444f414b48664f505a645152186c1f2b050a4a585e4f15191d23437a5a645152186e4b6a5641195a444f414b4a330c181f271a50026e1f3803041570444f414b48664f505a645152186e4b6a54175008111c3e1f07320e1c2531011e572f0f1515095613070a435148640e1c0d2508011a62616a5641195a444f414b48664f505a6451504f2b09151413560d170a13184a7c4f040831145e326e4b6a5641195a444f414b48664f505a66061b562a043d0543035a101d140e444c4f505a645152186e4b6a5641195a444f431c052f4d4a5a3003075d444b6a5641195a444f414b4866127a5a645152186e4b6a0b4d335a444f414b48664f52093010064d3d4970561a335a444f414b48664f505a6451505d3b072b29005a19011f150e0c6455500e36041714444b6a5641195a444f414b48664d1c1b37052d5d3b072b290958090c4d5b4b4a64437a5a645152186e4b6a5641195a461b090a062d1c2f0a251617673d0325010f1b40441b131e0d4c4f505a645152186e16405641195a19651c	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	RogueKiller64.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	RogueKiller64.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Adlice Software\RogueKillerSVC\ConfigBackup = 134c4f505a64531157200d231143035a1f65414b48664f505a6453045d3c1823190f1b40444d534558685f52564e5152186e4b6a56411b130a090e495266147a5a645152186e4b6a5641195a461f13040f340e1d252a101f5d6c516a5433561d110a2a02042a0a023e083d50326e4b6a5641195a44124d6148664f505a6451521a220229130f4a130a084351483d65505a645152186e4b6a564119580703080e063230191e664b521a6c47405641195a444f414b48664f5058210902513c0a3e1f0e5725000e150e4a7c4f40564e5152186e4b6a5641195a444f430701250a1e09212e195d37497056431b566e4f414b48664f505a645152186c1b2504155818080a435148200e1c09215d78186e4b6a5641195a444f414b4a3600020e25131e5d110e3206084b1b10060e0537220e041f664b520862616a5641195a444f414b48664f52082117174a3c0a2629085d585e4f4349444c4f505a645152186e4b6a56411b0e16060007372f1c2f0e21121a56270823170f1b40440900071b23437a5a645152186e4b6a5641195a461b1302092a30030e250306672a0a3e1343035a54436b4b48664f505a645152186e4b680213501b083014180d224d4a5a22101e4b2b47405641195a444f414b48664f50583008025d6c516a5443335a444f414b48664f0d564e5152186e4b6a56411b14011b16041a2d4d4a5a3f7b52186e4b6a5641195a444f414918340008031b01134b3d1c2504051b40444d434762664f505a645152186e4b6a564349080b1718341d3403524064535014444b6a5641195a444f414b48664d00082b090b673b182f0443035a464d4d6148664f505a645152186e4b6a54165c183b0e060e063230151425131e5d6c516a1000550901436b4b48664f505a645152186e4b6801045b25050804051c191c1508321400673b1926545b195846436b4b48664f505a645152186e4b6801045b25050804051c191b1f11211f50026e49687c41195a444f414b483b437a5a645152186e4b6a54125c0e10060f0c1b645550014e5152186e4b6a5641195a444f430a1d32002f093010004c6c516a02134c1f4865414b48664f505a645152186e492b03155625111f050a1c234d4a5a3003075d62616a5641195a444f414b48664f521c2d03014c11072b030f5a123b0c0d041d221c131b2a5348183a193f134d335a444f414b48664f505a6451505e271939023e551b1101020337330652406405004d2b47405641195a444f414b48664f50582c1001673c0e3c1f044e1f004d5b4b0e2703031f687b52186e4b6a5641195a444f4149042701170f2516171a744b7b46520a566e4f414b48664f505a645152186c072b05156609070e0f340c271b15587e514214444b6a5641195a444f414b48664d1e15301814512d0a3e1f0e57093b0a0f0a0a2a0a52406405004d2b47405641195a444f414b48664f50583614104a2f052e29025617140e0f1237280e1d1f664b521a6c47405641195a444f414b48664f50583614104a2f052e29114b15031d000637280e1d1f664b521a6c47405641195a444f414b48664f505837121a5d2a1e2613056609070e0f3401281b150832101e1a744b7a5a6b195a444f414b48664f505a6453015b260e2e030d5c1e3b1c020a0619061e0e210304592234291914570e4655415b444c4f505a645152186e4b6a56411b090707040f1d2a0a14253712135611022402044b0c05033e1f012b0a524064415e326e4b6a5641195a444f414b48641c1312211507542b0f15050258143b1b181b0d6455504a687b52186e4b6a5641195a444f41491b2e0a1c161b140a4c2b05391f0e57585e4f15191d23437a5a645152186e4b6a5641195a461b04070d2b0a04083d5348183a193f134d335a444f414b48664f505a6451504c260e271343035a460b00190364437a5a645152186e4b6a5641195a461a02030d25042f1b31051d67220a3f180251585e4f070a04350a5c70645152186e4b6a5641195a444d140800230c1b25271011502b342e1f135c19100013124a7c4f5258687b52186e4b6a5641195a444f41491d250715192f2e11592d032f2904571b06030449526609111637145e326e4b6a5641195a444f414b48641a1312211219672d04271b1457131016435148321d051f687b52186e4b6a5641195a444f41491d250715192f2e114d3d1f251b3e5515070e150207281c5240642a2f14444b6a5641195a444f414b48664d020e3453481835616a5641195a444f414b48664f505a64515059230e684c414d08110a4d6148664f505a645152186e4b6a5641195a460c0d0218361d1f0e664b525e2f0739134d335a444f414b48664f505a645152186e4b6812004d1b3b03040a03191f021f32141c4c270424545b191c0503120e444c4f505a645152186e4b6a5641195a444f430f0725031f192f5348183a193f134d335a444f414b48664f505a645152186e4b68120e5a160b0c0a340e2903141f360250026e30405641195a444f414b48664f505a645152186e4b6a54220326383a120e1a35332c2a31131e512d3716320e5a0f090a0f1f1b64437a5a645152186e4b6a5641195a444f414b48664f5058074b2e641b182f04126526250b0c02061a33341527041f5d201f39544d335a444f414b48664f505a645152186e4b6a5641195827553d373d350a0209182d335c2302242a3d6913071b14190d354d5c70645152186e4b6a5641195a444f414b48664f505a66324864123e3913134a26382e05060128332c3731021b5b6c47405641195a444f414b48664f505a645152186e4b6a54220326383a120e1a35332c3b201c1b5612371c1f055c15174d6b4b48664f505a645152186e4b6a564119274865414b48664f505a645152186e4b6a56411b1c0d1d121f372a0e0514271950026e0d2b1a125c70444f414b48664f505a6451524562616a5641195a444f414b48664f520927101c562b19684c414270444f414b48664f505a645152186e4b6a54004b190c06170e1b6455500e36041714444b6a5641195a444f414b48664f505a6453134a25497056154b0f01436b4b48664f505a645152186e4b6a56411958000612001b6455500e36041714444b6a5641195a444f414b48664f505a6453164a271d2f04121b40441b131e0d6a65505a645152186e4b6a5641195a444f41490e2f0315093d02065d23497056154b0f01436b4b48664f505a645152186e4b6a564119580c00121f1b19091916215348183a193f134d335a444f414b48664f505a645152186e4b681b00550a014d5b4b0e2703031f687b52186e4b6a5641195a444f414b48664f52152a2e165d230a24123e5b1b070406190733011425371213566c516a02134c1f4865414b48664f505a645152186e4b6a56411b0a1600020e1b350a03587e51064a3b0e667c41195a444f414b48664f505a645152186c192f11084a0e1616435148321d051f687b52186e4b6a5641195a444f414b48664f52092719175c3b072f123e5b1b070406190733011425371213566c516a02134c1f4865414b48664f505a645152186e4b6a56411b09011d17020b231c52406405004d2b47405641195a444f414b48664f505a6451521a3a0a391d121b40441b131e0d6a65505a645152186e4b6a5641195a444f41491d250715192f5348183a193f134d335a444f414b48664f505a645152186e4b6800084b0f173015041c27032f0f341d1d592a34291e0e5019014d5b4b4a2703071b3d025014444b6a5641195a444f414b48664f505a6453055d2c3428040e4e09011d124952661b020f215d78186e4b6a5641195a444f414b48664f505833181c5c211c39545b190e161a044762664f505a645152186e4b6a5641195a444d1606016455500e360417326e4b6a5641195a444f414b483b65505a645152186e4b375a6b195a444f414b48664d030e2505074b6c516a0d6b195a444f414b48664f505a6453174d220a1517025a1f141b040f4a7c4f040831145e326e4b6a5641195a444f414b4864031109302e174d220a151e004a12465541494a6a65505a645152186e4b6a5641195810070005033530001b23142d4b26043d1843035a101d140e62664f505a6451521833616a564119076e12	RogueKillerSvc.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32\ = "C:\\Program Files\\RogueKiller\\roguekillershell.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFileSystemObjects\shellex\ContextMenuHandlers\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\adlrk\URL Protocol	RogueKiller_setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adlrk\shell\open\command	RogueKiller_setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\ = "RogueKiller Shell Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adlrk	RogueKiller_setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adlrk\shell\open	RogueKiller_setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\adlrk\shell	RogueKiller_setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD9D4D3-40F5-46E8-B3F1-416F1A5F4EC7}\ = "RogueKiller Shell Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\adlrk\shell\open\command\ = "\"C:\\Program Files\\RogueKiller\\RogueKiller64.exe\" \"%1\""	RogueKiller_setup.tmp

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1660	RogueKiller64.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1252	RogueKiller_setup.tmp
1628	RogueKillerSvc.exe
1628	RogueKillerSvc.exe
1628	RogueKillerSvc.exe
1628	RogueKillerSvc.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
800	chrome.exe
800	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1660	RogueKiller64.exe
1252	RogueKiller_setup.tmp

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1628	RogueKillerSvc.exe
1628	RogueKillerSvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	RogueKiller_setup.tmp
Token: SeDebugPrivilege	1252	RogueKiller_setup.tmp
Token: SeDebugPrivilege	1252	RogueKiller_setup.tmp
Token: SeDebugPrivilege	1252	RogueKiller_setup.tmp
Token: SeSecurityPrivilege	1252	RogueKiller_setup.tmp
Token: SeRestorePrivilege	1252	RogueKiller_setup.tmp
Token: SeTakeOwnershipPrivilege	1252	RogueKiller_setup.tmp
Token: SeSecurityPrivilege	1252	RogueKiller_setup.tmp
Token: SeRestorePrivilege	1252	RogueKiller_setup.tmp
Token: SeTakeOwnershipPrivilege	1252	RogueKiller_setup.tmp
Token: SeSecurityPrivilege	1252	RogueKiller_setup.tmp
Token: SeRestorePrivilege	1252	RogueKiller_setup.tmp
Token: SeTakeOwnershipPrivilege	1252	RogueKiller_setup.tmp
Token: SeDebugPrivilege	2900	RogueKillerSvc.exe
Token: SeDebugPrivilege	2900	RogueKillerSvc.exe
Token: SeDebugPrivilege	2900	RogueKillerSvc.exe
Token: SeDebugPrivilege	2900	RogueKillerSvc.exe
Token: SeDebugPrivilege	1628	RogueKillerSvc.exe
Token: SeDebugPrivilege	1628	RogueKillerSvc.exe
Token: SeDebugPrivilege	1628	RogueKillerSvc.exe
Token: SeDebugPrivilege	1628	RogueKillerSvc.exe
Token: SeDebugPrivilege	1628	RogueKillerSvc.exe
Token: SeDebugPrivilege	1628	RogueKillerSvc.exe
Token: SeDebugPrivilege	1628	RogueKillerSvc.exe
Token: SeDebugPrivilege	1628	RogueKillerSvc.exe
Token: SeDebugPrivilege	1628	RogueKillerSvc.exe
Token: SeDebugPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeDebugPrivilege	2900	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe
Token: SeSecurityPrivilege	1628	RogueKillerSvc.exe
Token: SeRestorePrivilege	1628	RogueKillerSvc.exe
Token: SeTakeOwnershipPrivilege	1628	RogueKillerSvc.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1252	RogueKiller_setup.tmp
1660	RogueKiller64.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
2760	iexplore.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
1660	RogueKiller64.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
1660	RogueKiller64.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe
800	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2760	iexplore.exe
2760	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1252	2068	RogueKiller_setup.exe	28
PID 2068 wrote to memory of 1252	2068	RogueKiller_setup.exe	28
PID 2068 wrote to memory of 1252	2068	RogueKiller_setup.exe	28
PID 2068 wrote to memory of 1252	2068	RogueKiller_setup.exe	28
PID 2068 wrote to memory of 1252	2068	RogueKiller_setup.exe	28
PID 2068 wrote to memory of 1252	2068	RogueKiller_setup.exe	28
PID 2068 wrote to memory of 1252	2068	RogueKiller_setup.exe	28
PID 1252 wrote to memory of 2900	1252	RogueKiller_setup.tmp	30
PID 1252 wrote to memory of 2900	1252	RogueKiller_setup.tmp	30
PID 1252 wrote to memory of 2900	1252	RogueKiller_setup.tmp	30
PID 1252 wrote to memory of 2900	1252	RogueKiller_setup.tmp	30
PID 1628 wrote to memory of 1660	1628	RogueKillerSvc.exe	33
PID 1628 wrote to memory of 1660	1628	RogueKillerSvc.exe	33
PID 1628 wrote to memory of 1660	1628	RogueKillerSvc.exe	33
PID 1660 wrote to memory of 2368	1660	RogueKiller64.exe	35
PID 1660 wrote to memory of 2368	1660	RogueKiller64.exe	35
PID 1660 wrote to memory of 2368	1660	RogueKiller64.exe	35
PID 1660 wrote to memory of 2368	1660	RogueKiller64.exe	35
PID 1660 wrote to memory of 2368	1660	RogueKiller64.exe	35
PID 1660 wrote to memory of 2760	1660	RogueKiller64.exe	41
PID 1660 wrote to memory of 2760	1660	RogueKiller64.exe	41
PID 1660 wrote to memory of 2760	1660	RogueKiller64.exe	41
PID 2760 wrote to memory of 2192	2760	iexplore.exe	43
PID 2760 wrote to memory of 2192	2760	iexplore.exe	43
PID 2760 wrote to memory of 2192	2760	iexplore.exe	43
PID 2760 wrote to memory of 2192	2760	iexplore.exe	43
PID 800 wrote to memory of 1344	800	chrome.exe	45
PID 800 wrote to memory of 1344	800	chrome.exe	45
PID 800 wrote to memory of 1344	800	chrome.exe	45
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46
PID 800 wrote to memory of 1732	800	chrome.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe
"C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\is-54NM0.tmp\RogueKiller_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-54NM0.tmp\RogueKiller_setup.tmp" /SL5="$40144,47992881,136192,C:\Users\Admin\AppData\Local\Temp\RogueKiller_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Program Files\RogueKiller\RogueKillerSvc.exe
    "C:\Program Files\RogueKiller\RogueKillerSvc.exe" -accept_eula
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of AdjustPrivilegeToken
    PID:2900

C:\Program Files\RogueKiller\RogueKillerSvc.exe
"C:\Program Files\RogueKiller\RogueKillerSvc.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files\RogueKiller\RogueKiller64.exe
  -minimize
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\RogueKiller\roguekillershell.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:2368
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2192

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5d79758,0x7fef5d79768,0x7fef5d79778
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1068 --field-trial-handle=1260,i,14812008407528282896,12305198645022960170,131072 /prefetch:2
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1260,i,14812008407528282896,12305198645022960170,131072 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1260,i,14812008407528282896,12305198645022960170,131072 /prefetch:8
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1260,i,14812008407528282896,12305198645022960170,131072 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2304 --field-trial-handle=1260,i,14812008407528282896,12305198645022960170,131072 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1272 --field-trial-handle=1260,i,14812008407528282896,12305198645022960170,131072 /prefetch:2
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1356 --field-trial-handle=1260,i,14812008407528282896,12305198645022960170,131072 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4036 --field-trial-handle=1260,i,14812008407528282896,12305198645022960170,131072 /prefetch:8
  2⤵
  PID:2004

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\RogueKiller\RogueKiller.exe

Filesize
26.9MB

MD5
f2bdfb8163fafa1a4f147520d91645a1

SHA1
d6677e8a16c67d39c04ebb2ef36fb93e55ae2746

SHA256
beb64b13a4d002da6dbda249ada69271b17e2265098b7633a3a0caab6b3ed3f9

SHA512
4aa9502ed281bd87db0dfe9717aea5935309ff95c4e5801c2ff1a794a21b81d5bf39fc008c0922e5cbec8ed8e10abf7166f8acff5797e42caed130cefc22ac56

Download Submit
C:\Program Files\RogueKiller\RogueKiller64.exe

Filesize
2.0MB

MD5
64e0b666e91c64ae5d771a0cf6e83252

SHA1
f2b4610cfccbe4802fa66cfa7f371f3aec8ec581

SHA256
3a787454a01e7098240c1e998147434b7c9d04aad6235959bb6415f6c0076643

SHA512
ddb807cea4b82cfaf91fad35f62ab00560a9a58cda4c84f8553116633e5ce72643aa92a07c90042724b45be91ad9b2e30740cf00c04e504add9357590b24a5dc

Download Submit
C:\Program Files\RogueKiller\RogueKiller64.exe

Filesize
15.9MB

MD5
503d5778d940337f8aa6f750f0f7eacb

SHA1
2bd6749fc330eeb30782633253e4c1b3e0c04878

SHA256
b124e81ff5fcf27692e6a4b035ad1b1befaf6849fed69e3346893917ac715cca

SHA512
f0cbdd570abde1b987f5592a9cf66f9bb3dd1aea481f8dbaa2b066ee9ed624249949150b8afaf4bf6de3bc627f6be396e22bdee01e0a69d5f3dcfa90adcd5e93

Download Submit
C:\Program Files\RogueKiller\RogueKiller64.exe

Filesize
6.5MB

MD5
d6b7e2e0e3a785a8fe01fde3e7f6ac0e

SHA1
eca0d9674b43742241241cc1942cc14c133bd38d

SHA256
fffddd724be9176d56ab612c481cd49efae3e202430cda9011321a5f562f24c4

SHA512
bd4bdd9de28771ff851f16948028df28391e0c082fed644f2df999ea98758755620b4bf3c8ccbfeeacbde28e38d431b23347b0558795e004dafd6759ff87bc2f

Download Submit
C:\Program Files\RogueKiller\RogueKillerSvc.exe

Filesize
7.5MB

MD5
6e03102952347bf17afca6299ebd37bc

SHA1
8b91271ef1393d21625190a34bad385d937943c2

SHA256
98b46b5258653ebf7690b997cd89e9dc6de26cf876011a7f0ed347be5973d6aa

SHA512
311842a7b3f680852f1b5a1e7915ffa66e01154d20f5a21b23f520cbb5971f863f5b7fa7dc3c517cdd92b0188c52febe15e5108c9d56f0930dd7ec26d009c445

Download Submit
C:\Program Files\RogueKiller\RogueKillerSvc.exe

Filesize
6.5MB

MD5
6fea5215bac76813a0c1b6933657084f

SHA1
3488f449d27767ef2d461341b60abe674a32751a

SHA256
a85f7113f79ee36dbacf7b822d384a1451aefea090d7162c0d4c6f44b623a79e

SHA512
99abb0f441430dc2456c2674cb6e179681d79f91a26f24275fefce6e56aab432738e34b4064e90d643e32a4a016c67039529ee5e5ad009eee2c9589c52374962

Download Submit
C:\Program Files\RogueKiller\RogueKillerSvc.exe

Filesize
6.5MB

MD5
c35b6a061ddbb1106a7cfc35db8c072a

SHA1
8eef6bd6e5d9f928bab6980d1587426cb5170d57

SHA256
b99d8cec28e7ecb748931d84bd22165f1ed8de584db9ede5b7f48e7eedb2e744

SHA512
f744d3c7064905bb62421ee4041a59b6a01a01edcf2f6025f7de0bdc30f4340c1a2897021004f55d655d478d2eecbb930a03bb4782069a6fb41e286f44f53fcd

Download Submit
C:\Program Files\RogueKiller\roguekillershell.dll

Filesize
535KB

MD5
bc5df1e5889ec29616709357c36cfae2

SHA1
52133bc39d7b891c0caf7f2fe1e7cba2a188997d

SHA256
5ad5809c280cdd697fe9fd2ef6c8b294adbdf86024691d1c1d70b5e5f42e06f5

SHA512
cab844ce8772657a9761f9c3c46970266734675aba40b06a1207c89da199b946484e4b682a6d3c5539b3057e008678ffebf83263d354762a60fc2a9f8932496e

Download Submit
C:\ProgramData\RogueKiller\Debug\RogueKiller Anti-Malware_debug.log

Filesize
5KB

MD5
acea8cef23007aa781ee5c89a3b40269

SHA1
194c2df96a9fb4b61555e0dbbe446bc5d7809430

SHA256
7c1df1db0e9a10e9aedbd0151985e5af903d4cab2e6db4ce8a9a691ccc2f26b3

SHA512
c86aa7edcf1f20d44739bc2ae7dfe193618ff43e068d4d1991c3a12a42342428b6727e5d49ba7be36876bebfadd8ef57aab311a0489fa0db684a5f4d7eadbc6b

Download Submit
C:\ProgramData\RogueKiller\Debug\RogueKillerSVC_debug.log

Filesize
9KB

MD5
d4b7e4cd211d276acc91759b9cdf92c3

SHA1
5ce16858e12d5467e9569beb3c721c146fff2079

SHA256
d0cdcc597424812f4ac1c04ff6b8989990e139fbeae385cf93576cd5543a150a

SHA512
5cff6c08b078f1b9735723fb45e5c3ecb90c5ea243d5203786080f27d61a079d56e59f8e92fded14deec721377064bf7a897645490d972c3ea62119d9c994103

Download Submit
C:\ProgramData\RogueKiller\Debug\RogueKillerSVC_debug.log

Filesize
901B

MD5
487168f55b54cdb727a91d8070ea42ac

SHA1
fe5fc5ca58da0b4d546b5dc7460617c36ba3cd15

SHA256
42ad3017d99e599f1e75e4f60a0dfd2257911468ff10f53ff722dddbb2b4d8e5

SHA512
15221707afeec753de1641ad8ebf3632f8d1b2bad18eff1b3edbe7de5fc968e952fd04c30b9aa4e791888eb7c9ad203e4e513a4bf78a68060bf7198cf3869088

Download Submit
C:\ProgramData\RogueKiller\advert

Filesize
22KB

MD5
8006b64df8ce08a57fe87420b4a6107f

SHA1
b404ce6fd5a37de6ffc2319e55dd506c0b21e162

SHA256
1d889c66fdd75d8ffad931318a857b466d2fe75654f653eba3c030031b90fb74

SHA512
66ef6a2ddfc3a5e95a12f88fade50749fb8bd233f67777ab6ea1e1bab59b842350bf195245faa5b6cd232e1f3bee82da89a576c1e89b5a5aee031bb39cb6df5f

Download Submit
C:\ProgramData\RogueKiller\config.ini

Filesize
2KB

MD5
a010a3c330740f7e44c82f0df0940273

SHA1
43daefa516a0af64037ed03c4318d6a57d53c239

SHA256
78ac6adec6ba7e20182e0b5bb59e02fcdf8427699bc00ff986d4cb3546ed36d4

SHA512
8423f758f5e9464ddbf22bda170ecb56cb088c1c73cf9ec0b401f84cb4daa672646f0c8732f4ed06bc5e08b9c99d7eafbca2814a65dd6ea96de512ede3e9edd6

Download Submit
C:\ProgramData\RogueKiller\config.ini

Filesize
2KB

MD5
6e2b791f8e4c5fb07759a17261a69ff1

SHA1
0713a09d331a9dcb75aea661ed0b100c9759e8cb

SHA256
b81edd4076167409ef70cc7d9bf42ae927920c35b348e1e8386adc5d3f2d539a

SHA512
3426fffeffd4779f23d6c189c8cb8ecb6eda7fca30752c6a25691296e944e9f7114eb04e4bd698b9d69c434644ef64f827d4b2ac48fdde51e26ebad89460246b

Download Submit
C:\ProgramData\RogueKiller\config.ini

Filesize
2KB

MD5
042fb2b503b6350a23824a3d4bc13a22

SHA1
7267f147ab819d8715be818523d873683e620991

SHA256
a5997d9688d5396bb9df6b8c700396f5a45f327396eb3c2f0501a9f3c0973d9b

SHA512
384a4b97d41a7d3b99d9e0ee4bb459fac9280311980510746ef010442803dee5fec0ac5999dd80a6d70ce5d82976868951217514dff69f768b207470778b579c

Download Submit
C:\ProgramData\RogueKiller\config.ini

Filesize
2KB

MD5
dfdd463afc0be9fb503ea148f4a40ec9

SHA1
63b92fa31f20017367d09034597f1a76fa23f988

SHA256
2cf94739973bf899992935b365a266b226342f1dde87c06617b0103a6fa4193e

SHA512
62a41efcacfa281a243736a543ba4e025feb1025f874bde30d8bb472cf242f35a20b107e5f4e2dd283fed577543fe3898b6449ad9d6eb0323b851dfa6e63feab

Download Submit
C:\ProgramData\RogueKiller\config.ini

Filesize
2KB

MD5
05d384573dbdc539d000a658cea735d4

SHA1
b381a6b1bc70aa77b184ed0f1099fe734fb1d948

SHA256
306ca1f71bd4ca216a29287c2639cc3f6879d854707e975ffb477c71ddf1893b

SHA512
c86523e23258ad4331602d7b73fa1bf4866dfa2779efdbe25a787a779405df43dafe4e833b51fabe8ee0f1c5be124e55dc257ca7ddadc922787e6aebd848ce5d

Download Submit
C:\ProgramData\RogueKiller\exclusions

Filesize
18B

MD5
f46ef257534139a88f49c91b5ce8ad56

SHA1
37bf8547e48383141c0d5bd8fb986b9b2973f650

SHA256
d8c3ace08558bd4aa2a1643a10c55a151a6a4f46ea6f5670ae2da135a9ada71a

SHA512
274caf3069df6bf932a80f5c939293a24c71ba51cba53cb0a2b6985ce5c55b0fde9adfb1f515885f8bfe056c017451a3d40e339c3c16b723c423d0ce5fb08442

Download Submit
C:\ProgramData\RogueKiller\scheduler

Filesize
1KB

MD5
9bfac8daeb8e0e06f7eefe39242b818f

SHA1
2863431b60b87945bc7f385d7c5512f5ecac4da7

SHA256
74e715084cd9f8f2e905c234337caa2bb2f353c13acbbdc2d21504eea82220ae

SHA512
06224849f0cf1dc5801aca09332332d50f7e9fceb56f9ee52e1be0c6c0e8ecaccd060248e9abf7e854d950e3920ba2f5af132a1b5f43037095ee7519cdc39743

Download Submit
C:\ProgramData\RogueKiller\scheduler

Filesize
1KB

MD5
039ab46f874d7aec81149cb46d6c5abc

SHA1
0543a8ff2a0f669f10ee8fab6fd6937ed9225563

SHA256
6be3a642cbc5893097dfe226a7f430c35f60714166f24dbf1a20888a9b2a4fda

SHA512
ba7d1b615dab9264d641aed0988b12a9d38517529e427de02aa5cbb683313a0581e50003b9f962b21be8fda9ac88856b9e6069a4c37999a89fc4ff30d349fb3e

Download Submit
C:\ProgramData\RogueKiller\signatures\FILENA~1

Filesize
4.4MB

MD5
d3d0a832e6fbe74e09a775f0b2949e6c

SHA1
6deafed954712f37b6ba4910371acc0b2dbf42f9

SHA256
16f62fd1ca2fa4795a427be6bac642ae5bea55f6bfb80541a0dbcef6cd78209f

SHA512
ad103eee8c7c82c5fec296e23c1b7a8b722d19ba819ed34d74b962a5983228e262d529f613edc499faa54fa8326a45af98a87ca82288d3e71226e2e330ce4ab0

Download Submit
C:\ProgramData\RogueKiller\signatures\SIGNAT~1

Filesize
103KB

MD5
628d3c71a815af84d4ad474cff1d633f

SHA1
1c4107e580cb6969636f485b0afab574a4860fff

SHA256
bb70ff20f4ead7359ac1b13b53fbbea6a50cca7ad724bceab4f8e9eb25370430

SHA512
d016ec6002aedf7046300c2b535b7e57d193b753ccabaf97773bf57633d1f602d028d7c514a66e6e9e4648dc9af4e13f2fc18613d3b034f2c183946be04b5e54

Download Submit
C:\ProgramData\RogueKiller\signatures\WEBCON~1

Filesize
22KB

MD5
c6247bff46c830c8d22a14e894f74fe7

SHA1
dc87098b3be3af8a5920cee1e83a9005388a3039

SHA256
0215c47f456ca5c35464276613385f06a342cd58e790497b1ed9fdb33e79f7c1

SHA512
588e873170a9ee588c24e9678d54e4397f088cb08d074f132137abf5eff60e3dd2e8a8ebfc8ab15e608a4999c3b164b7db96ff87a584abd2939508f97f1b25f7

Download Submit
C:\ProgramData\RogueKiller\signatures\addons

Filesize
1.9MB

MD5
33f91c26e5e3c3d8210364686dbdb42a

SHA1
97e2563d279a45eaff58a2115d165bf1816a8927

SHA256
5ca69e23452497d1585b22cae0872f441cec7bde8e5d9634996d90e22e77190d

SHA512
01aef51d04687c1d7322a9e74a65d2d452d0d1bb7d80a111438edc90d2824226c45f96942a7ba791f010cb12464ab678d8371a64c43d761f7b1995c0318b6fe9

Download Submit
C:\ProgramData\RogueKiller\signatures\digisig

Filesize
65KB

MD5
329906749d35de4bfadd487bbcd8d7c9

SHA1
6b80629cdbd2430faec00dab16cd11dcc06fbaf8

SHA256
af8293c490320de8fae3c45e22b40523c22d952d5282b69dd05323b4cbc55b41

SHA512
9b8958e5b4fb62c374156f34d9d178a4118c97ef35803383f49285cd5dafef15314523f0004e37aafdfa7813ab1682f63859d858c5f5ba0d6dcc0be9bc9e2777

Download Submit
C:\ProgramData\RogueKiller\signatures\domains

Filesize
342KB

MD5
ab5523ccd0943e0ff5dea1fcdf51fe58

SHA1
c6d87ab55cbd56c25d7afaec1a27a63f263674b9

SHA256
30ace25c44a409b5b3319e7b39ba927fe97ffbce02b8a200d487637e2d2c1422

SHA512
a47354f55282963ffcae3c0cda0ca86a411bfc4dbfd7bfda0e31ceff96ae5c8d032d3cd1242b8ac4fc23eeede715b2870d4edc1eaaf4e400145c5035c35a8a3f

Download Submit
C:\ProgramData\RogueKiller\signatures\filenames

Filesize
7.6MB

MD5
2d7784f4f681f53d9a5638c0f00434af

SHA1
1b9e3bc2e45f990462a0e5362bd54473aaf95b8a

SHA256
3243d5b66ab9eed530ea0b758fc4b4b637c461ddcfa2005d09227cf34db3d396

SHA512
6d37a0846f4e2e10a5a4a634134b359fe82463eef966c056e09e196832c6b020e2352d93028d03626c289b1fc066f08d5dc79813deec815e12dc27f9ae5d0d40

Download Submit
C:\ProgramData\RogueKiller\signatures\guid

Filesize
2.3MB

MD5
c59a25afe626829a3500a58842b4a15b

SHA1
a5e0c5f890b31598b77c518e228d70cbf12a6c50

SHA256
efe60f18b4960204ea81ceebee5ef1f9af27639a7157d0b5f28db51106bbf6ff

SHA512
5bb7d755185ca615b469695dacd228eda10556112fe43b0cd11f669d5f606bd9efed950e3e07716e77e63fe6124021c24e2add62f34ae1bd92cf6872263eee1a

Download Submit
C:\ProgramData\RogueKiller\signatures\hosts

Filesize
44KB

MD5
b8c0d2cc9873a23e8ce503896087c1fd

SHA1
d18d4bf4f68ea88957a11ebd9968bb68225ac007

SHA256
c2d419f357cc62ec519c92f183ce6eade306b802d9187baa20d2cf5a26d1403c

SHA512
4b5cdbcca223db004e7c2e007d915538b746b1079da1a44fab95457f410108ee31b074b0eaa529437199cddf3a01b40b8bd1d40b83f11ca36e998fa4951a02e2

Download Submit
C:\ProgramData\RogueKiller\signatures\ips

Filesize
30KB

MD5
69dcc0d7ac2a7e41ae6161dbfd3eae71

SHA1
3a26daa6dde14f53c0fc09d55ad470454c8f72ec

SHA256
01d549401b74ed866516324d5165649bdaaa361ffdc0104aca433ee6d18f57a0

SHA512
38ec29835839f32642720045913873a971178e5b3da09ba66d930e4958ed0383f6cfa23e166969c6b9fd63bf9ac1044b19338ddc6d723934569185ddece9ddf6

Download Submit
C:\ProgramData\RogueKiller\signatures\mbr

Filesize
34KB

MD5
ac0af67ad50f7e3c0595b4e984523c73

SHA1
5f00dcb6f1ac3c697decfd521694d23a834792c6

SHA256
daed8d7bc6a68a801b7a72ead6f0e82db6e3cee7674229c1b847ad1f7c44d3c3

SHA512
8d94d46862ce3dddcb281cbfb9f60a36f7d902889346ad1c3f4f903977ccf9693cb5fb1ad1ef0596ad2143c49a3b74bfc417fac8701233d4d2f21bc18a68ca05

Download Submit
C:\ProgramData\RogueKiller\signatures\pdb

Filesize
59KB

MD5
0c17d2dc0aa82c6732dc874cff047845

SHA1
0d32126ae9448ab8685791dd33b188f9135f69da

SHA256
53ed6e5822a9c72201a18b7f87c87b3276ef6aa9bcd04a092bf1e727a7af38dd

SHA512
364d92f652cb66fa700400853fbb165a31713bc2ca1c025c55bd9906ceee5f2f7208817b505d1d286e5339f36d42e2888798ad0bfdc3866b8c18e5d47d9a2426

Download Submit
C:\ProgramData\RogueKiller\signatures\regnames

Filesize
3.8MB

MD5
06540b8805a6a3ec95c3aa24b605488d

SHA1
746dc3cdf93a30f1a96488eef49605907e20012a

SHA256
fbb4be7a69a9bda1fd3a0154e3522f9f592069de8b1d73efa1d5852505c089db

SHA512
54dba524f1ed1baafd12287dc221375053dbfe43d405589951a16d833d21af4bd961c96222ab9082afcf6c27fb7a7cf9c5cbabc3fc03987d30a1d86da07f82e6

Download Submit
C:\ProgramData\RogueKiller\signatures\regnames

Filesize
2.0MB

MD5
67859b4d03237888014a30debfca5091

SHA1
af23b3e9b1386017c4704878325e11c7e2f28d78

SHA256
c2dc62e89f4b8d4078773ced0e4d230436129632869b9b9eaa5cae23b8574ade

SHA512
a07a6858c85501e9122e958e7a62e3c01c843842b4dd0f308a087ddd9612c36ce2980a8b5e8db6a3b20069c670651c5660f68f763b8fc64b1f505db0762fc814

Download Submit
C:\ProgramData\RogueKiller\signatures\services

Filesize
532KB

MD5
240ea2721ec6a9b3d2f2cc244ffd0c1f

SHA1
a7bba55420c17b959490ae5cc8e7103b7721f419

SHA256
feff3706926c5a0d19ca9cec0bc14163c03504d61e7b88fa09a04faf6833bba8

SHA512
3df9d33f2470c615e702bfb64a08af8b31c2156ef47b786f162a2c97b9e39a9621ebc0912e4d06540ce05bb4b7ee6e4707d43a4640477af8e5c786b6a38ea95f

Download Submit
C:\ProgramData\RogueKiller\signatures\tasks

Filesize
596KB

MD5
23bb2e11865a8a16096515694129280e

SHA1
6872c10862bf87b0b2b95acfb3404e9de04a0dca

SHA256
397bad7105a6324d69e37f3b65e6a640d68f9b26593377dbbfd1660d5984ab44

SHA512
0a80b12eacbfff4ab45419acd6d2eb99435a6577e5ff4840155e832ff61ad38b93ec865eb6189021076e8be73b4df3a9bff3bf10ac8201c1ad4c309dc7fc279b

Download Submit
C:\ProgramData\RogueKiller\signatures\version

Filesize
32B

MD5
815f69208286ef6f8628beb0328add50

SHA1
1d73f309e2369d60b05395da1154a0529defbe1c

SHA256
59af6311c61e12f31b04c9c55d21f19d5c375b687e760b1c9f13d4e5d5451d8b

SHA512
8c5bd2fb1610fcf8d310c99399eda7651a89a233ab371e2a1a6c74010547377b664f4063616ca53fb96d662e1a028524aa6ef0785383a02ed1684a66314ac561

Download Submit
C:\ProgramData\RogueKiller\signatures\windows

Filesize
65KB

MD5
0ffefc6fb47c9dd8bc04eec45d9f0576

SHA1
87daa1a3367dd71e59549b1ae807286915ec0d77

SHA256
8e178204cffb9a72a9da771639ad110c407d73b9c7a2ec05d0a9243e85ba4d41

SHA512
7c9175732237c1fde67dfd415ccab7d72335ae0a436cacf5926a5f2c0d72a685b12ac60c3493095ca9005af6304f7093a3ca37b2050e98ffd7881938d9a6713b

Download Submit
C:\ProgramData\RogueKiller\signatures\wmi

Filesize
9KB

MD5
9588c487cebf881601f9799f65cec4e8

SHA1
5ddefc77d512a25f06525bbaebdb0265003ad6a9

SHA256
e6f37008cb50ae72957b6115ff31b97d8df7271f3063e4e63366c7b3cda64de0

SHA512
e219d17291bd7489c72a31327442490a64de3575ccc24b1d1468b50d0fe1599d59241a28007cba801093c81f2a932affa266a6486ba2f18443c1ac876f33135b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6e45b2e5-baa9-4f82-b616-6200c749b056.tmp

Filesize
255KB

MD5
68ad2119c4970f7f1948aad8e50a1a1b

SHA1
721fc8b71a065d8187047e010b777f753683e6a8

SHA256
c90edb1ee7078c57aee39c6d6cdcdd7a2772b0cce95fe33993d6736255af5018

SHA512
0255e4f8ab891e6937a094270d5382835571b851370e4a63be59f84b4afa49a6283db86e2856491123226d37bf8727991f6cc228dac68b56456589cb32b32427

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
bceacceb0bf2a5d8fa5fe3415140deb5

SHA1
8bc375a1cde0682eff38aa0cba381c55ea9a452c

SHA256
1f6baa9ff5dc8a0b33d5b201a82a46307d80bfddecf4c501c4311a2833d0b615

SHA512
3d77eaa058ca9be8105122b189935e2e93aa59343ada90f2b4dbc2f973d940de2eab488c887485b57f1e9f5cc881b1d9b81ed97b39aab35de827c6046ac689e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1e74b3059d399fa78abcb84c3ebb256b

SHA1
cb4224150b3b76abbfd04a00785860fecf6cac9f

SHA256
dbac5d4993b7a7379da54fb3985c0d800f7bcbe696ff66ec94a81f7a1b0da967

SHA512
7269698856cc03e1df46a27fd24fe95fff92694c6acb2c2e7f3c58a004bcefe46b879cfa3b73b7a99605642c1dda5ba66d1f5d3bb527d44a6dec0417f1def9fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
255KB

MD5
1df3e4571c822278ddae9ca64cedf829

SHA1
996d00cf1ce67e2d3216257a237537ec0cc656cf

SHA256
a54fbd42529ad575663d3a1738393223bdfa34ec585f633a970d57488c6d88c8

SHA512
f47ab80f292c40c4e69d080bb9e8220998f0efb6e10054f3f7a151e0d6e8cfdd13136c2ff8380caf36bcaaa5111a24a5dab627bb2dc1aa67a046e6487d02bd26

Download Submit
C:\Windows\Temp\as_5419.tmp.zip

Filesize
4.3MB

MD5
e1e3e9e3b688182f0e7b902d1bbd420f

SHA1
c4307ef177f8f17382fae9ce442e58ddbb03896b

SHA256
95e9946efe3505cad39babcfe5cbded9056a19612ee410a81014b38e4111c3ea

SHA512
c2a564e0159390bfa430701baae66b785d578d33bfb0cf47552ccec0a9253b6a4ef1aa47704b5256e8132a1a189fb1a92fc2a67a4bc6f7b676e1de071550891b

Download Submit
C:\Windows\system32\drivers\truesight.sys

Filesize
37KB

MD5
bf514aa5d5a02ec8eb8d6ad50607a6f3

SHA1
c4739d9dd48ec1fae4ae47221515a06de27439b3

SHA256
4a4899da2070261eff91c71e2fb1f8ae66be95850191ee6c49e95fdc2133d038

SHA512
51fc1951120ac3fecf817a91a4b5229befd9bf110520339b94f69eead24e896247a58c3a4f9374e7dfc0be18606876a1c890f471b8672d569dbcccc30f864865

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
2.9MB

MD5
a7646e5414972ff32b4d77cf6314299c

SHA1
416bf5f68fa31ba047afbac04ff85e9efbbcda9b

SHA256
f8e437301e0a0ecf110f3362a754a7fc98b559a4bd38a7f93a39dad61ab45098

SHA512
1ff5dc90953d3c8298b27b27f970b7ddf04a0b4ddb765284b235e131e35991eb813f753a83ac4b3881fdc75f1b879554d2adc03c47f28147c1ba1f09efe20289

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
14.7MB

MD5
2f191dfb7abc12190a93ca32e5a40640

SHA1
668fe0a962712c4826bf8f0ac97c1ecbf8a03156

SHA256
a887700bf02824b0574271df769c0d531bab35fd1fe802d072ed0545ef307d2a

SHA512
ca0ecef1d957d71f9f19e94e5e78b1c8be83d85536e303173e03b3e1304b8ebd12b2d0ce40ff405ad48ada1d839caf5e088275140bb82ef980655a949100de54

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
15.1MB

MD5
9c0b689c8060797d5b1b9f64c44f9bc9

SHA1
ed2ecaaf780738527fac7a49e6c41c0d29fcfc48

SHA256
987f91fe3fd02da0e90955dbca775a56b7464e349733b93f2a70882690100f38

SHA512
312ea0762fca7d2771fe36e49c421491372459bf20043eaaee99e7fec70e59b10f409721dd6799c81df1db2a402c9c947222320a05bf251556341f5ba5eb6491

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
8.3MB

MD5
14d60188fe1b5b6ce446cb9c358017c9

SHA1
ff899a6d2b823ca194a063812b083afa57fe328e

SHA256
2458806944de13e4b9d996b9afc6f6387a2d35dd7e4e99132aaa0df893ac1439

SHA512
f16c40964a748b7c2248d05880d3353b3eaeeb1a20a93070ad60ed1f5c2965638c59bb77746831137e62a6b50ac86b8ff3489444f35cc28e5225a73f3c4bf545

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
9.8MB

MD5
6bfa6981502a7a3ed04e13cf8e0e362c

SHA1
3a0bc5fe8c428e39707d7a79bf6cfd7f5ca91920

SHA256
aae04cb9deafb413ba5f3e7fcaf23dc063c5d6a354a7da67d0141073e0aa6114

SHA512
2c73a21168ef59d1daf8158e64cc714bc10a97e624a5aef918c90fb4f8a2f8c3ecbd55c34fe2b48f04b0a5822330133bf8cc74930f2c6911a2ae168bb7a08198

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
9.8MB

MD5
a8b462926a7e6f5b7dbee1efe7401f09

SHA1
f48378d6ba669f4cca3362ee0e28e34e8e2bd957

SHA256
02b70300a77773f09062fbe4de9e1dfef27cb2efca320179912bdf0ded885956

SHA512
ea21eae0e323c029122d191686085f448668b993086744655b62c3f5a286d16c7aa91e54895102c1073e64e771234f5c5dae8b91e6a2b593ee06130784c80ff3

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
9.2MB

MD5
6431a8e1de54429072b9d4a882f94191

SHA1
fee27758ccd22a486bd546a5d20e9eaea631d580

SHA256
c3a14f129a746e5bd3b7fa16c59079afac882fcd7803f4badf86713eccf696a7

SHA512
faaa8304d7477acb3838a80e1e10ebf3b7212ebbf4f3c2bb9d6aacc29a8b7427a8eb2ab23f08c078f610e050c0f27660b9ffbe280402b00b93d174744bc7495b

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
6.4MB

MD5
0d0aee52b90c492c03b608c0088bdf7f

SHA1
23811288fb48aacfdd6d05d0e0528005a5431f67

SHA256
63ad5e09f346fb4ff1e567ccc8460f20899791bf0cb8984f553f390c724caabc

SHA512
2c8496158654e4e74191d7f7b29f10fb2c26fb18600bd4adfec5c565fd68735708975854b069b490db8bb4500cdeca127e8d8872e78b479e0ba4340ed77d5adc

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
5.5MB

MD5
9e77fca3c9587cf4f1c13713ade1ea0f

SHA1
a056f87eaeb7a1f2efe9e006a9a528f38fcd0696

SHA256
bb409a01c76563637efcf8d800d2900137f8c4827566cea45b42294d00105bd8

SHA512
f20d413d03e1ee620a56051d542fc9cd80c798e2c68c47b8201b125155c487fd16a64fc748453186019230556a798f0cb97576baf1ad998b8a07efccce213565

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
6.6MB

MD5
f0ab6fd09572b85bd9ad44130a60a8fd

SHA1
f76a2eb21a25c577ae2fc452f0e8f64e48f86ca6

SHA256
03af3e8d5b93c0b61a112eb1404e8d23b36ccfd91d1c70345d56938876eae926

SHA512
46eeb74b2cc376135aeab10072d25a20cf1200cc33a6c724307628cd8e679828bd6f31616f56e067ba1b2123c967dfb2fe4f7933067d7899844dcdee8f4cd80c

Download Submit
\Program Files\RogueKiller\RogueKiller64.exe

Filesize
6.3MB

MD5
5730ce09fea4e6a68126fc97ee685013

SHA1
8d27e2a870a4516874fba2fd631a9ff5a105b7c2

SHA256
947fe873027607b72f0f054c3907cee7dda1e733f0d43932b049467ec942d1c6

SHA512
2fd2498a705dafc7ae49858b04e650d25db99ea9345c0c7a1374f755f511e6eb580826916b7abc7868d0c0b137630493917bf02fab273c09d076bab31251685c

Download Submit
\Program Files\RogueKiller\RogueKillerShell.dll

Filesize
1.9MB

MD5
86b883689d8d2535ca23cf478810f91d

SHA1
0adf3d6153bd45ce72d2e659fe97185cf6956e97

SHA256
55470a0b05b7783cd404052b0d892e3496cec359148da8b2c446a9a72397286f

SHA512
781ad0f336370c3e665f46b9f10dfd9137a2f4ab408cef07c86749e38c41db8c0f3dbef1249f6f5526f019dd98f46c3784caef429dbcd39d615db6b804f22b4f

Download Submit
\Program Files\RogueKiller\RogueKillerSvc.exe

Filesize
6.0MB

MD5
84c3f52c1d98dcd91e80d03b6628f5b8

SHA1
2b517213ed51b85d3a42b609ed39848b0d0a511b

SHA256
9f51752d2f6a11fdd8a276fa5579cd9bdf30f0e92f29646b4df9ef82b651757f

SHA512
2b772f66c1634da858334413599015aba20dd5e311adbc88a4a4197038b19b45a8653ab39329ec02b29d9ec1920f2c04385adbafc405d1cd1f78e7509afcec6a

Download Submit
\Program Files\RogueKiller\RogueKillerSvc.exe

Filesize
6.4MB

MD5
5f4b92e3af3a3c5e6de74544545a5c97

SHA1
04300d0ea81c15262438a209341cb2678294d299

SHA256
24f78217b128bfd5c8a8de6e022d59f6650c542bb706a092db9d0ec7822c4653

SHA512
73d5cc2629cbbd1fad921c66f0bcee6894ce999e6b42d78f7b7123515330004f1e3907b8b5cccb7c6e2a5c23be11b6c4a835b033d97b061fef1bbd60953846ee

Download Submit
\Users\Admin\AppData\Local\Temp\is-54NM0.tmp\RogueKiller_setup.tmp

Filesize
784KB

MD5
b2887d41753b031e39037f44583765c8

SHA1
18ff5ba679e4747388cc77febc88ee92d7802828

SHA256
e2fcdcf1c447cb0da876eed12d74fe612e31677a9e433ef4ac5fcdbb34dc5a10

SHA512
28202b0e3d9af75e5046b5cccdc2bb0874ae00a3cb2daf7e32a78e342de92add25ef58318411896975949a5b82dbb401d4896deeb4ab6343c123afe38469e3e3

Download Submit
\Users\Admin\AppData\Local\Temp\is-8HT6S.tmp\roguekillerdll.dll

Filesize
5.0MB

MD5
d138d33e04d9fe932a28ce27f6b2ffdc

SHA1
02fc5c7be8ae2b7893e6191e9683d1fb19eebf12

SHA256
eecec38966cce281a516f8a1f2e25e5a50110d89aff0959c0665a5ddf5606eaf

SHA512
4605e28fc17682e2802842c714feb4b8ca1fb4fbb5306a79cea8822f9b597286dfe6532add7fcde82291908e035e0db149009fbec0d24815f9127a91be6791d4

Download Submit
memory/1252-25-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1252-7-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1252-224-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1252-344-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1660-419-0x0000000000650000-0x000000000065A000-memory.dmp

Filesize
40KB

Download
memory/1660-420-0x0000000000650000-0x000000000065A000-memory.dmp

Filesize
40KB

Download
memory/1660-364-0x0000000000650000-0x000000000065A000-memory.dmp

Filesize
40KB

Download
memory/1660-363-0x0000000000650000-0x000000000065A000-memory.dmp

Filesize
40KB

Download
memory/2068-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2068-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download