infinitylock | 7b82c3211ac2385422370846a2873f6dae0f6441b5a96095fb08754d23ef71f8

Analysis

max time kernel
120s
max time network
149s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VCDS-PCI-15071-Installer.exe
Size

27.2MB
MD5

07b471064f26c23a28ae21cbc5c6ec07
SHA1

8fd8b5a7289e26aaf48397b89e0f6653cd43082c
SHA256

7b82c3211ac2385422370846a2873f6dae0f6441b5a96095fb08754d23ef71f8
SHA512

799181487ea18e4f82ca992b8266a7cedcf24d50eeccd4b589ab4054c10610eb44bc7990cad6d38a97ff42bb2f0b857b71857297a8bbde5f33f6a2d7432f3054
SSDEEP

393216:HWoSq/0R7XDdADriXkOG3aTGbz0SDTjIjSk3iO/r7HH8tQUpgrbs/iVA:H7ps7u/iUr3lMiTjIv3ifbpgPs/iVA

Score

10^/10

infinitylock link pdf ransomware upx

Malware Config

Signatures

InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
ransomware infinitylock

Executes dropped EXE 8 IoCs

pid	Process
4176	DPInst.exe
4300	DPInst.exe
4360	DPInst.exe
3244	DPInst.exe
3092	DPInst.exe
3288	DPInst.exe
3096	DPInst.exe
1264	Process not Found

Loads dropped DLL 11 IoCs

pid	Process
292	VCDS-PCI-15071-Installer.exe
292	VCDS-PCI-15071-Installer.exe
292	VCDS-PCI-15071-Installer.exe
292	VCDS-PCI-15071-Installer.exe
292	VCDS-PCI-15071-Installer.exe
292	VCDS-PCI-15071-Installer.exe
292	VCDS-PCI-15071-Installer.exe
292	VCDS-PCI-15071-Installer.exe
292	VCDS-PCI-15071-Installer.exe
292	VCDS-PCI-15071-Installer.exe
292	VCDS-PCI-15071-Installer.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00040000000252e6-12039.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
66	camo.githubusercontent.com
53	camo.githubusercontent.com
56	camo.githubusercontent.com
59	raw.githubusercontent.com
60	raw.githubusercontent.com
65	camo.githubusercontent.com
44	camo.githubusercontent.com
58	raw.githubusercontent.com
69	camo.githubusercontent.com
70	camo.githubusercontent.com
67	camo.githubusercontent.com
68	camo.githubusercontent.com
71	raw.githubusercontent.com

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\RT-USB.DLL	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\SET9A8C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\rt-usb64.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\SET9A8D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\SET9A8C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\SET9A8D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\RT-USB64.SYS	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\SET9A8E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\SET9A8E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\SET9A8B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\SET9A8B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\RT-USB64.cat	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099179.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\TIME.XML.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_am.dll.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21512_.GIF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADVZIP.DIC.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Aspect.thmx.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Adjacency.eftx.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287415.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02127_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.HTM.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HTECH_01.MID.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0183174.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15056_.GIF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Essential.xml.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0205466.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099176.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174635.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02263_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.CNT.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FBIBLIO.DLL.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152602.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188667.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Flow.eftx.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01298_.GIF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00531L.GIF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\PREVIEW.GIF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01164_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\PREVIEW.GIF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Civic.thmx.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02886_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187849.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387604.JPG.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00956_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00192_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086426.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00941_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01561_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\SATIN.INF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090781.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Apothecary.eftx.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\SONORA.INF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\SUMIPNTG.ELM.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00034_.WMF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0075478.GIF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\BLENDS.INF.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\VSTARemotingServer.dll.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{E285345D-6578-4F37-97CE-FB505D8DF788}\chrome_installer.exe.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02223U.BMP.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB	[email protected]

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DPInst.exe
File opened for modification	C:\Windows\DPINST.LOG	DPInst.exe
File opened for modification	C:\Windows\DPINST.LOG	DPInst.exe
File opened for modification	C:\Windows\DPINST.LOG	DPInst.exe
File opened for modification	C:\Windows\DPINST.LOG	DPInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\DPINST.LOG	DPInst.exe
File opened for modification	C:\Windows\DPINST.LOG	DPInst.exe
File opened for modification	C:\Windows\DPINST.LOG	DPInst.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/0x0006000000016cb9-31.dat	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[email protected]
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[email protected]
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[email protected]

Modifies data under HKEY_USERS 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4176	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4300	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	4360	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3244	DPInst.exe
Token: SeRestorePrivilege	3092	DPInst.exe
Token: SeRestorePrivilege	3092	DPInst.exe
Token: SeRestorePrivilege	3092	DPInst.exe
Token: SeRestorePrivilege	3092	DPInst.exe
Token: SeRestorePrivilege	3092	DPInst.exe
Token: SeRestorePrivilege	3092	DPInst.exe
Token: SeRestorePrivilege	3092	DPInst.exe
Token: SeRestorePrivilege	3092	DPInst.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
292	VCDS-PCI-15071-Installer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2940	AcroRd32.exe
2940	AcroRd32.exe
2940	AcroRd32.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 292 wrote to memory of 2940	292	VCDS-PCI-15071-Installer.exe	37
PID 292 wrote to memory of 2940	292	VCDS-PCI-15071-Installer.exe	37
PID 292 wrote to memory of 2940	292	VCDS-PCI-15071-Installer.exe	37
PID 292 wrote to memory of 2940	292	VCDS-PCI-15071-Installer.exe	37
PID 292 wrote to memory of 2940	292	VCDS-PCI-15071-Installer.exe	37
PID 292 wrote to memory of 2940	292	VCDS-PCI-15071-Installer.exe	37
PID 292 wrote to memory of 2940	292	VCDS-PCI-15071-Installer.exe	37
PID 292 wrote to memory of 4176	292	VCDS-PCI-15071-Installer.exe	41
PID 292 wrote to memory of 4176	292	VCDS-PCI-15071-Installer.exe	41
PID 292 wrote to memory of 4176	292	VCDS-PCI-15071-Installer.exe	41
PID 292 wrote to memory of 4176	292	VCDS-PCI-15071-Installer.exe	41
PID 292 wrote to memory of 4176	292	VCDS-PCI-15071-Installer.exe	41
PID 292 wrote to memory of 4176	292	VCDS-PCI-15071-Installer.exe	41
PID 292 wrote to memory of 4176	292	VCDS-PCI-15071-Installer.exe	41
PID 292 wrote to memory of 4300	292	VCDS-PCI-15071-Installer.exe	42
PID 292 wrote to memory of 4300	292	VCDS-PCI-15071-Installer.exe	42
PID 292 wrote to memory of 4300	292	VCDS-PCI-15071-Installer.exe	42
PID 292 wrote to memory of 4300	292	VCDS-PCI-15071-Installer.exe	42
PID 292 wrote to memory of 4300	292	VCDS-PCI-15071-Installer.exe	42
PID 292 wrote to memory of 4300	292	VCDS-PCI-15071-Installer.exe	42
PID 292 wrote to memory of 4300	292	VCDS-PCI-15071-Installer.exe	42
PID 292 wrote to memory of 4360	292	VCDS-PCI-15071-Installer.exe	43
PID 292 wrote to memory of 4360	292	VCDS-PCI-15071-Installer.exe	43
PID 292 wrote to memory of 4360	292	VCDS-PCI-15071-Installer.exe	43
PID 292 wrote to memory of 4360	292	VCDS-PCI-15071-Installer.exe	43
PID 292 wrote to memory of 4360	292	VCDS-PCI-15071-Installer.exe	43
PID 292 wrote to memory of 4360	292	VCDS-PCI-15071-Installer.exe	43
PID 292 wrote to memory of 4360	292	VCDS-PCI-15071-Installer.exe	43
PID 292 wrote to memory of 3244	292	VCDS-PCI-15071-Installer.exe	44
PID 292 wrote to memory of 3244	292	VCDS-PCI-15071-Installer.exe	44
PID 292 wrote to memory of 3244	292	VCDS-PCI-15071-Installer.exe	44
PID 292 wrote to memory of 3244	292	VCDS-PCI-15071-Installer.exe	44
PID 292 wrote to memory of 3244	292	VCDS-PCI-15071-Installer.exe	44
PID 292 wrote to memory of 3244	292	VCDS-PCI-15071-Installer.exe	44
PID 292 wrote to memory of 3244	292	VCDS-PCI-15071-Installer.exe	44
PID 292 wrote to memory of 3092	292	VCDS-PCI-15071-Installer.exe	45
PID 292 wrote to memory of 3092	292	VCDS-PCI-15071-Installer.exe	45
PID 292 wrote to memory of 3092	292	VCDS-PCI-15071-Installer.exe	45
PID 292 wrote to memory of 3092	292	VCDS-PCI-15071-Installer.exe	45
PID 292 wrote to memory of 3092	292	VCDS-PCI-15071-Installer.exe	45
PID 292 wrote to memory of 3092	292	VCDS-PCI-15071-Installer.exe	45
PID 292 wrote to memory of 3092	292	VCDS-PCI-15071-Installer.exe	45
PID 292 wrote to memory of 3288	292	VCDS-PCI-15071-Installer.exe	46
PID 292 wrote to memory of 3288	292	VCDS-PCI-15071-Installer.exe	46
PID 292 wrote to memory of 3288	292	VCDS-PCI-15071-Installer.exe	46
PID 292 wrote to memory of 3288	292	VCDS-PCI-15071-Installer.exe	46
PID 292 wrote to memory of 3288	292	VCDS-PCI-15071-Installer.exe	46
PID 292 wrote to memory of 3288	292	VCDS-PCI-15071-Installer.exe	46
PID 292 wrote to memory of 3288	292	VCDS-PCI-15071-Installer.exe	46
PID 292 wrote to memory of 3096	292	VCDS-PCI-15071-Installer.exe	47
PID 292 wrote to memory of 3096	292	VCDS-PCI-15071-Installer.exe	47
PID 292 wrote to memory of 3096	292	VCDS-PCI-15071-Installer.exe	47
PID 292 wrote to memory of 3096	292	VCDS-PCI-15071-Installer.exe	47
PID 292 wrote to memory of 3096	292	VCDS-PCI-15071-Installer.exe	47
PID 292 wrote to memory of 3096	292	VCDS-PCI-15071-Installer.exe	47
PID 292 wrote to memory of 3096	292	VCDS-PCI-15071-Installer.exe	47
PID 2672 wrote to memory of 4724	2672	DrvInst.exe	53
PID 2672 wrote to memory of 4724	2672	DrvInst.exe	53
PID 2672 wrote to memory of 4724	2672	DrvInst.exe	53

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.3.710687281\874903408" -childID 2 -isForBrowser -prefsHandle 2276 -prefMapHandle 2216 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80ba3bb4-c88a-4034-a7d6-ee279962f28c} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 2292 19844f58 tab
1⤵
PID:2316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.4.48525041\576343008" -childID 3 -isForBrowser -prefsHandle 2652 -prefMapHandle 2648 -prefsLen 26111 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ff9942b-903d-4caa-983f-aca4a4e50bac} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 2664 18bd5158 tab
1⤵
PID:800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.5.846601153\1512263008" -childID 4 -isForBrowser -prefsHandle 3412 -prefMapHandle 3408 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {487cc07e-bc34-42e8-a714-e480b9b95630} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 3424 1bd77758 tab
1⤵
PID:2096

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.6.1611573183\508544645" -childID 5 -isForBrowser -prefsHandle 3660 -prefMapHandle 3656 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7806b2ff-3f2c-4ef4-9f9c-47dc04c34e8a} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 3536 1bd79558 tab
1⤵
PID:2600

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.7.1505203699\1297609647" -childID 6 -isForBrowser -prefsHandle 3756 -prefMapHandle 3760 -prefsLen 26170 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5baa5db-5bb7-4187-bd9e-1ca0f1135716} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 3744 1bd77158 tab
1⤵
PID:1308

C:\Users\Admin\AppData\Local\Temp\VCDS-PCI-15071-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\VCDS-PCI-15071-Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:292
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\VCDSAnleitung.pdf"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2940
- C:\Ross-Tech\VCDS-DRV\DPInst.exe
  "C:\Ross-Tech\VCDS-DRV\DPInst.exe" /d /q /u .\Drivers\20204\RT-USB64.inf
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Ross-Tech\VCDS-DRV\DPInst.exe
  "C:\Ross-Tech\VCDS-DRV\DPInst.exe" /d /q /u .\Drivers\20418A\RT-USB64.inf
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Ross-Tech\VCDS-DRV\DPInst.exe
  "C:\Ross-Tech\VCDS-DRV\DPInst.exe" /d /q /u .\Drivers\20418B\RT-USB64.inf
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4360
- C:\Ross-Tech\VCDS-DRV\DPInst.exe
  "C:\Ross-Tech\VCDS-DRV\DPInst.exe" /d /q /u .\Drivers\20602\RT-USB64.inf
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Ross-Tech\VCDS-DRV\DPInst.exe
  "C:\Ross-Tech\VCDS-DRV\DPInst.exe" /d /q /u .\Drivers\20814\RT-USB64.inf
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3092
- C:\Ross-Tech\VCDS-DRV\DPInst.exe
  "C:\Ross-Tech\VCDS-DRV\DPInst.exe" /d /q /u .\Drivers\20817\RT-USB64.inf
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3288
- C:\Ross-Tech\VCDS-DRV\DPInst.exe
  "C:\Ross-Tech\VCDS-DRV\DPInst.exe" /f
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3096
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /NAMESPACE:\\root\CIMV2 path Win32_ComputerSystem get Manufacturer
  2⤵
  PID:2492
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /NAMESPACE:\\root\CIMV2 path Win32_ComputerSystem get Model
  2⤵
  PID:3164
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /NAMESPACE:\\root\CIMV2 path Win32_Processor get Name
  2⤵
  PID:4064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2116.8.1820531588\934354997" -childID 7 -isForBrowser -prefsHandle 4040 -prefMapHandle 4104 -prefsLen 26251 -prefMapSize 233444 -jsInitHandle 816 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ff3c3df-838d-484e-b126-b7ad13a974c3} 2116 "\\.\pipe\gecko-crash-server-pipe.2116" 1724 1bf67358 tab
1⤵
PID:584

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
PID:2536

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2cbdb4d9-9d20-24c0-d1e4-441aaaa31f3c}\rt-usb64.inf" "9" "63bc47aff" "00000000000003C4" "WinSta0\Default" "00000000000003C0" "208" "c:\ross-tech\vcds-drv"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{02db78f0-f10f-26f4-6140-100e741da33a} Global\{7117e5d3-2b28-2e28-7d51-c82b71e2e525} C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\rt-usb64.inf C:\Windows\System32\DriverStore\Temp\{64f1da6c-c46a-5798-a816-1c3996665c3c}\RT-USB64.cat
  2⤵
  PID:4724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4952

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
PID:4444

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
PID:3900

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005E4" "00000000000005E0"
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
5KB

MD5
21c353d6d9e7429015405efc78a3703a

SHA1
da81b16710d2becc27904b031c2d405eb0ca0c7a

SHA256
aa4e6c8b960ab2635daf53ed9f8d730877d3e31becde391b2e0abd0034563d48

SHA512
39e262ff12fd410e5afed084f8563a502ec3d0d779ee14166e998f1502895855f3c6bd91abe01c8bdd6f1650d187bd4a4c7ee3ffe18b6a61b46a115a67c1fce3

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
17KB

MD5
6693478f76d848087f8deef88b39fbbc

SHA1
4e04e19a47f1f74c1ac53a6683d72f023c807e2e

SHA256
1a07f6b0a2f61046875ad91249f2b940a4fb5e89f215d4c6d9f35b425e563ebf

SHA512
da106e7fb6c1ea5815a5742ed151bd86a2fb79d21a2131582a03df9bf157a61eb86c683872d69338ccdd870dae27ef205500852db583fec721bab69846ec711b

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
17KB

MD5
7c5c336636801ffdc5d9fb60f3e7f1ff

SHA1
63412302a4e474a131356b6a1f45125afe453bfc

SHA256
9df766ec948f611f86edf0da8f4258e0fac4e107cdc80d20ee58d8eaa7510c5f

SHA512
dd6c3fa3001c4c70976af831e3670cbcc0a01084171d5323833abc244ee1a50ebabdefd963ecb513846a1442a2a8ce7a70021c57d0d1595d698a77e213822d4b

Download Submit
C:\Program Files (x86)\Common Files\System\DirectDB.dll.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
23KB

MD5
3e7ca79c292fa8096583d5d0b86e9d34

SHA1
8186f2f080a5d266b44704a3f30341ef37c9200e

SHA256
5376a4a0cd18d22095bd112e967e64855ca2bd0c9125c1f879d5269a65649d35

SHA512
ef05f3fdb4dcfee1d1b3488cee25dae47f2d19bcf627a7c8f4fc8a6357ecd6bb4c5284b49e431173cc25cc8f73d6acf7995f8a2394ce9653929765f8d43af51d

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\DAO\dao360.dll.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
596KB

MD5
dc916e57b25cc3b5a01f925b69a5088f

SHA1
bff8b9e29784ca412f75de119aa0639d13548543

SHA256
fc1ab5365a0411074cfef75c4a0c54d3c390bcb89b5bf4273f6539676e37bf47

SHA512
d7d2e16f99d0c34ce421095f705c960239edd615658e540f77d0848818d7057ef819069defd941e4a5efc4e914e0a9602579d51fc4dfad4378fb4580a7f0d491

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\DAO\dao360.dll.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
596KB

MD5
250ffd338e1ae4762f49bd1604300c01

SHA1
b43a60a840635517d40156d97017dfda144f183e

SHA256
284cce944281a3294e4d5f7a90258f347e37d8a42bfbc0a19b19c8909552c40f

SHA512
907793b3066f61ef2085eca07aebe526a33ff82a66974f6de0a6c749a56617a1f016d194f5c45a51eb63f0ee4047cc065d40aef927d8abffdd2abe9b156b3a89

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
296KB

MD5
60a7493a3a255cff4ce5bafe2790570b

SHA1
8ce426102d23296d0b4dce3c48d6c9f6e279d696

SHA256
8e8da6aa00dae52bfb6ae3d57bf7f68058aa7670893d5b37b31fa5aa50481b1e

SHA512
499c665b82c1bb80a82318d2f875bd99c3484cbc7f7b1cd8938707807923f476c383962d3325e78e7d3fe450c09185f6db902133c5fbd96f49c23233fcedd951

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
256B

MD5
a5722c5e7cdca7c992f9ddac90ecb523

SHA1
af083005e36ec95c4cdaf93aaad55a211f7c0af2

SHA256
8b7b84d22c048e632182b36fc5906fe95a632f421f67b40f36569e01a19426f3

SHA512
52f929cd7213a15e5724d21618170d6248aff4108d96146c8c40aeb23629734271dc84a87cde2ee7f9c938b29cbe8209d83f85f6fb8db3f0d1cbd283195d8dc6

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
256B

MD5
cc3f2280b897bae888baa683e4c6db8c

SHA1
be48e8c455573c4f5d9ff65f93839fc732c91492

SHA256
730304552b7e2977b09de4495650810412236f45f5fd4bc2dccfab29e2165860

SHA512
aff780e4fc4e3386d0d07599d9a2c2960c2736b8a06e3957c345bc2452a4b79eb9a48d842fa0ea622c1bb5dd45007a9c9611e51d854073c812caefa4c6c9525c

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\VGX\VGX.dll.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
735KB

MD5
1471f18817dbf6fc7c36a8863697913f

SHA1
1d928a1a4961d5f3ab7a9bab60f987c00d63a5f4

SHA256
4f62a32d55cff1c2c67fe5f013fe1efc825a46e8fb3810be668496cc320eab3d

SHA512
8c8c9695a48242ffec3ab5a7593457bd6296661842bf1e09b36646fcf60ed5b97afb5e0a53996af6b3787b54e765fd23851d2bbe18c5d144dce296d41ac7052f

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
9KB

MD5
e52affef600f2d591c1f68c7cd33af4d

SHA1
c5cb10bb08e5caf7d94884e678f215840bfec4ad

SHA256
22b01b0a68a424a5bf949edba0182ba21176d419a0c7e785a2f5190d3a225816

SHA512
be99319cf5b27b8e8b3009c23c8d405bd3d2fcc9c7559e9585e0c27ac2fddf4879fa31e8fc3bff7dd0317d2b19f2abeff6f24b7f9680324141b63d469332bd56

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
9KB

MD5
43d26f02afb6ac46793b2592a4a62943

SHA1
7cb0119920d468fe84cc4b681f173743e0e22684

SHA256
649eae85ef200311d2e6b082d97babc61c16236945cf074f47e996c0944a6f51

SHA512
76fe59c5f845310078b6998e1f1b8227d4756e3c4f4f4bc11cb05bf064a5e3c282d46c69b15340979582cf5e5572381ac9253d3b17c4d2acdab994659e9565c2

Download Submit
C:\Program Files (x86)\Internet Explorer\D3DCompiler_47.dll.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
3.3MB

MD5
3576e41da14a2d44c4ab95ab55220fff

SHA1
f7ed98325fdc3962ce1f2ade155904b06d8e56a4

SHA256
35a8c9d3faee46060aa053ef4b00180696729ee8ff025a6baf4fbc26ded22b7c

SHA512
e9212cfbb96b027fd8185768604ca109b500a347cd1d6a00fd00ba30f157d642dfc7314b62061fca43e4745d822e5b911209d251cb72d6f1cebe8e511ca77dce

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
128B

MD5
dbdabd16f710b07dc9d70c4f411a75ad

SHA1
69463e538a20a542f421536d65c09940592a1454

SHA256
5e8715858bbd4099f4640e5b00211150f65f887fc2b1c3dca80f03d881dc2484

SHA512
280ba285c4c80661f9543aab18d90073d1319ed67482a805cc73ec5787e1bec69b4024368884e3bcf33c1f29d5e26f158535cc1551b32fec79ceb1a3b9fae0a3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.57E017D4B11778F3CCFEADA786CDCC1A5C0CE367E3462CCF5284141A548D57EB

Filesize
128B

MD5
ab1c399292cf7e9b177d505ef2c8ce91

SHA1
a705644ae398b10e57df1b7586acf545c8fdfea9

SHA256
f30f895c4a04e3620450c6ebb5b0ad6d6ae87f2dc79b2825c586f15354a29af4

SHA512
fea6f2a8c220e4fc5363290ae083476d2873a5820c34599bb3b5e30b3f791981079fb7f7a9c53c25e50cd52137794c635461428baa43023413f9693177b2da48

Download Submit
C:\Ross-Tech\VCDS-DRV\Debug\SystemInfo.txt

Filesize
812B

MD5
76b51d69ccf88d6a6bb310cf42fa8df7

SHA1
7f828bb59b1c8036ae9eba4e4deb5dc854c7f824

SHA256
3b23be0fd070035c7b11253832df88dc367432794ea6004a4f8debba9484e177

SHA512
95f75a67628b85978bb947af39467daed9353050a6e0bcddfd1c73387eece92e4cc09a851003a7273ef67eea527e814dfc81f84aa8b10f0455cf4da3a954ef27

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20204\RT-USB64.CAT

Filesize
8KB

MD5
e8dde6e09bfbeb0ca0e05815ad33bf95

SHA1
44a799a220e60b6a67e61361d178d819f5bcb205

SHA256
2bcbb6a745dc4f911b9783191cdbfce0c3b45ca0c2dc8cbbe61746b486ce4e13

SHA512
8b68f43c3153e94bcbec81d403e15fb84fcdcef768dbbe5c6918b745cac8be8b996b13ac15bfe164aad03c5350b7b6a5fc282649dad2399a7e8c108c48586e6c

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20204\RT-USB64.inf

Filesize
1KB

MD5
57c6e9019c5c8af0730ba0585183428f

SHA1
b8fd40b599f92436b4e15f69728fa7f3f6a8b1cf

SHA256
038414cbd9606ddc1173c70113d09eb290b6fe79389d1d0e306443e4170b1043

SHA512
f2aaa207b88b4057cfd47b45d4490ea1de5ebbab62aed05e90d00b1f59e7581d226ce96e30b44c5cfabb1b4e1dee70009ee5a11e26e2bb00de03425064341409

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20418A\RT-USB64.cat

Filesize
8KB

MD5
3529b290ccf28f00d6f58e635e7bc2fe

SHA1
99aaf04db1e3e1f35af1930ffc7294f75667ed63

SHA256
e45a777d741a9e62a2fc9c40d89045c4e1ea24033847d5584361cda92c6ec459

SHA512
06e50d34f589b8552bf43011160e8a7ef8028c1737be939dfbf3385877decc06a0722ac807036ecaaa44751fb08e6ea01869fc861f319a02553c99f537b4334b

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20418A\RT-USB64.inf

Filesize
2KB

MD5
91134b48fa3d8017b0c18f9df891a92a

SHA1
11048bf85f94917099c328b5a6204f2805030c64

SHA256
28dc44e3e281ef6b4680661f1bf9915005e6bc9b65d47bfc20712beb044a7fc6

SHA512
797746a7f5b9b4f17a9b8d6402f83f179ed20a38eadcc04a9c9d02fd429842f16c1fe4f2d092ee319a1d1ff09fa72a50fcee06939e61079b631205d3c4455c51

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20418B\RT-USB64.cat

Filesize
8KB

MD5
f536099ce3b366e1c47e93fdb5086931

SHA1
397e4946506240c604d0a04cc9e2d20895c47a4a

SHA256
3700f2579ea1fce7499df97913262893d78345432b49968a1f6f794313d7a7ec

SHA512
8b20d2c16f2c05e6e67beba2ffe6174dc3a6a774bd38311cbe02deeadaae8526dc5c7efa1af1208d69d2071510834ca4cec563cd6de779d03c1de12f789c63ab

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20418B\RT-USB64.inf

Filesize
2KB

MD5
4a0def266ec0d0f4854d5a4fcb86bd46

SHA1
1c31507b249e28ddfd7ae9c3b00701424611152a

SHA256
17cbfb4a1c52231fda640449c38edcef293763ace7aecbe4b6e9cb6882696658

SHA512
0e880ec3472f683f8540f81fa1e6e020780bbd46336808a7781c7857bdfb80053f7d42a9e557b9afffcfd631cb94cbe49fedea7d273655fdf984fb68f773433f

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20602\RT-USB64.cat

Filesize
8KB

MD5
cc08d0a72737bd93fa696a8dc5586768

SHA1
12f2bffa7e70c247d7541c21823e0522e41440a8

SHA256
be68f77d37999352e4d2abf3db23fe590e8c71eb4384fe29a15f9bdca9bd53f6

SHA512
41df487fe54f82d6ac60b36707e26ad2591caf3cdfe700dd980ff48265ae0a63f5bdcfa309017410c698517be27c8dee2d83d515e96197bae299f357e802932d

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20602\RT-USB64.inf

Filesize
2KB

MD5
dee1c44a0ef5cf3ed3faaa7acc2c24d2

SHA1
f2d626f9a8e5c6126bed6ebd3e3504d0b2ab8443

SHA256
61885d981c9e7ae4f80b258ce6a91d6d207a1bb004d5e358a8154fb5e0974e15

SHA512
d3ececf6ab9925261a2d17e78f841438cb5770b8c36f9226c26b837ee5f01027f50065f6205ca73dd62bb867a053cd154cd54a9bec1cea7634aef3dc90a41e85

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20814\RT-USB64.cat

Filesize
8KB

MD5
1a4af092e38acf8cfe33b543f2be7e2e

SHA1
f8c088a4d0c5ece97a3bee5c738b9457431f525b

SHA256
d168290cee6c7966003f5c93d753cd6aeb9eee0af650b8754787ebb2e0f52392

SHA512
866f0ec51aafa28dab09084a002b5ad6517279cf5940e42d441a12cc4af3597a660399b2b8469b2fb9f687ef5361e234b8ecbbd029d602a3f8cc69bab7b17645

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20814\RT-USB64.inf

Filesize
2KB

MD5
e26f9b5a04ee745b68fd66d1907ce57e

SHA1
1d8362a73835baf17864b726377a794c69668d00

SHA256
edaec2f3966e8446535be0c04770ffed2c4c0cf4e3e3655e9be33de921ea3ae2

SHA512
871b92cfbfe695f647e61ae7fee4590479d6714ea775ade09dc7fc9ac2e11fbdc47fbdc9a3052b1976da0206f83a45c0ab95e79003236daed2ae3bf571b4912f

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20817\RT-USB64.cat

Filesize
8KB

MD5
e1bee2d58b63547915c4e8f5cc4bf6bb

SHA1
44c70af2487d06e17a421fa0ef7fc186c537637c

SHA256
cce324b1b5ff506c32c9a269513fb10cb16c2cdcdcb83512ff7f0cdc1cc6e65a

SHA512
6a8355fc8b5a3aabf38e488c7f7bc784f4791b0bbc1f2ba8638b24193c66cdca98314a4a25410d54270682326c24bd83216c8177fa375d74bbc9af9d681a0ecb

Download Submit
C:\Ross-Tech\VCDS-DRV\Drivers\20817\RT-USB64.inf

Filesize
2KB

MD5
c1c5724c7b7fd02d9ed6c8cbec7e5bc7

SHA1
1971775d7c639e4623ca02f743182fb91197b81c

SHA256
33964a1ca17e0b63b19611161ba4cb21fa32250efec9992d50e789fcbd3e0428

SHA512
ef45aeb5d08244c1a8d65e9e77194f826b6d633218a78421edeabc31126bf2d242e37e3434dec48deb2754de327a0719e45ed509e4edd0fc989bcaaab112cfe8

Download Submit
C:\Ross-Tech\VCDS-DRV\LCode.exe

Filesize
695KB

MD5
dbc72d45b55dea34ac6761075898446e

SHA1
d193fd49278484a6d6ae113ad16e5e25a2ff367b

SHA256
02884f2779158bb37d67ab6a304c15fa8124d2bd3dcfd6e025b2343563288da6

SHA512
604c6159704538c423d1fa4d74762ee18179f331b46f9008f3314011cd28e68c6f0ffe57a800770bc31709c9ef00219d7d114059202ee6b7049d9689f1291033

Download Submit
C:\Ross-Tech\VCDS-DRV\Labels\4G0-907-637.clb

Filesize
40B

MD5
807642c966d7a43b5dcac6f5848c2787

SHA1
4e3349ff3b32c3de030106e44f4a89f36cf3192e

SHA256
4a6ccff9d4c3d6e8bd8f1b366ebb0cb0365b7b4c48de79bfafdba0221c92bb87

SHA512
660a00659ee972b7df96f8edfa02d1426030acb28d9af51583df1af718350bb94bb5acac099dcbb9433b8e3e2750e07b25976f382e8516a609a61d09c4cee8d6

Download Submit
C:\Ross-Tech\VCDS-DRV\Labels\8K0-907-163.clb

Filesize
288B

MD5
694ce3507a249fbf0e73be16e69ec2aa

SHA1
583edc6dac97b0b93bbdee4cfc851116ea25a6a2

SHA256
ebd90621d530ce3fb360610e3d27a4b4efe495a3c953a7ab1f339c1d75646ed4

SHA512
19f595e3443d056646702a52eab0883fd5f24583e30272d4bfbe5da642682ccb13214a6d081765a520633d9a217a024f3f725c255f4ff4d6c63e2a7bc08edef4

Download Submit
C:\Ross-Tech\VCDS-DRV\Labels\8P0-959-655-10.clb

Filesize
408B

MD5
ab77c685cc1b49eb3d45737aae68e374

SHA1
e87dea8d1c9ae9618744cf122bb45996852dc91b

SHA256
7bd701f4736e98afd3843c4956dd832f8504a5627b68e86f2c4c56dd051fa3db

SHA512
3ae4962dd4c5f4e82a9502f9f14694599b7e3bc395dd9c9a7531fbeb1d9f9b4fb3784dbb35da11963fe3a732a7171a23c6fd5e12aafd58dcab86b1cdf353b21c

Download Submit
C:\Ross-Tech\VCDS-DRV\VCDS.exe

Filesize
2.3MB

MD5
9644e0c548de043263196f7c8b05443e

SHA1
2373d58368d2e35986a1ee9d2e69c532c2e5dbda

SHA256
b26ec38e4d15bb45a1b523840dd463f69c84e37489af1d949a79374c4d96089f

SHA512
fd1f5494324a7682690fb687516a107ba42e6a74ba516c1b6e2984db642486933eff73ad49c89e09cacc57266f7ad8a249806097d485ec159f64483ed730f786

Download Submit
C:\Ross-Tech\VCDS-DRV\VCScope.exe

Filesize
317KB

MD5
d2862bb1e1b2b59359b4686d1b6b0e37

SHA1
3d901e2f8922f66b602f2852bb28a7df66f2819e

SHA256
1c231893c417d3cede750d4abe3a5ded8486ac9b8e0c6ea1438e5e8c5e043a8b

SHA512
d2aed194bd4e164225b1de323a7f07400f0877ddda1bfb75b415e4879f6b392cbb4288bcbd52fce198c21d37affcdfccd0612e5b09fdd5f6e42496c140d420bb

Download Submit
C:\Ross-Tech\VCDS-DRV\epgclient.exe

Filesize
626KB

MD5
b03def509626a10636fef2891036ae5d

SHA1
455b9de6c4aff3251db89f72db0755be92093c84

SHA256
b2f11bd8e5246086a4b6aed7441f759194b40ebfdb55a523a51c377ff2119fd3

SHA512
3d751725583e7c8c75aff28b0e4613d511a330f928e5362094180760c5f4118d3bcc35e7e9a69c9699a57a1c2478690846d3524b3482b35049a8f567aa104cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9C8F.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\VCDSAnleitung.pdf

Filesize
582KB

MD5
510b8e1b7d15f6f4ed84f57d12d1663a

SHA1
e88fc31a03a176aa89eab906fde162eb6536441f

SHA256
6207b8532f4074bca8cb08e7aca5503028b41c1deffe57540a7f6cda3a8e16fa

SHA512
a1c63e3a644d6264fcfe25e9eac546a67256a7e1fab0eac44629764c5a68d96c8916a259637b61e1d349ad0ab1ff49cb706d42540cde920246e2b363b5f0756c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi3D9E.tmp\nsExec.dll

Filesize
6KB

MD5
ec62e1a8d16d8f1b0eb792aa26e5de5c

SHA1
faa219618aec99cffb81c312728dc56c1fdc5798

SHA256
193d396fc7be5fed9d585de3c43e23d640c1dce725499f0274b3898c248545aa

SHA512
cb3f3458cf734ab7b964ed25cac87ff2938292eed9caae1305b2e5975bde885f4d8b06d05d4099ef614982cd55d97e9ddc0f13bbe2cdd9fb642d008788ed3017

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c3cae048fc289332436d2fac1e94339f

SHA1
50d0b239ece41ecaf74c6c20a5d309ee623d60d2

SHA256
a902c1243cf937ae95b4266f2cfebc289de19f9e9543424cc5d8314287fb2958

SHA512
21873cb446719a11ed3f38116adb66c956020495abd0346af3a004bbdc5743ccd17d543bb21f344fc5020c43dfe7001c8090bdc55da952d1a361030b2fd0f066

Download Submit
C:\Windows\DPINST.LOG

Filesize
4KB

MD5
1fbfa6c13c44f2eda71ce361df8130b3

SHA1
0c2327bf10810f994501d4df203fb7cb163a4c15

SHA256
f311a714399d1b40c979b39af8d33b438160307908d08392e1ac2f686db8941c

SHA512
eb288c593fbab672dfd8daf884c4dd84d71167c4fb21b99b2ce9c190a520bb35c37e4295101d2e456f93af337b61ed59ff8e65706bad6ba835cb12509c2f1234

Download Submit
C:\Windows\DPINST.LOG

Filesize
9KB

MD5
d748618323b4c045270ce91883b5665e

SHA1
52ecd96952ce8388854bce3d999ba99044ca547a

SHA256
0b8ea0e28d32677cff277ab9a423dce4f6fa11de1f36575dd513c0cc4302770d

SHA512
1594fd7c5773165a44289936da0febee3679bff682db285899710ff30ca3371481095dd8cfac1e5ab508718cfd063babacd497d8d257fd628c504ef2023d5f61

Download Submit
C:\Windows\DPINST.LOG

Filesize
14KB

MD5
64cbf32830408d0e61b6bea94a023441

SHA1
9c0c3cd2c2262d04cf7fc190b474a434d5a8532d

SHA256
8d2cdf24388fd4de66ffda7406a202ee30758024f618574c97479b1c109c2402

SHA512
ddfffa2b5aaf4aa646844ee6c878983a02b90a716a61f6ba6292576fc144b8559fd7ebdda431a47f39726483a54b7ea186f0878d2b9ba47b7bfb29523515c699

Download Submit
C:\Windows\DPINST.LOG

Filesize
15KB

MD5
97a7e74567353713a60350130859e9ad

SHA1
ac82c6a8c1575806d743799433a9d4f9364a471a

SHA256
32193f8e49242432c9ffc70705df1b0c3c77acc0d57a9ca9829ee3287b573865

SHA512
37e7ccd1b8a90ec2536f3f91d4e500b21c8a9c71f540bab5b09298209860376b9a23aefc6a0a3bacb77d517f2425ddb4bccfc9c81abe3d9dada4d10a60203edc

Download Submit
C:\Windows\Temp\Cab9B38.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar9B5A.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
\??\c:\ROSS-T~1\vcds-drv\RT-USB.DLL

Filesize
217KB

MD5
9df64e7edb3b70410d80008c916a9322

SHA1
48d19590e571f078f3a28564937d3f68ed09be21

SHA256
5a42313f5b7e4380e1a7b0fb8d1abc97f9321ce383c2cade85199892c550a9eb

SHA512
614e034648753860fe5a6b68e3d29533c965967fb94bb9b266dba3df77b24bfe133844baa75c6b135888159250eac36f741053905ce03ab15d682df4fb775a5f

Download Submit
\??\c:\ROSS-T~1\vcds-drv\RT-USB64.SYS

Filesize
94KB

MD5
2d16360308c99fcbc0b97d7930d1b4e0

SHA1
b1730716630a0c68517e3481e7fbf0d28f88d0ee

SHA256
e252f42a7d93c774813e2de8a17c29a74f1901a223ddb925423cb64d31e197dd

SHA512
f20d0ca0f339af264f68301a2f77e5d959343afe8c31793edd190e25016cd616ffeff7f10e824b5f287b32a9b4c48d301b16bd34e8c3217ece3ac4286ea5e4f3

Download Submit
\??\c:\ross-tech\vcds-drv\RT-USB64.cat

Filesize
10KB

MD5
a43f337f78211c8da106a37f45fb099d

SHA1
297ec5c3063999140699b144ccf03ded2050b576

SHA256
1c88f69cd770b02f037a74fcb531c8e4547b7725ba98aae4e563ca4e0a17582c

SHA512
2f20a35eccfc746ad82a9135f87c87845788bf4032d1347a946cfc98424192a3431d844837c6a54c9a283cb6db11ecb20d37e33d2828a9f4c53d1e9438380138

Download Submit
\??\c:\ross-tech\vcds-drv\rt-usb64.inf

Filesize
2KB

MD5
7c6231227d356aed4ecaa06b4da9322d

SHA1
88b02c4bd09aa7910c55c4e74be8f036244b5cf9

SHA256
b31276e1af141846c2bc9be0f9ea64b7dcc67f8dc169cee775de4707d80ede63

SHA512
8440898bd3eb2c916c06cb5ab8e205d3b4a5896e8bf0429085459ebe353e1a9f7969afb09ee434d1ccc8c321e9d1b16e887d45a98b012159d8dfd7c1a7c29ca3

Download Submit
\Ross-Tech\VCDS-DRV\dpinst.exe

Filesize
1023KB

MD5
b368feace16f83eec0565afa8462eef9

SHA1
f6a3c3f91df6b88441b711b8017dc7b8165d60cc

SHA256
9abb993585a69136576dae7eea8745bb30c8440aa333e0b81c0ec77695307473

SHA512
84c484ecd49e13007b71f2908b7aa8799785c22bda04ce4dae826a8f9f00e24c4dd0fc261ad8bf4bb6538000ed424c828bf5322efc1101e24466871378681a97

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3D9E.tmp\StdUtils.dll

Filesize
26KB

MD5
c291f96471927e7bc49398b0de7168dd

SHA1
eda478005d69ee86126a8378de5007b139e20a5d

SHA256
c169393e49723cfdcdcbcf80e062be9e841539f90e4b7b85b482212715a1f7c6

SHA512
b4244615e99617d437d3120f201ca88c7ab4a6b4b84e7f0c3b4495a0fe8c979e04feaa08f11ad14fa92f002a3a521422221132ff54a081ef1c6bcbdf09d5929d

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3D9E.tmp\System.dll

Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3D9E.tmp\newadvsplash.dll

Filesize
8KB

MD5
55a723e125afbc9b3a41d46f41749068

SHA1
01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c

SHA256
0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06

SHA512
559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c

Download Submit
\Users\Admin\AppData\Local\Temp\nsi3D9E.tmp\nsDialogs.dll

Filesize
9KB

MD5
904d8313031ac05e2bac3dd329828833

SHA1
6c8322f76e5c38bc24b0bcc057a510c92ec40b43

SHA256
a7c5516478ab02b5d6c1684b3c2b31ee03331712bcd9f9a8ef8309d2b72c8ec4

SHA512
9d524ebc965f224e1a16f537f71df0963c586fd548cb9a901f8afb1951416dd656d5493cc5e304157dfa6d70d69bcd4c5a5b140fceb3736548e71fe7086b6de8

Download Submit
memory/292-12060-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/292-12059-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/292-12031-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/292-11995-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download
memory/2536-8705-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/2536-11703-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2536-8115-0x00000000013D0000-0x000000000140C000-memory.dmp

Filesize
240KB

Download
memory/2536-8116-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/2536-8117-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2536-11493-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/3900-8935-0x0000000004BD0000-0x0000000004C10000-memory.dmp

Filesize
256KB

Download
memory/3900-11536-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/3900-8919-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/4444-11353-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/4444-8771-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download
memory/4444-8770-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/4444-11498-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download
memory/4444-11521-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download
memory/4444-11704-0x00000000005F0000-0x0000000000630000-memory.dmp

Filesize
256KB

Download
memory/4724-8706-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download