9c13c1623344db34cf9e30c98e572a76eaa5772419c0558f5219c7551054b820

Analysis

max time kernel
148s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PowerPoint_Soft_new.exe
Size

65.6MB
MD5

afcc5f484ef62ed4e16950e5befcdc3a
SHA1

d04b96ae17157e621b1835c946238ca63a6458a2
SHA256

9c13c1623344db34cf9e30c98e572a76eaa5772419c0558f5219c7551054b820
SHA512

a57c83ab8fa2257b7eddbf6a275ed466c3945547402f535428b0dcadc217e4022ac652fec3f8c821cc6e5aac8440e9d5db5c6e6c336585b33885ff8d1cd49486
SSDEEP

1572864:syOTlnb3zkYUWPHMjEBzQZ6RM1IpLRjzxAGqgZtDhDMGd:aUYUWPacz6wRj9eoSGd

Score

8^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pptview.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pptview.exe	msiexec.exe

Executes dropped EXE 16 IoCs

pid	Process
2568	PowerPoint_Soft_new.tmp
1208	PowerPointViewer.exe
2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe
2436	cb3ad9a983bf595d841fd591e8e9ab63b.exe
1724	cb3ad9a983bf595d841fd591e8e9ab63b.exe
1996	cb3ad9a983bf595d841fd591e8e9ab63b.exe
2356	cb3ad9a983bf595d841fd591e8e9ab63b.exe
2304	YandexPackSetup.exe
2344	a18b92654881dfd72a446ee033ffa0db7.exe
2796	a18b92654881dfd72a446ee033ffa0db7.exe
444	lite_installer.exe
1248	seederexe.exe
5536	Yandex.exe
5708	Yandex.exe
5852	sender.exe
4128	lite_installer.exe

Loads dropped DLL 64 IoCs

pid	Process
1700	PowerPoint_Soft_new.exe
2568	PowerPoint_Soft_new.tmp
2568	PowerPoint_Soft_new.tmp
2568	PowerPoint_Soft_new.tmp
2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe
2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe
2436	cb3ad9a983bf595d841fd591e8e9ab63b.exe
2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe
1724	cb3ad9a983bf595d841fd591e8e9ab63b.exe
2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe
1996	cb3ad9a983bf595d841fd591e8e9ab63b.exe
1996	cb3ad9a983bf595d841fd591e8e9ab63b.exe
2356	cb3ad9a983bf595d841fd591e8e9ab63b.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
1320	MsiExec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2568	PowerPoint_Soft_new.tmp
2568	PowerPoint_Soft_new.tmp
2568	PowerPoint_Soft_new.tmp
2556	Process not Found
2568	PowerPoint_Soft_new.tmp
284	Process not Found
2144	MsiExec.exe
2144	MsiExec.exe
2144	MsiExec.exe
2144	MsiExec.exe
2144	MsiExec.exe
2144	MsiExec.exe
2144	MsiExec.exe
2144	MsiExec.exe
2144	MsiExec.exe
2144	MsiExec.exe
2144	MsiExec.exe
2144	MsiExec.exe
1248	seederexe.exe
5536	Yandex.exe
5536	Yandex.exe
5536	Yandex.exe
5708	Yandex.exe
5708	Yandex.exe
5708	Yandex.exe
1248	seederexe.exe
1136	Explorer.EXE
1136	Explorer.EXE
1136	Explorer.EXE
1136	Explorer.EXE
1136	Explorer.EXE
1136	Explorer.EXE
1136	Explorer.EXE
1136	Explorer.EXE
1136	Explorer.EXE
860	Process not Found
860	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000014f57-33.dat	upx
behavioral1/memory/2732-44-0x0000000000400000-0x0000000000924000-memory.dmp	upx
behavioral1/memory/2436-51-0x0000000000400000-0x0000000000924000-memory.dmp	upx
behavioral1/memory/1724-65-0x0000000000400000-0x0000000000924000-memory.dmp	upx
behavioral1/memory/1724-68-0x0000000000400000-0x0000000000924000-memory.dmp	upx
behavioral1/memory/2732-72-0x0000000003E80000-0x00000000043A4000-memory.dmp	upx
behavioral1/memory/1996-76-0x0000000000400000-0x0000000000924000-memory.dmp	upx
behavioral1/memory/2356-91-0x0000000000400000-0x0000000000924000-memory.dmp	upx
behavioral1/memory/1996-9527-0x0000000000400000-0x0000000000924000-memory.dmp	upx
behavioral1/memory/2732-10007-0x0000000000400000-0x0000000000924000-memory.dmp	upx
behavioral1/memory/2436-10010-0x0000000000400000-0x0000000000924000-memory.dmp	upx

Blocklisted process makes network request 3 IoCs

flow	pid	Process
25	2040	msiexec.exe
27	2040	msiexec.exe
30	2040	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 27 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	cb3ad9a983bf595d841fd591e8e9ab63b.exe
File opened (read-only)	\??\D:	cb3ad9a983bf595d841fd591e8e9ab63b.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\D:	cb3ad9a983bf595d841fd591e8e9ab63b.exe
File opened (read-only)	\??\F:	cb3ad9a983bf595d841fd591e8e9ab63b.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Csi.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1049\MSOINTL.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1049\MSOINTL.REST.IDX_DLL	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1049\PPINTL.DLL.IDX_DLL	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1049\PPINTL.REST.IDX_DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSORES.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OART.DLL	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1049\PVREADME.HTM	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1049\PPINTL.DLL	msiexec.exe
File created	C:\Program Files (x86)\MSECache\PPTViewer\ppviewer.cab	PowerPointViewer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SAEXT.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll	msiexec.exe
File created	C:\Program Files (x86)\MSECache\PPTViewer\ppviewer.msi	PowerPointViewer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GFX.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\USP10.DLL	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PPTVIEW.EXE	msiexec.exe
File created	C:\Program Files (x86)\MSECache\PPTViewer\Catalog\files14.cat	PowerPointViewer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\RICHED20.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1049\ALRTINTL.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1049\MSOINTL.DLL.IDX_DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\INTLDATE.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GKPowerPoint.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1049\xlsrvintl.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\pptview.exe.manifest	msiexec.exe

Drops file in Windows directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\CONSTAN.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA032.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA052.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8480.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI856B.tmp	msiexec.exe
File opened for modification	C:\Windows\Fonts\CANDARAI.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CORBELB.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CALIBRIZ.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CONSTANZ.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA24D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA25D.tmp	msiexec.exe
File opened for modification	C:\Windows\Fonts\CONSTANB.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\{95140000-00AF-0419-0000-0000000FF1CE}\ppvwicon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8732.tmp	msiexec.exe
File opened for modification	C:\Windows\Fonts\CAMBRIAB.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA20D.tmp	msiexec.exe
File opened for modification	C:\Windows\Fonts\CALIBRIB.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CORBELZ.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CONSOLAZ.TTF	msiexec.exe
File created	C:\Windows\Installer\f767f8f.ipi	msiexec.exe
File created	C:\Windows\Installer\f767f91.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA17E.tmp	msiexec.exe
File opened for modification	C:\Windows\Fonts\CALIBRII.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CONSOLA.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CAMBRIAZ.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CONSOLAI.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CORBELI.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA15D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8403.tmp	msiexec.exe
File opened for modification	C:\Windows\Fonts\CAMBRIAI.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA18E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f767f8c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f767f8f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA002.tmp	msiexec.exe
File opened for modification	C:\Windows\Fonts\CALIBRI.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CAMBRIA.TTC	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Fonts\CANDARA.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CANDARAZ.TTF	msiexec.exe
File created	C:\Windows\Installer\f767f92.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA16D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1BE.tmp	msiexec.exe
File created	C:\Windows\Installer\f767f8c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI829B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f767f92.msi	msiexec.exe
File created	C:\Windows\Installer\f767f95.ipi	msiexec.exe
File opened for modification	C:\Windows\Fonts\CORBEL.TTF	msiexec.exe
File created	C:\Windows\Installer\{95140000-00AF-0419-0000-0000000FF1CE}\ppvwicon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f767f95.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8152.tmp	msiexec.exe
File opened for modification	C:\Windows\Fonts\CONSTANI.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CANDARAB.TTF	msiexec.exe
File opened for modification	C:\Windows\Fonts\CONSOLAB.TTF	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\NTURL = "https://yandex.ru/search/?win=642&clid=2313442-110&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\NTTopResultURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\TopResultURLFallback = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IE11TR"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Яндекс"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "https://www.ya.ru/favicon.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "https://yandex.ru/search/?win=642&clid=2313440-110&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\FaviconURLFallback = "https://www.ya.ru/favicon.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\NTLogoURL = "http://downloader.yandex.net/banner/ntpagelogo/{language}/{scalelevel}.png"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer	seederexe.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "https://yandex.ru/search/?win=642&clid=2313442-110&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\Local\\MICROS~1\\INTERN~1\\Services\\YANDEX~1.ICO"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\DisplayName = "Bing"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\SuggestionsURL_JSON = "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\SuggestionsURL	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://downloader.yandex.net/banner/ntpagelogo/{language}/{scalelevel}.png"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\TopResultURLFallback = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IE11TR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\FaviconURLFallback = "http://www.bing.com/favicon.ico"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MINIE\LinksBandEnabled = "1"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\DisplayName = "Bing"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\YaCreationDate = "2024-36-20"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	seederexe.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\URL = "https://yandex.ru/search/?win=642&clid=2313440-110&text={searchTerms}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	seederexe.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer	seederexe.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\ShowSearchSuggestionsInAddressGlobal = "1"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\YaCreationDate = "2024-36-20"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\DisplayName = "Яндекс"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\db6c0df0-ff01-11ee-be28-ee69c2ce6029\FaviconPath = "C:\\Users\\Admin\\AppData\\Local\\MICROS~1\\INTERN~1\\Services\\YANDEX~1.ICO"	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\buffer\FaviconURLFallback = "http://www.bing.com/favicon.ico"	seederexe.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	seederexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL_JSON = "https://suggest.yandex.ru/suggest-ff.cgi?uil=ru&part={searchTerms}"	seederexe.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.ya.ru/?win=642&clid=2313439-110"	seederexe.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C03A3-0000-0000-C000-000000000046}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C1711-0000-0000-C000-000000000046}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PowerPointViewer.Show.12\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0385-0000-0000-C000-000000000046}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C03BA-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PowerPointViewer.ShowMacroEnabled.12\shell\Print	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C035A-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0386-0000-0000-C000-000000000046}\TypeLib\Version = "2.5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0389-0000-0000-C000-000000000046}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C172D-0000-0000-C000-000000000046}\TypeLib\Version = "2.5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PowerPointViewer.SlideShowMacroEnabled.12\shell\Show\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0304-0000-0000-C000-000000000046}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0320-0000-0000-C000-000000000046}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C171C-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C1712-0000-0000-C000-000000000046}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C03D4-0000-0000-C000-000000000046}\TypeLib\Version = "2.5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C03E6-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C030E-0000-0000-C000-000000000046}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0322-0000-0000-C000-000000000046}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0334-0000-0000-C000-000000000046}\ = "PropertyTests"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0367-0000-0000-C000-000000000046}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PowerPointViewer.SlideShow.12\shell\Print	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C030C-0000-0000-C000-000000000046}\ = "_CommandBarComboBox"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0392-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000CD901-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C1725-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C03C5-0000-0000-C000-000000000046}\ = "IBlogPictureExtensibility"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B722BCCD-4E68-101B-A2BC-00AA00404770}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C03CB-0000-0000-C000-000000000046}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0304-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0338-0000-0000-C000-000000000046}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000CD809-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0306-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C030E-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C1713-0000-0000-C000-000000000046}\TypeLib\Version = "2.5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerPointViewer.SlideShowMacroEnabled.12\shell\Show\command\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\pptview.exe \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C031E-0000-0000-C000-000000000046}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C035A-0000-0000-C000-000000000046}\TypeLib\Version = "2.5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C033D-0000-0000-C000-000000000046}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C03CE-0000-0000-C000-000000000046}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0410-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0369-0000-0000-C000-000000000046}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C1534-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000CD902-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C03C1-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0308-0000-0000-C000-000000000046}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0366-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C038E-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000CD6A2-0000-0000-C000-000000000046}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0313-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0320-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0936-0000-0000-C000-000000000046}\ = "NewFile"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0377-0000-0000-C000-000000000046}\TypeLib\Version = "2.5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C1710-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerPointViewer.SlideShow.11\DefaultIcon\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\pptview.exe,3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C030E-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C0339-0000-0000-C000-000000000046}\ = "COMAddIns"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000CDB0F-0000-0000-C000-000000000046}\ = "CustomXMLValidationErrors"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C1728-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000C03CA-0000-0000-C000-000000000046}\TypeLib\ = "{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OfficeCompatible.Application.x86.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C0300-0000-0000-C000-000000000046}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000C030D-0000-0000-C000-000000000046}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{000672AD-0000-0000-C000-000000000046}\TypeLib	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	cb3ad9a983bf595d841fd591e8e9ab63b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	cb3ad9a983bf595d841fd591e8e9ab63b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	lite_installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	lite_installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	cb3ad9a983bf595d841fd591e8e9ab63b.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2568	PowerPoint_Soft_new.tmp
2568	PowerPoint_Soft_new.tmp
2040	msiexec.exe
2040	msiexec.exe
2304	YandexPackSetup.exe
2040	msiexec.exe
2040	msiexec.exe
444	lite_installer.exe
444	lite_installer.exe
444	lite_installer.exe
444	lite_installer.exe
1248	seederexe.exe
1248	seederexe.exe
1248	seederexe.exe
1248	seederexe.exe
1248	seederexe.exe
5852	sender.exe
5852	sender.exe
4128	lite_installer.exe
4128	lite_installer.exe
4128	lite_installer.exe
4128	lite_installer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1136	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1208	PowerPointViewer.exe
Token: SeIncreaseQuotaPrivilege	1208	PowerPointViewer.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeSecurityPrivilege	2040	msiexec.exe
Token: SeCreateTokenPrivilege	1208	PowerPointViewer.exe
Token: SeAssignPrimaryTokenPrivilege	1208	PowerPointViewer.exe
Token: SeLockMemoryPrivilege	1208	PowerPointViewer.exe
Token: SeIncreaseQuotaPrivilege	1208	PowerPointViewer.exe
Token: SeMachineAccountPrivilege	1208	PowerPointViewer.exe
Token: SeTcbPrivilege	1208	PowerPointViewer.exe
Token: SeSecurityPrivilege	1208	PowerPointViewer.exe
Token: SeTakeOwnershipPrivilege	1208	PowerPointViewer.exe
Token: SeLoadDriverPrivilege	1208	PowerPointViewer.exe
Token: SeSystemProfilePrivilege	1208	PowerPointViewer.exe
Token: SeSystemtimePrivilege	1208	PowerPointViewer.exe
Token: SeProfSingleProcessPrivilege	1208	PowerPointViewer.exe
Token: SeIncBasePriorityPrivilege	1208	PowerPointViewer.exe
Token: SeCreatePagefilePrivilege	1208	PowerPointViewer.exe
Token: SeCreatePermanentPrivilege	1208	PowerPointViewer.exe
Token: SeBackupPrivilege	1208	PowerPointViewer.exe
Token: SeRestorePrivilege	1208	PowerPointViewer.exe
Token: SeShutdownPrivilege	1208	PowerPointViewer.exe
Token: SeDebugPrivilege	1208	PowerPointViewer.exe
Token: SeAuditPrivilege	1208	PowerPointViewer.exe
Token: SeSystemEnvironmentPrivilege	1208	PowerPointViewer.exe
Token: SeChangeNotifyPrivilege	1208	PowerPointViewer.exe
Token: SeRemoteShutdownPrivilege	1208	PowerPointViewer.exe
Token: SeUndockPrivilege	1208	PowerPointViewer.exe
Token: SeSyncAgentPrivilege	1208	PowerPointViewer.exe
Token: SeEnableDelegationPrivilege	1208	PowerPointViewer.exe
Token: SeManageVolumePrivilege	1208	PowerPointViewer.exe
Token: SeImpersonatePrivilege	1208	PowerPointViewer.exe
Token: SeCreateGlobalPrivilege	1208	PowerPointViewer.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	PowerPoint_Soft_new.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2568	1700	PowerPoint_Soft_new.exe	28
PID 1700 wrote to memory of 2568	1700	PowerPoint_Soft_new.exe	28
PID 1700 wrote to memory of 2568	1700	PowerPoint_Soft_new.exe	28
PID 1700 wrote to memory of 2568	1700	PowerPoint_Soft_new.exe	28
PID 1700 wrote to memory of 2568	1700	PowerPoint_Soft_new.exe	28
PID 1700 wrote to memory of 2568	1700	PowerPoint_Soft_new.exe	28
PID 1700 wrote to memory of 2568	1700	PowerPoint_Soft_new.exe	28
PID 2568 wrote to memory of 1208	2568	PowerPoint_Soft_new.tmp	29
PID 2568 wrote to memory of 1208	2568	PowerPoint_Soft_new.tmp	29
PID 2568 wrote to memory of 1208	2568	PowerPoint_Soft_new.tmp	29
PID 2568 wrote to memory of 1208	2568	PowerPoint_Soft_new.tmp	29
PID 2568 wrote to memory of 2732	2568	PowerPoint_Soft_new.tmp	30
PID 2568 wrote to memory of 2732	2568	PowerPoint_Soft_new.tmp	30
PID 2568 wrote to memory of 2732	2568	PowerPoint_Soft_new.tmp	30
PID 2568 wrote to memory of 2732	2568	PowerPoint_Soft_new.tmp	30
PID 2568 wrote to memory of 2732	2568	PowerPoint_Soft_new.tmp	30
PID 2568 wrote to memory of 2732	2568	PowerPoint_Soft_new.tmp	30
PID 2568 wrote to memory of 2732	2568	PowerPoint_Soft_new.tmp	30
PID 2732 wrote to memory of 2436	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	31
PID 2732 wrote to memory of 2436	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	31
PID 2732 wrote to memory of 2436	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	31
PID 2732 wrote to memory of 2436	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	31
PID 2732 wrote to memory of 2436	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	31
PID 2732 wrote to memory of 2436	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	31
PID 2732 wrote to memory of 2436	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	31
PID 2732 wrote to memory of 1724	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	33
PID 2732 wrote to memory of 1724	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	33
PID 2732 wrote to memory of 1724	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	33
PID 2732 wrote to memory of 1724	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	33
PID 2732 wrote to memory of 1724	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	33
PID 2732 wrote to memory of 1724	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	33
PID 2732 wrote to memory of 1724	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	33
PID 2732 wrote to memory of 1996	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	35
PID 2732 wrote to memory of 1996	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	35
PID 2732 wrote to memory of 1996	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	35
PID 2732 wrote to memory of 1996	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	35
PID 2732 wrote to memory of 1996	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	35
PID 2732 wrote to memory of 1996	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	35
PID 2732 wrote to memory of 1996	2732	cb3ad9a983bf595d841fd591e8e9ab63b.exe	35
PID 1996 wrote to memory of 2356	1996	cb3ad9a983bf595d841fd591e8e9ab63b.exe	36
PID 1996 wrote to memory of 2356	1996	cb3ad9a983bf595d841fd591e8e9ab63b.exe	36
PID 1996 wrote to memory of 2356	1996	cb3ad9a983bf595d841fd591e8e9ab63b.exe	36
PID 1996 wrote to memory of 2356	1996	cb3ad9a983bf595d841fd591e8e9ab63b.exe	36
PID 1996 wrote to memory of 2356	1996	cb3ad9a983bf595d841fd591e8e9ab63b.exe	36
PID 1996 wrote to memory of 2356	1996	cb3ad9a983bf595d841fd591e8e9ab63b.exe	36
PID 1996 wrote to memory of 2356	1996	cb3ad9a983bf595d841fd591e8e9ab63b.exe	36
PID 2040 wrote to memory of 1320	2040	msiexec.exe	37
PID 2040 wrote to memory of 1320	2040	msiexec.exe	37
PID 2040 wrote to memory of 1320	2040	msiexec.exe	37
PID 2040 wrote to memory of 1320	2040	msiexec.exe	37
PID 2040 wrote to memory of 1320	2040	msiexec.exe	37
PID 2040 wrote to memory of 1320	2040	msiexec.exe	37
PID 2040 wrote to memory of 1320	2040	msiexec.exe	37
PID 2568 wrote to memory of 2304	2568	PowerPoint_Soft_new.tmp	39
PID 2568 wrote to memory of 2304	2568	PowerPoint_Soft_new.tmp	39
PID 2568 wrote to memory of 2304	2568	PowerPoint_Soft_new.tmp	39
PID 2568 wrote to memory of 2304	2568	PowerPoint_Soft_new.tmp	39
PID 2568 wrote to memory of 2304	2568	PowerPoint_Soft_new.tmp	39
PID 2568 wrote to memory of 2304	2568	PowerPoint_Soft_new.tmp	39
PID 2568 wrote to memory of 2304	2568	PowerPoint_Soft_new.tmp	39
PID 2568 wrote to memory of 2344	2568	PowerPoint_Soft_new.tmp	41
PID 2568 wrote to memory of 2344	2568	PowerPoint_Soft_new.tmp	41
PID 2568 wrote to memory of 2344	2568	PowerPoint_Soft_new.tmp	41
PID 2568 wrote to memory of 2344	2568	PowerPoint_Soft_new.tmp	41

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1136
- C:\Users\Admin\AppData\Local\Temp\PowerPoint_Soft_new.exe
  "C:\Users\Admin\AppData\Local\Temp\PowerPoint_Soft_new.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Users\Admin\AppData\Local\Temp\is-1KSJ8.tmp\PowerPoint_Soft_new.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-1KSJ8.tmp\PowerPoint_Soft_new.tmp" /SL5="$30146,67751279,943104,C:\Users\Admin\AppData\Local\Temp\PowerPoint_Soft_new.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\PowerPointViewer.exe
      "C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\PowerPointViewer.exe" /quiet /passive /norestart
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\cb3ad9a983bf595d841fd591e8e9ab63b.exe
      "C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\cb3ad9a983bf595d841fd591e8e9ab63b.exe" --silent --allusers=0 --setdefaultbrowser=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\cb3ad9a983bf595d841fd591e8e9ab63b.exe
        
        C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\cb3ad9a983bf595d841fd591e8e9ab63b.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=89.0.4447.51 --initial-client-data=0x188,0x18c,0x190,0x15c,0x194,0x73fa2288,0x73fa2298,0x73fa22a4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\cb3ad9a983bf595d841fd591e8e9ab63b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\cb3ad9a983bf595d841fd591e8e9ab63b.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\cb3ad9a983bf595d841fd591e8e9ab63b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\cb3ad9a983bf595d841fd591e8e9ab63b.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --pin-additional-shortcuts=1 --run-at-startup=0 --server-tracking-data=server_tracking_data --initial-pid=2732 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240420103620" --session-guid=67fedfc3-e761-4915-a260-730014ccfceb --server-tracking-blob=ODVjMjU1NTM5OWE3MjBjNjJjMzU0MmFhZGNjNjM3NzI2ODk2NGNmNGFmZjE2MTIxMjI5ZjAyZTY5ODk3ZDQyMTp7ImNvdW50cnkiOiJLWiIsImVkaXRpb24iOiJZeCAyMDAzIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYVNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYSIsInF1ZXJ5IjoiL29wZXJhL3N0YWJsZT91dG1fbWVkaXVtPWFwYiZ1dG1fc291cmNlPU9NR00mdXRtX2NhbXBhaWduPVVOTyZlZGl0aW9uPVl4KzIwMDMiLCJ0aW1lc3RhbXAiOiIxNjU4Mzk4NjAxLjgyNzEiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCA2LjEpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMDMuMC4wLjAgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6IlVOTyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Ik9NR00ifSwidXVpZCI6IjQ0YzVlNjgwLTU5ZGEtNDc4NS05NWM4LTQzZDQwMzcxNmViYiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=DC03000000000000
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\cb3ad9a983bf595d841fd591e8e9ab63b.exe
        
        C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\cb3ad9a983bf595d841fd591e8e9ab63b.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=89.0.4447.51 --initial-client-data=0x194,0x198,0x19c,0x15c,0x1a0,0x72d42288,0x72d42298,0x72d422a4
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\YandexPackSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\YandexPackSetup.exe" /quiet /msicl "VID=110 ILIGHT=1 YAQSEARCH=y YAHOMEPAGE=y YABROWSER=y YABM=y "
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2304
  - - C:\Users\Admin\AppData\Local\Programs\PowerPoint\a18b92654881dfd72a446ee033ffa0db7.exe
      "C:\Users\Admin\AppData\Local\Programs\PowerPoint\a18b92654881dfd72a446ee033ffa0db7.exe" "C:\Users\Admin\AppData\Local\Programs\PowerPoint\Мèð Òàíêîâ.lnk" 5386
      4⤵
      Executes dropped EXE
      PID:2344
  - - C:\Users\Admin\AppData\Local\Programs\PowerPoint\a18b92654881dfd72a446ee033ffa0db7.exe
      "C:\Users\Admin\AppData\Local\Programs\PowerPoint\a18b92654881dfd72a446ee033ffa0db7.exe" "C:\Users\Admin\AppData\Local\Programs\PowerPoint\Ìèð Êîðàблåé.lnk" 5386
      4⤵
      Executes dropped EXE
      PID:2796

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5CBA24004DC1E915B732534EB142B2CE
  2⤵
  - Loads dropped DLL
  PID:1320
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 89A89FDBA433517D20BB435FC959F56B
  2⤵
  - Loads dropped DLL
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\371F26A2-9FBC-4EFA-ADAD-00233EB42FC3\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\371F26A2-9FBC-4EFA-ADAD-00233EB42FC3\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\78D9ED5F-FC7C-4C3A-B824-A00980E54C5E\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\78D9ED5F-FC7C-4C3A-B824-A00980E54C5E\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=1" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\BB824BDC-2949-4A3F-8F97-9296B3ED0992\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious behavior: EnumeratesProcesses
    PID:1248
  - - C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
      C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5536
  - - C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe
      C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.exe --silent --pin-taskbar=y --pin-desktop=n /website-path="C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\Taskbar\Яндекс Маркет.website" /icon-path="C:\Users\Admin\AppData\Local\MICROS~1\INTERN~1\Services\MARKET~1.ICO" /site-id="2AE68B04.8A85F169"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\BB824BDC-2949-4A3F-8F97-9296B3ED0992\sender.exe
      C:\Users\Admin\AppData\Local\Temp\BB824BDC-2949-4A3F-8F97-9296B3ED0992\sender.exe --send "/status.xml?clid=2313438-110&uuid=7a79d744-1C5A-4DE9-999C-CC7B8372d041&vnt=Windows 7x64&file-no=6%0A10%0A11%0A12%0A13%0A15%0A17%0A18%0A21%0A22%0A24%0A25%0A40%0A42%0A43%0A45%0A57%0A61%0A89%0A103%0A111%0A123%0A124%0A129%0A"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5852

C:\Users\Admin\AppData\Local\Temp\371F26A2-9FBC-4EFA-ADAD-00233EB42FC3\lite_installer.exe
"C:\Users\Admin\AppData\Local\Temp\371F26A2-9FBC-4EFA-ADAD-00233EB42FC3\lite_installer.exe" --job-name=yBrowserDownloader-{971C0F1F-C4A5-43E0-B333-32266379F83D} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{D24F9E11-64F9-4E64-B834-9A455C438EC5}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2313418-110&ui=7a79d744-1C5A-4DE9-999C-CC7B8372d041 --use-user-default-locale
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f767f90.rbs

Filesize
417KB

MD5
485c133b8fca1d8f3596d92025582f69

SHA1
a50c73dcd5edac0e52b093f4a1afc6f4af3dd154

SHA256
e6e498b714dbc674c83c317a0c13a29b66717b8b71e447c639533985788e8bc9

SHA512
cfbac31c81b447f9ed2f724c28a33663853a56eaa082fc8caccc9857f5a26056ef39c8dcd20b5c0780075fa93b5c0c525508b59a43ee959a14e893bc62a604dd

Download Submit
C:\Config.Msi\f767f96.rbs

Filesize
911B

MD5
dda275dabb405c2b9d2c17c0c71a93d2

SHA1
2d64061bf3ce5cdfbf6e1492a6a47f5cd41416c7

SHA256
cd4b3cf947cfa5180000ac288a0dfffbf0ae6ac697fb10df1a14adf7ee14984e

SHA512
fc8df0537d9a1f9881c064a3147720da4c618c6fe55e0b5d1a04dcde942b4bc5ac1178362aabf2cf35aea67e44ef8830a997a0e4735b51f0f6a4967588688603

Download Submit
C:\Program Files (x86)\MSECache\PPTViewer\PPVIEWER.CAB

Filesize
59.3MB

MD5
12d68dfb6c386685633e4397a26ad8ad

SHA1
87a8b3709eefd7b88845d492451016047669bced

SHA256
3adb5c33c097465b8f1890f5ddc9a2d9c3659b048644f103c623940bbb2aa8c0

SHA512
d986f315586416c8aada2f3cce013f5f20b38faee568c09cad8c16b756bb688f7a8b6e0227f88dfe6db58b6c3b04d05ed5038f2a16e85dcfcc3e2375b04108ce

Download Submit
C:\Program Files (x86)\MSECache\PPTViewer\ppviewer.msi

Filesize
1.1MB

MD5
df4bf52d40e400d599d4cb1b7f3df928

SHA1
f79c2d85b3e9d5ab94651faae53694786b5030bf

SHA256
c005bba64a1f761a38f01a50f33b07473df2976c9db87c4e0d0d4d305cf71ee5

SHA512
7a382a995d3a577c795f4770fdec1aed8f42db62656911cb62802a534ccc5282439c1ce805084ebeca62c77f0b41f2f446ab83dbb255f024fb95e9d1479c7b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b2fd8810fb9d173bf149df2d309d0b4b

SHA1
42d59429fb1f0f395ff3db85d4a827054bc28703

SHA256
da82f4232c4f9b39f2344b6dae6e8734db903a54bb4f2b384ffde9a1a1f430ae

SHA512
0317fe5295cc08f8a5e98b217ebc97d22b5e3c0257582939c5782d4457297f67ec1ba1304f542a6d68b54d6a04fb59131e4eb91e03f487dbe1762295e0aa4884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94a986049b8702e5f1aba676e4119a1c

SHA1
683afe6a1452cacf068e45a28dca84857198ec23

SHA256
db3e195ed70f0ebb34eaf8f98221e607bfc94877256e09452275fdea86859135

SHA512
c6eba85d0b715da330617de47ad4cb0492a7c967fc09d8ae019b38301012e59acbb44b0cfe15a4c8b49f4cd05c32214d1ebf1bb494cd0042ac3a8615023c7713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d7f6e209560d112141f7c35a244b1da

SHA1
3d6fd0710803a27abc8e9209a03096938960a3ad

SHA256
0576e72605f42c6489f2f9d20d59cb00ffcf31ca5c391c7e32af4a9171f186dc

SHA512
c423df9e6385ba456e1fe2ee282ce6307ecb8f4029a1101b3529fc5a7c0d76faf9e8a3ed19c8fe34b3d53d542a25d2393300a51833ae13b85670ae180a8e3ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f5ee568c44d740659bf82a6bdb4cff9

SHA1
9f9df7dde9efefaf80dbfe9b1493e871413ebbf1

SHA256
e00fda63196d7f6c4a3142f89b2a4814643c6cc6b496e5c9edd11b59006dd635

SHA512
b749853211102356eb62b8a873b6351826cabac0e475b779c4ffe418174100ad838701ff20a26cfc72f8d7c707df5f50f7cf42e97de783942eae0fbfcfa799be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59c5d521926c34da0f1f7a19033086b7

SHA1
c791b08a88c622188278317d50a6a4911b234552

SHA256
2e974544d56b2f2002349979b8ba5ad61893fe1d76d7d3f1187423fe54602436

SHA512
aedfc84f06ceb1a011f53405092b57cd0b6b5dc0a684f74606b622710b037962862cae2ac9e964dcb8bae14fe4f7d9ee2f78dd81952000d19e812236c16b243d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9138493f073a9001cbf0f880e55c34a

SHA1
45985b5ac014133056a61874ac9f3dd95844b1bd

SHA256
432d40c187b9ddc5c0fe4ca438d0ec1449c18a7d9f54295202be9b6407d9b434

SHA512
fb7d0be23ecb5c2f852d3a2487d298c476fe5d9657ad503a291848acdad27c25ce06987139653a49f36be7c6eb4826a519e6006436a301f8efe4c991138e92e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7c006f048a3d3ef5937033655b527b5

SHA1
c2cab92830a058be5981f97957b6f7e1ffd88220

SHA256
ba483af5eee5048507b20642c7bfb14ad9210c36333a22a7911aa35ffdcac541

SHA512
49c3b091853d1701234600ca9399db2e793676518344f07bbf3d32dacad0ff1f4957597d458b563b0a08274a6b436dbfce89949e0687cee487882f786acc6a80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
425c394667a1ed34e456b7f84a3808e8

SHA1
336011daa97731501a24fd9f95dcc2f3d93fa1fa

SHA256
83f260d449e7ecb840b4ae319a2e5373ccf9c7f508a33f8691a440be2902f428

SHA512
f3fd2e1b98f32b573ef1230bb352563317047c34917d90651bcae73200cdb5c98dbf53c8c54b9aa016972f152af8bbf59c5759a80eb12d0841e9da4528ed8a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c35df994f7a6ec0af0db62e30653832

SHA1
6c4e6d03cf65a69841d6b37b4d4a439ca8411964

SHA256
9d8348fbb3ab5b7e8663717aea4c3af1ea5e878234623f7938a61c3f41bfe15f

SHA512
05ac0f64d32532c88e623a75323ef6a2387d0d225728dac183000ef24a0f860e51cb13ccf0e9fcac2dcf5904bb8d1fb3a7db3b0df1813745086340207716f317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa3ecda2e194e0ce90dcf5ab6cc52edf

SHA1
d73d36005b426f9b54b0c9e6f7d504b30b35751a

SHA256
59e803b931b7191248e96ab7d508f079536018234f0f83fd28321c6303eaa623

SHA512
b3a8f848f5ebf5b6ad3a1d045591ea4031f514df22108465dd3d4301a5211ff07f0156aa8151cdb6c15d6921492a5344a73866c22c875ec309d094916ec6cbc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51cd527e15afc565fc7996584839418b

SHA1
87ea726083dcb0c8c3b01eaecfa881f5cab4ec2b

SHA256
df3bd38f6f1362b2806c93467842d026cde578d675ea9a9578dbfda0a45ac5cf

SHA512
456f0d1409b96ace7767501101ccca032c76b0072aadf2a6e124cee130220459ba087b9b98c542dd5c19a1a31a98ddf1aa35f0636a0a54924f4b2a901c07590e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a419b57c22fdd970ae0dc11682565d72

SHA1
32103e8c784bae2363c8faadff03c87dd9ff8c82

SHA256
b48b1e02193741d6b7fa98f85172114c9a49739ac0875578a0d56039359da835

SHA512
a9ee99b35e178a98ccf920be9e590056c042c9be6c1ff6dafcf0711ced1364f55e4d9681c1c798a94818fe940b0970f17b3877b023aff48984c52508739a15c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5bf7f96f2a35e917b0c130c863869ad

SHA1
8af00b2557f21a76c05ffea4da1e9e638cec90c7

SHA256
63df645c7a1758d21289f4d7a789bf504cb419751f80fd8efd7bac63e1171a94

SHA512
2c8c17138d80e73bf80bc4663ee06a91095ecf5cf75239f157159301664f38bac28e4ac9e33ac6951cb9ef9c72fc9ef11b7fb3854d15215b35ba8e014d819755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41902ca0b751c35a89a007225757214c

SHA1
10bd78dd94f4cf18fc087de9ca3ddf67669cd41e

SHA256
6ce6fe2e0f351e9d9b2f558f3b647f52639079c422e2724714dd41aed21507dc

SHA512
584acd65ecbde20f5e7c6e78395ba2da31d2b41918939a0ed70bda882cee80186091c2a22e6e02d07a78985316c4fc8d01df2e69f5efed4c48a2d273d2b6f9d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
daac3947a63cfa527303c50cb9be8236

SHA1
94dcac8898b4e7ca6849dcd4485f61fbbf95b103

SHA256
a84d7c50e6f3f833898af66261341441894bb31a0ab13fc9e91fe83eac52e009

SHA512
610868b76e4b3732b3b852cc59b817bdbe395d04b15591cb02aa5d04cc0b7179968ed2d1cc5a98d04f53f5d10f87313fc301c597592a4f69408220c3981e76da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Services\market.yandex.ru.ico

Filesize
9KB

MD5
037dcb9f2d8c769d7b9e362fedd36e84

SHA1
8019da23adf7b4baa2b4a0e615b9167f8d2aa984

SHA256
ac03c5b69ffe00e7937efa6917d2a4212ddb2f6e911aeba54461fe8c59de53f2

SHA512
c219b4c9c8077fe028fe863046f528ef389953878ec111f8cb9b00aaef74efc0ec428c930bdc5298bd5439afac81de5c9ec09c57a659f7e8ba263e509daed718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Services\www.ya.ru.ico

Filesize
5KB

MD5
534409dface053e62660de921ddc600d

SHA1
bd3dcb399327b1d5a2d53ab24e0217d9f524ab62

SHA256
38a3749cdb839c84168f23a9ee46cfd73d482e923bf2c6b4339184b4c93f91fb

SHA512
f58d2192660472e7cfb3c139c145c37f52aba993e2035afebe729a4ba08cf000d18f58cf20d77239cfad3adc278843238307fd0fba96c387e3f4cbbe84cd6b95

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\thumbnails\20b523aecd425e90266f0dab7bf8351b

Filesize
15KB

MD5
af80a936c10e18de168538a0722d6319

SHA1
9b1c84a1cf7330a698c89b9d7f33b17b4ba35536

SHA256
2435c0376fca765b21d43e897f4baa52daa0958a7015d04103488c606c99d1d3

SHA512
9a1325c8ce05806e5c161a4cf47239f62baad8f79650fbd713e74928fce8171ced10ba7f24fac46c548e1dbf3f64106270cb25ca88c836c870107f5dc1f97879

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xkoyglns.default-release\thumbnails\78cb426bea78e4d51fcbd8a9133dcb57

Filesize
5KB

MD5
2d0a37bb716f9ad9fb916eb8b08d34c4

SHA1
48658fb5f716478bcfa239ba635589184edc33cf

SHA256
a08d93fef42579ebf000b3496ae50837ba14024fd07df04304534de480c72a1c

SHA512
15216319722cd68b7e0018cfd360a3ef3ba512a0686646677b51f4926ee8290f984e72fdd5a815dc5fdfc7170e8d9b2f207413574c96c7189291140475fe959b

Download Submit
C:\Users\Admin\AppData\Local\Programs\PowerPoint\b83a1e9eefc9f1af929fb536fcf115abe.ico

Filesize
264KB

MD5
515c78ddaabc3880c9d218fdce2013d0

SHA1
47fb48543b9344d81dfd9f8451a0089187fab7e9

SHA256
ae05e5c33dd14b05ef65f559b26d7b2ace75475b37a03b6dfa14a0c6a1f50276

SHA512
ce7e33659ecdb1b7a4f6d38e3ebcfdf9454413442b808bcea0a0e5ee0290dee3b0a115bf20a82eb543aedb31fea05d96c2b2f1ef3593025c1c63a6f48abeba53

Download Submit
C:\Users\Admin\AppData\Local\Programs\PowerPoint\Мèð Òàíêîâ.lnk

Filesize
1KB

MD5
c535ffa40e71d96bab5a9e59e57fbdb6

SHA1
dc0a46fc25a0efca49cc33e1f71b5cc2b41e28d6

SHA256
b0b2bdd94bd9747cd829457f99a371c072b69c7430b4ba8c695785f2a47f5851

SHA512
365526b28dca02f2fa02306ac14ab994a415c0cbf82266e5a24c4530d2390917849b8c3f7b32094280a51f609cc5ae5ed8080c352a4bad190f4bbe2a5537c650

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab81BF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft PowerPoint Viewer (0).log

Filesize
3KB

MD5
7469ba91e08e4c299fb8aa11fdc3691b

SHA1
ba8e459ca7cdf6cece7684752cc8f78eead2951d

SHA256
248119a183572b6b1576cab47e882e15a5d456af7f3be6e50bd3674ede850d9d

SHA512
3cd550c296a043586ce04fa9c8538bb0ee6b6929b730e29ca7305883ce72897f0098e265cbe49cb0af623355cf25a057bd219dd7ce316a94991d9fbea2744da7

Download Submit
C:\Users\Admin\AppData\Local\Temp\OMNIJA~1.ZIP

Filesize
41.3MB

MD5
14f9524b34e06bee369c87fa3316f6c4

SHA1
cd77089a42b0e496850f6f6918b942458cd1effe

SHA256
fdb51298cba90c85ca7ccc371b7493c99292760a1967b1232fb39f020c6dcffa

SHA512
48575f1fa4376666e7f3c513958dd99a04cfd782fb47fd6d505c6c7defea238f98f24568e0e4fc037c47550227ea2abb5f5fec9fff041e990cac1cb194b4e4cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81C0.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar834E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log

Filesize
3KB

MD5
9064a5a994f48443d724f962ad1a4b8b

SHA1
32ceba470a3b0154420b53687e6f2c248a243149

SHA256
267de9bebd2e33024681d3c0f13660083cce5c0dc494cbbb134d9fcd4ea98589

SHA512
02a9597e306883c1ffef82817a0c56d4eae3b5026358735394d97114c6d21e02bd8c10bdb8ba3418694c4d0baa000fcc81d6705abe41d627c728e5f60072e38f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\YandexPackSetup.exe

Filesize
10.1MB

MD5
607863e41427e411980ed9dc06d47164

SHA1
e57a29a5b7be8a090148c63473ea8b5f3f3d16a7

SHA256
405460a1d696847c25fcfe0992f3b803c1b39399000b827dd3fdb85569f98db3

SHA512
92b41bf0cf199d63ae50c8c2661f253f805f83e129aa85ed27dfd590442e2cd735aa760da0cc6c83140265d804d3d715fd372787b49ae589886c7e9248b50a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\vendor00000.xml

Filesize
508B

MD5
54e4b8032d028b7956e07b2d7363fb32

SHA1
8ab03847257cca80f4afc2c03753198f707c7d15

SHA256
3d2889b15326ab15f7dff1652e886dab59a18a474d47d38775ccbe0887aa13fd

SHA512
c214728af961d66647583f2b753d97b38f9dc9d162e92d10c44d46fd4ef05c9ae6366190ac681f0f62e2f387dd6c592d845323edee5a704a4e9533387464d6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi

Filesize
9.8MB

MD5
32631cb23ae355006ddbbceafa6f7a0a

SHA1
65c20d2beda8d63eddcabef49e832045d15d67a7

SHA256
a72405f2124da6ef6ef68977efe279972a96b9748aa1e1d062c4fe44e715f7c0

SHA512
0543e668b5debfbd8d4d38d3ca0218d4e01f4d70832b8c5c28d8308ca66858d23ecc3623ae3c802b8b37db7356e27880107e245c05be418b4ae77b816a7162b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{D24F9E11-64F9-4E64-B834-9A455C438EC5}.exe

Filesize
3.2MB

MD5
eb3991970c77253b6a13272201cba8e3

SHA1
9562fc9fa71b46f9afcd623dc6e1b6e4885fc69b

SHA256
ab1ac5a35f04b6bea94b3d6c0b269751fc49ad57bfac86af1f4b269e117f4489

SHA512
558c21624ec9680eaba4c5fc401fbe3cf81ed8c77e549fc2fc4a1336af40668396d3cdfabe65f5ca5ecd293f49e4dc24208dbeffaeff9fd53180e63903ebbd8b

Download Submit
C:\Users\Admin\AppData\Local\Yandex\YaPin\2AE68B04.8A85F169\2AE68B04.exe

Filesize
397KB

MD5
1e64bdf002fa6dcae92e0b9ae4283867

SHA1
8db18047e35e77ca365a1da1648918fb710979c6

SHA256
dec6ed68c43845defcc2031c8e8da56fd6e2a476e2d5a2ea204c92b82d559bab

SHA512
b3207a4d10e07d97041bb471ba3f80e46dd70f2037ebc1a012b74943de4e78c5a5a2f5fb4c0a86615db34280b0d9f39a3f98f7b7734a7bf9fc29f41dd1bca1e2

Download Submit
C:\Users\Admin\AppData\Local\Yandex\YaPin\2AE68B04.8A85F169\Яндекс Маркет.lnk

Filesize
2KB

MD5
9167ec77e20b3efe2b9390a2f55565a4

SHA1
f0bd7975c1eda423a06141740c5e61b7cbc6b389

SHA256
99f189fb6a725f7516baacc6b45638a55586c26112b91c593f9e19e69909d79d

SHA512
078ce3b1772d30fa2a002ccc9c0848e4aca6d6f72ff2beb26ab0714eba21dd19d133a960b6ff3a09396e73f4a4e4fff349fd640ab00d1f03ce20fe892c743a49

Download Submit
C:\Users\Admin\AppData\Local\Yandex\YaPin\Yandex.lnk

Filesize
1KB

MD5
b31a147d90da070b7fcccb5748866f2c

SHA1
dcf7f85b0bfcaa3e3a4e6b93aff80fca32cad84d

SHA256
62acff4ee226fa8d20ef41b212c743a423dfe7ac25731073ed06a7140cf1492a

SHA512
2068537f2ef467bb7697b573eae672ed05cdaba4f53bb08ac40147fe625d9c0b1f168c662b460496bbd1fccbf47218f1eaf8343a83ae19dd9ffb8a18d8df2eb4

Download Submit
C:\Users\Admin\AppData\Local\Yandex\YaPin\Яндекс.website

Filesize
515B

MD5
9ecfbc284c35d151ed6145f5f19fdb0a

SHA1
698593804945056a361f71e3cee8d841589a0b97

SHA256
8bc933004f862750f2c05fd1277068834a4557c0e6b1facd9637458483dab75a

SHA512
d5a74242bc01121014bd320679f7eed47e7fc554f6d82853d1a8cd89d339ca38686cd614d2e8ddaad43eb12fb0da5a3ca4f791b1e2ae302a0ae8e687c51e2fb6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Ìèð Êîðàблåé.lnk

Filesize
1KB

MD5
74315e49270b89efa96842f64a2e10e5

SHA1
c64d2bcc05db8b48ef6af7e00fe9cdfe947158f8

SHA256
1ba99068a491c248706d2c38eebb7ac782cac82cd7a1320a14f777d9bc02dd20

SHA512
3acda8bc42a8c8b824928c1424a9dbfbe6be2ccf97965ed23d0f9abcd093005a474be7165a8086030d8b6bbfcb32a713c7412f45451948963affff0af21fce68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.Admin\places.sqlite-20240420103633.157000.backup

Filesize
68KB

MD5
314cb7ffb31e3cc676847e03108378ba

SHA1
3667d2ade77624e79d9efa08a2f1d33104ac6343

SHA256
b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1

SHA512
dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20240420103633.656200.backup

Filesize
1KB

MD5
3adec702d4472e3252ca8b58af62247c

SHA1
35d1d2f90b80dca80ad398f411c93fe8aef07435

SHA256
2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

SHA512
7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
a71fffc4528f92913bdc6b0d7b62867e

SHA1
42d93828e516943ced6749634942b953036ac371

SHA256
ac45581b55233fe5f5fc1e9f5a29851a904cd14cb731594e523329648d79ea98

SHA512
e34b3bef888c1a3ee25aaa6db21ba4995d91a744daba30f2ae2e29b215acf23f0201c3433650acbac236f7666a45c2653b56d5ebc5b77890fb4ad3e9836208c8

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences

Filesize
318B

MD5
689141d9435d37e49205384f229f2882

SHA1
5d9e579f6abc20a50d3ce0be208aeffbea02de24

SHA256
64b158ce5f3a93b78174d6e3501a08b8f37b72d0c14d9995e38970eca178db26

SHA512
f96c44b71a0868b5d3adb98ee6f0d0d1bd4700d2fe505d7c7e6d587a8e8a6bbb676c1dee49fb31c17463bf5c9403b38cc3072d1cfcb2d04707667aa670437de1

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20240420103633.656200.backup

Filesize
313B

MD5
af006f1bcc57b11c3478be8babc036a8

SHA1
c3bb4fa8c905565ca6a1f218e39fe7494910891e

SHA256
ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

SHA512
3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

Download Submit
C:\Users\Admin\Desktop\Мèð Òàíêîâ.lnk

Filesize
1KB

MD5
411cc16dee5cabd6333dbd6609532ea1

SHA1
977f5f4176fa1f94c27d3bdb3846dfcfae46e02a

SHA256
68ad165a942b9b398eccffdb3ebfecedb8b09c8947db5cc8ae959c6f7ce8f64e

SHA512
665ba779abf4cb741df1c3f1e442c73b98e34fe64788544f10ac211ab2b5eacf53eee7024d48e4b89846ed98af3a7ddd975cedefcc9035a9be851a08f6bb50bd

Download Submit
C:\Windows\Installer\MSI8480.tmp

Filesize
85KB

MD5
5577a98daef4ba33e900a3e3108d6cc1

SHA1
5af817186ab0376a0433686be470ea2b48c74f5f

SHA256
148199b4f3b6b2030e2aeb63a66e8e333e692d38691bcbe39139cf02bb61b31d

SHA512
d37d511975b5331a5b1cdda736890c7d4f2dcba4abac2b9399c977bdb7e09c964327e3f771cd592e2632b0e776545c490f29fd391ec13c7948557957cd805dd5

Download Submit
C:\Windows\Installer\MSIA16D.tmp

Filesize
181KB

MD5
b502c676e82cb196e20db36601a08ace

SHA1
391e219b99b9eccecfa8f866baa9bd09671c3a3e

SHA256
bca6f0bec828d4f1d9748e78de826c327a853bdceb3c432426f1d53994c0d88f

SHA512
7488451baccd548601a3c69105066842bf47e8e5dd2680b1a8caa50390a7fd6c8e666c603b7a9fef0ad5a0b41f8bd302f69c50f231e95c8ea6e8da98c3de7816

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

Filesize
4.1MB

MD5
74624aee2d3814e91f60619827dad662

SHA1
a8bb5f482752002e4c0a097b4d0fdf91f407e0ab

SHA256
b869e98960b4ee8c420dcda26c949d35e3cc9f4f947372f4611f14201e5cc31b

SHA512
e9a5bffeeec2c0f40f6077a9c73c801b2a91c5d5f94180cb5a04a55874a30d2ab87414501ca497b0b4e8f00f8e21e53485337a8e3c5914a7326ad650086dd8fa

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSORES.DLL

Filesize
69.2MB

MD5
adb5b569d47bb9766bcdd9234296d227

SHA1
e8b2a0b57c0072379cf3656b106d643a2dffc685

SHA256
4fdaabb819e3fb72706271ea698ca4b53bc8cb9fd74df0201469f14f025431d4

SHA512
091995b239e4cba37e27c4ae553b68930c680e906fa505db91feabc17f641f41214ddc232b36ecaddbb8aca3e916ec0afc3db5dcf61a839b2e03524c68a72b5b

Download Submit
\Users\Admin\AppData\Local\Programs\PowerPoint\a18b92654881dfd72a446ee033ffa0db7.exe

Filesize
19KB

MD5
44b878919f79e365120f1c960434870b

SHA1
c8131976421b07782a1c913eb5996581a277e047

SHA256
a6967e7a3c2251812dd6b3fa0265fb7b61aadc568f562a98c50c345908c6e827

SHA512
e9fd65eb9e01ec40d67b558e3a4be4ae24766436ed8f60b62e75cef07f2f983b3df4d7963f23d23007acee12f151359d7d3861663348ef2b360e14a84bf3d2ee

Download Submit
\Users\Admin\AppData\Local\Temp\Opera_installer_2404201036199592732.dll

Filesize
4.5MB

MD5
d2602deb0802865f749e2f5bbe8996fc

SHA1
dded8db99f8dc3d2e3c47f07269f021060a13d15

SHA256
df6ce456be3a71ee584b8a89c4df0a1b52f96a0e6c1e10bcdc520c663e01c75e

SHA512
56d3f0cebe52048e8778b2efcb3cf6f4daf8b99ef4e95421bfd8fefee99d545370bf31488992fc02fa623a3d18bbc681befff124aec0379c78c92c64e00f2c32

Download Submit
\Users\Admin\AppData\Local\Temp\is-1KSJ8.tmp\PowerPoint_Soft_new.tmp

Filesize
3.1MB

MD5
5c993694eae2d266b710c50c7217ba25

SHA1
18b3a239975558fb64553838f5f1a47194a3b22f

SHA256
676aed8190bfdf46ee811987f59c983cc15de72a2bb5e75c1b61604d0957487d

SHA512
0a14e0c7c83da28fc0195d36398a7e55074f2e1966aed652d6ac7d7324d1d394888f023dc179e69fe526f58f01eecf02eae57b472e03eee5a520f417012bc9bf

Download Submit
\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\PowerPointViewer.exe

Filesize
60.5MB

MD5
c84cd633b73778181ad20a19dcd9dda0

SHA1
d465a85621f1c93cd34c882169e21897e0dc2766

SHA256
0914bb694d4df6c58317a41a4d88a503228552f7fbed0e3c1d4953e257b6d8d3

SHA512
f5da4deedad71071797d046cd59fdf5a92a34945874437cc054d80568e83e3119dac41d39e7b05510d34d4bffa0fc3bb2f41ce4715a69371918f3f8b1254d054

Download Submit
\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-26SS1.tmp\cb3ad9a983bf595d841fd591e8e9ab63b.exe

Filesize
2.7MB

MD5
6c4ed217d7149e952f57911093e45529

SHA1
9086f96b7f7cc1e88e68cef38f20746d0b5126b0

SHA256
3d020def240d470214b43bde8772d8901e6de24fd26c2906d49bea1f9011c08e

SHA512
d8a0936f4535a774b4cbf51a983d3a91813fe072a86b1126159365ac39ccee0775ec69424f912bd6615cebe1eb9e3a9799c6ee48dda842575832c4671ca4eb3b

Download Submit
\Windows\Installer\MSI8152.tmp

Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
\Windows\Installer\MSI829B.tmp

Filesize
257KB

MD5
d1f5ce6b23351677e54a245f46a9f8d2

SHA1
0d5c6749401248284767f16df92b726e727718ca

SHA256
57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

SHA512
960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

Download Submit
\Windows\Installer\MSI86F2.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
memory/1136-389-0x0000000002EB0000-0x0000000002EBA000-memory.dmp

Filesize
40KB

Download
memory/1136-388-0x0000000002EB0000-0x0000000002EBA000-memory.dmp

Filesize
40KB

Download
memory/1136-391-0x0000000002EB0000-0x0000000002EBA000-memory.dmp

Filesize
40KB

Download
memory/1136-465-0x0000000002EB0000-0x0000000002EBA000-memory.dmp

Filesize
40KB

Download
memory/1136-387-0x0000000002EB0000-0x0000000002EBA000-memory.dmp

Filesize
40KB

Download
memory/1136-433-0x0000000002EB0000-0x0000000002EBA000-memory.dmp

Filesize
40KB

Download
memory/1136-435-0x0000000002EB0000-0x0000000002EBA000-memory.dmp

Filesize
40KB

Download
memory/1136-434-0x0000000002EB0000-0x0000000002EBA000-memory.dmp

Filesize
40KB

Download
memory/1136-423-0x0000000002EB0000-0x0000000002EBA000-memory.dmp

Filesize
40KB

Download
memory/1700-8727-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1700-1-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1700-15-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1724-68-0x0000000000400000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/1724-65-0x0000000000400000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/1996-76-0x0000000000400000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/1996-90-0x00000000027C0000-0x0000000002CE4000-memory.dmp

Filesize
5.1MB

Download
memory/1996-9527-0x0000000000400000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/2356-91-0x0000000000400000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/2436-51-0x0000000000400000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/2436-10010-0x0000000000400000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/2568-22-0x0000000000400000-0x000000000072F000-memory.dmp

Filesize
3.2MB

Download
memory/2568-8704-0x0000000000400000-0x000000000072F000-memory.dmp

Filesize
3.2MB

Download
memory/2568-1815-0x0000000004CE0000-0x0000000005204000-memory.dmp

Filesize
5.1MB

Download
memory/2568-8-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2568-16-0x0000000000400000-0x000000000072F000-memory.dmp

Filesize
3.2MB

Download
memory/2568-41-0x0000000004CE0000-0x0000000005204000-memory.dmp

Filesize
5.1MB

Download
memory/2568-23-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2568-322-0x0000000000400000-0x000000000072F000-memory.dmp

Filesize
3.2MB

Download
memory/2732-72-0x0000000003E80000-0x00000000043A4000-memory.dmp

Filesize
5.1MB

Download
memory/2732-44-0x0000000000400000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/2732-63-0x0000000003070000-0x0000000003594000-memory.dmp

Filesize
5.1MB

Download
memory/2732-49-0x0000000002880000-0x0000000002DA4000-memory.dmp

Filesize
5.1MB

Download
memory/2732-10007-0x0000000000400000-0x0000000000924000-memory.dmp

Filesize
5.1MB

Download
memory/2732-8825-0x0000000002880000-0x0000000002DA4000-memory.dmp

Filesize
5.1MB

Download