Overview

overview

10

Static

static

3

Windows.10....4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    196s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-04-2024 09:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Windows.10.Manager-3.9.4.exe

  • Size

    18.4MB

  • MD5

    fe3e550b3c92e6ea44ffd37f9396ffa9

  • SHA1

    124aa3b61468c7dc749a8455845f29bddf107751

  • SHA256

    51a759bcc937a6fe611d3f51bfcdd0aab88966099435768e933dac15a98a92ec

  • SHA512

    19245fb78dbc949ef2ef17564a365decc50214bfc97b5e9835848fc1d7e0268adedafd317ad39dd852ddbe1ea341d13bdd8534f43d8d95c2f6db01333eab0e19

  • SSDEEP

    393216:yEjGitsb/tM8Us+MNsg9XPlrzy7YRZkb0eIJR1BWPM:yE6VrthUsxNs/kkb0e01j

Score
10/10
ploutusatmbackdoorpersistenceupx

Malware Config

Signatures

  • Detected Ploutus loader 1 IoCs
  • Ploutus

    Ploutus is an ATM malware written in C#.

    backdooratmploutus
  • Uses Session Manager for persistence 2 TTPs 1 IoCs

    Creates Session Manager registry key to run executable early in system boot.

    persistence
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 18 IoCs
  • Registers COM server for autorun 1 TTPs 2 IoCs
    persistence
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Control Panel 3 IoCs
    evasion
  • Modifies registry class 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows.10.Manager-3.9.4.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows.10.Manager-3.9.4.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Windows\SysWOW64\msiexec.exe
      "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\Temp\packeg.msi" /qb APPLICATIONFOLDER="C:\Program Files\Yamicsoft\Windows 10 Manager"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3564
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3600
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2996
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding FE18A3BE10CDEEC8616FE952A9B6AB13
        2⤵
        • Loads dropped DLL
        PID:3572
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3768
    • C:\Program Files\Yamicsoft\Windows 10 Manager\Windows10Manager.exe
      "C:\Program Files\Yamicsoft\Windows 10 Manager\Windows10Manager.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:804
      • C:\Program Files\Yamicsoft\Windows 10 Manager\LiveUpdate.exe
        "C:\Program Files\Yamicsoft\Windows 10 Manager\LiveUpdate.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4224
      • C:\Program Files\Yamicsoft\Windows 10 Manager\Windows10Manager.exe
        "C:\Program Files\Yamicsoft\Windows 10 Manager\Windows10Manager.exe"
        2⤵
        • Uses Session Manager for persistence
        • Checks computer location settings
        • Executes dropped EXE
        • Registers COM server for autorun
        • Drops file in Program Files directory
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Program Files\Yamicsoft\Windows 10 Manager\SystemInfo.exe
          "C:\Program Files\Yamicsoft\Windows 10 Manager\SystemInfo.exe"
          3⤵
          • Executes dropped EXE
          • Gathers system information
          • Suspicious behavior: EnumeratesProcesses
          PID:4436
        • C:\Windows\system32\SystemPropertiesPerformance.exe
          "C:\Windows\system32\SystemPropertiesPerformance.exe"
          3⤵
            PID:3876

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      Query Registry

      4
      T1012

      System Information Discovery

      5
      T1082

      Peripheral Device Discovery

      2
      T1120

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e57adc7.rbs
        Filesize

        26KB

        MD5

        69f0184e6fdc4a1c3ae6e4ce07e47cba

        SHA1

        4737c1595a6d96255d307442607a4bf4d2774d11

        SHA256

        ad3eed5de44d692de3296c0eab4fd1c3cbc06f3e1292a043a46fc36aa9003ca4

        SHA512

        76cfa169f396a98b085ff3dce8dd50ec0586c75289896ea073b027aabc80e6fc398ad29990a510c1ee7fb234233bf4d9cdf67354327e26bbf3527a43e501434c

        Download Submit
      • C:\Program Files\Yamicsoft\Windows 10 Manager\Windows10Manager.exe
        Filesize

        2.1MB

        MD5

        a2c837a065ce36c73ef4b0053c5e3ffa

        SHA1

        fb385b8e35666956d83ece9b534a02b5f9ec2121

        SHA256

        a470cd877eb595ec5dc0de294588005cba3b038250bad8be8333f512db2a12cf

        SHA512

        4621771de8132b41f62fb45d8b32c006a29beaac8016112ee54f01d3c49380059541b551ff0abab090b2dd55f0094add8756a425f63a61e9823de018c882ff2c

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\1-ClickCleaner.exe
        Filesize

        781KB

        MD5

        2cbbf896601ad7eb710d81e5a6c473c8

        SHA1

        4be0e374acc7669d9d8736747f65a783962ccf1a

        SHA256

        d266442ea2ccd1bf3aff3f21fd88f944e50cda2529ea4e5378274f9e9af5a353

        SHA512

        d7d9d47f03b9a2cffdaf0e3583e6c8f71d03059ed947678b4e96d837b0cb4cd323bb472079f0b29bd59087b88ed4cb37930e747f3b8f7300af6cd572cf16f846

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\BingImages.exe
        Filesize

        668KB

        MD5

        70a6379b0cd3d9436a3010c3c4b57574

        SHA1

        aa6550976e0e2788910820a5780ac867f896d84f

        SHA256

        ac64635dc47f7f9a4ab7e01264a7e2e8a6a92a8443a7e3563bc582ef6d4095af

        SHA512

        fbce9a0367b6f8b0c80a753298b5332aa1478fab4c0e234b7f6bb7bc4ae3cd72fe7a7fe2318e23f5d4974c61c79d96fff76964e0d943ab5fd95c167ccc301ae0

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\CMMultipleFiles.exe
        Filesize

        104KB

        MD5

        938d570621a3ff7bfbcfa91e838696a6

        SHA1

        d6bd05f07bd81b6d28a777f858fecc9f59a3b7ca

        SHA256

        cd776e2938bfc75ff7013bce63755cd0db636090b3f6a02d40e6ff2bb198c9ea

        SHA512

        241d68fb5cef909544dafbe5e2776c8feda36555fbc397df2d9a1aac17896ceaad3c7ad31d830acfe2c8d888991211fe98d451f7f6ab979988d346024e66571e

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\CheckBoxComboBox.dll
        Filesize

        42KB

        MD5

        84401e715f90ec42623c6d214c7647e0

        SHA1

        8833bd546c05d597cd8a10db9020823c94b74388

        SHA256

        c2e8006bcdf4a302afeaa6350e216fe919a7f78e4bba69102bdc1ff31816c18b

        SHA512

        7db5f89e5d2da6d1c90bb1c984b656727f333ac1499a4ad1dbba029215578866f022a1666fa0501257fbff042c75993faa69e04fc3b9f115f52aa54f58a47531

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\ContextMenuManager.exe
        Filesize

        794KB

        MD5

        527627f9e80acc41dc6cf88f3336a7b3

        SHA1

        b884363ab23cc8e012cc4d9054fbb538c88b2620

        SHA256

        b8a9c72e43fa9642a18e91b83c539f808454af2c70acd4dfff97ef1c1ff0d9bd

        SHA512

        4d3981912acb68eab736381a51377d25ec2fde1484f085583c18b25ba69dcfd80f1fba312bfad3eed0e92dd980d67dca56380d6aeb3ebad58d89d70977919649

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\DesktopCleaner.exe
        Filesize

        662KB

        MD5

        f3568c4d79f195b7d141fa00983ce6b6

        SHA1

        b210e993734da199075cc200c3def0c8b237adad

        SHA256

        c1b5b79a3809002077d042bba613b24b07b1039440ecdbeb5d0c846b3c43302a

        SHA512

        ecf6fe746ac5bfce3126fa0550fc9a82de9ff86f1b5c2cb5cbd9ddd91d8ce74eea02a39097099b4305337af9d8dd9c4f4456cadff74d3d0c9c0b6f85ff711487

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\DevComponents.DotNetBar2.dll
        Filesize

        5.5MB

        MD5

        caafc76b9b81f5f95246025161abdf39

        SHA1

        109dfc25249f5c5edc409d08ee608f012b9449c1

        SHA256

        0d518811fe8dfe378828669199840028fbbd20e222fcb92435a8b976cffe2a43

        SHA512

        c6897c3f35b97f37b60785db9cb3bd4766e2856c178c7f74a42c26ca75fe5a10031b5acf12eb322e553fe11c8376b5d98f5f2655403a2a1b9f949ff3aaff192e

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\DeviceManager.exe
        Filesize

        663KB

        MD5

        a6438bcab52beedd284166632be7c9c0

        SHA1

        f48e9e59874b87d9d5f028b2b43a91134728d2be

        SHA256

        1a5a7494a5329440e0d3922b4aa2c04fdb78f80fd40c1d0327f70511d9da2c7f

        SHA512

        1cb45c526e657b1286868f57cf59247e876ccd687c734619b4ab323eecbae4c7909b7553fd73f54b70db47df832ffbd92a20ff5bb75cbe6e730a6a9caa6aa168

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\DiskAnalyzer.exe
        Filesize

        1015KB

        MD5

        f4bba42b9ffd1ea2c14e2199edd898f2

        SHA1

        5aa0155551beb90db808989cda8a3b11a1280926

        SHA256

        6d20780e9323ff0cdb723deebcd98146cfc6002054b4411ce82e76ed6df3e147

        SHA512

        0b0e34c3fe2cb92e68bf415054ff1c68317bc61a890537bbecb6959e020a52c6e37992ebc057ff37c5ba1070403aa02e3a4092f1a20d1eea17c0619e619593a0

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\DuplicateFilesFinder.exe
        Filesize

        746KB

        MD5

        d52a1e7b4d418061da86698905ac8fb2

        SHA1

        0d740c13840a6302250e8736ab78fa56674cd80f

        SHA256

        504faae99c4e78108a71d9217e6fe446bb2e0956c5b1a8b012033312145e1ff1

        SHA512

        04ed190132a156da8e0d25c50b139482ce0be0372b4e15981180b5e14d4c589df126a3de133a40ce4e1fd0fdfc1ff0ece4ac70362077e5e6e8ff6742d4ae0715

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\FileSecurity.exe
        Filesize

        1.1MB

        MD5

        5d585b1323d1025d93619fce1b19d450

        SHA1

        8df3cb8bd90be2ee8fd11759076fcfb6cf3976b5

        SHA256

        912262dbf6b55e904282cf927471aceb6807d2bde1b8d6c89bf2515d3cd664f6

        SHA512

        0d7f75f19165f94c06b1939d55d3efd0ec91a1a7be94ce0ac4df2ef2fe18666fc9eb7adc2c140ea4b755d231a85addb82fc83f240797d9fb708d261f5b3358d7

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\FileSplitter.exe
        Filesize

        804KB

        MD5

        26efe36d17952ba23ce6a31b4d0f7508

        SHA1

        cf2d3f13f8e8ae886b227828d05499a1a9dded6e

        SHA256

        213d0dc07a9a2164451926b537a81309f5bd39066a612d9b093090fbcb71bda6

        SHA512

        cdae1592608bc0935cbc821d3dbe6e2dcd4525130850c552f8a4a35048219849588d198f2c1e310baee30d052f5ccfc25d4a735a0a4b12112bf8c01720d75519

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\FileUndelete.exe
        Filesize

        918KB

        MD5

        5379d01702612c3b6aa07be8a702760b

        SHA1

        eb2682444b101fdccfbe991629b3ce5fb9e741d5

        SHA256

        235b1f27a2e4eecdca77b91d6981a348d4ebb7e8f32e8f4158295e80fbaa8117

        SHA512

        293dcf69f9e0bfced00c0f6a8f50b8550272d392805d506ba38585fa9f426ca05c85c5b19423958c93fded8e2a80de98b0f47f33c265710c445dde857131d98c

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\HardwareMonitor.exe
        Filesize

        1.4MB

        MD5

        2042a36ce0f2feccd8e0271af8827072

        SHA1

        5b648fc3cdf7518d7d00406bf2eba953d839911a

        SHA256

        7f5f350027e2a73f3ec490af346268784192ca27d61a71fe9890374889bfc886

        SHA512

        57bd17e761d6a9ce0e8523b06be2172567ef27c5c96c7a56b67c04b1f806ffefb276c1f9cd2e985f6d5a98667b74bf31afa1d1e0896bb422f3bb93afed17265b

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\Help.chm
        Filesize

        63KB

        MD5

        18bd34161b44c828825626b3c44121d0

        SHA1

        737876cc741745617ffa3b4b6a4bffbbcf5cc7fb

        SHA256

        840a6814025abe6a8ec935eac09d2e785eedccaeeab9e3872b9248c3852b0554

        SHA512

        72900ed1faffdc0875f8e78e3eaa68d122956a86cba4dfbb866cb961c6ba21da80c76774846392457ef60a873cec5c2cf28373f3d155d421ce0f701905c781c3

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\HotkeyManager.exe
        Filesize

        306KB

        MD5

        3ea81fc9860e0c2f401797400ac1d314

        SHA1

        764676652dfbf16bc09e78e579c2447f8b10ec8e

        SHA256

        ec68e406954f1ac203fe521fed94df01dc77169c7ca11fe0a39de286e4e633d9

        SHA512

        ab162de64cfa49bcf2cee1cfe0ba77d016b82512363a0876aefa4c76cc2cd8e96f06dcf2ebaf60522dea3ce4c3c1615f3ad899fbd65421c8f38221d14a9c4f3a

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\IPSwitcher.exe
        Filesize

        663KB

        MD5

        3b6885ec2bfbfc81906133ccf0badab5

        SHA1

        2f0a2bcb1474a8e5c1f8a9f9df30c1bdcda1a084

        SHA256

        e0952a1270b76d94818db865ec30916b11208b80b9101d0ad86a70f93a49ae49

        SHA512

        8f684cf1ece778dd15cdc8e2464acf3ef1b5e549be498d6f72ec073ec65a2803a49e5c16999a79f947b5fe8cde49d8d34b7a313bba51896a00ef117df3ecebbf

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\JumpListQuickLauncher.exe
        Filesize

        916KB

        MD5

        681d06da8854fad338d46702fad12e17

        SHA1

        d672d1b62ec1d3fe1df030c036912ea8e0779d88

        SHA256

        e223c58628a15cc52cd19d3bde4dbf6f4db2638d2efa4841f097ee4bb3a57435

        SHA512

        f248c150f53a1dcd822b375df1814c0b612eddccc71a7f6b59be652743641abc9f64bee6fab90e5a5fc9116de985fb466ba5e84e361f4d713c08d83f466d33ab

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\JunkFileCleaner.exe
        Filesize

        924KB

        MD5

        52cf470d8f81df70f4aa62f8b28ac13e

        SHA1

        93333df041b56ea5c4f2f3247c72c5c628ccca34

        SHA256

        8c5f297506415d95f8edeba2ce8eb42c2672d9a37e56e78b96a6e9e51e7a7bb8

        SHA512

        063ec125672a31c834eca1715025beaadc38e7a5f8803d3d525898138bf35d32c674cedbd4e50c766030cc20fab8788e386ca2c0ab59bffaab1845162212b1ad

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\Language\Arabic.lang
        Filesize

        305KB

        MD5

        abcc55ce3f6b9bd57bffe740cd55469e

        SHA1

        43fe39aa8db5feb01b842778f9f54a8d222d10ee

        SHA256

        88ac083eaeff425edd5a27323f4212d1884f6e3dd448e40e5a253f27bd332b7b

        SHA512

        ed7a6f1514f13c0fd346d3922245c2f1e6ce20f3600a34b50c81ae6b5ceec9f69daae73d558a8063983b4e544be6d75e15da2c153f8d2320c718335adb3c661c

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\Language\Chinese_Simplified.lang
        Filesize

        136KB

        MD5

        2605fb4fab0d6c7a0e2245e7927ee675

        SHA1

        4e73b3cd13f7e3df50b86cfe9d05f241133a8e77

        SHA256

        0b27c474c9bafdeabea9eb3b61e84adc375bba5f6a8d5b1ae703e8044fe15b7e

        SHA512

        424892b61c673557085b16792d645b82da111831efbee2a842fd9eaf136f5e4999756abdf1703e6faf1d2619c8b19b2c0f80ab5bf49bf3bb8ae59a58d8f61ee4

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\Language\Dutch_Netherlands.lang
        Filesize

        371KB

        MD5

        5d53e6b5662abf81abb22aed8a9d9905

        SHA1

        aaa243ec5eff425e5d25a4cb9053efe7fe40ff48

        SHA256

        fcd64feca44186d8adae95e00b151e3b6a0b7fbd6c4d2f6d948c1bec72a237a7

        SHA512

        3f550b53023eb53b0ed048c909a37f547b9a645690b86eec6aa4f384ec383e32cb6da174c895df261cd691864f9661d593d11750a243db3c9ad344a82df0a938

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\Language\German.lang
        Filesize

        376KB

        MD5

        d17311d21820c9434d095ab1fbb3bdc9

        SHA1

        285fd5388f24732d607e5fb70c72b23a93ff4ce0

        SHA256

        4273f3d4c46f396dd76b6dfa7c66172bc1ee36a46fa33ea26b659d7dbd5a8e4b

        SHA512

        9cbef0a9fd354cf4e276ced9ca3fc58f84ed0bed2a8c1d7724e7ec63f9a8a2b59bcc26cf88b7ac273271cb955988bfcba31d8d4a9c5777d0045ddebcd75d992f

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\Language\Greek.lang
        Filesize

        413KB

        MD5

        c5ed9c60bb558d225aeb8691ccec0121

        SHA1

        094aad777166903038c8075a1a48c72fc7ba53eb

        SHA256

        b5fa1017fd2e1d54da7be30ce12c0110bb6b6dd90385db7fd4091a207dfdbfcb

        SHA512

        c04c9d804d756333ac098f3d778f1c02ee7e4fc7f6f5dde50278c378428ffeaf2dc01deb8c01332ba85f702e42ce12c910b5cd6df86298362550ffbc25134297

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\Language\Polish.lang
        Filesize

        367KB

        MD5

        83b0b5d91b23c63bb30652d649a3b8e2

        SHA1

        9e3f78eee9801fd20d88461a1fca812102969e86

        SHA256

        154b647da2f55ae03bee80d7b9f09818524b7260fefe190cedc9b14edc395bbe

        SHA512

        0cfeeb30242359a24078243cba1a2b65c8a1824e22d7c6764c772e2c61de3821c1c88dfd4dac4c8110509cc5e4f1d72542ce4d56652f268fc285bcbe9333955e

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\Language\Serbian.lang
        Filesize

        358KB

        MD5

        5f6a79259a76ed6169c3e4495e1bce93

        SHA1

        77743d6b35772ca4ff09307cc584716361283d03

        SHA256

        9b3c55fc480036613f3fe4ba46d114847fba0de1fbda96a0464a9f93354cc371

        SHA512

        8df68f006ae696adaccb1cf8b0e6fe4f69160fa62ec82e8203771fab4f7bae615c9316c9696e09073eac01ace5c8486378a71aa3d21532fa09c64008e6cacb51

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\LaunchTaskCommand.exe
        Filesize

        69KB

        MD5

        05214e469ad18d3b109e61b21eecdca1

        SHA1

        6be8f3266acdc28c09318471f54c53695898106f

        SHA256

        75cfb3603ea150035dde8184f1e8dff8587dc556396b7a8dff8fe5255858ac5e

        SHA512

        47370c784a6ede511c403fdec7fd85dea4135c7cf47178eb061d68a17093ff77fe7a1f8adc8cf18ad8c9a16781ddfc10b73e1d3a0d93d489193fc9da5c814e55

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\LiveUpdate.exe
        Filesize

        836KB

        MD5

        0a3a93b3e8636add2824dc661929c3cf

        SHA1

        373d4c12fce8b9e3beacdf2936acbf8ec5c79807

        SHA256

        aab05a57e8f1c41d191eb2b2bdf7ab5746b8024e8f683a2fa41c3035db08332d

        SHA512

        75aca809505c14498158d41868ddfc9b3b4f9c809bceb2d02bb5b96655f671a079251ef677f15def849f24bfcfdf90754b15180bf97a1e06997b1a1692f6ecae

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\LiveUpdateCopy.exe
        Filesize

        18KB

        MD5

        ebd1319d6a70b89fe6078f984d00ca92

        SHA1

        397baf1bdb3f865069569842bc56c99823f186e9

        SHA256

        b35802dfec518a6b62d1f5898ae5970724776084ec5e5ccf8515ffe9f3dbdd7f

        SHA512

        179cf5cae108ee1088b7b15a72f3ede2383fda7d48de85312d81f24fe940ee4adfc5814d22aececcd69f7134c3097a5e37b2950c00d7f0d7956a233bd41841e5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\Microsoft.Win32.TaskScheduler.dll
        Filesize

        323KB

        MD5

        c0c515668a76a0a3df96567864537ab8

        SHA1

        e709c80b05d001509050f616a25e5481e62db434

        SHA256

        f179d25cb4088432e5efadf80eb489fbb32a240beb86d99a12db2018da7acced

        SHA512

        f191dad21148c52017d9884c17ecfcf4ddc824659d7a9c779c32c295b87992c1c28ac6b204da90476b1bdf75ae9bdfd9ac2282bfdf0380a4427eae8a570812c8

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\MyTask.exe
        Filesize

        790KB

        MD5

        855ad09fe8a4f102d7764a1243e573bb

        SHA1

        1d0a10d9f19bde49dad50aff93de0167469f3a02

        SHA256

        faac65658bd49c6bd37ecc3b2db16edb00852b58d11efd41475ce6d2c4451021

        SHA512

        cc5267f8235582d798d0410efeac76e2192f05fb1cb6ef944e721141b83a35cfa0d4a544d0e051c45d34f55f27e4d31268b0f5f4263aaea80107b141dcd6a2dd

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\NavigationPaneManager.exe
        Filesize

        271KB

        MD5

        b9cd686df2745303e59e80844c363de7

        SHA1

        8990e17b8ee4be4eace9d5051444e887db6f0984

        SHA256

        dc87cc914f5fb9e671944b36b4c938382f06e4a8d62451d840b2b29bfbbba017

        SHA512

        feb1ec3851617672c4555bb6c43a1ab0519455187612d3e9e0d91b23cfeece2add1aaa8310b59e2578355695baae86899071cfafb67eaab364e3f4122e3bc706

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\NetworkMonitor.exe
        Filesize

        1.1MB

        MD5

        cdf01378430971a90e4a3a79c5ebbf4b

        SHA1

        f8e1f1fcd624b94aac821793b3b3e5170d05d5a0

        SHA256

        38047b70b9e3546a73f835cd7380296232bbdd71b1fe5c5785605c33876dfeaf

        SHA512

        904086f454648a89a14832401d8a8ecfec384a2bcaf5f2b6a0183485d36f9a44f380585393a1b3165007ca50a37d44cd5dae3764868edf1d8b1ff9a4c30bd4ab

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\NetworkTools.exe
        Filesize

        412KB

        MD5

        43e2f8a89c8fbc52c4adeab533d83c52

        SHA1

        24ae04f5cf965e47068b6540e1740e430b9b4a79

        SHA256

        11dbfe3756cbc2ff0aad0ee184e29ddbb2d98a6c7a5b915079c58b529aabf28a

        SHA512

        7de3ab0aa3b1e70c98b0fe4fd4667d99bbac2975516a186a09e2fc2a9d3041b9d0441fbf85e5acbc67f372065960b9626e54f9fec4fb40e685e371eb773a705e

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\OptimizationWizard.exe
        Filesize

        705KB

        MD5

        90cf819665b7a3c82959566a5f9ba8f2

        SHA1

        7a07f9cd339cacddc365e5817a01c9b7fd4e2af0

        SHA256

        506b1d9eacadc117dc07513fd166be903bd0f6983c1424c91cdadb1dca772d66

        SHA512

        46a5bb0c3a39ee5855c6bed80e8ebfca3f9cd24cc1e5d938d5c6c14c4cb53de42be122170274557a1cd66be17a249378fd5791de60f64b2ae2244cd5e5e90edb

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\PrivacyProtector.exe
        Filesize

        7.3MB

        MD5

        8d39e2bdd4f709df15b5607c7eff41f5

        SHA1

        878effa0d04d8e9c96d226cdf2f344233afa639c

        SHA256

        05433365aaa564f931bdda698aeda545301a9b0e3daad6ab9203045a4db5db9d

        SHA512

        d59c64e39351c996b7fcbf674122ef83b73e28103da7ab05b8a2e6ead27c986120f9c498b807cd4f9c062e69a99db3700c16aeb4d87604d6fe2e65f3eb8368f5

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\ProcessManager.exe
        Filesize

        1.1MB

        MD5

        32f36014fe0777316d73dd34e7d74764

        SHA1

        d475321988a566c990606a263277667d281dcaec

        SHA256

        3bda38ad507afd352599acd2bbb20a025bdb74ed0dff064eee5a0797b1ce40ac

        SHA512

        55544918c8409848107d60ba39ae94577b23dc0dd0361fb53af86d7becf56a9baae863e94cc375a4e9296dcb07a9a14115552c92fab3b159ab9103953bc01ef8

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\RegistryCleaner.exe
        Filesize

        963KB

        MD5

        658c8b0900a42c7c94ed055a62cbc6ce

        SHA1

        37dddf7f82aaca8e132f81574e9a6451aa2f7603

        SHA256

        628fc8ce945749bed0df994bc0982cd7054db394e0c97dee85b47960bb850075

        SHA512

        97f175cb04f6d1fbc9010d98d51cdfeb6b4c91bea74acef0f064ddbcc17f3373591d9b4e86f0de3dd219e0a412c78ca4a7e81bbcb8819d03d8397d22d1908a4a

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\RegistryDefrag.exe
        Filesize

        786KB

        MD5

        e305cda17e72c98f85b5b405dfd0ce5d

        SHA1

        7a3d7419fdbdc72a4a5b033dffe068eca9754eec

        SHA256

        843ce28b61b0564c4afa22a6758c049e58118cb295fe6e93397675538721c9de

        SHA512

        21198645a9a047f21a54737926f0ddf595a2ffea67583e00eeb5c77bfc8f7393f2d2e67f3f7c784bc82392debffff841e7982667aed075ba82762caa72333e8d

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\RegistryTools.exe
        Filesize

        937KB

        MD5

        811673863a9d497584a2131f2f74777b

        SHA1

        ca0655aa36120f2afd378c884aedfbb06e88f5e1

        SHA256

        bbab7d9214eceb1204d767afa8e2b858b33c90fe12d22dbd41d06c892353032c

        SHA512

        e62eaff6573172479cde729cd64bfa7153177d678e75c815b4f940abce2f82073f04d57b4f8c05e26cd8b6ce76b17a0e548c3a41b8b1471b574def57b3a6d097

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\RepairCenter.exe
        Filesize

        1.2MB

        MD5

        2064042b83b6950bee5d2e5e729f7560

        SHA1

        bccce4bcd42f759ef64ab5635888f8590ae67bca

        SHA256

        0536784807eac93143a457fd66291d3341daee58a8b6fc1d74d9cbd2c379d7c8

        SHA512

        3334d58798f9279d202035d1a2ea170de85f69524a48fe4c8e1d96cc38582f6962bc06421a4bd2545ad11e37d1ac05f8c73f10e53ccb86b424783ce6f8003457

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\RunShortcutCreator.exe
        Filesize

        659KB

        MD5

        3d260ff15b117a79184ee604218d0116

        SHA1

        bc99521a7b805935b1f8b4b66d5f7cd4b0d78ba9

        SHA256

        33d4da7a2cc82d79051e3b0e4e9aa104aa6158cf96b30d358b21d8598e81f61d

        SHA512

        3419d7ec0e9734529a8ca39e49705ba5c79aac92425a554d4313169c6c01935026397714f9045b821d5cb37eaf3bd3afdc9f4bd18de871b96955fe94c99d8703

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\Temp\packeg.msi
        Filesize

        4.3MB

        MD5

        401306534c2c6a35ae88c9a1ff59f22c

        SHA1

        04f96a73433155420d7af35b3ce264b1f92d5cdf

        SHA256

        f0152ee59e139e7d3020eb2c2368e88455884a799b04d844d86bcdf2f9389946

        SHA512

        6c28205bbdd8b3cedfc3b41b780316a539d4a9b3c615c55bd039d31a36064138e9a91a66b461a38778f0cd46864d49600721757f501e1094d46affc9e4eb1be0

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsl3048.tmp\Aero.dll
        Filesize

        6KB

        MD5

        243bf44688b131c3171f2827a93e39dc

        SHA1

        07e9c7bd16ae47953e42c06ae2606de188386f35

        SHA256

        04a577df50431eb0ff6fb103566402bf66c50415bcc1f8a86b9c235053131455

        SHA512

        a1a8c21d38c54a43d1c6c394f481dfbddcb359c617e9928ecca8f84d47354616a78d20735a1fe7bebd21626c21cf96d0e1a69e3e98f6b35f2a774cc0244f9516

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsl3048.tmp\BrandingURL.dll
        Filesize

        4KB

        MD5

        71c46b663baa92ad941388d082af97e7

        SHA1

        5a9fcce065366a526d75cc5ded9aade7cadd6421

        SHA256

        bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

        SHA512

        5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsl3048.tmp\LangDLL.dll
        Filesize

        5KB

        MD5

        40eaa85160444940ff71d7aec7c6aa39

        SHA1

        62b0c779f32af751f3ef00833d3f5c75ed9f081d

        SHA256

        b4e00150349af7a646a84792b565a0c81f080a838a6e0da69e5cf8f4cdc560a3

        SHA512

        6d9e04dae68f9fd78a4f20a1d3fd34a9b92cf78b554d1e3e8e7fc3b2881d4659e49346f707cab43fd72c001ac192516deea7ef458ecab6b9f74b16ec05382ab4

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsl3048.tmp\System.dll
        Filesize

        11KB

        MD5

        8571f5fc7f75b0ee8d99849a147e0a67

        SHA1

        0881a57ef76dae56454d3af836f0f8da8e583d49

        SHA256

        6c84f2582301ac235aa5ad222c7138f44f262d7a03dcab2a293f0f2a5e32c002

        SHA512

        e1e5854e9378f0c9d8590b66c10e23b56977ba367d724e272f5714b16845369d53a4bab29f0d41a9bb383032f7fb4ea3d814bf13b7fbb29a04f5876c14d61e76

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsl3048.tmp\ToolTips.dll
        Filesize

        4KB

        MD5

        9a0da2692764bb842411a8b9687ebbb7

        SHA1

        5c3a459faa08a704bdf162476897ad4580ae39bd

        SHA256

        28aeaa48c929188a0d169887cc3f16370741467ae49e1db59763f030710a6bbb

        SHA512

        814d686617df4fe9f50a93dac9428babff3a14836aa27b4666976379ec3fafcab65fd82d8886998fa65e7b59dc192ca067cf8b4cdeb8ef551812912d80dab8ed

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsl3048.tmp\modern-wizard.bmp
        Filesize

        150KB

        MD5

        425b29766a313467796e006b9cd661c5

        SHA1

        11ad5369d1ef3c87a24dbf8ef78e99a7be5e1d3e

        SHA256

        b31e83385b49250e3e90b11ffd35c9c5325a2d6867e7ab847725309eb9ba759e

        SHA512

        2284a8f8a4bbcd74caf06095e72ebee957dc049819415557977e078149466978a06e9ea84de086143d5761aca1d66a2fe33d6ed40918cffc944a9e422b764e98

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\nsl3048.tmp\nsDialogs.dll
        Filesize

        9KB

        MD5

        2d4e6314e1291e211f3326b9e9a7be8c

        SHA1

        67236ee783506c854a40229f311eec7f8a74d218

        SHA256

        01c37f54c7019f09734ce28ac929d2f1f3da1ae469282a6df1d34b69b8ff9280

        SHA512

        6063b3f82376cacf95bcc70061cb29bd2c4261959cfa1063426f4b4617e399d263f4ad63551ec64187ec04b847304bfd1cbbbc6825c810cecdff5b17f0b64fd1

        Download Submit
      • C:\Windows\Installer\MSIAE70.tmp
        Filesize

        391KB

        MD5

        a32decee57c661563b038d4f324e2b42

        SHA1

        3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2

        SHA256

        fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04

        SHA512

        e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9

        Download Submit
      • C:\Windows\Installer\MSIAF9C.tmp
        Filesize

        864KB

        MD5

        4e2e67fc241ab6e440ad2789f705fc69

        SHA1

        bda5f46c1f51656d3cbad481fa2c76a553f03aba

        SHA256

        98f4ebaa6ea1083e98ea0dd5c74c2cb22b1375c55b6a12cfdc5d877f716de392

        SHA512

        452df66dd2b09485bf92d92b72b3ad2638cbf0a570741b80309056d1e67e68a18cbd0ad3616a2943bb29de62a057848a7382b6c64c3821335a51b0a03131564c

        Download Submit
      • C:\Windows\Installer\MSIAFCD.tmp
        Filesize

        569KB

        MD5

        0be7cdee6c5103c740539d18a94acbd0

        SHA1

        a364c342ff150f69b471b922c0d065630a0989bb

        SHA256

        41abe8eb54a1910e6fc97fcea4de37a67058b7527badae8f39fba3788c46de14

        SHA512

        f96ef5458fdc985501e0dca9cac3c912b3f2308be29eb8e6a305a3b02a3c61b129c4db2c98980b32fd01779566fa5173b2d841755d3cb30885e2f130e4ad6e2c

        Download Submit
      • C:\Windows\Installer\MSIBA62.tmp
        Filesize

        269KB

        MD5

        e665cf6f92685a531f9122623453f00d

        SHA1

        35316d190fe0b895f8c871ff509df1b6da05d17d

        SHA256

        c3b04fcf6aab702f3fd2e26728b9c5fde96c288bea5e52c4122433dd41cf48a2

        SHA512

        dc8ee378dde88f74f17be171c6fbcea6a879e018d485f6147928cd1030bf77294a554045c62d6e8b4c268878a3e9e2c3b6b9daf55525e3bb14963d41b41a83d5

        Download Submit
      • memory/804-379-0x0000013C6AC50000-0x0000013C6AC60000-memory.dmp
        Filesize

        64KB

        Download
      • memory/804-383-0x0000013C6AC50000-0x0000013C6AC60000-memory.dmp
        Filesize

        64KB

        Download
      • memory/804-391-0x0000013C7EA00000-0x0000013C7EA56000-memory.dmp
        Filesize

        344KB

        Download
      • memory/804-390-0x0000013C7E970000-0x0000013C7E992000-memory.dmp
        Filesize

        136KB

        Download
      • memory/804-365-0x0000013C685C0000-0x0000013C687E8000-memory.dmp
        Filesize

        2.2MB

        Download
      • memory/804-366-0x0000013C6B250000-0x0000013C6B7C8000-memory.dmp
        Filesize

        5.5MB

        Download
      • memory/804-367-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/804-368-0x0000013C6AE20000-0x0000013C6AF70000-memory.dmp
        Filesize

        1.3MB

        Download
      • memory/804-369-0x0000013C6AC50000-0x0000013C6AC60000-memory.dmp
        Filesize

        64KB

        Download
      • memory/804-370-0x0000013C6BD00000-0x0000013C6C228000-memory.dmp
        Filesize

        5.2MB

        Download
      • memory/804-371-0x0000013C6AC50000-0x0000013C6AC60000-memory.dmp
        Filesize

        64KB

        Download
      • memory/804-372-0x0000013C6AC50000-0x0000013C6AC60000-memory.dmp
        Filesize

        64KB

        Download
      • memory/804-373-0x0000013C6AC50000-0x0000013C6AC60000-memory.dmp
        Filesize

        64KB

        Download
      • memory/804-389-0x0000013C6AC50000-0x0000013C6AC60000-memory.dmp
        Filesize

        64KB

        Download
      • memory/804-375-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/804-395-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/804-377-0x0000013C6AC50000-0x0000013C6AC60000-memory.dmp
        Filesize

        64KB

        Download
      • memory/804-382-0x0000013C6AC50000-0x0000013C6AC60000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2280-403-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/2280-398-0x000001F1B7810000-0x000001F1B7820000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2280-397-0x000001F1B7810000-0x000001F1B7820000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2280-405-0x000001F1B7810000-0x000001F1B7820000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2280-407-0x000001F1B7810000-0x000001F1B7820000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2280-396-0x000001F1B7810000-0x000001F1B7820000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2280-408-0x000001F1B7810000-0x000001F1B7820000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2280-413-0x000001F1BC4E0000-0x000001F1BC4E8000-memory.dmp
        Filesize

        32KB

        Download
      • memory/2280-476-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/2280-392-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/2280-394-0x000001F1B7810000-0x000001F1B7820000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4224-385-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/4224-378-0x00000287CBC10000-0x00000287CBC22000-memory.dmp
        Filesize

        72KB

        Download
      • memory/4224-381-0x00000287E4510000-0x00000287E451C000-memory.dmp
        Filesize

        48KB

        Download
      • memory/4224-380-0x00000287E44F0000-0x00000287E4500000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4224-374-0x00000287C9E40000-0x00000287C9F14000-memory.dmp
        Filesize

        848KB

        Download
      • memory/4224-376-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/4436-400-0x00000214FC770000-0x00000214FC86C000-memory.dmp
        Filesize

        1008KB

        Download
      • memory/4436-402-0x00000214FEE00000-0x00000214FEE10000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4436-404-0x00000214FEE00000-0x00000214FEE10000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4436-401-0x00000214FEE00000-0x00000214FEE10000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4436-406-0x00000214FEE00000-0x00000214FEE10000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4436-399-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/4436-409-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/4436-411-0x00000214FEE00000-0x00000214FEE10000-memory.dmp
        Filesize

        64KB

        Download
      • memory/4436-412-0x00007FFFFBF90000-0x00007FFFFCA51000-memory.dmp
        Filesize

        10.8MB

        Download
      • memory/4640-127-0x0000000074F80000-0x0000000074F8A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/4640-23-0x0000000074F80000-0x0000000074F8A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/4640-344-0x0000000074F80000-0x0000000074F8A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/4640-36-0x0000000074F80000-0x0000000074F8A000-memory.dmp
        Filesize

        40KB

        Download