f880afedb4cc325c4f653ed869650226ed59576bf82b178d91fd0c5b49fe9ef8

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
01/06/2024, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tinytask-1.77-installer_U48iS-1.exe
Size

1.7MB
MD5

2d2893a132bc5b09054f3170e3c7bc17
SHA1

a32a8ede926df16be2cc7bb2cc21ced928165be9
SHA256

f880afedb4cc325c4f653ed869650226ed59576bf82b178d91fd0c5b49fe9ef8
SHA512

b232a113b74513019a691e8e0e936804b09dffc67bb6dafa5a9da7e5d9c9e539860ceda6845fee89975800f4143a4d9b0156458810c0581b827c799256688daf
SSDEEP

24576:y7FUDowAyrTVE3U5F/Z5bOyUSTXaorKQROO/Fz+n4HDHtw3ebE/AWDe/kjCvbWxv:yBuZrEUyPS7asJROQzKGWe/SMA

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\rsElam.sys	RAVEndPointProtection-installer.exe
File created	C:\Windows\system32\drivers\rsCamFilter020502.sys	RAVEndPointProtection-installer.exe
File created	C:\Windows\system32\drivers\rsKernelEngine.sys	RAVEndPointProtection-installer.exe
File created	C:\Windows\system32\drivers\rsElam.sys	RAVEndPointProtection-installer.exe

Executes dropped EXE 9 IoCs

pid	Process
4276	tinytask-1.77-installer_U48iS-1.tmp
1984	component0.exe
2844	lpud2sn0.exe
408	RAVEndPointProtection-installer.exe
3840	rsSyncSvc.exe
1456	tinytask-1.77-installer.exe
1560	rsSyncSvc.exe
6912	rsWSC.exe
748	rsWSC.exe

Loads dropped DLL 3 IoCs

pid	Process
2844	lpud2sn0.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rsWSC.exe.log	rsWSC.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Process.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.IO.Compression.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.AppContext.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\x64\ext_x64.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.IO.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.AppContext.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Encoding.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\Microsoft.Diagnostics.FastSerialization.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Data.Common.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\icudtl.dat	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\kn.pak	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsEngine.Data.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Net.Security.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ar.pak	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Collections.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.IO.MemoryMappedFiles.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Runtime.CompilerServices.Unsafe.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Collections.Concurrent.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Globalization.Calendars.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.Csp.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ca.pak	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.Registry.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\Dia2Lib.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.Tracing.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Edr.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsEngine.Updater.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsDatabase.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Data.Common.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.IO.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.IO.FileSystem.DriveInfo.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Text.Encoding.Extensions.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Programs.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\uninstall.ico	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.Quarantine.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Threading.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsEngine.Scan.OnDemand.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\NAudio.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsEngine.Protection.Ransomware.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Net.Primitives.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Reflection.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Console.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Diagnostics.TraceSource.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\ui\EPP.exe	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\lv.pak	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\amd64\KernelTraceControl.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\rsEDRSvc.exe	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Principal.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Net.NetworkInformation.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\ur.pak	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Globalization.Extensions.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Collections.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Data.SQLite.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\rsEngine.Utilities.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Diagnostics.FileVersionInfo.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\EDR\System.Net.NameResolution.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\ui\app.asar.unpacked\electron-core\node_modules\@reasonsoftware\rsbridgenapi\prebuilds\win32-x64\rsBridgeNapi.node	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\System.Security.Cryptography.X509Certificates.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\rsClient.Protection.Microphone.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\pl.pak	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\Microsoft.Diagnostics.Tracing.TraceEvent.dll	RAVEndPointProtection-installer.exe
File created	C:\Program Files\ReasonLabs\EPP\Microsoft.Win32.TaskScheduler.dll	RAVEndPointProtection-installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3920	4276	WerFault.exe	77
1440	4276	WerFault.exe	77

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tinytask-1.77-installer_U48iS-1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	tinytask-1.77-installer_U48iS-1.tmp
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rsWSC.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rsWSC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	rsWSC.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe
408	RAVEndPointProtection-installer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
6784	fltmc.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	component0.exe
Token: SeDebugPrivilege	408	RAVEndPointProtection-installer.exe
Token: SeShutdownPrivilege	408	RAVEndPointProtection-installer.exe
Token: SeCreatePagefilePrivilege	408	RAVEndPointProtection-installer.exe
Token: SeDebugPrivilege	408	RAVEndPointProtection-installer.exe
Token: SeSecurityPrivilege	6708	wevtutil.exe
Token: SeBackupPrivilege	6708	wevtutil.exe
Token: SeLoadDriverPrivilege	6784	fltmc.exe
Token: SeSecurityPrivilege	6856	wevtutil.exe
Token: SeBackupPrivilege	6856	wevtutil.exe
Token: SeDebugPrivilege	6912	rsWSC.exe
Token: SeDebugPrivilege	748	rsWSC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4276	tinytask-1.77-installer_U48iS-1.tmp

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 4276	780	tinytask-1.77-installer_U48iS-1.exe	77
PID 780 wrote to memory of 4276	780	tinytask-1.77-installer_U48iS-1.exe	77
PID 780 wrote to memory of 4276	780	tinytask-1.77-installer_U48iS-1.exe	77
PID 4276 wrote to memory of 1984	4276	tinytask-1.77-installer_U48iS-1.tmp	78
PID 4276 wrote to memory of 1984	4276	tinytask-1.77-installer_U48iS-1.tmp	78
PID 1984 wrote to memory of 2844	1984	component0.exe	79
PID 1984 wrote to memory of 2844	1984	component0.exe	79
PID 1984 wrote to memory of 2844	1984	component0.exe	79
PID 2844 wrote to memory of 408	2844	lpud2sn0.exe	80
PID 2844 wrote to memory of 408	2844	lpud2sn0.exe	80
PID 408 wrote to memory of 3840	408	RAVEndPointProtection-installer.exe	82
PID 408 wrote to memory of 3840	408	RAVEndPointProtection-installer.exe	82
PID 4276 wrote to memory of 1456	4276	tinytask-1.77-installer_U48iS-1.tmp	84
PID 4276 wrote to memory of 1456	4276	tinytask-1.77-installer_U48iS-1.tmp	84
PID 4276 wrote to memory of 1456	4276	tinytask-1.77-installer_U48iS-1.tmp	84
PID 408 wrote to memory of 6568	408	RAVEndPointProtection-installer.exe	91
PID 408 wrote to memory of 6568	408	RAVEndPointProtection-installer.exe	91
PID 6568 wrote to memory of 6588	6568	rundll32.exe	92
PID 6568 wrote to memory of 6588	6568	rundll32.exe	92
PID 6588 wrote to memory of 6624	6588	runonce.exe	93
PID 6588 wrote to memory of 6624	6588	runonce.exe	93
PID 408 wrote to memory of 6708	408	RAVEndPointProtection-installer.exe	95
PID 408 wrote to memory of 6708	408	RAVEndPointProtection-installer.exe	95
PID 408 wrote to memory of 6784	408	RAVEndPointProtection-installer.exe	97
PID 408 wrote to memory of 6784	408	RAVEndPointProtection-installer.exe	97
PID 408 wrote to memory of 6856	408	RAVEndPointProtection-installer.exe	99
PID 408 wrote to memory of 6856	408	RAVEndPointProtection-installer.exe	99
PID 408 wrote to memory of 6912	408	RAVEndPointProtection-installer.exe	101
PID 408 wrote to memory of 6912	408	RAVEndPointProtection-installer.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tinytask-1.77-installer_U48iS-1.exe
"C:\Users\Admin\AppData\Local\Temp\tinytask-1.77-installer_U48iS-1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\is-ANRIB.tmp\tinytask-1.77-installer_U48iS-1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ANRIB.tmp\tinytask-1.77-installer_U48iS-1.tmp" /SL5="$4023E,837551,832512,C:\Users\Admin\AppData\Local\Temp\tinytask-1.77-installer_U48iS-1.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Users\Admin\AppData\Local\Temp\is-6HH0G.tmp\component0.exe
    "C:\Users\Admin\AppData\Local\Temp\is-6HH0G.tmp\component0.exe" -ip:"dui=f3dcadc9-113d-4c66-8517-189abc125a61&dit=20240601221049&is_silent=true&oc=ZB_RAV_Cross_Solo_Soft&p=fa70&a=100&b=&se=true" -i
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\lpud2sn0.exe
      "C:\Users\Admin\AppData\Local\Temp\lpud2sn0.exe" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\RAVEndPointProtection-installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\RAVEndPointProtection-installer.exe" "C:\Users\Admin\AppData\Local\Temp\lpud2sn0.exe" /silent
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:408
      - C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
        
        "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
        6⤵
        Executes dropped EXE
        
        PID:3840
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf
        6⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:6568
        
        C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        7⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:6588
        
        C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        8⤵
        
        PID:6624
      - C:\Windows\system32\wevtutil.exe
        
        "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6708
      - C:\Windows\SYSTEM32\fltmc.exe
        
        "fltmc.exe" load rsKernelEngine
        6⤵
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:6784
      - C:\Windows\system32\wevtutil.exe
        
        "C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6856
      - C:\Program Files\ReasonLabs\EPP\rsWSC.exe
        
        "C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i
        6⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:6912
- - C:\Users\Admin\Downloads\tinytask-1.77-installer.exe
    "C:\Users\Admin\Downloads\tinytask-1.77-installer.exe"
    3⤵
    - Executes dropped EXE
    PID:1456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 1808
    3⤵
    - Program crash
    PID:3920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 1808
    3⤵
    - Program crash
    PID:1440

C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4276 -ip 4276
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4276 -ip 4276
1⤵
PID:2776

C:\Program Files\ReasonLabs\EPP\rsWSC.exe
"C:\Program Files\ReasonLabs\EPP\rsWSC.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Filesize
795KB

MD5
3068531529196a5f3c9cb369b8a6a37f

SHA1
2c2b725964ca47f4d627cf323613538ca1da94d2

SHA256
688533610facdd062f37ff95b0fd7d75235c76901c543c4f708cfaa1850d6fac

SHA512
7f2d29a46832a9a9634a7f58e2263c9ec74c42cba60ee12b5bb3654ea9cc5ec8ca28b930ba68f238891cb02cf44f3d7ad600bca04b5f6389387233601f7276ef

Download Submit
C:\Program Files\ReasonLabs\EPP\InstallerLib.dll

Filesize
339KB

MD5
feadbb02bbce1a52cea80d5b38262eaa

SHA1
cba0f46ebb3570a08cf15ae992ae845afcd13801

SHA256
393b052e9e76bb446f568e755c84f61ff7f1b1db4ca0eb0114067ad1ff95daa4

SHA512
997d83820aeb16612313e33b63827de993fff39acd27c54835ea15ebaaa07bb24eeb955e892699f75fcbf2d1f92a8653416893341633b79cdddbcd8b9a119126

Download Submit
C:\Program Files\ReasonLabs\EPP\elam\rsElam.sys

Filesize
19KB

MD5
8129c96d6ebdaebbe771ee034555bf8f

SHA1
9b41fb541a273086d3eef0ba4149f88022efbaff

SHA256
8bcc210669bc5931a3a69fc63ed288cb74013a92c84ca0aba89e3f4e56e3ae51

SHA512
ccd92987da4bda7a0f6386308611afb7951395158fc6d10a0596b0a0db4a61df202120460e2383d2d2f34cbb4d4e33e4f2e091a717d2fc1859ed7f58db3b7a18

Download Submit
C:\Program Files\ReasonLabs\EPP\mc.dll

Filesize
1.1MB

MD5
05aae9798ed4d8b021dac87c720c8d8f

SHA1
e652b7e4f5e345fdd7a019965062b455bfbb3f16

SHA256
e57e33ecca1da5b655502cbb1e521406015ffa7e095be31ed1f09347db8bfd82

SHA512
221ae09f1963c6454ac083bfe4dd41581e3c9e13f1caca5b0f39a53af583a094d34fe6bf6a7687e597e428c9dc48edd3f09b9593954afdc436651d65c07b34a9

Download Submit
C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll

Filesize
350KB

MD5
4b88a61fbbb3308a669f4b319052a4b1

SHA1
74d2b2fafa5e58c5289e82f12074c315f58b207d

SHA256
1c27b9059d56439ac82d8a4f430050611589901edeacea052b1ab79629243fc8

SHA512
216cf1f477af196e20da23d04a7c7e748ff5936280a1888da15af996045b764a0ad329d949e946a240b45bf4a4348f88c7e9c103f21462424069a216964d3f9c

Download Submit
C:\Program Files\ReasonLabs\EPP\rsEngine.config

Filesize
5KB

MD5
8b57500701eec678b540f84e9bdf6e82

SHA1
0724dded1c41a0d2bc270c0a8e08cf00c50e477f

SHA256
e25722d0ee697a3f67bfe854fa16d794ddd94f775634ebbaf917d0d6476cd888

SHA512
f83435c2f060b67c2e4d1da5f7cd97b8cb16280a297e1e24b7808b69cf469896d135c9b7d819fe64a699a5afbf0a9437537c9e8d490e6cd34ed0bbd0f3de7b97

Download Submit
C:\Program Files\ReasonLabs\EPP\rsWSC.InstallLog

Filesize
606B

MD5
43fbbd79c6a85b1dfb782c199ff1f0e7

SHA1
cad46a3de56cd064e32b79c07ced5abec6bc1543

SHA256
19537ccffeb8552c0d4a8e0f22a859b4465de1723d6db139c73c885c00bd03e0

SHA512
79b4f5dccd4f45d9b42623ebc7ee58f67a8386ce69e804f8f11441a04b941da9395aa791806bbc8b6ce9a9aa04127e93f6e720823445de9740a11a52370a92ea

Download Submit
C:\Program Files\ReasonLabs\EPP\rsWSC.exe

Filesize
203KB

MD5
0bfdbdfcc152fda7faf9c6d5e8d3f502

SHA1
6ddfa4f5400bcfb7d1feffa32fb5ace00ef630e3

SHA256
85ef27c8c549aada88554fcb3b8672d7d748a00bfce0ea22b1f56029b4eada0c

SHA512
67fd585b2ed32e28017fe832f0c90b5c62e3ba668b61b10beaef800d7ea6c8504c0c3165547072e711bea43da52bd69fc46d08a37e02a2933385d5601646e4b8

Download Submit
C:\Program Files\ReasonLabs\EPP\ui\EPP.exe

Filesize
2.2MB

MD5
6a9180009669c530a95712cd3540c091

SHA1
16864aa292cf96ba28f539419bab03a810addf79

SHA256
fd17a55e4fd758e6afb3d4dee02c45a785c91d798245369aaebc0137a8680fb6

SHA512
c1893d55efe0ab7539faf46d7fb7ac3965ab87533e3d9b8ff80521da1f23e6c41dbe6d52c9af22ae24e0f4aff8795b42c3af639f38e8f06bd880e4ff644bc3a0

Download Submit
C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf

Filesize
2KB

MD5
e8ef8570898c8ed883b4f9354d8207ae

SHA1
5cc645ef9926fd6a3e85dbc87d62e7d62ab8246d

SHA256
edc8579dea9faf89275f0a0babea442ed1c6dcc7b4f436424e6e495c6805d988

SHA512
971dd20773288c7d68fb19b39f9f5ed4af15868ba564814199d149c32f6e16f1fd3da05de0f3c2ada02c0f3d1ff665b1b7d13ce91d2164e01b77ce1a125de397

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6HH0G.tmp\RAV_Cross.png

Filesize
56KB

MD5
4167c79312b27c8002cbeea023fe8cb5

SHA1
fda8a34c9eba906993a336d01557801a68ac6681

SHA256
c3bf350627b842bed55e6a72ab53da15719b4f33c267a6a132cb99ff6afe3cd8

SHA512
4815746e5e30cbef626228601f957d993752a3d45130feeda335690b7d21ed3d6d6a6dc0ad68a1d5ba584b05791053a4fc7e9ac7b64abd47feaa8d3b919353bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6HH0G.tmp\WebAdvisor.png

Filesize
46KB

MD5
5fd73821f3f097d177009d88dfd33605

SHA1
1bacbbfe59727fa26ffa261fb8002f4b70a7e653

SHA256
a6ecce54116936ca27d4be9797e32bf2f3cfc7e41519a23032992970fbd9d3ba

SHA512
1769a6dfaa30aac5997f8d37f1df3ed4aab5bbee2abbcb30bde4230afed02e1ea9e81720b60f093a4c7fb15e22ee15a3a71ff7b84f052f6759640734af976e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6HH0G.tmp\component0.exe

Filesize
44KB

MD5
b12ed441a157d3f6d08204a763909167

SHA1
745bd2f00f35582585db4efa7b785c6cbe332e32

SHA256
157879290bfffa20f48fc4a0fcd2bf4c4537cf1ae0c2bb9a8e87e45d8cea8229

SHA512
24cfed3c23ee2418930c98c86bd807875718ef9225c1599860d89695889170aaa6579567492c7ed696699f812e73ca8b4d61265ff901a12d5a94244407b97d22

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6HH0G.tmp\mainlogo.png

Filesize
1KB

MD5
82ddde1241822130cae9fcc93530e3d3

SHA1
8a427a92518192d576295d51f605dd1c7094be91

SHA256
3d54f67c56b652ef1fc26ad35ce7c1422eb6148ac3d20fb54ab4a8900bc1d285

SHA512
4d15baa2efc7aa23f21e3eeef2a91da67d2c0ccd411c28c3387b92f24008ddc180bbe4f17e19a994f661e80b0cbd5514ece27d213361e635d87fb161eb8fe19b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ANRIB.tmp\tinytask-1.77-installer_U48iS-1.tmp

Filesize
3.1MB

MD5
d610eb12737b527a3335bfdea4c1dd84

SHA1
91d3084f623c60922ac0f11e3fbb8dc082dac148

SHA256
0b35a24540a527a626ee4a813a663ad5239863473e80ea9b5ba6be5bb55d2341

SHA512
ae5351d1ff5a7b80a68b3dec75d2b733b203fcb46949c1a3d031dac77141f985269b06b7ecbd240a6c9e03d5ffb98d07725428bb9d76d28f3a811783f51a6b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpud2sn0.exe

Filesize
1.9MB

MD5
971d5f3b172ec27aaee5243e2b50095f

SHA1
efd7d2a7779200bbb900460248710729178e2545

SHA256
0359eeaae92895260b525b033de52914e912c18c27e2e2e7077068343b3fe860

SHA512
925557808c7a68e82996a9e1f2f4aeebd556bdc85881077f6fded25bf91ebd4617bad10769442674352532846f2e3e11eebe41b4b593229d6eb1b5f811b8cea8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65EF.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\ArchiveUtilityx64.dll

Filesize
150KB

MD5
ec2d7737e78d7ed7099530f726ac86f9

SHA1
8f9230c9126de8f06d1cddaa2e73c4750f35b3d9

SHA256
dd034654cffd78aabc09822a9a858ecf93645dcc121a4143672226b9171c1394

SHA512
e209784fc2338d33834101ac78e89cba6c1da144e74330fd0ff2a2372e70316c46c2189b38b34b18b157c9221a44760d20bce8549573fbeda248d4ceb03e8365

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\Microsoft.Win32.TaskScheduler.dll

Filesize
340KB

MD5
192d235d98d88bab41eed2a90a2e1942

SHA1
2c92c1c607ba0ca5ad4b2636ea0deb276dcc2266

SHA256
c9e3f36781204ed13c0adad839146878b190feb07df41f57693b99ca0a3924e3

SHA512
d469b0862af8c92f16e8e96c6454398800f22aac37951252f942f044e2efbfd799a375f13278167b48f6f792d6a3034afeace4a94e0b522f45ea5d6ff286a270

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\RAVEndPointProtection-installer.exe

Filesize
538KB

MD5
31cb221abd09084bf10c8d6acf976a21

SHA1
1214ac59242841b65eaa5fd78c6bed0c2a909a9b

SHA256
1bbba4dba3eb631909ba4b222d903293f70f7d6e1f2c9f52ae0cfca4e168bd0b

SHA512
502b3acf5306a83cb6c6a917e194ffdce8d3c8985c4488569e59bce02f9562b71e454da53fd4605946d35c344aa4e67667c500ebcd6d1a166f16edbc482ba671

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\rsAtom.dll

Filesize
156KB

MD5
16d9a46099809ac76ef74a007cf5e720

SHA1
e4870bf8cef67a09103385b03072f41145baf458

SHA256
58fec0c60d25f836d17e346b07d14038617ae55a5a13adfca13e2937065958f6

SHA512
10247771c77057fa82c1c2dc4d6dfb0f2ab7680cd006dbfa0f9fb93986d2bb37a7f981676cea35aca5068c183c16334f482555f22c9d5a5223d032d5c84b04f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\rsJSON.dll

Filesize
217KB

MD5
afd0aa2d81db53a742083b0295ae6c63

SHA1
840809a937851e5199f28a6e2d433bca08f18a4f

SHA256
1b55a9dd09b1cd51a6b1d971d1551233fa2d932bdea793d0743616a4f3edb257

SHA512
405e0cbcfff6203ea1224a81fb40bbefa65db59a08baa1b4f3f771240c33416c906a87566a996707ae32e75512abe470aec25820682f0bcf58ccc087a14699ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\rsLogger.dll

Filesize
176KB

MD5
4ece9fa3258b1227842c32f8b82299c0

SHA1
4fdd1a397497e1bff6306f68105c9cecb8041599

SHA256
61e85b501cf8c0f725c5b03c323320e6ee187e84f166d8f9deaf93b2ea6ca0ef

SHA512
a923bce293f8af2f2a34e789d6a2f1419dc4b3d760b46df49561948aa917bb244eda6da933290cd36b22121aad126a23d70de99bb663d4c4055280646ec6c9dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\rsStubLib.dll

Filesize
248KB

MD5
98f73ae19c98b734bdbe9dba30e31351

SHA1
9c656eb736d9fd68d3af64f6074f8bf41c7a727e

SHA256
944259d12065d301955931c79a8ae434c3ebccdcbfad5e545bab71765edc9239

SHA512
8ad15ef9897e2ffe83b6d0caf2fac09b4eb36d21768d5350b7e003c63cd19f623024cd73ac651d555e1c48019b94fa7746a6c252cc6b78fdffdab6cb11574a70

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\19e23c1d\b83c0ca1_70b4da01\rsAtom.DLL

Filesize
159KB

MD5
29a3ebadbd3e25947a9b1a9d715d3438

SHA1
bdccd16225f63fccf5c747d1fa214c8a9bb4c386

SHA256
90b3e5dbfc98b04c7378fd5ac4cc3da49eaff0a1d009d442ff9d684375ecf9ea

SHA512
452322434ea37832987d43fa845192f285170b54707277a7dfebce888af584a217a5cd140be8d61441aced203a567e95ba19e8aed6007cf8fc3a5020e34d86e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\34f0da13\2e0211a1_70b4da01\rsLogger.DLL

Filesize
178KB

MD5
e12ac3dcc1587825766bd2d914f45993

SHA1
19f317677780f98a2d5918f0133d3e1c8064991c

SHA256
524affc19cc7e13ec985928181ae4d3cd03a76cc732b0b0dd4d7cf90d2d10c7e

SHA512
431fd58234d1928cf0bf73ad58d01585017dbf0ac5dc0ec4af4b06835d35dc95fddf5419ed00e4b472ed0059e4ffc8cf15eb7a1012b17fbc23d08fd3ff8e839c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\faf33f42\2e0211a1_70b4da01\rsJSON.DLL

Filesize
219KB

MD5
fc5039cf40b355bdf0c6da26cce1829d

SHA1
2424100626a6b68c7b6e8eaf5058a06ef2b2f0cf

SHA256
af81ab29fc1de68fc1cf3c03d780fac427c55fe58a308e3afe8322d3c56e77c1

SHA512
4796c0003cdcf8733a338ede6e0626f31041b5d76934e728d7ec82736befae8b721ed5024a6befcf53cfc246afcca5c82802a9029a235c6bc26c5f0752b76434

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\fda5aec1\866313a1_70b4da01\rsServiceController.DLL

Filesize
174KB

MD5
563dc8297d19772f74bac789644a2c62

SHA1
f1b414d2172d5031b555cca648cc5b1c6c40273d

SHA256
30964e46a5a5650a73e1c8457fb84787be615e3cc7de6811b7c80251b88345ec

SHA512
6f03f8bc3168abc9b13c5d9f590fe2dcf2863590a493e14af1ff0bae79bff6758a1f6928ebd4c4c8195e996807040f8baf17cd4ec2dc74ffe6134d3877d39d5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss65F0.tmp\uninstall.ico

Filesize
170KB

MD5
af1c23b1e641e56b3de26f5f643eb7d9

SHA1
6c23deb9b7b0c930533fdbeea0863173d99cf323

SHA256
0d3a05e1b06403f2130a6e827b1982d2af0495cdd42deb180ca0ce4f20db5058

SHA512
0c503ec7e83a5bfd59ec8ccc80f6c54412263afd24835b8b4272a79c440a0c106875b5c3b9a521a937f0615eb4f112d1d6826948ad5fb6fd173c5c51cb7168f4

Download Submit
C:\Users\Admin\Downloads\tinytask-1.77-installer.exe

Filesize
35KB

MD5
8fd3551654f0f5281ddbd7e32cb73054

SHA1
9b1c9722847cd57cd11e4de80cd9e8197c3c34cd

SHA256
75e06ac5b7c1adb01ab994633466685e3dcef31d635eba1734fe16c7893ffe12

SHA512
a716f535e363fc1225b1665e1c24693e768d13699ea37bdf57effe4fea24b4b30a2181174f66c35e749b9c845b07f82eecbf282ee5972de0426f847293d46b4b

Download Submit
C:\Users\Admin\Downloads\tinytask-1.77-installer.ini

Filesize
138B

MD5
bb756b51ec21dfa45df8eca40bb4feff

SHA1
651ca12b9a65499bf8fca3112d207fb3f773ee30

SHA256
91110f9f4fc28c551130807d82fb1c498add19cce02bd9fe4c7dca6609c16308

SHA512
d11c10454ef3c83af313524ccf9e2eaa4f52d26af7ed548c5d57002cbdf606c328a46d5b6845e3a39e87635227c50a99d3c3080f79c7b73e2a4ff879e7d3af31

Download Submit
memory/408-657-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-672-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-142-0x000002B0E1830000-0x000002B0E186A000-memory.dmp

Filesize
232KB

Download
memory/408-140-0x000002B0E1610000-0x000002B0E1640000-memory.dmp

Filesize
192KB

Download
memory/408-151-0x000002B0E1900000-0x000002B0E1958000-memory.dmp

Filesize
352KB

Download
memory/408-138-0x000002B0C7620000-0x000002B0C7660000-memory.dmp

Filesize
256KB

Download
memory/408-2314-0x000002B0E24A0000-0x000002B0E24CE000-memory.dmp

Filesize
184KB

Download
memory/408-2301-0x000002B0E23C0000-0x000002B0E23EA000-memory.dmp

Filesize
168KB

Download
memory/408-136-0x000002B0C7110000-0x000002B0C7198000-memory.dmp

Filesize
544KB

Download
memory/408-2289-0x000002B0E2360000-0x000002B0E2390000-memory.dmp

Filesize
192KB

Download
memory/408-2278-0x000002B0E22E0000-0x000002B0E231A000-memory.dmp

Filesize
232KB

Download
memory/408-676-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-688-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-652-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-646-0x000002B0E2280000-0x000002B0E22D8000-memory.dmp

Filesize
352KB

Download
memory/408-655-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-650-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-648-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-647-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-674-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-700-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-698-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-696-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-694-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-692-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-690-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-686-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-684-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-682-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-680-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-678-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-144-0x000002B0E1870000-0x000002B0E189A000-memory.dmp

Filesize
168KB

Download
memory/408-670-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-668-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-666-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-664-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-662-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-660-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/408-658-0x000002B0E2280000-0x000002B0E22D5000-memory.dmp

Filesize
340KB

Download
memory/748-2386-0x00000189171C0000-0x00000189171E2000-memory.dmp

Filesize
136KB

Download
memory/748-2385-0x00000189171A0000-0x00000189171BA000-memory.dmp

Filesize
104KB

Download
memory/748-2384-0x000001892FA90000-0x000001892FC0C000-memory.dmp

Filesize
1.5MB

Download
memory/748-2383-0x000001892FC50000-0x000001892FFB6000-memory.dmp

Filesize
3.4MB

Download
memory/780-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/780-48-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/780-186-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/780-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1984-50-0x00007FFF10393000-0x00007FFF10395000-memory.dmp

Filesize
8KB

Download
memory/1984-51-0x000001BB52390000-0x000001BB528B8000-memory.dmp

Filesize
5.2MB

Download
memory/1984-47-0x000001BB378F0000-0x000001BB378F8000-memory.dmp

Filesize
32KB

Download
memory/4276-20-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4276-25-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4276-19-0x0000000004300000-0x0000000004440000-memory.dmp

Filesize
1.2MB

Download
memory/4276-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4276-184-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4276-49-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4276-63-0x0000000004300000-0x0000000004440000-memory.dmp

Filesize
1.2MB

Download
memory/4276-29-0x0000000004300000-0x0000000004440000-memory.dmp

Filesize
1.2MB

Download
memory/4276-30-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4276-24-0x0000000004300000-0x0000000004440000-memory.dmp

Filesize
1.2MB

Download
memory/6912-2358-0x0000014E1D4A0000-0x0000014E1D4DC000-memory.dmp

Filesize
240KB

Download
memory/6912-2357-0x0000014E1D3F0000-0x0000014E1D402000-memory.dmp

Filesize
72KB

Download
memory/6912-2344-0x0000014E1CF60000-0x0000014E1CF8E000-memory.dmp

Filesize
184KB

Download
memory/6912-2343-0x0000014E1CF60000-0x0000014E1CF8E000-memory.dmp

Filesize
184KB

Download