Analysis
-
max time kernel
235s -
max time network
217s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 06:06
Static task
static1
Behavioral task
behavioral1
Sample
smart_game_booster_setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
smart_game_booster_setup.exe
Resource
win10v2004-20240611-en
General
-
Target
smart_game_booster_setup.exe
-
Size
62.6MB
-
MD5
926b5e7688d592fb453da48898f4ec97
-
SHA1
c7d17abc367acfcb823ec4e929b3e7f49791850c
-
SHA256
fb1947184523d28fa4ed47f06e648ebef74f2029345db5762ebacc114c3b047f
-
SHA512
db999dce86630ca68297153cb44e400c6cc16e00b3f78c3da2ab963c311675617bd83a3bcfaba1c44c3eb23e5f4ab65271760988f7fa062cfc70260eae12b4f6
-
SSDEEP
1572864:kJVXmPjQaaNja+kN9RXR8TJbZPHcPDjxSQXYOSPYDz90KNFLzL:6mrQaSjI9RXaTfEH8QX93zNFHL
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 73 ipinfo.io -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 SgbMain.exe File opened for modification \??\PhysicalDrive0 SgbTemperature.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation smart_game_booster_setup.tmp Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation SgbMain.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation SgbMain.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation SgbTray.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\is-Q75H2.tmp smart_game_booster_setup.tmp File created C:\Windows\SysWOW64\is-9K2LK.tmp smart_game_booster_setup.tmp File created C:\Windows\system32\d3dx11_43.dll SgbInit.exe File created C:\Windows\system32\d3dx10_43.dll SgbInit.exe File created C:\Windows\SysWOW64\is-6M5TE.tmp smart_game_booster_setup.tmp File created C:\Windows\SysWOW64\is-04QEV.tmp smart_game_booster_setup.tmp File created C:\Windows\SysWOW64\is-PN0UN.tmp smart_game_booster_setup.tmp File created C:\Windows\system32\D3DCompiler_43.dll SgbInit.exe File opened for modification C:\Windows\system32\D3DCompiler_43.dll SgbInit.exe File created C:\Windows\system32\D3DX9_43.dll SgbInit.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\LibAV\is-CM48U.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-NRUGI.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\InBoxDriverFeature\is-2OO3A.tmp smart_game_booster_setup.tmp File opened for modification C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Update\Update.ini SgbUpdater.exe File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-LVI66.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-FF2EG.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-491D8.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\is-JK32O.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\InBoxDriverFeature\is-1QVLE.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-GC0TC.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-GOLBQ.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-TN9Q7.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-3518H.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\PinTools\is-HV3CK.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Smart Game Booster.lnk smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-KVD9T.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\DrvInstall\is-OICIR.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\is-UFL8C.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-PMK1O.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\is-2E2OI.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-0C1GD.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\skin\is-N54RJ.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\LibAV\is-QB7Q6.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-OMP7O.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\is-6GCMS.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\unins000.msg smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-M325F.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\LibAV\is-0A17M.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\PinTools\is-O34C7.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-S6SGH.tmp smart_game_booster_setup.tmp File opened for modification C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Update\Update.ini SgbTemperature.exe File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-1E7MT.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-NPOG6.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\HUD64\is-HVAI1.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\is-JP3NQ.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\PinTools\is-SGIH9.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\HUD64\is-LJFGI.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-QE2T8.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\is-70JIL.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\is-90A9A.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-54NM6.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-Q5HL7.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\DrvInstall\is-A6T26.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-BSFLA.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-BRMIB.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-1BQEQ.tmp smart_game_booster_setup.tmp File opened for modification C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Reserve\Config.ini SgbMain.exe File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-F3DQH.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-1POSG.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\HUD64\is-LLDF1.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-2EVTP.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\is-6DII3.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-IMAR2.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Language\is-4R57P.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-1TLQ8.tmp smart_game_booster_setup.tmp File opened for modification C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\unins000.dat smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\unins000.dat smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\HUD64\is-14VNP.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\LibAV\is-7BG2J.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-2S0L5.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-IJIMH.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\is-ICCGQ.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\is-PIVUN.tmp smart_game_booster_setup.tmp File created C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\Database\InBoxDriverFeature\is-JV7E0.tmp smart_game_booster_setup.tmp -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\INF\c_display.PNF SgbMain.exe File created C:\Windows\INF\c_processor.PNF SgbMain.exe File created C:\Windows\INF\c_monitor.PNF SgbMain.exe File created C:\Windows\INF\c_volume.PNF SgbMain.exe File created C:\Windows\INF\c_diskdrive.PNF SgbMain.exe File created C:\Windows\INF\c_media.PNF SgbMain.exe -
Executes dropped EXE 18 IoCs
pid Process 1812 smart_game_booster_setup.tmp 1872 SgbInit.exe 3232 SgbInit.exe 1856 SgbInit.exe 1020 SgbMain.exe 3892 ICONPIN64.exe 180 UninstallPromote.exe 5096 SgbInit.exe 4356 SgbMain.exe 3452 SgbTray.exe 3008 ProductStat.exe 848 SgbTemperature.exe 3924 SgbUpdater.exe 5052 SgbInit.exe 1900 SgbHUD32.exe 1884 SgbHUD64.exe 3444 AUpdate.exe 5596 SgbInit.exe -
Loads dropped DLL 64 IoCs
pid Process 1856 SgbInit.exe 1856 SgbInit.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 1020 SgbMain.exe 4476 regsvr32.exe 3660 regsvr32.exe 5096 SgbInit.exe 5096 SgbInit.exe 5096 SgbInit.exe 5096 SgbInit.exe 180 UninstallPromote.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 4356 SgbMain.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceCharacteristics SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceType SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Address SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceCharacteristics SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LocationInformation SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceType SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceType SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LocationInformation SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceType SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceCharacteristics SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LocationInformation SgbMain.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SgbMain.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service SgbMain.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SgbMain.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SgbMain.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133644606415880132" msedge.exe -
Modifies registry class 54 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6EFD2D6-0DCC-4E57-AB47-A90DAAB3E592} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6EFD2D6-0DCC-4E57-AB47-A90DAAB3E592}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PCGameBoost\\Smart Game Booster\\5.3.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PfShellExtension.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F6605BA7-71E8-4C6D-AD31-F05E3F568602}\ = "PfShellExtension" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PfShellExtension.DLL\AppID = "{F6605BA7-71E8-4C6D-AD31-F05E3F568602}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6EFD2D6-0DCC-4E57-AB47-A90DAAB3E592}\1.0\ = "PfShellExtension 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6EFD2D6-0DCC-4E57-AB47-A90DAAB3E592}\1.0\HELPDIR regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}\InprocServer32\ = "C:\\Program Files (x86)\\PCGameBoost\\Smart Game Booster\\5.3.0\\MenuExt64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}\InprocServer32\ = "C:\\Program Files (x86)\\PCGameBoost\\Smart Game Booster\\5.3.0\\MenuExt64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6EFD2D6-0DCC-4E57-AB47-A90DAAB3E592}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6EFD2D6-0DCC-4E57-AB47-A90DAAB3E592}\1.0\0\win64 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F6605BA7-71E8-4C6D-AD31-F05E3F568602} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6EFD2D6-0DCC-4E57-AB47-A90DAAB3E592}\1.0\0\win64\ = "C:\\Program Files (x86)\\PCGameBoost\\Smart Game Booster\\5.3.0\\MenuExt64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6EFD2D6-0DCC-4E57-AB47-A90DAAB3E592}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}\ = "SmartGameBoosterMenu Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}\ = "SmartGameBoosterMenu Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PfShellExtension.DLL\AppID = "{F6605BA7-71E8-4C6D-AD31-F05E3F568602}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{2F328987-4EF6-4DEB-A0E3-FB94767BD3CB} msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F6605BA7-71E8-4C6D-AD31-F05E3F568602}\ = "PfShellExtension" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\SmartGameBoosterMenu\ = "{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6EFD2D6-0DCC-4E57-AB47-A90DAAB3E592}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6EFD2D6-0DCC-4E57-AB47-A90DAAB3E592}\1.0\0 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96C86AD1-055D-457D-9C00-0D4A91ECF1B4}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SmartGameBoosterMenu regsvr32.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8\Blob = 5c0000000100000004000000000800001900000001000000100000004fca18b530ab2d3765b8830436884be603000000010000001400000028903a635b5280fae6774c0b6da7d6baa64af2e87e000000010000000800000000409120d035d9011d00000001000000100000003475b6ae07580528b505a98d7f0fe1f4140000000100000014000000a0c38b44aa37a545bf97805ad1f178a29be95d8d62000000010000002000000088497f01602f3154246ae28c4d5aef10f1d87ebb76626f4ae0b7f95ba79687997f0000000100000020000000301e06082b0601050507030306082b0601050507030906082b0601050507030153000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b00000001000000660000004100670065006e00630069006100200043006100740061006c0061006e0061002000640065002000430065007200740069006600690063006100630069006f00200028004e0049004600200051002d0030003800300031003100370036002d004900290000000f00000001000000140000001b8b713e8748912a4b073db0c8e9e3e5c0962d98040000000100000010000000ebf59d290d61f9421f7cc2ba6de3150920000000010000005a050000308205563082043ea0030201020210ee2b3debd421de14a862ac04f3ddc401300d06092a864886f70d01010505003081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d414343301e170d3033303130373233303030305a170d3331303130373232353935395a3081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d41434330820122300d06092a864886f70d01010105000382010f003082010a0282010100b322c74fe297429588478340f61d17f38373241e51f3988ac392b8ff409005708760c900a9b5946519221517c2436c66449a0d043e396fa54b7aaa63b78a449dd963918466e0280fba42e36e8ef714279369ee910ea35f0eb1eb66a2724f121386657a3edb4f07f4a70960da3a4299c7b27fb316951cc7f934b59485d5995ea048a07ee71765b8a275b81ef3e5427dafedf38a48645d821493d8c0e4ffb35072f276f6b35d425079d0943e6b0c00bed86b0e4e2aec3ed2cc82a218653313779e9a5d1a13d8c3db3dc8977aee70eda7e67cdb71cf2d9462df6dd6f538be3fa5850a19b8a8d809754270c4eaefcb0ec834a81222980cb81394b64becf0d090e7270203010001a381e33081e0301d0603551d1104163014811265635f61636340636174636572742e6e6574300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414a0c38b44aa37a545bf97805ad1f178a29be95d8d307f0603551d20047830763074060b2b06010401f5780103010a3065302c06082b06010505070201162068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c303506082b0601050507020230291a2756656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20300d06092a864886f70d01010505000382010100a0485b8201f64d48b83955359c807a5399d55affb1713bcc3909945ed6daefbe015b5dd31ed8fd7d4fcda041e03493bfcbe2869c379290561cdceb2905e5c49ec735df8a0ccdc52143e9aa88e535c01942635a025ea448183a856fdc9dbc3f9d9cc187b87a6108e9770b7f70ab7addd9972c641e85bfbc7496a1c37a12ec0c1a6e830c3ce872469ffb48d55e97e6b1a1f8e4ef4625949c89db6938beec5c0e56c76551e5508888bf42d52b3de5f9ba9e2eb3caf47392020bbe4c66eb20feb9cbb5997fe6b613faca4b4dd9ee5346063bc64ead935a817e6c2a4b6a05458cf221a43190876c659c9da560953a527ff5d1ab086ef3ee5bf9883d7eb86f6e03e442 SgbMain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8 SgbMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8\Blob = 0f00000001000000140000001b8b713e8748912a4b073db0c8e9e3e5c0962d980b00000001000000660000004100670065006e00630069006100200043006100740061006c0061006e0061002000640065002000430065007200740069006600690063006100630069006f00200028004e0049004600200051002d0030003800300031003100370036002d0049002900000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07f0000000100000020000000301e06082b0601050507030306082b0601050507030906082b0601050507030162000000010000002000000088497f01602f3154246ae28c4d5aef10f1d87ebb76626f4ae0b7f95ba7968799140000000100000014000000a0c38b44aa37a545bf97805ad1f178a29be95d8d1d00000001000000100000003475b6ae07580528b505a98d7f0fe1f47e000000010000000800000000409120d035d90103000000010000001400000028903a635b5280fae6774c0b6da7d6baa64af2e820000000010000005a050000308205563082043ea0030201020210ee2b3debd421de14a862ac04f3ddc401300d06092a864886f70d01010505003081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d414343301e170d3033303130373233303030305a170d3331303130373232353935395a3081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d41434330820122300d06092a864886f70d01010105000382010f003082010a0282010100b322c74fe297429588478340f61d17f38373241e51f3988ac392b8ff409005708760c900a9b5946519221517c2436c66449a0d043e396fa54b7aaa63b78a449dd963918466e0280fba42e36e8ef714279369ee910ea35f0eb1eb66a2724f121386657a3edb4f07f4a70960da3a4299c7b27fb316951cc7f934b59485d5995ea048a07ee71765b8a275b81ef3e5427dafedf38a48645d821493d8c0e4ffb35072f276f6b35d425079d0943e6b0c00bed86b0e4e2aec3ed2cc82a218653313779e9a5d1a13d8c3db3dc8977aee70eda7e67cdb71cf2d9462df6dd6f538be3fa5850a19b8a8d809754270c4eaefcb0ec834a81222980cb81394b64becf0d090e7270203010001a381e33081e0301d0603551d1104163014811265635f61636340636174636572742e6e6574300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414a0c38b44aa37a545bf97805ad1f178a29be95d8d307f0603551d20047830763074060b2b06010401f5780103010a3065302c06082b06010505070201162068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c303506082b0601050507020230291a2756656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20300d06092a864886f70d01010505000382010100a0485b8201f64d48b83955359c807a5399d55affb1713bcc3909945ed6daefbe015b5dd31ed8fd7d4fcda041e03493bfcbe2869c379290561cdceb2905e5c49ec735df8a0ccdc52143e9aa88e535c01942635a025ea448183a856fdc9dbc3f9d9cc187b87a6108e9770b7f70ab7addd9972c641e85bfbc7496a1c37a12ec0c1a6e830c3ce872469ffb48d55e97e6b1a1f8e4ef4625949c89db6938beec5c0e56c76551e5508888bf42d52b3de5f9ba9e2eb3caf47392020bbe4c66eb20feb9cbb5997fe6b613faca4b4dd9ee5346063bc64ead935a817e6c2a4b6a05458cf221a43190876c659c9da560953a527ff5d1ab086ef3ee5bf9883d7eb86f6e03e442 SgbMain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 SgbMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e SgbMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8\Blob = 040000000100000010000000ebf59d290d61f9421f7cc2ba6de315090f00000001000000140000001b8b713e8748912a4b073db0c8e9e3e5c0962d980b00000001000000660000004100670065006e00630069006100200043006100740061006c0061006e0061002000640065002000430065007200740069006600690063006100630069006f00200028004e0049004600200051002d0030003800300031003100370036002d0049002900000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07f0000000100000020000000301e06082b0601050507030306082b0601050507030906082b0601050507030162000000010000002000000088497f01602f3154246ae28c4d5aef10f1d87ebb76626f4ae0b7f95ba7968799140000000100000014000000a0c38b44aa37a545bf97805ad1f178a29be95d8d1d00000001000000100000003475b6ae07580528b505a98d7f0fe1f47e000000010000000800000000409120d035d90103000000010000001400000028903a635b5280fae6774c0b6da7d6baa64af2e81900000001000000100000004fca18b530ab2d3765b8830436884be620000000010000005a050000308205563082043ea0030201020210ee2b3debd421de14a862ac04f3ddc401300d06092a864886f70d01010505003081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d414343301e170d3033303130373233303030305a170d3331303130373232353935395a3081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d41434330820122300d06092a864886f70d01010105000382010f003082010a0282010100b322c74fe297429588478340f61d17f38373241e51f3988ac392b8ff409005708760c900a9b5946519221517c2436c66449a0d043e396fa54b7aaa63b78a449dd963918466e0280fba42e36e8ef714279369ee910ea35f0eb1eb66a2724f121386657a3edb4f07f4a70960da3a4299c7b27fb316951cc7f934b59485d5995ea048a07ee71765b8a275b81ef3e5427dafedf38a48645d821493d8c0e4ffb35072f276f6b35d425079d0943e6b0c00bed86b0e4e2aec3ed2cc82a218653313779e9a5d1a13d8c3db3dc8977aee70eda7e67cdb71cf2d9462df6dd6f538be3fa5850a19b8a8d809754270c4eaefcb0ec834a81222980cb81394b64becf0d090e7270203010001a381e33081e0301d0603551d1104163014811265635f61636340636174636572742e6e6574300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414a0c38b44aa37a545bf97805ad1f178a29be95d8d307f0603551d20047830763074060b2b06010401f5780103010a3065302c06082b06010505070201162068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c303506082b0601050507020230291a2756656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20300d06092a864886f70d01010505000382010100a0485b8201f64d48b83955359c807a5399d55affb1713bcc3909945ed6daefbe015b5dd31ed8fd7d4fcda041e03493bfcbe2869c379290561cdceb2905e5c49ec735df8a0ccdc52143e9aa88e535c01942635a025ea448183a856fdc9dbc3f9d9cc187b87a6108e9770b7f70ab7addd9972c641e85bfbc7496a1c37a12ec0c1a6e830c3ce872469ffb48d55e97e6b1a1f8e4ef4625949c89db6938beec5c0e56c76551e5508888bf42d52b3de5f9ba9e2eb3caf47392020bbe4c66eb20feb9cbb5997fe6b613faca4b4dd9ee5346063bc64ead935a817e6c2a4b6a05458cf221a43190876c659c9da560953a527ff5d1ab086ef3ee5bf9883d7eb86f6e03e442 SgbMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a SgbMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\28903A635B5280FAE6774C0B6DA7D6BAA64AF2E8\Blob = 1900000001000000100000004fca18b530ab2d3765b8830436884be603000000010000001400000028903a635b5280fae6774c0b6da7d6baa64af2e87e000000010000000800000000409120d035d9011d00000001000000100000003475b6ae07580528b505a98d7f0fe1f4140000000100000014000000a0c38b44aa37a545bf97805ad1f178a29be95d8d62000000010000002000000088497f01602f3154246ae28c4d5aef10f1d87ebb76626f4ae0b7f95ba79687997f0000000100000020000000301e06082b0601050507030306082b0601050507030906082b0601050507030153000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b00000001000000660000004100670065006e00630069006100200043006100740061006c0061006e0061002000640065002000430065007200740069006600690063006100630069006f00200028004e0049004600200051002d0030003800300031003100370036002d004900290000000f00000001000000140000001b8b713e8748912a4b073db0c8e9e3e5c0962d9820000000010000005a050000308205563082043ea0030201020210ee2b3debd421de14a862ac04f3ddc401300d06092a864886f70d01010505003081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d414343301e170d3033303130373233303030305a170d3331303130373232353935395a3081f3310b3009060355040613024553313b3039060355040a13324167656e63696120436174616c616e612064652043657274696669636163696f20284e494620512d303830313137362d492931283026060355040b131f53657276656973205075626c6963732064652043657274696669636163696f31353033060355040b132c56656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20286329303331353033060355040b132c4a657261727175696120456e7469746174732064652043657274696669636163696f20436174616c616e6573310f300d0603550403130645432d41434330820122300d06092a864886f70d01010105000382010f003082010a0282010100b322c74fe297429588478340f61d17f38373241e51f3988ac392b8ff409005708760c900a9b5946519221517c2436c66449a0d043e396fa54b7aaa63b78a449dd963918466e0280fba42e36e8ef714279369ee910ea35f0eb1eb66a2724f121386657a3edb4f07f4a70960da3a4299c7b27fb316951cc7f934b59485d5995ea048a07ee71765b8a275b81ef3e5427dafedf38a48645d821493d8c0e4ffb35072f276f6b35d425079d0943e6b0c00bed86b0e4e2aec3ed2cc82a218653313779e9a5d1a13d8c3db3dc8977aee70eda7e67cdb71cf2d9462df6dd6f538be3fa5850a19b8a8d809754270c4eaefcb0ec834a81222980cb81394b64becf0d090e7270203010001a381e33081e0301d0603551d1104163014811265635f61636340636174636572742e6e6574300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414a0c38b44aa37a545bf97805ad1f178a29be95d8d307f0603551d20047830763074060b2b06010401f5780103010a3065302c06082b06010505070201162068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c303506082b0601050507020230291a2756656765752068747470733a2f2f7777772e636174636572742e6e65742f766572617272656c20300d06092a864886f70d01010505000382010100a0485b8201f64d48b83955359c807a5399d55affb1713bcc3909945ed6daefbe015b5dd31ed8fd7d4fcda041e03493bfcbe2869c379290561cdceb2905e5c49ec735df8a0ccdc52143e9aa88e535c01942635a025ea448183a856fdc9dbc3f9d9cc187b87a6108e9770b7f70ab7addd9972c641e85bfbc7496a1c37a12ec0c1a6e830c3ce872469ffb48d55e97e6b1a1f8e4ef4625949c89db6938beec5c0e56c76551e5508888bf42d52b3de5f9ba9e2eb3caf47392020bbe4c66eb20feb9cbb5997fe6b613faca4b4dd9ee5346063bc64ead935a817e6c2a4b6a05458cf221a43190876c659c9da560953a527ff5d1ab086ef3ee5bf9883d7eb86f6e03e442 SgbMain.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 SgbMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a SgbMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e SgbMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e SgbMain.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e SgbMain.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1812 smart_game_booster_setup.tmp 1812 smart_game_booster_setup.tmp 1020 SgbMain.exe 1020 SgbMain.exe 1812 smart_game_booster_setup.tmp 1812 smart_game_booster_setup.tmp 180 UninstallPromote.exe 180 UninstallPromote.exe 180 UninstallPromote.exe 180 UninstallPromote.exe 180 UninstallPromote.exe 180 UninstallPromote.exe 4356 SgbMain.exe 4356 SgbMain.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 848 SgbTemperature.exe 848 SgbTemperature.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 848 SgbTemperature.exe 848 SgbTemperature.exe 3452 SgbTray.exe 3452 SgbTray.exe 3924 SgbUpdater.exe 3924 SgbUpdater.exe 3924 SgbUpdater.exe 3924 SgbUpdater.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3444 AUpdate.exe 3444 AUpdate.exe 3452 SgbTray.exe 3452 SgbTray.exe 4356 SgbMain.exe 4356 SgbMain.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 644 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1812 smart_game_booster_setup.tmp Token: SeDebugPrivilege 4356 SgbMain.exe Token: SeDebugPrivilege 4356 SgbMain.exe Token: SeDebugPrivilege 3452 SgbTray.exe Token: SeDebugPrivilege 3452 SgbTray.exe Token: 33 3452 SgbTray.exe Token: SeIncBasePriorityPrivilege 3452 SgbTray.exe Token: SeLoadDriverPrivilege 848 SgbTemperature.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe Token: 33 4356 SgbMain.exe Token: SeIncBasePriorityPrivilege 4356 SgbMain.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 1812 smart_game_booster_setup.tmp 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe 3452 SgbTray.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1900 SgbHUD32.exe 1900 SgbHUD32.exe 1884 SgbHUD64.exe 1884 SgbHUD64.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 1812 2692 smart_game_booster_setup.exe 91 PID 2692 wrote to memory of 1812 2692 smart_game_booster_setup.exe 91 PID 2692 wrote to memory of 1812 2692 smart_game_booster_setup.exe 91 PID 1812 wrote to memory of 1872 1812 smart_game_booster_setup.tmp 117 PID 1812 wrote to memory of 1872 1812 smart_game_booster_setup.tmp 117 PID 1812 wrote to memory of 1872 1812 smart_game_booster_setup.tmp 117 PID 1812 wrote to memory of 3232 1812 smart_game_booster_setup.tmp 119 PID 1812 wrote to memory of 3232 1812 smart_game_booster_setup.tmp 119 PID 1812 wrote to memory of 3232 1812 smart_game_booster_setup.tmp 119 PID 1812 wrote to memory of 1856 1812 smart_game_booster_setup.tmp 120 PID 1812 wrote to memory of 1856 1812 smart_game_booster_setup.tmp 120 PID 1812 wrote to memory of 1856 1812 smart_game_booster_setup.tmp 120 PID 1812 wrote to memory of 1020 1812 smart_game_booster_setup.tmp 121 PID 1812 wrote to memory of 1020 1812 smart_game_booster_setup.tmp 121 PID 1812 wrote to memory of 1020 1812 smart_game_booster_setup.tmp 121 PID 1812 wrote to memory of 3892 1812 smart_game_booster_setup.tmp 122 PID 1812 wrote to memory of 3892 1812 smart_game_booster_setup.tmp 122 PID 1020 wrote to memory of 2720 1020 SgbMain.exe 124 PID 1020 wrote to memory of 2720 1020 SgbMain.exe 124 PID 1020 wrote to memory of 2720 1020 SgbMain.exe 124 PID 1812 wrote to memory of 180 1812 smart_game_booster_setup.tmp 123 PID 1812 wrote to memory of 180 1812 smart_game_booster_setup.tmp 123 PID 1812 wrote to memory of 180 1812 smart_game_booster_setup.tmp 123 PID 1812 wrote to memory of 4476 1812 smart_game_booster_setup.tmp 126 PID 1812 wrote to memory of 4476 1812 smart_game_booster_setup.tmp 126 PID 1812 wrote to memory of 4476 1812 smart_game_booster_setup.tmp 126 PID 1812 wrote to memory of 5096 1812 smart_game_booster_setup.tmp 127 PID 1812 wrote to memory of 5096 1812 smart_game_booster_setup.tmp 127 PID 1812 wrote to memory of 5096 1812 smart_game_booster_setup.tmp 127 PID 4476 wrote to memory of 3660 4476 regsvr32.exe 128 PID 4476 wrote to memory of 3660 4476 regsvr32.exe 128 PID 2720 wrote to memory of 2384 2720 cmd.exe 129 PID 2720 wrote to memory of 2384 2720 cmd.exe 129 PID 2720 wrote to memory of 2384 2720 cmd.exe 129 PID 4356 wrote to memory of 3452 4356 SgbMain.exe 131 PID 4356 wrote to memory of 3452 4356 SgbMain.exe 131 PID 4356 wrote to memory of 3452 4356 SgbMain.exe 131 PID 5096 wrote to memory of 1728 5096 SgbInit.exe 132 PID 5096 wrote to memory of 1728 5096 SgbInit.exe 132 PID 3452 wrote to memory of 3008 3452 SgbTray.exe 138 PID 3452 wrote to memory of 3008 3452 SgbTray.exe 138 PID 3452 wrote to memory of 3008 3452 SgbTray.exe 138 PID 3452 wrote to memory of 848 3452 SgbTray.exe 139 PID 3452 wrote to memory of 848 3452 SgbTray.exe 139 PID 3452 wrote to memory of 848 3452 SgbTray.exe 139 PID 4356 wrote to memory of 3924 4356 SgbMain.exe 143 PID 4356 wrote to memory of 3924 4356 SgbMain.exe 143 PID 4356 wrote to memory of 3924 4356 SgbMain.exe 143 PID 4356 wrote to memory of 2100 4356 SgbMain.exe 144 PID 4356 wrote to memory of 2100 4356 SgbMain.exe 144 PID 4356 wrote to memory of 5052 4356 SgbMain.exe 145 PID 4356 wrote to memory of 5052 4356 SgbMain.exe 145 PID 4356 wrote to memory of 5052 4356 SgbMain.exe 145 PID 4356 wrote to memory of 1900 4356 SgbMain.exe 146 PID 4356 wrote to memory of 1900 4356 SgbMain.exe 146 PID 4356 wrote to memory of 1900 4356 SgbMain.exe 146 PID 4356 wrote to memory of 1884 4356 SgbMain.exe 147 PID 4356 wrote to memory of 1884 4356 SgbMain.exe 147 PID 4356 wrote to memory of 3444 4356 SgbMain.exe 148 PID 4356 wrote to memory of 3444 4356 SgbMain.exe 148 PID 4356 wrote to memory of 3444 4356 SgbMain.exe 148 PID 4356 wrote to memory of 5596 4356 SgbMain.exe 151 PID 4356 wrote to memory of 5596 4356 SgbMain.exe 151 PID 4356 wrote to memory of 5596 4356 SgbMain.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\smart_game_booster_setup.exe"C:\Users\Admin\AppData\Local\Temp\smart_game_booster_setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\is-IB5AL.tmp\smart_game_booster_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-IB5AL.tmp\smart_game_booster_setup.tmp" /SL5="$C0056,64886966,229888,C:\Users\Admin\AppData\Local\Temp\smart_game_booster_setup.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\is-ULKM5.tmp\SgbInit.exe"C:\Users\Admin\AppData\Local\Temp\is-ULKM5.tmp\SgbInit.exe" /DoAboutInsur 0 ""3⤵
- Executes dropped EXE
PID:1872
-
-
C:\Users\Admin\AppData\Local\Temp\is-ULKM5.tmp\SgbInit.exe"C:\Users\Admin\AppData\Local\Temp\is-ULKM5.tmp\SgbInit.exe" /DelCrackDLL3⤵
- Executes dropped EXE
PID:3232
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbInit.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbInit.exe" /install3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbMain.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbMain.exe" /needskipuac3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c Schtasks /run /tn "SmartGameBooster SkipUAC (Admin)"4⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\schtasks.exeSchtasks /run /tn "SmartGameBooster SkipUAC (Admin)"5⤵PID:2384
-
-
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\PinTools\ICONPIN64.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\PinTools\ICONPIN64.exe" pin "C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbMain.exe"3⤵
- Executes dropped EXE
PID:3892
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\UninstallPromote.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\UninstallPromote.exe" /install smgb53⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:180
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\MenuExt64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\MenuExt64.dll"4⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
PID:3660
-
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbInit.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbInit.exe" /CheckOpenURL3⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pcgameboost.com/blog/?st=install4⤵PID:1728
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3028,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:81⤵PID:5024
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbMain.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbMain.exe" /skipuac1⤵
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbTray.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbTray.exe" -Main2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\ProductStat.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\ProductStat.exe" /postspcache "C:\ProgramData\PCGameBoost\ProductData\iTopSpCache.dat"3⤵
- Executes dropped EXE
PID:3008
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbTemperature.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbTemperature.exe" /show3⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848
-
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbUpdater.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbUpdater.exe" /auto2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3924
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\MenuExt64.dll"2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2100
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbInit.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbInit.exe" /InstallDelFile2⤵
- Executes dropped EXE
PID:5052
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbHUD32.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbHUD32.exe" /FromMain2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1900
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\HUD64\SgbHUD64.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\HUD64\SgbHUD64.exe" /FromMain2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1884
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\AUpdate.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\AUpdate.exe" /smgb /dayactive2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3444
-
-
C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbInit.exe"C:\Program Files (x86)\PCGameBoost\Smart Game Booster\5.3.0\SgbInit.exe" /CheckFileInfo2⤵
- Executes dropped EXE
PID:5596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://goto.itopupdate.com/smgb_appgoto?name=smgb&ver=5.3.0.670&lan=&type=free&st=pop_autoboost3&to=promot2⤵PID:5144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=3808,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:11⤵PID:4856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3020,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:11⤵PID:4000
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5308,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:11⤵PID:2228
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5460,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:81⤵PID:4276
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5488,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:81⤵PID:5048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5492,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:11⤵PID:3012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6036,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:11⤵PID:6092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=4876,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:11⤵PID:6104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6616,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:11⤵PID:5148
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6768,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:11⤵PID:5224
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6496,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:81⤵PID:5324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4228 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x28c,0x290,0x294,0x288,0x2b0,0x7ffd4bb84ef8,0x7ffd4bb84f04,0x7ffd4bb84f102⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2168,i,12036566389199865294,10671176181654714998,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:5664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1912,i,12036566389199865294,10671176181654714998,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:32⤵PID:5676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2424,i,12036566389199865294,10671176181654714998,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:82⤵PID:5704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --field-trial-handle=4184,i,12036566389199865294,10671176181654714998,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:82⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --field-trial-handle=4184,i,12036566389199865294,10671176181654714998,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:82⤵PID:5972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe"1⤵PID:5840
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5ebe7550ac6c538d6a592cad8995bbc3e
SHA1515bd8e9462b275d5bea0bcd581bbd9ec1ea90d4
SHA2560ed86e36a070c142c5a9d677c4562e51a6279e0bad51cec9054a4cecc5a6732f
SHA5125d704f5b89bbb13d428d1d707268aba1a857925200de165067a50003d4dd83ee0dc5f5be92cc9fe182d60d2df51c83ec5e3ce965395b352860540c4055d45d7b
-
Filesize
274KB
MD530b7b3efa18afd66f7f8e05795ebe6f4
SHA197f24fe40c7fe41c91c654d35ceaa424b981e2e5
SHA2567ef6cc7f30a77520eec220553800daf873f2a0bc51a8b743012117e86e69a945
SHA512e07b15f6f9acb89d10f7e5346246e1e4a256d28b242b29b77cfacad16983349f118c54870d6d6e0529d530a6056f7ae277484caa583003ebe2a46188aa244d52
-
Filesize
1.9MB
MD54446004e43275432ed2ae0cb373c2f50
SHA11593fefe08723e1600f81239869b23860d2005ce
SHA256014252c69f35d59c94ed9f2ce969abb840b26c9a9bdc8ed35825c68e235790a7
SHA51225b9301dcc61e81f2dea50a990d0b2ae802033bb81606ce0e82cfc83900644dd58bc7c8feeef5631d8cd718a269fe34e1e13001c7c34f342280bcd0620d14c8c
-
Filesize
74KB
MD5a1b5a4d4d8e027c056b6b6a2a5a22080
SHA13154c363ca49519c0be4aee493e02f02110da47f
SHA2566d33107ce562e7fa41a2cd7a48b4c8ab49cc5ee16af9fadcb65277cdca27c4e3
SHA512a98da1505a1c0745a1ae1982e6c4d190dc52421d6b2466e352c049ed35ee8cf6e9f42245e7fe47f1f3ac5db361d5c9580e97bb2c2d24bb120460094826578c3c
-
Filesize
185KB
MD5022568111d51b5dbb92c0ab0872b380c
SHA137962202c8f5b74532829796821d5989e0f2d673
SHA2564e5f1f42f90316819b9fe431722c5cc8c0a91d90e0fea87e580f17629e088a9a
SHA512d5e8ede38e4a81d63737e17688581d434ad27aa2508cc1f7614b6aa9892a6e62956503f495b816005517df4815381d3b14d5deadc4164c8ee08ca3018e108dc7
-
Filesize
14B
MD53225e1e3514e633953a1e3129389a091
SHA14150cdb9ec57a4276d02e0bd49f185ca743908e7
SHA2567b86a311fc5fa2097f2ff818eadcf361381ee6df7235f892c173098dcb537706
SHA512f930da498487c4b87c5a3647f1aba743e7d3d9aa2eb5c25f35e265ee15c14dd2c66327d5aeb34239357bdb302ca30e2a27353c718faf1dfef41845f6d3f1ae54
-
Filesize
196KB
MD58dfcc7e65776104551611498419ccdfc
SHA14c054137765838883791dfffeb9cec5a0d72b76b
SHA25690a932fb085ad941f278090483bc89661b242f5bd5ef32a49b68c7e04dcbfe90
SHA5129164b17fb9fd8b73427d953f011720e3404913541833e100052af143a2346ef6cdee66a471a979b6706f195fd8431aa812fb25a1331f63e052735a42cbca30f3
-
Filesize
58B
MD579b3923c41884aa5b9791b122a653e1f
SHA124718d177bf1db703c9142937807cbf145f3ebfe
SHA2569da30c33b79323179d0353001f105e73ae134411818110db4c5ba5cd10d1bea0
SHA5122a8145a37a003c959187343c07dd83d856607e95c6346fbcaf2987f0527d250ac915c98a341c2864d11ef3f0eec0d8a2a670d9ca417905ffb7aadad165e0bfe3
-
Filesize
28B
MD5e30dca5ec903629af7a90b499858882e
SHA1ee7f5584e528346cdeb97196caa4bc89a481673f
SHA256e4bebea38a90b8c50ffb197201009a712ce56d67538be9cada68a0a24baa6fe6
SHA5128bb6e059879b4fb44db91645c52185106f0a4087feb10757c024de2cfcfad04441a4eaaa816428f99151abc7ce0b2e2e847796938f4f05c208c555f1562a3bc1
-
Filesize
575KB
MD5514cbd49324f8f45cd00fe6fd69a245c
SHA18e26c0c14be87ed8e221da1713ec6580b6a1ac5f
SHA256ca8771322b4a6b3a48fcecb9c61a33abaf0e83d437889581297a186ad62d653d
SHA51266d4f07e222508027526801c8e40e1fc8928c03b7d6d323b8d43ac9880392c3238673e8e413c90e4460e777d9fc4814b46ffc466948d43cafb70326016d769c4
-
Filesize
134KB
MD5ddc1cc25830c2afaaa64d6bd784fb26d
SHA18866309780e0f88051775bf399a424de38bbaf8d
SHA2563b123f1fea7f38de527bca6dc51b9a922a7189a72441b48a39743063fb131148
SHA5122b96d682b8fc0e93f4cdda84dda82c24fd9703112f655d3b1436e9aec1b6ad2321eb0d3a84e10c774c3c4b9bb9ad1f4c035a715e4735850fbac651f0023c4544
-
Filesize
72KB
MD5d0d3e744178eea35ddb3e55568eeedca
SHA160a26b2777f80c17b9dbc1f5898eba7eebec11a0
SHA256461a9122a5c3a63644d005caa601cf9e4b7e5ef6f852e8767e398f39486e4e34
SHA5120d54fb3409138bf089f77b17529887930d4731c85893877fc56fa7b3b83f9e7f07441b9c1d9b51daf7afa1053fbc49e678c0f92f6184343383fb6e587915e285
-
Filesize
1.4MB
MD5d4e9244aed9d8ffc18f7d928f2e520c4
SHA1a534e42facce7a2d054269a8f53953d5a3ab8ba0
SHA2560408ee9513a32d5c5c1495e2ee3dcf43f02533cea770ab1f07e1ab0167f4067b
SHA512e28a55d2b6d2504a03056c46aada5a51f2898f656e0ec8f5b01d37ef18282feb343b7883457ada489c81740a417d4b388f975113e63a820428c6a13ff9037d02
-
Filesize
905KB
MD53fcc5348556331c365025ac57dfbcb1a
SHA1f357091018f9d68e34017908a07c2255a3ec5e93
SHA256622243b663cb4beef8ac22184e72a15e4593b3591804188114385b00950a7eb7
SHA5127963490e41ed0192dbfb0d67e1c6fd55810fd89fa71b032ee45516fba01db6eb0a2b7194ef185786ac4eca0d8a1e4e475bf9dacc7ca0959d7b70209a9d571881
-
Filesize
1002KB
MD51fbb754a64f4c48984f47fc0532799d4
SHA173543dbe71e39f7dc4f63699a722e22f232b096f
SHA256313778d51081f38feb3b9ea5279f941b4793291a1842306022d329242a57e0d7
SHA5129bdcaac1b96de9a3e74aa05e39feb460f557f4000f9a3c8aa1a38d0c63e68a83dffd85b7a4f1933ca1ae30c96d9ef0909f03e6f909afb41375091348573f4d0a
-
Filesize
5.6MB
MD5bd61566af089cacebdd1b4c41bfa4e85
SHA1e3e877688ebd19645080bf15b08da9e7b0b7fb27
SHA25614d140999ab5d2ab903ddf1aedda4d868be68db054424c7fad70b8927b32a145
SHA512142e48caa5179ad2d8d2c66689e2569cb7dda624b0d89494c338cc0c4692d1dd7f6d51c6051b8a57207a45f173ce53e76633861e311e31b0e9b46e5a1580f105
-
Filesize
173KB
MD53747108570b8433d047a7e1208fda541
SHA1787518792f39a7e2365a424711dbfc3abcd60dc0
SHA256d987a17b4566602232353909027fa07ac5bf2c38f0613b24873e84fcc5e1d336
SHA5124768bdadce5ec8d0eaac4fd08a92f7d9e937304ab60bbf92bca44ffc5c095056faf2dca3c96347648443ddfc09f9aed421e2506e4a6ff6780f0aadabcfab774c
-
Filesize
3.2MB
MD50d45002a435fd8aa79b1be50ad66e892
SHA14d33b00d4189c328b2c26493dc51c10cb0cc58bd
SHA25651e82695d805e2ad178f374a8665c22a17fbab07152df7ffecb92145f9bcc8bf
SHA5121f9701bc875bef2e4cdeb67ce6cd32c8d6d31b16884b5c3db5520d89ecc175f5210b7ca06f77a97f16db63cd431ab3b2bfbbc0094b0f568390433f81ef5ad2a9
-
Filesize
1KB
MD5643d147e7502397af708262f9705b8b3
SHA1739c9f3852424969fd01546a500692d5d728ac93
SHA256b303db108804a1c907c7c0c43b27ed3672cb11db7a44e70deeb0960418c8fa35
SHA51231f249d33aee69870eae42f4701239c1575d1cdf7b4cf82e827d29a5f867161b69302d49d339be20659ee3ed8ec06a55f77cc71ec9bcc15e2d2b47cae535ccc6
-
Filesize
470KB
MD59f2344af5ef96ef7ae59268824f3151c
SHA1b3da439d056bb3ae7f00ecda4aaae73ef79e22b4
SHA256c69799ea10f65780dade40fec14610295bd1fea15c6e165452c89ff83ab093a6
SHA5129bb2d42c86ebf0ea220b9455eab1b794ff3ef5721e23cfcf141d0fa5b1951343c75382bd35836a596f3666bf31b507d107f71591f1b3d663ddf4a3675881662f
-
Filesize
253KB
MD5f3447226656778933c98be43f7a748a3
SHA113c042b8c6034aae8f114df2110e740b374a40c6
SHA25616f1ad014f30e5afb51c34b68b48ba553ec4622bd3439a3584e72e548fd8556f
SHA5128735d37f4afa2f34a3f6a90bf9eb8a4640b60df6a24129fc879c190f6fda2cff4cba7616923b62d857bb489bd34cef447f4c190c46462696c7c42d0207a04649
-
Filesize
76KB
MD51299a7fd5e65e32a7dde8af89e4db61d
SHA1036dbd7df035892da84ab7d0dc1b9225e54e065a
SHA25613dd748913c226f4929af229f755230724adbba5ced7c11b83bc918f8294b5da
SHA512d9cf8d9496d6495ce1054a7cc00b6c08748cc7df9431881eb137f0d5d8a387eda500be214f06232fa1c8a481d05537c75fed2a4367eece848a15ffc39374df14
-
Filesize
1.7MB
MD5439e9fb8d5e39b48bfaa4f2700f65b83
SHA1270302336f1c57bdb91bc8d80ba846fcc27a5e4a
SHA2562cf28f824d1c452b63087a7434996c05e897c486a04299dd2d72ab8e9ff39a0a
SHA5128aec77ba448e2bdcc4800d10ec66ff28f7ff9531e7142e98ce011fcfe1d9c943ac1b314169e566661d2054ff3cb9d55a7ffb39d5eb6795b3e49c264bdbac4f9f
-
Filesize
353KB
MD5473f224dd928b93370e3e12a12d78ce7
SHA16285daa3586679c161d11dafeac23bf8f9016005
SHA256fcc0e468e0ea8ee56231f5678e527c7d2312fcc5dfddd7fbeb71896206500b47
SHA5125ec0b7d86da2c4f391ec69d095eca3c0dbeb58d4376c8654df03d03574b2c48dca1a513b0de8580d47522b98424304608cdc4bd79406cb6e49e068176cc14556
-
Filesize
209KB
MD5c4bb0a8bfbd4a632180b7a2c62e82b10
SHA1d5126cff50ab25313f746104faafdc70e1d9fbd7
SHA2564b2e1c988a09e5b318c4dcdd51a25887d02bf48cbdef239b9cc86742459a50e6
SHA512504fc157591f4282528b8bda1d4dae14362b8f30b9a9e1921579a510cc1725390216274c5d925dccf9a3daf411b29a9ff027e77ada50fc581c7451de5c75af0f
-
Filesize
61KB
MD53f02eac260ab175a46849c2b70caf483
SHA1cb5774f3f429f86ad3043950b57917b2f191612a
SHA2563c930bbc232dc6e3c06b77a372431197ad31f4e75f2f68b9547fc29b015d9e49
SHA512f02d459e8886861d6f3f7f2d28dc0935244e00d247e3155ae5cc95b96ba41beea9ce83bc3920eb2471bd4bf76048e5a777e2fe28d43c481dcfeb7bdf25e1d40d
-
Filesize
435KB
MD59e5f266f5b7c8771a2a25dcf5fc23873
SHA1933acf655b97aaf1966158fa18ce5f67ab070d25
SHA256f700ab8251ee590cb5a22e242bde3d8b7c62288278c0c051352ccc99b56ace4e
SHA512a1e1ac6be2074ac5ac55ce493b73d7591ce476a19906cdfef1c065154eb96d4e360ad6c1b42d7a00ec09b6a877aa4f8f0cea71496f12a19ce5e92543d5ae4186
-
Filesize
1.1MB
MD5886bcdd81bbce31fa03c23e78f11158c
SHA18c01b607c8b80871d2ae6bf63b4870c40aebcb42
SHA2569d299887fb4a886be03f11a86af0d1021a2331ab0283c90ba6d790fa366d3767
SHA5120c00229307950f55bec9d3026ab7120c7f0487eb3fb24aadd8808d2f2c801731e2eca458a58273992a519fa55cf49603089c4aca4600f4a8279beb933d4b076b
-
Filesize
201KB
MD5d76d18c5d897b043827ff03739b8298c
SHA177a4274d4c6524c0d4b6b355d302235187254f90
SHA2564a79ad74e70700b8db6bf101023d70fcd5b1b28f0e28584ee93610a873263995
SHA51216c351c21edcb9bf308c68c18bb128291145820c72e7dbaf2202ef85b7e9c31fc1943702f12a3f41afa0f21f5794cca043b0f37bbbe5141b90ce6f264a862535
-
Filesize
1.9MB
MD5d5145c203ad9d94a13416b1e5400ab2d
SHA1ebcbb8948b16760854dd87742d88ac9bf0cb3c78
SHA256859d84044efc9b130c639db1c9e65250546606ffd7e3f27f491099e56fbca97c
SHA5120da26730b85be0be07934516d3292c46256fd54a6188f32f6ebd70cf5859c1ae94852a20239bc391f792e2c0f8768e1465dba2744499145b665622f214ae3310
-
Filesize
220KB
MD579c930429a1b86933c1ca4346ab74d34
SHA15d2aaf228686b2e8dbe5306ff339398c78c75a49
SHA25636f599a8ff2bb6246f895f92a3bf2611a69c2590d5ac28d1160f7a34fe33a3fd
SHA512064485680b43858a16eaca53e83f4dd2dcac55828e53bf8384b5d6d30d9a7858552978f75b15be3689fd3db70820a43d53454beedeead3efa3a9dd51640fdf9f
-
Filesize
299B
MD51bbf28aa5a56942ce64a3c9cfbae8c88
SHA1d7d04562c2c9783fbf9034e2d42ce3de6138e015
SHA256118ad64fbb58279b1ca7ae371b688afa6a5360cb8bc8f7e0f436504efb47d479
SHA5120d13b9bbb78f0d7b99c43ce8789afa59c7a6cd1d5823f2c9a7718b51eca9a70b8070b300fe18279e0d30535afee062ec0f9e8d94c87d715beef881fe64ab3534
-
Filesize
315B
MD5947a0801fb60c4e8669e86a6878697d8
SHA165e6a6a38d53d836cc7c51ab0a56d85645a37869
SHA25626d1f97ae1d43d53dae63dfef2d076f0e433a78edf020b89b54260a81ab7f685
SHA512017361cfd081f4c1fb47b2f7cf43d91e6712e32219edb0626d7a63fdbb2e84c26d6f3c3acb44da1f3676252f71735ab135554282e7dbfd2ed554476df358b604
-
Filesize
148B
MD5c8b11108cae67b5f81e8c5b70cf3d5f9
SHA12446046dc193bbd43dc5cbc6cc3ad73fc9e17c8a
SHA25689e671cef4959ecb73bf512eb14440552e3e36d27515eb03f1b5baa750ae98ac
SHA512a46ad6b4335bb9de0c98998fee98c9372251004bc36b7823b0f576a18f4c784574f939b26a5ba8fe94d6f02d277318a329d663eea8c8d809855aedc65f3cb804
-
Filesize
100B
MD5d72e8d82dd79e7d624e4261bdf83b829
SHA1ca418e6e4450164bbc8fad445e9b11e6a090ee6c
SHA2564aa386ca40a343140439012b8cfed1f330c7b33ca84ba381934101255ac80f16
SHA512700536afa57bc5d9375e6543d4251340e5b30ca12eac882a910d65a8cfc069676798deeda35db0c4a4f73cd5e1053f2e92787c76d3d7b19180637d10f5a6e6bf
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
11KB
MD5d3ba798e4397c4f0542f6504ada781d9
SHA146cbf560d2144e8a420dd0bbf1842f7fa3ae3626
SHA2561fb42a268d6a4f84f43640f44f6274b3e33307f4406c77f6a3753e80888a15ce
SHA512543eeaafa87b535cf37055b33b0b5bff2416145150b2c6d67b1ff1e88b730ee42dd098340f3aa90138ada7fb410eea35362ae4003daed85be00fa8af9362284c
-
Filesize
30KB
MD59dfd27ec1feaa43a89b3bd3c8724c98e
SHA150039f8d31cd1b1fa9ef0e222ecf3e73b33da5cf
SHA256142014668005c043b2727204dabc042ccc6aad83e0584aa539a507c6c0127b73
SHA512cc0f12735c4650ff99f6cfb96594fa37dda5ae86bbb913aaef5d662ea6e30d8839da635c0849f98297336a59ab481197027381008e784868b7230e2ab20b1b6e
-
Filesize
73KB
MD5f4ae0778d8c16e1bdc82f6599348e7e3
SHA14e6ad982ebafa80b1d24b23a1cf0b1cd5fe1ae89
SHA256439012c5477cae982da69355b8308788ae2e82a75b3cca8079126e190d3f898b
SHA51239e5f20a056710899b1bc2500bf57e9ef675ba386974241ba3bdb18a103199bc7cc9f31ce2f1a8e9b1bc27a0f1533b69d3f42e45111f7b111b93b411c3cd9eca
-
Filesize
77KB
MD51f688bceb0a34c8fd6f1bc0b9582d709
SHA1e041be7c6612e6f69166bbf8f65101b6988cc2db
SHA2568c9ce1d0fde39b77cfc0a82bb42cbd57a1e3ac124351b57a79bfc6ab9495d7e0
SHA512f288e2022f6fe952e69bcab2d5b03be886155aab7b89d1b20dabf00ae104a99da5b446bd745e422f1dd2d4e2951215929db2bfc9ce277638ecab1437eab7141a
-
Filesize
1.2MB
MD5b9fb2e0d8378b15d091d677ff96fee70
SHA17bad6ac39763cccf8f4b3789d1acdb9a85057d6c
SHA256b1f7352390ac91b9a71ac4497cb16575892c644157f4f9aaa8639518ff4d9b17
SHA512dc019ab7e8884e69205396b966cbfab5f614f5435cbd6ac623115d0cde7609c7ea79d5a6862b5c651869c8ebdabbc06f4dba98ac507ad50c3eb93b7580bba7de
-
Filesize
8KB
MD52d90e66759874d4be1ce548cb349ff88
SHA1b2bb654ebe1ec2a0bde1f0377a4fb3dbfbbacc32
SHA256aec63b417b37a083a18bb9fe2779fe79986c8fdce276c9cd0b7624fc2f02a447
SHA51266b8889b3eda29300f551ce06160ab2ed3c26e0f7b5019b375e13f529c031daf7a4d6cc6d12147122541b560a18fe0112c3bcb98e56228171b45f74780e40748
-
Filesize
1.8MB
MD501f9b851b051cd200c052cfe2fe9b71c
SHA18afca33f5642281f9fe231119d4e78c2dcf89ec5
SHA2568da4669efacfcca65de1403a6a37319714608f216aa475b6ab142d40f65fe70f
SHA512853e7451fc685a4f92587fc21789e3bd75a2a72c4ce30485931b46fb96aa275021b9793d04ca0a55159bdcdd319cd5a2da82269152eb54374711e2aadc57ba33
-
Filesize
64B
MD5099a789730a3e6266eca606b344e6c5a
SHA1345b6bdc499bd8a9dbd9de99a37e5713808dabca
SHA256650be9eb1553335334633209373c15fe850bb94f1a1a712d802d1adfab92b140
SHA5126033500f8972d6ceee27c6a5307b0d4c71ef9644bd7db56f416f4bc13d6219f59c4ec1eb7d7cc92799d3275e2fd5f6772041ec41255c47cfccefbd3c342c97f4
-
Filesize
1KB
MD5d605a36c0b64481812cb73891bdfc1b8
SHA1b71521b8058742548623d65fe13d65d7083848fd
SHA25638ee38a7ce3b7987f6cc46393d35d99922ca982ec3c6124b87c2e6b404f9cc34
SHA5125ae48cf8beeda1ddaba28aa88a6301128cf7403608aac582be5f9cd25d87d1a35c59d45cdff1326f481f4c7d92424253435144fdce92e4e4669b4416871e36a8
-
Filesize
3KB
MD5bee66b2c2ea629f6bc089b75edc8a44e
SHA102e45c40e2772832af7a012211d7cfba100d0004
SHA256791291733f3b727241ce08b92b12ad6fdc2589d6d79ebc612da8e4cf605221c3
SHA512dc403c5c839a49a7c40980f50e0972f47db62c6a1ba9ea3e6a725bfae7b0ac667e8a391159c7853bd46058b9aba0da8f84ba040163f6d9ba15aa5fe0b9eef8a5
-
Filesize
4KB
MD5cf90c463cbb2b77dea06ad509f265280
SHA1c3f624e220649b9d272a773f9f70f56a483567b7
SHA25677ceea6c1b99dff5dd87997e36e6163cdc4a456d89acb1ec9d3160193934dc26
SHA512aa71f3fd8415d47f48116111243e634ac3910f44e3e6e7ed5bc1ed71abc30fdce2afdf66a97eb0ffc5e3c7a854454576b6a2320fb0f62783455f158d466e4591
-
Filesize
1KB
MD518c01cafed3cb165115211d38ba140d5
SHA151fd169cdf281e17e3d9437f65c01a6c44ea6cb5
SHA256a0ed652cba5f93a6516ccbf7ab0864fc812b24f9c58e673c4d9ca4c0ddda7923
SHA51292a69cac8dc79ce94f3c6cf0c4c01c1effa71843a100a16ccb7617bd4adde050338d8d3491dd5c92baf069c3bbe4a07483c9aec98ecf6ff06f278591b9f7cddc
-
Filesize
2KB
MD52c76aa244221fbd33ee1b66b191fd822
SHA104c73779874775e52423f1ba172553c172972b9b
SHA256f64020cb817eb0b2e7d9602b5fc90cc3826de7ae2055e1b34127fbabc1d71cf6
SHA5126582c705723374157b6e6f97a04aa59448fbe921527a4f4bbadfd8831032ed51bb7b6670a514544d79e4e7aa8ee922bdb545a8e18998b73820112abffaad0508
-
Filesize
3KB
MD5909ef699860472fa76fb66de5569e047
SHA1ac6d8f986d2548d59e845d1b3c3382bbc1fd7321
SHA25684cdd5c9e0e22542b2e348a72c4e94703b08d0e490722d983995ca693a1dbfb5
SHA5123d6f782bdf00ff407e7a6c350a44274de9acb5c11ee9fb33e66d5a5d51e4d48f2036ad485dbd290aa25e5883e035fe5cf3bfc8a0ad775654fd33847a34f1d5e5
-
Filesize
2KB
MD586e989f09fd4eea06208621967e68a63
SHA101fe7b2a5ab3a2bea42fc6290f1cb15c7fe3297f
SHA256f518f5ea57a0cb040d18a3f07e38b4ee6d3e6b26d92c8176699239b304abc53e
SHA51292553ab412a27f6cd34951e90f09b7033c6cb2f7f7bdfbd53850574e74b7994b946ac35cecde30340d8f64c41d00a52c4c23831e79f1ed6d93fe481c8e548f6f
-
Filesize
3KB
MD56ef361b9e92fcaf3deabf59c5f429ab7
SHA1215bbd0a5e1999b7351f4b46ba890fa9f55e982e
SHA256db3a48aa65bd45118f4912297da71ec095d3eb713a9a92ae891eab3e9f34f2c1
SHA5129582f0036d32401886181e2766c65c8ce2b362850007a7f33108b443bad1ee78acbc8c29ee20dcaadafcbd61d2de13a745c2ad76b8173f9c1dbda8050eb3541d
-
Filesize
3KB
MD5dd5afaf7f279bee2b4545dee47c980d1
SHA15f87870828bd4b181764833332154ea6dd6a925d
SHA2569ef566dabae21871bad7a1cfa336c43209d1a791bf80d5df4f8897c886030b27
SHA512e604f2e0dc92c7054b682ea5f8cca5ab6420953c287f0f8f9a7b17a610aa0dde71a314b9fc51aabd7ce467496ff52f8b1a41c60f27798c32afd364238b6a4f9f
-
Filesize
554B
MD5e2d5c3629b1bf8b661e230cc10194f0f
SHA1b52a0e971389a19e58a7058618d5082e36ab9f29
SHA2560bcf1a5268a408906b1e84533365d428bcd3f78a2cc524b7ddbe13d3906748a0
SHA512010d4267ee9fb13663477810657bc675b5419602f1dd72d972ea8720070de5192888f443590d07dbbe34b52787ff8ada271acbaf6523b1b15011cee5898b8894
-
Filesize
12KB
MD5d5ad53fc7b5fc6783dea3e049f3167cc
SHA1028e7d65d4dd37930e8660fea6f9427e421e0a71
SHA256ed1b2cbbebc296e0ebecbdc50cb06c8aeb720e362b7a36407a27ddaf4f717c79
SHA512f7d976f8778928f3dcc6b7a6f43e56bfec87d08c1a47f8886305dfc72cfeb1b1077abdcb7d36c8062c86a813290196386be15e035a27ad8b176160b6f89babe5
-
Filesize
1KB
MD50a7b2ef249b5d120b1a93a9b5759f884
SHA177badc56008cc736b7227a1d0cb92aecc573ffc9
SHA256d0c158c03fd019a3323a6e851f30926ac35f81574197af97049e39da8e27c5d0
SHA512136d48d534ddd359b25d52beb6ace47c3948d12c8bf3b8b0132556835ea50a64e5066d2339f8a6773ae487e21b106b44b8522a5a04f482f9c3f6584c46eb0f88
-
Filesize
1KB
MD5451e82830d127d7c1266cb71b9019508
SHA1d0f52a09e56ba9e3ecf78357013cc5043b48d420
SHA2566f79cffd08bd0d368c8f2ed33f71afa71d5838495d0b40658848e3fc5c4535c7
SHA5125a8de9ddf8f22e81331f03e13e6162320fbd0ec66867898396379599017931396d3c95afce5fdcf40f34668ef5e540290a52c236c8c960a4de9022bd14f76f20
-
Filesize
1KB
MD57c2cabe71f4da012ceff1f3628ae65e5
SHA15e0e7fb0394641781139ec8c73c28c09e36110d2
SHA256897075bd7f1089e2c6753e60076de2a35ad14e310a8fbc6bff2a9d1521b9d60b
SHA512fb747f228720adf2b778f398c1c331fdbffe55b7199682bf0bc6d8d284da6b079e1798c502504d250023120092eee21674cf1b36f0b6e6ea487caa6978309b99
-
Filesize
3KB
MD5914b4562c8435c0b77e8e6935a55b0f6
SHA1a11ae68bb0c120622831ced096f61b44d3ea26f0
SHA25681db30462393e8cc355b46671caabf0876592006804f64c76586122214ae95b9
SHA51277c982bae49d6d82022cc6ac8a32d8296c1b7f7db6bdf4977921cf51934c53ecec2d36032fc5b5aaa84ad44699d08a5d36cb5b5b32b5c9f538dc24d0380626a2
-
Filesize
3KB
MD5b0371a8e20e22c1d21ec4a817e8171b4
SHA1f65fda508a1c8b96a64de9b6cadd0ca2c6c56007
SHA256557568c2f44782ec81c87b652c91f9a8d71bf9d2747ba8e438705cb36e4243ae
SHA512ba6ed22e38742271f098e45ba4f2ff1748f3fb6fdff363b8b371231c393eecebe7b730b6963ebb39d476a9002c65c251ed7dcbb7dbeed38dd8ba6559888683be
-
Filesize
28B
MD5d5740c35b16d09667ab7291f0dd0247a
SHA17c986be6b047a8061247926178322fd72c937e67
SHA256d35617625512a7fa89d57fd4d2a943d0ff8055a5fe06006dd206df27a62a4151
SHA512d1bbba00f129e7d74b93e7107e68cf21a2e51709eeddf512b803af15bf9b9f833d41268473d6530a7fad56c3c9ab93eb8d11d2df9b50a5cfaa462665892c511e
-
Filesize
292B
MD5695abd3b9b87cc89b0cd820a9709d22a
SHA1da528492f5db4df8424c58f3b48da038b64e0f27
SHA256a2eaa612674a902860d58714adadf2084ba50e7e4cf33e935ab14919d55243e9
SHA512c6db7b1a996cb0322df675f485fc84ac58876367e6cadea2ffbd6e321a5ff800fe6b26aa2ad47d5f936c97bed5da646eaef9579b7dd3a82b2b2054073d16b623
-
Filesize
378B
MD56fbcd0bc7ee66beda72c83c59ae7903b
SHA1d738fa350c3faee9c49ac7f9f59f2b8fd408c5ba
SHA256a476e921675c5a370d5b7b0c97e0e11db46ec6192206130be6fbe678e56f2f49
SHA5128837771429bc64bac64c7ac0fb8a53e4f77628bcb7eb0a9e50de49b1968092c4da043a1843d0da9b0c2134b5e2d3397dad0a039aa13953f874dd6c20993ec0c4
-
Filesize
378B
MD579d9d2cbce7961ab8bff23186ed8d484
SHA1936fc9fd728adfc6d2f460c7d20998480b70b689
SHA256397191cff20d90a614fa892fd83f87de8482851cbf8de937b907db545c903de9
SHA512567e250cb461bfef543f198f8c7ca6364e51034632abced407a65986eee9d340f5b2e7379bae0e2f0bf3332732771314bb9b25d79969526646a20f491b93177f
-
Filesize
3KB
MD55243072c920598503f525543b234e936
SHA12cb25ad7cb5319fbb1dc883d1ed36b9e490bce12
SHA25640a439fdc9ae36eedbce443ff1dc5bb514e272528c59adab4b25634e5dbf75ca
SHA512127e81f6f6c360c5032b7b65a46aa19e78718bc0900b4ebff6b9e8f1e6951472a1a56385186a25ec62cdb9529bc01b29f3d67019b924b70a542955506ea9264a
-
Filesize
3KB
MD520ec82f1a42b97893d54de3c2b17a1d7
SHA147eb39e893a9ed36f0caf6863aee166340c6e57e
SHA256ec547e72ff8a143ddc84cfd3da722a8ab476e45b10226d257c0837b6834fe129
SHA512816713dc0d0700702425606da548054ba4f2ecc5bcf33c84e7614a22bf04124401fc57fdb3a8eed48d1ccfc619f50b4bfef8587738e735b7a283036055f5ea6b
-
Filesize
458B
MD52e1222fb4ac44f5c4aa27a043031d289
SHA1b14768c7b3ae07765ba4ec30eb36d2feef57f18a
SHA256be9599fcdf734ab9937faadbf5a767a7d60f620111ac1af0f64f19bdfcbc46e7
SHA512a90e87694da773fc769e375b318e80739e52bca77f142b918ce0e9901de86d8ff299ca13f8daa1e8725c79a01e8e4e5b742ed104b42689057d74cd1f73fc3162
-
Filesize
1KB
MD569c6361f93cadd8c7568d5cc6af20dc5
SHA1971d7867f9dca6f16e9fc9efd8f36be4fba3bdda
SHA2560b1ae4fa681d8f63d1ee23ac37e2d46ac0aee1aa0db7671ae51cfe9379850167
SHA512f23e8b807fba91b297666db636d761b0e34c121036900b837d677d5daf3f82d98e8389b8d412d5b68e9fe5b0fa70c2d67fbab5bbd33510d076e3f4d52b8f6b3d
-
Filesize
4KB
MD5c7ecaa4b1cc065eba2a6b07d23074df5
SHA179bcfe0c95352dd2f880f1b3f5dd3152f35d35c8
SHA25656abd3007e7a5a226a58cd4b02379f3b3386b1e5573777e9b8809066a06eb72f
SHA512cf87684c0b1f11fb88869893d164eee55c90269d1858c9e2e9fab932daaed1c5b8c09125a43897000e9f96d6d2767e7c0a530cea0002ff967eab9b1608bbe5a7
-
Filesize
4KB
MD5f758001b136b38304f165ed859dd4a19
SHA1a4ae2ca390651fb1070f9654bc2fdc8bdeb391ab
SHA256955f0e7f4406445672e811bbb779990a9ee6af4562b4a724fa45f15a1c149ddc
SHA512e046116658d441d49bbebde2cf4a95499c7cd6efde97d9c69cca98bcdafcbff93a02e5cd5d707c7ae6e6f6f57a574b91c2aabc126a44cfd060c4f4fdae1df6a7