Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2699s -
max time network
2668s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 21:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/x64dbg/x64dbg
Resource
win10v2004-20240704-en
General
-
Target
https://github.com/x64dbg/x64dbg
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules mDNSResponder.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\iVCam.sys DrvInst.exe File opened for modification C:\Windows\system32\drivers\iVCamAud.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\drmk.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\portcls.sys DrvInst.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Control Panel\International\Geo\Nation iVCam.exe Key value queried \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Control Panel\International\Geo\Nation iVCam.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 27 IoCs
pid Process 2948 iVCam_x64_v7.3.3.exe 4524 iVCam_x64_v7.3.3.tmp 2924 mDNSResponder.exe 2728 Process not Found 3024 devcon.exe 3084 devcon.exe 4196 iVCam.exe 788 adb.exe 3280 iVCam.exe 4100 iVCam.exe 1232 adb.exe 4124 iVCam.exe 4524 iVCam.exe 4652 iVCam.exe 1652 iVCam.exe 2268 iVCam.exe 5052 iVCam.exe 4724 iVCam.exe 4036 iVCam.exe 3268 iVCam.exe 3620 adb.exe 4580 iVCam.exe 1444 adb.exe 1968 Termoimpianti_Pro_Demo_Setup.tmp 3100 Termoimpianti.exe 752 Termoimpianti.exe 4528 Termoimpianti.exe -
Loads dropped DLL 64 IoCs
pid Process 680 MsiExec.exe 680 MsiExec.exe 680 MsiExec.exe 2796 MsiExec.exe 2796 MsiExec.exe 1624 MsiExec.exe 4112 MsiExec.exe 2128 MsiExec.exe 4500 Process not Found 3856 x64dbg.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 788 adb.exe 788 adb.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 3856 x64dbg.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 1232 adb.exe 1232 adb.exe 4100 iVCam.exe 4100 iVCam.exe 4124 iVCam.exe 4124 iVCam.exe 4124 iVCam.exe 4124 iVCam.exe 4124 iVCam.exe 4124 iVCam.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iVCam = "C:\\Program Files\\e2eSoft\\iVCam\\iVCam.exe /silent" iVCam_x64_v7.3.3.tmp -
Blocklisted process makes network request 1 IoCs
flow pid Process 161 2044 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
flow ioc 19 camo.githubusercontent.com 22 camo.githubusercontent.com 24 camo.githubusercontent.com 619 raw.githubusercontent.com 16 camo.githubusercontent.com 17 camo.githubusercontent.com 20 camo.githubusercontent.com 21 camo.githubusercontent.com 27 raw.githubusercontent.com 616 camo.githubusercontent.com -
Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\amd64\iVCamAud.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ivcamaud.inf_amd64_80f5b498a53e97d9\amd64\iVCamAud.sys DrvInst.exe File created C:\Windows\system32\dns-sd.exe msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\amd64\SETCB81.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\ivcamaud.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\amd64\SETDD34.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\amd64\iVCam.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\SETDD23.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\iVCamAudx64.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\SETCB61.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\amd64\SETCB81.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\amd64\iVCam.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\amd64\iVCam.sys DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\SysWOW64\dnssd.dll msiexec.exe File created C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\ivcam.PNF devcon.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\SETDD33.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\amd64\SETDD34.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\amd64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\SETCB60.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\SETCB60.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\SETCB61.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\iVCamx64.cat DrvInst.exe File created C:\Windows\system32\jdns_sd.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\amd64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\SETDD33.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ivcamaud.inf_amd64_80f5b498a53e97d9\iVCamAudx64.cat DrvInst.exe File created C:\Windows\SysWOW64\dns-sd.exe msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\ivcam.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ivcamaud.inf_amd64_80f5b498a53e97d9\amd64\iVCamAud.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ivcamaud.inf_amd64_80f5b498a53e97d9\ivcamaud.PNF devcon.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{dc105eb5-78f9-1440-bc8d-a81d6fa7d6c9}\iVCamx64.cat DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\ivcam.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ivcam.inf_amd64_0cf2c7c7b9a5517e\ivcam.PNF DrvInst.exe File created C:\Windows\system32\dnssd.dll msiexec.exe File created C:\Windows\SysWOW64\dnssdX.dll msiexec.exe File created C:\Windows\system32\dnssdX.dll msiexec.exe File created C:\Windows\SysWOW64\jdns_sd.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{123dbdc4-4eff-c24f-a99c-f5ce94dff7c6}\SETDD23.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ivcamaud.inf_amd64_80f5b498a53e97d9\ivcamaud.inf DrvInst.exe -
Suspicious use of SetThreadContext 26 IoCs
description pid Process procid_target PID 3856 set thread context of 4196 3856 x64dbg.exe 150 PID 3856 set thread context of 4196 3856 x64dbg.exe 150 PID 3856 set thread context of 4196 3856 x64dbg.exe 150 PID 3856 set thread context of 3280 3856 x64dbg.exe 153 PID 2324 set thread context of 4524 2324 x64dbg.exe 162 PID 2324 set thread context of 4652 2324 x64dbg.exe 163 PID 2324 set thread context of 1652 2324 x64dbg.exe 164 PID 2324 set thread context of 2268 2324 x64dbg.exe 165 PID 2324 set thread context of 5052 2324 x64dbg.exe 166 PID 2472 set thread context of 4724 2472 x64dbg.exe 168 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2472 set thread context of 4036 2472 x64dbg.exe 169 PID 2396 set thread context of 4528 2396 x32dbg.exe 226 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-V01UD.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-44191.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-EILO2.tmp iVCam_x64_v7.3.3.tmp File opened for modification C:\Program Files\e2eSoft\iVCam\libiomp5md.dll iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\is-BQR3E.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-1VTER.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-8H6KH.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files (x86)\Bonjour\Bonjour.Resources\fr.lproj\About Bonjour.rtf msiexec.exe File created C:\Program Files\e2eSoft\iVCam\driver\amd64\is-3PACM.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-C51UH.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-8A1D9.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-NSNP3.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-TVDNS.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files (x86)\Bonjour\Bonjour.Resources\zh_CN.lproj\About Bonjour.rtf msiexec.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dns_sd.jar msiexec.exe File created C:\Program Files\e2eSoft\iVCam\is-SN598.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-HINJH.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-VR1D3.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-MNRJP.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-9K1T8.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-U9B2V.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files (x86)\Bonjour\Bonjour.Resources\zh_TW.lproj\About Bonjour.rtf msiexec.exe File opened for modification C:\Program Files\e2eSoft\iVCam\avcodec.dll iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\unins000.dat iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\driver_mic\is-7CSTR.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\is-F1GK6.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files (x86)\Bonjour\Bonjour.Resources\es.lproj\About Bonjour.rtf msiexec.exe File created C:\Program Files\e2eSoft\iVCam\driver\is-A95O2.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-0R6TU.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-ICOJD.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-KL1A8.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files (x86)\Bonjour\Bonjour.Resources\ko.lproj\About Bonjour.rtf msiexec.exe File opened for modification C:\Program Files\e2eSoft\iVCam\adb\AdbWinUsbApi.dll iVCam_x64_v7.3.3.tmp File opened for modification C:\Program Files\e2eSoft\iVCam\onnxruntime.dll iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-TMH06.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-D6UF4.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files (x86)\Bonjour\Bonjour.Resources\en_GB.lproj\About Bonjour.rtf msiexec.exe File created C:\Program Files (x86)\Bonjour\Bonjour.Resources\nl.lproj\About Bonjour.rtf msiexec.exe File created C:\Program Files (x86)\Bonjour\Bonjour.Resources\pt_PT.lproj\About Bonjour.rtf msiexec.exe File created C:\Program Files\e2eSoft\iVCam\is-6AGU9.tmp iVCam_x64_v7.3.3.tmp File opened for modification C:\Program Files\e2eSoft\iVCam\avformat.dll iVCam_x64_v7.3.3.tmp File opened for modification C:\Program Files\e2eSoft\iVCam\avutil.dll iVCam_x64_v7.3.3.tmp File opened for modification C:\Program Files\e2eSoft\iVCam\vcomp140.dll iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\driver_mic\is-AQ68J.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-DQMQ5.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-0MK1O.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\is-2FNI9.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\is-B261A.tmp iVCam_x64_v7.3.3.tmp File opened for modification C:\Program Files\e2eSoft\iVCam\vcruntime140_1.dll iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\is-B8GTQ.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-CMMS6.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-HOIG3.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-T06HC.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-DU2VT.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\luts\is-R8ONQ.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files (x86)\Bonjour\mDNSResponder.exe msiexec.exe File opened for modification C:\Program Files\e2eSoft\iVCam\vcruntime140.dll iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\driver\is-12A1P.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-HHTBJ.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-JT8IJ.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\resource\filters\is-3S5H6.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files\e2eSoft\iVCam\is-504HK.tmp iVCam_x64_v7.3.3.tmp File created C:\Program Files (x86)\Bonjour\Bonjour.Resources\it.lproj\About Bonjour.rtf msiexec.exe File created C:\Program Files\e2eSoft\iVCam\driver\is-F6OE5.tmp iVCam_x64_v7.3.3.tmp -
Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5a8f9f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI980B.tmp msiexec.exe File opened for modification C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIA3B8.tmp msiexec.exe File created C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log devcon.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\ks.PNF DrvInst.exe File created C:\Windows\Installer\e5a8f9f.msi msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI9D1E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9E86.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD8D.tmp msiexec.exe File created C:\Windows\INF\oem3.PNF DrvInst.exe File created C:\Windows\INF\c_media.PNF devcon.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\Installer\e5a8fa4.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log DrvInst.exe File created C:\Windows\INF\KSCAPTUR.PNF DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log devcon.exe File created C:\Windows\Installer\SourceHash{56DDDFB8-7F79-4480-89D5-25E1F52AB28F} msiexec.exe File opened for modification C:\Windows\Installer\MSI9EE5.tmp msiexec.exe File created C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico msiexec.exe File opened for modification C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico msiexec.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log devcon.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9A00.tmp msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem4.inf DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133647746108258943" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\ProgID\ = "Bonjour.DNSSDEventManager.1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\ = "Analog Crossbar Property Page" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDService\ = "DNSSDService Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\ = "TXTRecord Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid32\ = "{7FD72324-63E1-45AD-B337-4D525BD98DAD}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\ProductIcon = "C:\\Windows\\Installer\\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\\Bonjour.ico" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ = "_IDNSSDEvents" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A802-A46D-11d0-A18C-00A02401DCD4}\CLSID = "{A799A802-A46D-11d0-A18C-00A02401DCD4}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0\FLAGS msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDEventManager.1\ = "DNSSDEventManager Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ = "DNSSDRecord Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\Programmable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord.1\CLSID\ = "{5E93C5A9-7516-4259-A67B-41A656F6E01C}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{19689BF6-C384-48FD-AD51-90E58C79F70B}\FriendlyName = "WDM Streaming Encoder Devices" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDEventManager\CurVer\ = "Bonjour.DNSSDEventManager.1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18FBED6D-F2B7-4EC8-A4A4-46282E635308}\1.0 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.TXTRecord\CLSID\ = "{AFEE063C-05BA-4248-A26E-168477F49734}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Bonjour.TXTRecord.1 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\ = "WDM TV Tuner" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDRecord.1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord.1\ = "DNSSDRecord Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid32\ = "{7FD72324-63E1-45AD-B337-4D525BD98DAD}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDService\CurVer msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\Bonjour.DLL msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDEventManager.1 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDRecord\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dnssdX.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8BFDDD6597F70844985D521E5FA22BF8\mDNSResponder = "Bonjour" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\Programmable msiexec.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3848 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 6 IoCs
pid Process 3856 x64dbg.exe 2324 x64dbg.exe 2472 x64dbg.exe 1888 x64dbg.exe 2396 x32dbg.exe 4028 die.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 2508 chrome.exe 2508 chrome.exe 4524 iVCam_x64_v7.3.3.tmp 4524 iVCam_x64_v7.3.3.tmp 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe 3856 x64dbg.exe -
Suspicious behavior: GetForegroundWindowSpam 7 IoCs
pid Process 3856 x64dbg.exe 2324 x64dbg.exe 2472 x64dbg.exe 4100 iVCam.exe 1888 x64dbg.exe 2396 x32dbg.exe 4028 die.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
pid Process 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 4172 chrome.exe 4172 chrome.exe 4172 chrome.exe 4172 chrome.exe 4172 chrome.exe 4172 chrome.exe 4172 chrome.exe 4172 chrome.exe 4172 chrome.exe 4172 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe Token: SeShutdownPrivilege 3600 chrome.exe Token: SeCreatePagefilePrivilege 3600 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 3600 chrome.exe 4196 iVCam.exe 4196 iVCam.exe 4196 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 3280 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 4100 iVCam.exe 3268 iVCam.exe 3268 iVCam.exe 3268 iVCam.exe 4100 iVCam.exe 3268 iVCam.exe 4580 iVCam.exe 4580 iVCam.exe 4580 iVCam.exe 3268 iVCam.exe 4580 iVCam.exe 4172 chrome.exe 4172 chrome.exe 4172 chrome.exe 4172 chrome.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 3856 x64dbg.exe 3856 x64dbg.exe 2324 x64dbg.exe 2324 x64dbg.exe 2472 x64dbg.exe 2472 x64dbg.exe 1888 x64dbg.exe 1888 x64dbg.exe 2396 x32dbg.exe 2396 x32dbg.exe 4028 die.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3600 wrote to memory of 2424 3600 chrome.exe 82 PID 3600 wrote to memory of 2424 3600 chrome.exe 82 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 4092 3600 chrome.exe 85 PID 3600 wrote to memory of 2864 3600 chrome.exe 86 PID 3600 wrote to memory of 2864 3600 chrome.exe 86 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87 PID 3600 wrote to memory of 4924 3600 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/x64dbg/x64dbg1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85ef1ab58,0x7ff85ef1ab68,0x7ff85ef1ab782⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:22⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1584 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:12⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:12⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4396 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:12⤵PID:2468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5244 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:12⤵PID:1008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4548 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:12⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5024 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:12⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5564 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:12⤵PID:4028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4232 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:12⤵PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3000 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:12⤵PID:4496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3064 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5860 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5088 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:12⤵PID:1312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3036 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4360 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:2128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1756 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5772 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:4888
-
-
C:\Users\Admin\Downloads\iVCam_x64_v7.3.3.exe"C:\Users\Admin\Downloads\iVCam_x64_v7.3.3.exe"2⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\is-MDPII.tmp\iVCam_x64_v7.3.3.tmp"C:\Users\Admin\AppData\Local\Temp\is-MDPII.tmp\iVCam_x64_v7.3.3.tmp" /SL5="$50168,46076563,321024,C:\Users\Admin\Downloads\iVCam_x64_v7.3.3.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4524 -
C:\Windows\system32\msiexec.exe"msiexec.exe" /i "C:\Program Files\e2eSoft\iVCam\Bonjour.msi" /qn /quiet4⤵PID:2988
-
-
C:\Program Files\e2eSoft\iVCam\devcon.exe"C:\Program Files\e2eSoft\iVCam\devcon.exe" install driver\iVCam.inf iVCamDevice4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3024
-
-
C:\Program Files\e2eSoft\iVCam\devcon.exe"C:\Program Files\e2eSoft\iVCam\devcon.exe" install driver_mic\iVCamAud.inf {SW}\{87CBEC3E-E0E3-44E1-A852-FFCD02450D2B}4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3084
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 --field-trial-handle=1904,i,10862671293627102178,16963917004436402286,131072 /prefetch:82⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4112
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1756
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2044 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 270DC7039DB33C9CE51C8F77100BC1F62⤵
- Loads dropped DLL
PID:680
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 67421B72A06121A960C0BBF47B84B13A2⤵
- Loads dropped DLL
PID:2796
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 093E25D522D8056ED27DE77CCEBD7B99 E Global\MSI00002⤵
- Loads dropped DLL
PID:1624
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"2⤵
- Loads dropped DLL
PID:4112
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"2⤵
- Loads dropped DLL
PID:2128
-
-
C:\Program Files\Bonjour\mDNSResponder.exe"C:\Program Files\Bonjour\mDNSResponder.exe"1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:2924
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1412 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{590d49f2-4634-f74c-b299-d09a0649d32c}\ivcam.inf" "9" "44ef8cb23" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "c:\program files\e2esoft\ivcam\driver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1568
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\IMAGE\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce884ba3b39ed:iVCam.NTamd64:3.1.0.185:ivcamdevice," "44ef8cb23" "000000000000014C"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4644
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4be9ab0c-bc95-9b48-bddc-5e3de230dcd0}\ivcamaud.inf" "9" "45df85a97" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files\e2esoft\ivcam\driver_mic"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3584
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca112759a6d3:E2ESOFT_VAUDIODRV.NTAMD64:1.2.0.158:{sw}\{87cbec3e-e0e3-44e1-a852-ffcd02450d2b}," "45df85a97" "0000000000000174"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3648
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:1108
-
C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe"C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe" C:\Users\Public\Desktop\iVCam.lnk1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3856 -
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SendNotifyMessage
PID:4196 -
C:\Program Files\e2eSoft\iVCam\adb\adb.exe"C:\Program Files\e2eSoft\iVCam\adb\adb.exe" kill-server3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788
-
-
-
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SendNotifyMessage
PID:3280
-
-
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:4100 -
C:\Program Files\e2eSoft\iVCam\adb\adb.exe"C:\Program Files\e2eSoft\iVCam\adb\adb.exe" kill-server2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232
-
-
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe" /restart2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
PID:3268 -
C:\Program Files\e2eSoft\iVCam\adb\adb.exe"C:\Program Files\e2eSoft\iVCam\adb\adb.exe" kill-server3⤵
- Executes dropped EXE
PID:3620
-
-
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe" /restart3⤵
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
PID:4580 -
C:\Program Files\e2eSoft\iVCam\adb\adb.exe"C:\Program Files\e2eSoft\iVCam\adb\adb.exe" kill-server4⤵
- Executes dropped EXE
PID:1444
-
-
-
-
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4124
-
C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe"C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe" C:\Users\Admin\Desktop\iVCam.lnk1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2324 -
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"2⤵
- Executes dropped EXE
PID:4524
-
-
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"2⤵
- Executes dropped EXE
PID:4652
-
-
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"2⤵
- Executes dropped EXE
PID:1652
-
-
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"2⤵
- Executes dropped EXE
PID:2268
-
-
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"2⤵
- Executes dropped EXE
PID:5052
-
-
C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe"C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe" C:\Users\Admin\Desktop\iVCam.lnk1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2472 -
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"2⤵
- Executes dropped EXE
PID:4724
-
-
C:\Program Files\e2eSoft\iVCam\iVCam.exe"C:\Program Files\e2eSoft\iVCam\iVCam.exe"2⤵
- Executes dropped EXE
PID:4036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:4172 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff85ef1ab58,0x7ff85ef1ab68,0x7ff85ef1ab782⤵PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:22⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:12⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:12⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4400 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:12⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:1800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4792 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:12⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4752 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3236 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4388 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2736 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4768 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:12⤵PID:1040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3992 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4964 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:12⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=244 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:22⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=1268 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:12⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4272 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:12⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5588 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:12⤵PID:1376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5560 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5492 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:12⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 --field-trial-handle=1856,i,2289507293516985769,3270461735003822735,131072 /prefetch:82⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4492
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_termoimpianti_pro.zip\termoimpianti_pro\Informazioni.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3848
-
C:\Users\Admin\Desktop\Termoimpianti_Pro_Demo_Setup.exe"C:\Users\Admin\Desktop\Termoimpianti_Pro_Demo_Setup.exe"1⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\is-C99EC.tmp\Termoimpianti_Pro_Demo_Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-C99EC.tmp\Termoimpianti_Pro_Demo_Setup.tmp" /SL5="$5026C,9162121,53248,C:\Users\Admin\Desktop\Termoimpianti_Pro_Demo_Setup.exe"2⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe"C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe"3⤵
- Executes dropped EXE
PID:3100
-
-
-
C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe"C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe"1⤵
- Executes dropped EXE
PID:752
-
C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe"C:\Users\Admin\Desktop\New folder\release\x64\x64dbg.exe" "C:\Users\Public\Desktop\Termoimpianti Pro 4.0 Demo.lnk"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1888
-
C:\Users\Admin\Desktop\New folder\release\x32\x32dbg.exe"C:\Users\Admin\Desktop\New folder\release\x32\x32dbg.exe" "C:\Users\Public\Desktop\Termoimpianti Pro 4.0 Demo.lnk"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2396 -
C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe"C:\Users\Public\Termoimpianti Pro 4.0 Demo\Termoimpianti.exe"2⤵
- Executes dropped EXE
PID:4528
-
-
C:\Users\Admin\Desktop\New folder (2)\die.exe"C:\Users\Admin\Desktop\New folder (2)\die.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4028
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD59e73d259bfbf16ac47aba0c6d41337dc
SHA12417a0401b0e8a2d4dd12e9f7589bfc8578691ec
SHA256cfa993d2f4b6c3b8598cf48c58d4b3700d1e467c15612d769051210acd89b9f1
SHA51274d3b8b960480f8f3e138e9ca5b32548516dba4b878281f26b1d4ecbd075d2d9872f0cc4cabfecc75b202b106f809c26c69c7140445906e56bf746f886c97485
-
Filesize
381KB
MD55ea9c80f18cbc393ea7d9a2991ded4b5
SHA1b8917c5ae45d1ba5ca534058f1386fac92f5da63
SHA2567e5eb1ce44febe93686174058d51581fa00bdff0ebb84bd74bc08f6386019253
SHA5127fd949b792a40630ca385dd2bc88db9673f9106975b9f55481e2382f67986dd75b03cdf0fbf59846b513a8def0c506ac6561f6ba658775286f11d761b575513a
-
Filesize
119KB
MD5f6d02735de16705c1ebe6429592cd355
SHA1c6ee693de2c01cad34012471b70d87869969a0cb
SHA256356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4
SHA5121e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13
-
Filesize
451KB
MD5b5c2f92ee1106dfe7bb1cce4d35b6037
SHA131070ef84c5355b082873ffc19ff60659637995f
SHA256e399c390687589194d8aad385055f0cfa7d52ad9e837d8ff95008b8eb2b34e50
SHA5127f82752b271ee35bad31a8571ae33b8cc83ef48f41937297dfc446f6f9b12da3d8b8336a527f6bbc5bc3c6627deadbd38a5f109b16c7d1386a3db36742c5a9c7
-
Filesize
130KB
MD5eaaa2b83c4764fdcfbee4a4d6546de92
SHA1961a7e7735ee8f07ca54fa7cbfb23399748f8174
SHA256043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b
SHA512bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3
-
Filesize
17KB
MD5ce9a2f5a7fcfff341d6d901ad919a2ab
SHA1341f9d9a0b3fd8cfbefe0169b148dcc55688ee93
SHA256cc36a44467f41cf2dc91c126e368e357b28a0d57101472d2dfd1c06a4091cdf7
SHA5121f53e652b042ee27fe05b11ccda2ed9ae9a8f44b948b8658aa7a2d7ad2f5bd94ea16f3d9a92e65a8c65b7480517f1d05a066a4fb8d961b927d0d305399ca4e8f
-
Filesize
2.6MB
MD586e2b390629665fbc20e06dfbf01a48f
SHA1d9f4697a6f4eceea24735822cb1df501268ca0b0
SHA25646e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1
SHA51205ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea
-
Filesize
80KB
MD5f40af690c8c4ef25e7774889c574743d
SHA1a559f9be11692178897e29bb5b077a7fa21dc74b
SHA256e830b1266010bb56807c5330e4b720ed82a7a78f557a69eaa4594439b7912fdd
SHA5125ef5e1c0528c4558c932857088c60b3fe512d856edfb39d7a935065c8b4d0c57728fbf804adc3c1e4438ee6646f428a06f578d8cebf422341fb9b1397c90a0d8
-
Filesize
7KB
MD5047290efd60f712d012883bde88e2721
SHA1681d7dd7ff45904c98ffd856bcd9c5093c3b8d50
SHA25623b3dd1cc59cee29c7f6eb89cf1824956113f247c3c90987fa19264d673e335e
SHA512cf5c39ce2bac0185213087ea9b75bef21ee4646d477a74ec9134157c30d37ddb47d219304176e541f93455949559169c3adafb98fbc3f2db29d02818d0e2113f
-
Filesize
3.2MB
MD5dde13355f57399a93a04ceb01f488450
SHA1de5577a9a969d55db1372cba278e22e22bd37315
SHA256d968dbe3bdeb0e8cdea39c5bd2deaab31add32ef9060b6b1f85b6e33a44e37dd
SHA512fee68a6c9c0cf61596142c8669708a84306af2a51ac37413087e2b21467e6dcb8d33f9dfc86eea1dcba4c10b94f14c570a8665ba92603e8debcbdedbc7a96b8e
-
Filesize
40B
MD52e622239aaff6d778c494fea97908109
SHA1aec335887bd43376554850d99955f5f5ae82a8e6
SHA256e3ba21a0ca61fcca7a8d22d7002f79a4d7a5435f017349601826e99a144ccdd5
SHA5124aa5c77f40a0f507f61163f63af8d1ed5d21c220c5666488a4cf4d2ca9d5cf965dddc2687eba4c61a732e07b269aebf4c5477c262b2bccdce1b15954d5a5ec80
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
Filesize
19KB
MD5f6c5f91182d258e81425b5814913051b
SHA1b82c9fa9215cc431995b0d5a6a74f44945a8c008
SHA2566978a3d3b264438b44353c188da1097721f8ae6bd6c42756f130de64b1034731
SHA5122cca8e44477ab360a5bd7ca0af4e12e54714577e9edab90f7e0fbf079e81e15229f7e08419dc7f839a2cb00129211cc837df2c5da97a346e7c8db9fa174f8da7
-
Filesize
33KB
MD5bd2a7d3944f0756e7bf4f71d45e91137
SHA1a09cef4cd8fd1fac5ac5a20c29f744436f25e227
SHA256a753d3d4d9acc09e00ea4c120515e5894b29ef0c6e36404b4bfa3a53bc41033f
SHA512e4901b565ccfdb6a3d60bfa5c3de7f9e456f36e3f707cf594a185ecc65f9bb54ee0ae74d77a21504741af71b8614b08a15d23e0b0d683c67512e96d9293c32f4
-
Filesize
59KB
MD56605246a239ba92340fd9bffcbbbe56c
SHA14f800e926a3e78cc405f8ce2e2ea2541f61c5d19
SHA256f4126432a558c17d96906cf98fb9dcd53a783cdc120ba33c3f346878794f3566
SHA512c7a9f0671d87025f8be35594f021de1b739d9bbdb3b1ec3f9aab330bdad78c1c9bf77c14fe63b45835f396005abe2be200fc89cb50a4e36763a0805cceb1ee2a
-
Filesize
27KB
MD59c74c1c6a1a51ff845f9abab8abe7e0d
SHA1657dcb20b01ffe4425503006d42610b3863a8507
SHA2566cc7741d4c19ff5bb130eb7af69ce8bf0b797d82f0832c770c23f43a55faa97d
SHA5124c6ff59b681bc6a707ef87b2af14116983c0c4156560e9127af7eda7a43cc7042c351955499e245cbbf37eac78bc08943ce8ee81ac600fae2b91c0f265620682
-
Filesize
64KB
MD5717e44bb4a259b9ee4a600bd4f2f2372
SHA1f08b1dd3e44d5057d6cb942febd1382969f9d605
SHA25645714612acf08d73a7b594609387b1547add832ed6289a56dd355d3d41199525
SHA5124a9a93d7d66dc91868ac0d330a645a6a08d35995642888e553ea3390aeb4b783ee9d81eb2b7a61943ad1f44eeabf1920ad33a407a8f4b37e29e6fac9ae03de8e
-
Filesize
121KB
MD54d160f5c1032115a43b6687dece5bf12
SHA14f1b00870968aec41d24ddea501f4125dbfbc37f
SHA2568c238cde58cc54693edd7d4dabb4a4cb5b761b44fb84de1187095698d26aec28
SHA5124da361a77e73c68629cf1f3fc097c7ece1166b588eeaac2953e18ae17aa04b0de6901dc9b32966015cf2f27eba36dbb487d51e7d676eb474fb338818ffc63af0
-
Filesize
191KB
MD5fddf30eed0ee94f6d6e24949c6328ec0
SHA18642f26785eab0e7923e7ac57723b45aaeeb2556
SHA25686a1c62fe399115e7fba10f7bbe80a501ec16046ae526717a2ac80da36ae1003
SHA51269b9d5e92229257cb97ad42761b4adb65c40440524408cf16c330537ceb956be0bb787e85007de6ba69bd22d0f5c68c39c275166233d85526f54eab843f6cdbd
-
Filesize
5KB
MD58d36a3238cb508d5475f2ec0c16c1ee1
SHA12b25d8c202b457aeded8bba3c88558483c17b018
SHA256446c66b8226827ae2be2a479cc970771ede7951060c01634f5ee25fd068dc707
SHA512e62318d44ff7ab7c91e1a69aa191ccf311addde669c8bcd6cb62ae0d97ce8ff5af033e9ce113c2269e6a881cb5eecd14802a2a07f9fdfe663934e3fa8ea119b8
-
Filesize
2KB
MD5b17322593b8a5507c335aacb8d350859
SHA103e6e1d05242735c142e27ada54e1c3e78142a72
SHA2563180b8ba53204b9bef728b9962a205995afacf12e12ebbe588367e0a97aa244f
SHA5120292faf8f270a5321426287f60b81f26f5db360fecb345df3a75d1cdf7d853c23e5b9be7073dc634bc58c22aec264ebc28b8ffabd2f5cd890aa7910ca24154c1
-
Filesize
4KB
MD531020b381d6f6c86af46ec8dbf84df11
SHA18748211ba4becd2f955a14d7ec142e79f10264d5
SHA256f4dfa450be12bb620ddd7c03ceb45f34e18132ccaac814dcc2ea7395bc53d3dd
SHA51213eb97243f05323009ae4bb75459e9eb3ffede27e2da9d394ee007d143579ae8cc6e80cc69f9c2919f20b6081d9cd2717f8005140df646fa74f1da0f9c0aabe4
-
Filesize
5KB
MD5e05f6172c3b9a7b184e90a4971e5bf3d
SHA101bf7e7876c2bc32df7601fcb0e5ddda0af9544a
SHA256efe15a608be644b71e66f51962c9e2e4f691414d9fc80e0d0a1b14305a4e5db9
SHA512c9aac191df2f658cfb280609334b1e388b7d95d0f609b7800315f0a7e12da3090baf342981e7c6aa7114ebce9e5710b2c8254598a6bb33ca3966a36a92988ee9
-
Filesize
264KB
MD5b3c8d14c3b947531815ef195531f8ef9
SHA193c0101406c8fdba61cdf85d1723a12d17b29506
SHA256c8157454e1ffa742a6ccee12c8a4df338e9cfdf51b38e45eefdf5989b53bf618
SHA5129b44ab41ea1fb0217125fb2a5c0c39221a8f7e2302ef84ce0ec24d5c85df8c2b5e7f8fe4741f28c5a5e2e92ac57bd27cb156a6d92ce7320c6f85a41976064480
-
Filesize
1KB
MD5706896abf9bff42691957b07e054c706
SHA181359d3a7bb8e3009266dc579fac5bd99c2a9ab6
SHA256e1122724329205d1d10c6d42466652a26c031a9af419fb6a57e1c4d97f210b4c
SHA5122457cc6b5634e0712e262ea3f704ffa1322e0a2fdae4c48e0f673b1e91b79ac2bca27d7911af586f0a445bf1d9f6ae48daf26587da63a2507bdf1a0e99e1f55d
-
Filesize
3KB
MD569087e3a8d7d94ce6df483c3864c1ce8
SHA1fad09a2a56336753c3c89e7b3fa9e8431a3b6d4c
SHA25670f35033f66ff7573c5359acb1601c8169988fc022e03de6bce49304f05b2582
SHA512b074de71e8f62aabc0feabd06229ab7178d5ef4ef80b2fff6284121ec6b283e7763be25f601e2b9ad532defbd491044bc1bca356690034dfb0abbabe382dc443
-
Filesize
5KB
MD5611bed384b41f6f675cb01fd356c9895
SHA14843f10aa163114f070d06793299784e373ec208
SHA2562f978d13abde15df19cfc76d780bfd7092cf21c7b28c114132cb91f12066fabd
SHA512b6b97aef02a1ee789a8976aa57b7dc3151665f00b0b14c157150a485d21bb2af3963e53d762cdc73221851cc40d0e66db93248f9f31691bf68b057fbbe0098a9
-
Filesize
5KB
MD5115df14070943aea9865083354ee355f
SHA1b0d7df43bb5aff4377275e94f95bba1f19920191
SHA25614a5eecc87b93f4b513e16c128d4d5dc53959448d0c3223942ac577f5a957bc5
SHA5122e7b492209ba99a33bef6912a5c69d87a327b20540db526f554c197976d294dcc06160e3f9d5c4e02bce47d9934fa9a30845fcf67a0a2afa181e52db4af8ff2f
-
Filesize
1KB
MD53435689f67c43b011e09c89ee2b81da0
SHA11a3e9fe2b898f5279b18b29c7fe1ea0e795e394c
SHA25686588da8b9abba45ece681eaa54c5762d8fbd7fb2204f3aa7a7790e7ae634ddb
SHA51289cd578a863c329668d57def883f49590c24ab94bf0a909c57a4836c4938a8c10938e9ba2a53daa93599861a8b50259f97fbf0004c24e47faaddc2533b38dced
-
Filesize
5KB
MD59c2bf9ab029bf447dc992d7ae7ac66cd
SHA1f5afcc7d75744bd8b0d6e0e0b74b3fb4da569d97
SHA256b3bcd8f91d8c2de8fbee0e480895060b6f89c7494246fd80c112be4d6ac3880c
SHA512088650ae7e322e0b7acaf6c5e5eb50c6a91f5e8129dbae81994dc157079aff221fb6b9c10e5a2d619a825c0e1e2e3738c0ec3418e297d5b25811f09a1dcc7013
-
Filesize
5KB
MD5870a204c9cd54b3d8066325120970258
SHA1e409943e08768e2c728db257066d7e8af5e38c9d
SHA256bc24c1c42bb0c184615af084574a7ecaa4fad6f1d6e670528f1c28150565e714
SHA51221beae8abb78539c99d6ffe420878eeb60c0c98a3eb18ed0edc2663449cf00053f4b22c71cf1c182057a4acbb9981cc5c673f39fcdfd61810f7e82acc5d9f492
-
Filesize
5KB
MD5808a1ae0e541bbc59c5ec64888313591
SHA187f3cf8d1014f212c324c0141948783227349567
SHA256de6670ab1326d6001490918ad0c4d68c59994a9a7c60561e33634fbd9131933c
SHA51232800e392abeb68c4e1b00899ad9c631b9050745acffd9906903a0bc2865ee108c7440ba85b7566d7b7677cd800c649f573aeef75b23cd353a63122d4a95d042
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5f5ea32935a9540efdbc1d8b7739ea29c
SHA121526ea720c7b0205fe0cf20ea98a918780e4a70
SHA256ff289de496a0a1302de25ed960869c2deeb14042d0200669189467294a1a669a
SHA512e48ff1d4974a775a586c53d68a2bb614b6cbf71cad26599483ebe5bb15fa81a1b14eba07103c113b3b676718d582ff2402ff2531f851e816204ca9b5f9a44b82
-
Filesize
1KB
MD56e7a99324fa33aa39e467946f3803a85
SHA152ce0c1385dcb7a117b5e9be1873c3da070b1d94
SHA2560f2e6e19bd7d0e579ca34552e54cfcf3e4d1fdcac6c6be53d501bd2448fb8789
SHA5124600b2410a23a355aacb18eb1bbde2c0c481adf86afa1d92e23c1de90a7f8d17d7ace09a18e9bcff9fd7196346949fa90e79a2b07f7494e9bd99bcc2b5cd38a8
-
Filesize
1KB
MD5094afc7c8eca522ae630f6d4e38195c9
SHA137cd0e0c45955469125484774f97309d403fce08
SHA256d76dfec9fda655a55bc99e04b1a6392799444f2fc7ee36cd4c72b7020a517329
SHA51287583bcbd1b0c0af433143ffe4ccf9688a40d239612fc8c41e3ad4fb9c510c1c40d087ebdf8d8c79dbabab179f6a878672873beae9fc5aea3eff265dc79d4ee0
-
Filesize
1KB
MD53d5d5b4366dbf7f8ce0b4ecc5f987d1e
SHA130e6a46979cc9690a1a7f26867b8c14d493fc519
SHA256a9006816d4a1f3904f486f46637e20c2588434509e936aa931062b36ce3dd317
SHA512310cfc7b5cd1f73757e4510e9c4bc44ff3727b6daf595d7e21b4d266a4be5000afa8620807a8dc47812fb23b40e4a2dad4105d9d230a421c8544f5382a0b0b4c
-
Filesize
1KB
MD5562eb1d005d980fdde0709c22a524eaa
SHA1d706647df1d97135a2869c813095adfeadb6ee68
SHA25680a0f8e85c297430f474963336ce038b279fcda1f5641715e0fde6b4560223f5
SHA512bd087687842899060879a0c3e3563370bd4adc8b4e5b68d1a9fb43dfa7149d67293d06d5bdaef74761131fe70f27773c474c0212b3dc93b77a5f3abe181eb39b
-
Filesize
2KB
MD5398d0722bac4a9cf888cf6cbe7c41036
SHA1e5f9a213ff16aacb004a081850a2e7f9eea945bd
SHA256ad8a7b77c78e2e8b91ac8c69b0982508ce3b6ea63931e7be2f4cc60108ea0047
SHA51280a18f80912449aa57c5cb7f93cafad9f10fd0aab514b1901c19e1ef24a755e2511404d520721fa65e5bf80bb9916337a088fa91bf335011cf9ad218399526c1
-
Filesize
2KB
MD55521fbc0c3e1049428de97ab80c4d4c8
SHA1cf23d1a69a5f5b0f69c95ec110d923a48979fbc7
SHA256e5fac08bd5f49887166f5d2616cd00925591217105469cd14caaa2087d1e0576
SHA51282db747924e1638c9d08b79f0c2fb0d845bc852fa68f94fa942a1cec71272b19b54af6643d2c92c301b3bb574c0aad6dc954aa401f4b14a18e737006bdeec0b4
-
Filesize
2KB
MD55061109050d28c5edc79a5ac508f8a5c
SHA11f97c02909167f064232a50bd637e334b31acae7
SHA25634393c58cd2736a219628b6d87c9bb722b8c199111912044e5e76bd4adf6881c
SHA51258674f1264bcd54cd09ffbd1d19561feb6ff350a2095da1eb4ea35708042434297e290db05b217dc524793c2aabff1b2cc61cf33f0ade4651a250f49be8bb891
-
Filesize
2KB
MD574be4e4d2b48ab0edebb66f366450d97
SHA13bf7c344b5d3760ddb792dbe1853ad40a95c8917
SHA25609513e2421654bc71f2591964776f104f714ad14c9b6074a7148a14aaf7a8f15
SHA51200cca64bfc0a7bb28956b7e2abc279b38d6681f37d84e274d108f3929d378965ca8f853e840b3755b8551f219d49c4253363ff25ff131acde35ab07dbb05e143
-
Filesize
2KB
MD5b16f45be659c3d9048df412568c76a33
SHA12518754a88932336993e67253d6c88c0e754d089
SHA25642197863faf5869345f262f32006873dde131824fffdbc4c798dfb7ed6d6e414
SHA51296b1f0765e39294ddda100c36d115a42cdabda0e7ceed4d2973f20c2175fa9d262a5b6ce1db4db801da1e13a939d7f5aed92887eac99243ee825c746c21ca4d8
-
Filesize
2KB
MD58a76ad3949a8dea0dc0e1e7c9eabf05e
SHA1789620b7f85feb5a9167d29652ab950e423956cb
SHA256d4869355843a4002c6b603f10f1344534ca07dcf62a366614d6123cb963a158e
SHA51285da07243f44a896d3ee00dfb862ebf3e07a1e8288bb074a46cfbd4f5c0dc82125dff190d12a05994deaf528bab0221f0b57ec228b2c175c264d77e5bd51b6c2
-
Filesize
2KB
MD5fd308390aca661007dbc42e5893dbea8
SHA134a271efe703b2536f6c14501e09a14f5d2a7193
SHA256682d09d5b46205d9165451339cb9528d321e1403761e1237b5da4e5d2f789b65
SHA512aad6dbb257260c68586a6344ba8f5d24b1a5dbed7ceaf54cc1772cdadc4f2da0e979de14ae81e1554f8da471a14cee2c6d683f21f27b5d39f4983cc26e43b64c
-
Filesize
2KB
MD5a65f991cabb8f9ac27f2953fd32b282f
SHA1f3f5ef892310c83254b0bfa01c165e141da08774
SHA2566273c8ef876ed28fdb8d076d1d76cdaa66b39a694872b43434c67cca683ca53d
SHA5125567d9a222bb063d42d971870ec653fbfcded80c2e8e43b9600eb1f56d8b161f79fc4800cecfb598bee7b54fa3fa81d6bf3552c9d3c763ee1d8bc8839773ef54
-
Filesize
7KB
MD5982aa37f7afb1ec1ca50aeff15b786b6
SHA189722967c5377b8dd91d68d50fa97674966a64f8
SHA2568e566c70e123a226d0dae7416bff4f6514e427d30dc56cb169a34fd89e650c6e
SHA5128a37c6b9fecbd0d8a9966540555946b7f9029137696c27d1f428295ded3e17c4b4fdabc7459dfefea00eb9564fc131d973e6ff49c6562e5a330ad29d8ace7e91
-
Filesize
6KB
MD5a0a9eb3bd3d354785c3429b027b59e06
SHA1faa93f4a208c295d9981550d2f23e233c4f524e6
SHA25646b86fac6c29389e894ec2befb0dd29279b42c36d0d142591313f2da8fd0fe5f
SHA512f49bcc920b6dbffee1447b049909325cc8b010477728071d8de07c370cf2e8fbd25ac9e4db6e97b9cfd270ed75aa8293bd7c448947b0ecdd188bffbc731385a5
-
Filesize
8KB
MD5dc01928e9671e704f94f2a9740e9f9c1
SHA14ff3d6b96c5abd9912745d793ae75708f22dd777
SHA256d1b6fbd3d6b7979810d0c1027d8e991fb1ba88f3913d6bf857e7397626f3155d
SHA512663c0e3eab76d662d0d90b5b0969e7850422491a8e1c227a035d0edf80c21188293889fece6790871d15117e01dd17a098a118e80ffc3461ef16900536b62dc8
-
Filesize
8KB
MD5c94acf9ca1da2f939062407275eab3ff
SHA1d42f27594bf8862fce833f492078c05049c1dc22
SHA256316f396222963552523140c81d9cafe47baba4d7ff37a80b8bc87fa87de50f5e
SHA5127712ae14e533b9124bca731a719b4846e6829f9f89f2edebb968de3ef715e6454fcf1e03f7747f2519eef8f56e4353796ea6c5060ecb12c13ad83f67d858e9b2
-
Filesize
8KB
MD5ef00e817c4024fac7b60a8c3b2f9e080
SHA1eec9417f651f003bef63cfc6718c7128a765cfef
SHA256927fbe948c6cf44730313e58127b22ec2ce923988251fd3050aec08a76c61165
SHA5126da1a80a81b9e5ea2d649bd444ed6c65aa2e9d931e0dbe6404fe718822744014088468e7bf170014179971a2a71ff03f3d7b278122aaf8597d5cea12cda925eb
-
Filesize
8KB
MD55f56f0399aeda78bc8410afd924d3fb8
SHA10366283840fb9d02af91baa65068955bd61b0d4a
SHA2565c8dbca662dba409d332aee1566dbda477201c7a56c377692ae2078328fcdc98
SHA51211aeb376b7dd05e6ba01eacae2eeb87fbe8066cdec50a5ced52938cb88fbe9314eef58786e4eb5e8efa6a1f84d0eafb3ae9775b0da4e53bd1db052ebca8ac74f
-
Filesize
7KB
MD55361dfd87e1b981841f707ae321501a4
SHA17b0076d06e72d17535aee602ba29a610db9d8697
SHA256f72546f710029f5b865efcf1dd6c806cba1e8c3c77b25e86f62ffb16263b63c7
SHA512764b07f0d8fa9a21eef91474d194aad893482353fc4243117c6fd3417bfd14cbf6a4df443f63e49e68ce6f7636f035c795bca644c394a78f7d2ec017084b958c
-
Filesize
7KB
MD55f10626432a7f90386ec96afe06f75c0
SHA13d6b5e78c3c16644c2fe68cbfb3c235c65b0391e
SHA256801f46255b7fafe87387b6cf5211cdaa597923acc8b4072d0b468b568c463776
SHA51263ff2bfcad0b42ebb90bdae3f74c77680ad99220ce9726a1b543e60dccb485adfd98dc4d80cf831f2f5b9e5736d5b4c18422042772187cf0b58a655e45b09829
-
Filesize
7KB
MD534f3f9fcc38396608c0f1796ff1f44d9
SHA110bed2aeab49ef985f66fabe98a1d07be928b402
SHA2560d6b818b7dbedc47167e3349ed7e17049e697caac2f02a75f4ef99fdd776d641
SHA51246a3e6b5375785e9357b6775508c1ccdadcb74a984fa0fee4742b436983a6ae7c3a0fe9bcc494a56aa1f19218609200f356e1bd95332a201a2fcc006a66b3969
-
Filesize
8KB
MD55d15ebbaddaf1fdd3ce3b24419158a85
SHA1b1eb35047b74303fe1c561443a88e514b65ebe88
SHA2567adf11a709699b6d77b67ed0590a6e9a044473a7fb735ea6ca2765886f825e15
SHA512d03ad81e61459ccd3e8991969fccc21df82000ba8fb13ceac581c51878c84d2499dad3c347b6113c5e44f3eb486e01cadd343e854bbf02ae4e5ccad0314d91cd
-
Filesize
7KB
MD55ed864d288f7fce6a01dcb3437dc88da
SHA1bad51d1d278d4883fc02239b46b93616567166c9
SHA2566f116f87b39ba8288cf61e1f638acae5fa21bd195582f5dea26bc7336c819674
SHA5124decad190c1e2520fae1d5f874120534415256a55f53aafee2455af9ceeffe18a969b46fe55e0d56d7cb9c47648ca49292f491edd7d4768a71024845b59f2fcd
-
Filesize
7KB
MD5c7b5bda5918954b9e17c8c609640efa1
SHA1cb587cc27d5a1644b9f9002c3085ed14314a49b3
SHA25690a7f7b66027972f7a6d4ee01e045286608898ae0144c0b64eb51fbc81bf0373
SHA512c91201fff871358e314d46f1551ae64ffdfd315192c52f32171e61a1801720f1d8c7c760c5696f27bc7c6fec78b1c68751a5c088870d3e4cf5ccfc22f81a71df
-
Filesize
8KB
MD553cd14189b3083123ddfb30294d8783f
SHA17ce953983c96a22b256e3a8dcc3847049def0eb6
SHA2568cf137c934711fc9ff38aef5f0b49140c7e7ba90682c63b83e822d37b64c3b93
SHA51202164ae977297dd440e919d63e6a0d6f66bdad7803b9182ef01a7799f272363c5e7c17734547dad24aa1bdb9c06607a9e0548dbe70f8c034f749e0a2d27f48a4
-
Filesize
8KB
MD520b9ff1939595a6a50b037b764d80b01
SHA193b853edd0086eaffa26735c6e33091f4c650e4d
SHA2565f3aaaa417a026d45cad971131795c241b4ede50556821d47300f033b1653e42
SHA51253e7637111ffcad8e63bd2b84791efdcd184c6208ffb222a3d0f6e08631a0f5e8d6abb451ef280a73903db94cf634cfe6bd5a6a3ad427e5a8ef1be24d8b7d167
-
Filesize
8KB
MD59de1103a90eb47ae076c4632240bbec8
SHA1e86ac47b4420fb198302f30459d1a31d1f4e3723
SHA256296c8aceb32043f3e6ff225a3a6538f4422066efb803ef91642cc3eb89f97ac5
SHA512afd2b4d5863b541be55ec28e55d8bb7a7e6288ad665b78254953a1469a67687c5b50e00dddc9930507e87851daf1c8da920c4ae2f5843bcb15222aa6d8b67c81
-
Filesize
16KB
MD508077c5488fe1d109324be103bc11283
SHA11f909452ba0bf9b218afa49e7090ebe6edd6c365
SHA256a011afcea695307eeecfb838e4129bb996fb7cf046ad2a609626fc821056c3c7
SHA512d1d40b3875d9aab72b55b81a0dc33642f0ea4756cb3da8f9bdba05a254b4405985744ed86f16b43a544b9e073cf9d72ba2fb9dc814a8b92d7117400247a9cb85
-
Filesize
146KB
MD5ac2779f102cb2756014701a2c9312616
SHA167c20178ae256150dde02d64906756947b70357a
SHA25626ef40d86c30dec5b9bbad7628bef6a6d947e43484ccc86fb7d39a0bf405fc65
SHA5129af0e930d25f2196b2c5f7e9acea23bcf9670091f07680960d49e1946b9ffc8b94ba1e4f8179535600c00366c4e13615c95eb8c0012741d280acb7e3ea941f0c
-
Filesize
146KB
MD5cefee2fe40d3762259b77723ba9dad3d
SHA1c82cfe6399bbedf87cb06bc67af225923873cf0e
SHA2567400821241d38cb201262b07172ed2633c44f99b026ea21336493cd4de4beab9
SHA512e6b5e9c4941637ed38ab1fc63bd023a7b457a83dd5d263d8ea8b13acd433f8d68c440f07cd39fb074527c204babca1afb273a621d52ac42adc4b09658e6154fd
-
Filesize
146KB
MD512660ebc6eb8f3ee7a2ad149e42b15e7
SHA1615fcf7a87e66fbcbf9cb0e98bf644e3ad4da346
SHA2565f9fe902baecf7f801e62e5c92186db8c5c77b7f1bcc09fa1f1d528a0a25a651
SHA5126dd656c1d18f466d8b580827b43a7a28eb40546a888936e9a7304a30d82c446f502707d1ee94e23b5aead09d7800ec1b99350d5267e8a4ebd3f7fedb5f2e94eb
-
Filesize
146KB
MD56ac73205e2a945289173043ccd9d70a3
SHA1c70b49bc095b02b99ccf2d6362a5feeaa81960fb
SHA256d9b0470d2d7346245eb1ba29712bf71bab23a51cb5aac6ac09345d01428b27e8
SHA512acc5ef767e664891bb896830697f6f54b630fe850b55239afdf32b081bf192ba369b0d8df946362cdd3de53d691e79cfc63fce264953033eb0424f48d7404b5b
-
Filesize
306KB
MD5a211daab04a5339d7e7c7f00850e9b89
SHA1ab58fba187e19195f15f6f66982dceeb27b533e6
SHA25644cbe1b260578c279222c7d846db0a433e4e25c3bf75962d224827594cf3d111
SHA51213809838d82509b79efba7297320d20c1a290f1f252c9947fe040a71a907156ad78e48dc68f118f9576cad118008c1e2570ec6108f511beb1cd2395d45e32cb6
-
Filesize
287KB
MD554c4b5187895c8a9afac5024714ec74c
SHA1719ddb8962aa648e114191b78a4af741f4fecfcc
SHA256267d19bb9b149b9265259292e5a880a5b59448293517faf5ba68d60ac14a4b6b
SHA5126d34afe80b1ab68cc9a811a44bf4890ecbf02307e5b0a871b9d92254a6a13fe3b31a9dd2a976c912ef8e4886fee00fadf65f91f5338c07c08ec3b75ae611d1bd
-
Filesize
287KB
MD5e321c1a93c17dbda7c87f95f53ad7a95
SHA1a68bf54d8bfa2850b6145b02c9c016a9ebb2f367
SHA2561f966c861a114dddc20e0d6885235b7a4d018c6c1561195cfb5d28b69e407e5c
SHA512156605e0f2bd5ae5d204ad2a73d3c7f8ce5a1c8696fed28b500e99f3c967e130b3175ad8143fdd6dbe31e4cdc7b7ae32f36fd2de5bf2b9084fbc798d8b477f4d
-
Filesize
167KB
MD559f4cb5bdbc5eab6f5491422b034945f
SHA1afb4f87c4a5a852348a7c2d8e498e3619f519ca3
SHA256be56828987314ff90654f504ab1aa2b039a93d4a8d5db373c6d9be4056e35387
SHA512accb4653f6fdc5fb3cb039eed55cbaca050e3a24a8b8af6ba75220a6a1845d8629289d49ffb7d13ab92dfa8409cf4028e5fe57f49534ffcfb4f0c55f91c0cd9b
-
Filesize
146KB
MD57425943a71110f67e8e942a677232b51
SHA133c761461532c40aff6646ae8b6ffd7f1b67ef37
SHA25676765bb8e1eabdee7c4fc3d23e7ad2e0fe4c3a6bb25a94575417a396bb1556b4
SHA51252c1b504004197d7f8b6597a9bd5684322780f997c77eb43d7861f8a7634b4a61a9d7a73c180efc0004843a3110670b122f26916352a23c923251dcef0501383
-
Filesize
166KB
MD5604c18e9229d46e62d9b34f783a7a108
SHA1253cea5919c3d7d292f3a0422404f20bd4c67a06
SHA2568bcb4f5b462107a86b0845e472ec45fa6efdd84953972dcf47f9cd33caab6f32
SHA5125fa0aa162ec97288f90e47dabf93c53102dbe0b55c1e342522ea66cb6e900e2bc05b5f788dfb0feb6af06e3fd313627595814c1e4848f4efc46e31713e0eb8c9
-
Filesize
97KB
MD5e71b1dc7cf11d18f660a9d7bd2f557ef
SHA1fbd37df1202cba62f18b75f9b1c9a6c5c08d3d1f
SHA2569fc1179f2a846cd8ca647e58e680b333e68a8e0d4e4aac466ca87fa2a540c36a
SHA512d1a96f03ad9232c1fa1fdc98a0de289e1d280993b16f643759bcb86f2819cc63cae2e0b18d85df6b064f75dc4580497ec0d257def0a3faf0045aeceed903432d
-
Filesize
101KB
MD585009b3dedcd87884054ad31a6c4b71e
SHA120c2a6cf4a748ee2b233a277190c444715b2f2f8
SHA256f2fa4d8580c2765b51a2e36d150c6a26fd8808d6e3b4decbe8a624b9d0df8328
SHA512a5483d2f37855bf1eb4e9222f01b0e672c2a754a79dcb5b391715916a88e1a3d573b3e0b2798c518ba05226a3b2621a6ea5495215f7343803e33cd772ea9a9e0
-
Filesize
105KB
MD51437afee9652a660679dc89803b50be6
SHA19d1320f71062150485c695c84888b9dcd0de4830
SHA2565ed8a307d0ca4c2b7373298cd30f8745c8d401978013fce765254e3416bef95c
SHA5120bbc1f2544423d93a5044f323d3aa4f278ef24ade34a46c8a6f5bac6e4ec9915ba325f872007d155ed1f2ce7a245e3ab2f6a895e612e3072d6159f5b2e78fb69
-
Filesize
108KB
MD541386dd58af310f9bb3a464888d8a7ef
SHA159ca350dcd853ea8d570df28a300d91c98a0be74
SHA2569a9b5d6e75e851f45a7f4beb752c25f39137f379b77eb9155d5c21e5db41f692
SHA512edfd87c546f8e8bf9c61efc67ff5c02f73797732e542a4fd8902aa3f4f8904331d9aeaeb2845628145695a9136daeb0ed9ceea98db23159e3a2ecef826c7fa73
-
Filesize
88KB
MD5b2f25da77929e3dbcb46fee53763b803
SHA1a21b8554200bf015ef843dc54a92d684cda7c0df
SHA256dc75d10d514895296928cdd7f734cfac0f200bd7ab634fa8ae630bd0d5fc00c1
SHA512519c83db1b7882156fe95c960c618e95a940dde042208e0d257b6832aa1889ecba06886f1d92d6585cbd8f452bee6fef98b5ecbde89dea4332ffcb1331f4b2c0
-
Filesize
1.3MB
MD52c9052cd97995e6e7b53c794bdc22334
SHA13decb65bdf356effc6ab5d72d0374ba640668ada
SHA2569cce716d82b72a99db601b466d1376ea797ec3a8f98b77b8b96c9a7abd2c291b
SHA512f80934fcda6171207e9a00498c07255aa15938593d3522fc5150c0c58715f5a36122371e6d704c70ffc126faf9818a18e27fa5b427eaffe756f384ff4e66a29f
-
Filesize
255KB
MD5b646cae82d2c1bb809862fd0f531798a
SHA1430ebe252e41eb337867827740f08ed0dddec692
SHA256dec0780dffe9c664b0d3c3514833b92d19194b146661ae8583e0569d245331fe
SHA51216ee59640d954643f7e8e7b7c2ec71565d6205d7474381d7b571ef9780a5e3d056998a71624ddadd52fe2efa0d597462456abdfd35f40ed85de12f4bddea62b1
-
Filesize
12KB
MD513cb2b1b5266ab32cc1a380f4cb82fb0
SHA16f5c44d8780ac595c4880ccecc09ffaea7c9d321
SHA256a9b83ae60479c64fef634d0a7fdb6eafb4079c702ac9d311b02caeba3dee642d
SHA5128113e55fc6bcde93938698162d1338f77b1dc7c868dadbbd373bc842e93e32b5cc19e1677a0b6fc9f96298e15679fe6b9eeaee2b2bcd6b9fff23fe4d7db2eaf9
-
Filesize
4KB
MD57ad00e486875ffb20fa6645c09f67b93
SHA1913935f317f2b3ddf1d74971403ba65fb183ccf5
SHA2563490c6325ca17a5e91747f2bbfab9b46d00029d04fdb893fb3941a48fc55e14a
SHA5121fb837266f183e87701a286b124398434fc1840810ef1b3c1e85a79ae1969ad7202ffda8b1c25698e783b6d0edcdaac318f269668fa21e913c78b24244a440c0
-
Filesize
1.1MB
MD5d3601de9507278bb52bf7a37aca30ac7
SHA1109c69bd78fbac1dba058b7c40236d900a79cc05
SHA256827aa5b010d142c5cfd9c7cda27d878be6c9a775c82f57d8f96b322827b09e32
SHA512a32276ac87cb95d92ea91e198fcad0898411c72c91d7293627cbdb3d0ce348628c4752fc70fab98b74d43404b4c4b7ef3258e7c56e0f1de798f070c1d13b0785
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
48KB
MD5e76494b892e44011b2249c6555a4fc44
SHA15ac9cead1b25d76445d7c47578ccc72a3ecdde12
SHA25612db173e29f6f768a8bb2d5bee9f6c5f0833948add6e36d744517f48ffff27dc
SHA5129c2d4bd292f5df366056a7b9ea9a44d880142225ba41a42ff37922da67eb90ea7b4adde2d64225506ac531e20c8e2fd938865ddbe0fda40de0aed5ac61ac9e6b
-
Filesize
18.0MB
MD5fb12cec5d2bff4ad7d1aff32ccfc4d7d
SHA1f508ba41e5de2baf32ffe6ad3b9036a1d720aa7d
SHA256902d615004982e42e90f73413d340110c0a3ac5eb83b56b5691dff020e4493ba
SHA5122b9e7473f8cb2b9579c03702d64d0e4df7938c5b6d8c5a28229cc7196c006e900b519217a8323feaf04d7b78a9a06c5948185e0591b063e75a9220e98ce4acdc
-
Filesize
44.5MB
MD5814d6bace85d71576caa529a0b6f6bcf
SHA11343cfa820077c0f2ca27a9f557270a15f6f104e
SHA256d84e614127227f2c39b5eb3ff03a92520ca551fe12a09ccf5062d81d972230df
SHA5127b965c5341a56b73c931409027a4fbf4ec603245ad26f60dbd8150a4af6c412dc7100afc888e5c192b4f1bb5501b3d331952817cbdb3fc659108a46fef2532cc
-
Filesize
9.0MB
MD5e38c141587202a146c1ea6130607994f
SHA16bb5578ace31ab65af157bc3d1d489d1f1131a18
SHA2560f83e1d52ad1ddc01464f790e3f7c6ac6cfc6c6b94c3630d5a7ea9bf939853ad
SHA51243b89d99006e3a3cd606eb605e130cbb5c7aee8a92786a0bb7159e8cd54bf90746b83ebf5379902aa87962b2f085da7580a3f11b83889828fa122380362c3999
-
Filesize
6KB
MD56b0360dda362050bac2e118574b18e1c
SHA1747825b9fedd249b0151d1d79f20b453b80886eb
SHA256acc1935c3f1d817d42f62c1fafb8d0b0b913ef643938f3a4322b05bad120d76c
SHA51268c61329ec26b3d88d4e63846fe88e658a421e5fd93214944287429755196a899592a9ee559ea1ea9aeff1b3a216abded100cd2271b2e8ef33e8180a1fa5b9c3
-
Filesize
181B
MD534f15d7f2c98274bd540479f1863d3cb
SHA15b141ee7b18a06293245ce0e43b5f72265e9decc
SHA2562f3d90671a3876ad7fad8111576d298cce076938bd0370b7d0eac38d05f8f529
SHA512f7d6c539e250af69b8cbac67036b0aa6b0164d2ffb2c3982fccfc107be2e914e6821b4d509c9a9f986c2b641468bffecf81d561b506f07d475db8ff2beec31c3
-
Filesize
18.2MB
MD562011dd1e62fb4850900aa949e0a68b0
SHA1c08a952fd665899a0295f5ab6b2026290a64a8c4
SHA256660d9e1a18b48ec299b98dc320d617a86b50ccd45f71dc00f8ca99975a2699aa
SHA51205ef56b9ca0e4eaac6840c575fa7cb092875e74ed510568c792d4edfbeba30b42c63a633a05b67cce59de04dbab6e7d1254d479689fef20378c99d8ea9b5b932
-
Filesize
105B
MD5d121cabd1009d3f47757cd294ec74bac
SHA1a46f54df12796a60c3b4a06894130a293f04ab50
SHA256413b43a8af73eb2f5a8a1be28d0c2295963ba9d063fb32a8ecc80bbdbba5f29d
SHA5124a7a41cdf847dc17634af81db4e07fcbceb84b17fc0dd0c2865423dad23f78c4b1b0b837452e5a586d3485e2eb1c3711aaf436b86bcd339652789bc4062eadc2
-
Filesize
864B
MD58f43f8d8edc0e3aa54d876e1f70288fd
SHA1dc85d41c21afbf16af7d76f996d867d2cc5b8a4c
SHA256462c8c1421f0a523e199d3c3933db13352ab15138b4f472516cdf9160d497e8b
SHA5129f859ae8c81df106605eb9539bfc6491a7a0acbaf932b667f80c0dddadbe85e568b471be102d1379de626ac0921183bd4599257835625d291bc1c799bda36be4
-
Filesize
126KB
MD5ec10ca8954ca09f9d1e00ba48596196e
SHA109a3ab802cd0d47e969de65a13bb3065f70764bc
SHA256189b48efc7b00f6d5cad6fed9d3dccd25f662ed08b1c22eb47d9f3a0b8d1912d
SHA5127b2a568f0e379f8673914206618cd6489faecf9722cc6cff36f9bc3a0803b74bff7a59b55729c19eb9f181be745e66071ea06633730fb84feebd2e14a0b18946
-
Filesize
76KB
MD5950087e828e1b7426f703678e446c799
SHA1c9f28be9b9f810132ec8d78c161e5a232491e60e
SHA2568a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee
SHA5129ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93
-
Filesize
75KB
MD56f8e3e4f72620bddc633f0175f47161e
SHA153ed75a208cc84f1a065e9e4ece356371cac0341
SHA2562adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
SHA51280187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
-
Filesize
10KB
MD56b7df9842e89e05d9235e1afe108d48c
SHA1389ea23ba6b8f0fd0a132e0e92aecf742dfaa56e
SHA256f2759d38f53274c04d1b44a022a5dd51dd4f2dd934364301b30c6a5c931e9262
SHA512464c4e368ac3d3115795812bfd141324c276e2c558f9109b8445da4bbb0255b8910fb06cbad40aaef0ae5ea0522eea6a17b99ed96c7790f2928fa49bd0e30a1c
-
Filesize
11KB
MD588be14abb9e82a9b08fabce5f01d8e26
SHA1bcf29d97641b3d2c915a66f4f28e44d24423a913
SHA2567797d3f53cf13e2429fbef8feb6326b8a5877e2b4785c1cbf95d9ac50eb16228
SHA512e3fa7eb15edfe7e5d12549fad7730dfe7b67af67d3781168808cf1bc8fa03fada2d956c49254017260a987aa0d727bfc483499d836fc94c8d53f4a6d010b877c