a4ae388c46f11c11e17762eef8bee6c1212a3f852846a31c93b7d0a337a57b3b

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Activation Manager Unlocker b14.exe
Size 4.4MB
Sample260620-dw7z8aes8s
SHA256 a4ae388c46f11c11e17762eef8bee6c1212a3f852846a31c93b7d0a337a57b3b
MD5 598bc881a3db28dffdf9a72e60e518b5
SHA1 c8f421f973898d116d68303c632c19bdf518d85c
SHA512 fb3b981d153f6f63ffc914ee37384a5b22348abd2afa9b8af6eb855ea1cc9f64689b3471e5a220b81bae79b515933a4ba1d11974ce13f84a6962861cf837cb7f
SSDEEP 98304:l7Go76WZWbsMgAFZxVWCdi1K0vjnubSsYPbUI:l7GoGgWbbWEi3vjuesFI
TLSH
T14726E057794E9D3CD025BA3851B2D9008D7AAE66E129CD9FC1F4395ECF338003E1AA79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer spyware trojan

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5420	Activation Manager Unlocker b14.tmp
3216	certmgr.exe
4384	makecert.exe
5712	certmgr.exe
4748	signtool.exe
1468	signtool.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Steinberg\Activation Manager\SteinbergLicenseEngine.exe	Activation Manager Unlocker b14.tmp
File opened for modification	C:\Program Files\Common Files\Steinberg\Activation Manager\license-engine-access.dll	Activation Manager Unlocker b14.tmp
File created	C:\Program Files\Common Files\Steinberg\Activation Manager\is-FPFO9.tmp	Activation Manager Unlocker b14.tmp
File created	C:\Program Files\Common Files\Steinberg\Activation Manager\is-C1V5H.tmp	Activation Manager Unlocker b14.tmp
File opened for modification	C:\Program Files\Common Files\Steinberg\Activation Manager\license-engine-access.dll	signtool.exe
File opened for modification	C:\Program Files\Common Files\Steinberg\Activation Manager\SteinbergLicenseEngine.exe	signtool.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7338A852EECE4225A8AF1A1A53D3E6B3097B61C9\Blob = 0300000001000000140000007338a852eece4225a8af1a1a53d3e6b3097b61c920000000010000006a030000308203663082024ea0030201020210d274e62fe18f85ab41213029b4531e04300d06092a864886f70d01010b0500302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d6248301e170d3236303632303033323331375a170d3339313233313233353935395a302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d624830820122300d06092a864886f70d01010105000382010f003082010a02820101009e4188d9ecc047e1cfea6302451668ed4f434f011397b7e7a97a9d9e211aec3bd80e15491779a4ad14ae615802f2a24f6702ec1ed050af66417257a4d9e2ca3eca5c49b2c912dcb49afe21a4de9976803602896e5330e64ae9971307bb4951f84b08134cc50e435842da6145789901fc925e7e9f961dd0f4b7c1ff30b244aa1415746ccdf284e6d6e98123b805f3866afc48dad00ea943fc9693bd3162d2830985d5f6ee4f3e6ef563d165f9607650b78be9682ebe9d3fc26f3463354950a03924563ab7214c52660025ab2f495661ee51c67dd432fad5734898801bb945789ab3a5dc8a5657481bcb29d7be3874538cffd962d970b67b46f6491bd082e4fcf10203010001a38183308180301f0603551d250418301606082b06010505070303060a2b0601040182370a030d305d0603551d010456305480101d3878ce01432c3cb47d064e36d6ff66a12e302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d62488210d274e62fe18f85ab41213029b4531e04300d06092a864886f70d01010b05000382010100110d64c7c12061728e74e49225828ae8bd07679936b07c4bfcecbd7646e8ba9b136c55f849f2e5a6a574d94e7ebd42ec7dd090daff8ea217b4f8e83cb05065430184781a3479c5036e362bced55df052ccb6da91598775aa0df133d500fd06b02cfbbba89c8b5f2262d1b4810ce91d976292140d4d15d7be5c133871dc7c4040bec1386fe1318c5af9f2c7d9220a3b1f727388ff3595ccefa41a567d319d9360308d00b7a55aa37fa3011f459f1cdb80750b03c0a06664ca145052db67500ec92d5c42b74ad5af9ad5d3a984eb4fdab20844c1128f1a578061d8d3e25f96df8d7e2b9c4295fecbc725608b8e8a487e1468a5737fe6d7096b3b54146adf4c680c	certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7338A852EECE4225A8AF1A1A53D3E6B3097B61C9\Blob = 0f00000001000000200000000d64ed3e75405cc41b5e0dd37c83b1413a92116589e27f09afd4c170aa22be9b0300000001000000140000007338a852eece4225a8af1a1a53d3e6b3097b61c920000000010000006a030000308203663082024ea0030201020210d274e62fe18f85ab41213029b4531e04300d06092a864886f70d01010b0500302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d6248301e170d3236303632303033323331375a170d3339313233313233353935395a302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d624830820122300d06092a864886f70d01010105000382010f003082010a02820101009e4188d9ecc047e1cfea6302451668ed4f434f011397b7e7a97a9d9e211aec3bd80e15491779a4ad14ae615802f2a24f6702ec1ed050af66417257a4d9e2ca3eca5c49b2c912dcb49afe21a4de9976803602896e5330e64ae9971307bb4951f84b08134cc50e435842da6145789901fc925e7e9f961dd0f4b7c1ff30b244aa1415746ccdf284e6d6e98123b805f3866afc48dad00ea943fc9693bd3162d2830985d5f6ee4f3e6ef563d165f9607650b78be9682ebe9d3fc26f3463354950a03924563ab7214c52660025ab2f495661ee51c67dd432fad5734898801bb945789ab3a5dc8a5657481bcb29d7be3874538cffd962d970b67b46f6491bd082e4fcf10203010001a38183308180301f0603551d250418301606082b06010505070303060a2b0601040182370a030d305d0603551d010456305480101d3878ce01432c3cb47d064e36d6ff66a12e302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d62488210d274e62fe18f85ab41213029b4531e04300d06092a864886f70d01010b05000382010100110d64c7c12061728e74e49225828ae8bd07679936b07c4bfcecbd7646e8ba9b136c55f849f2e5a6a574d94e7ebd42ec7dd090daff8ea217b4f8e83cb05065430184781a3479c5036e362bced55df052ccb6da91598775aa0df133d500fd06b02cfbbba89c8b5f2262d1b4810ce91d976292140d4d15d7be5c133871dc7c4040bec1386fe1318c5af9f2c7d9220a3b1f727388ff3595ccefa41a567d319d9360308d00b7a55aa37fa3011f459f1cdb80750b03c0a06664ca145052db67500ec92d5c42b74ad5af9ad5d3a984eb4fdab20844c1128f1a578061d8d3e25f96df8d7e2b9c4295fecbc725608b8e8a487e1468a5737fe6d7096b3b54146adf4c680c	signtool.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activation Manager Unlocker b14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Activation Manager Unlocker b14.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5548-0-0x0000000000400000-0x0000000000547000-memory.dmp	innosetup
behavioral2/memory/5548-41-0x0000000000400000-0x0000000000547000-memory.dmp	innosetup
behavioral2/memory/5548-45-0x0000000000400000-0x0000000000547000-memory.dmp	innosetup

Modifies system certificate store 2 TTPs 13 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore\CTLs	certmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore	makecert.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore\Certificates	makecert.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore\CRLs	makecert.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore\CTLs	makecert.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore\Certificates\7338A852EECE4225A8AF1A1A53D3E6B3097B61C9	makecert.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore\CRLs	certmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore\Certificates\7338A852EECE4225A8AF1A1A53D3E6B3097B61C9\Blob = 0300000001000000140000007338a852eece4225a8af1a1a53d3e6b3097b61c920000000010000006a030000308203663082024ea0030201020210d274e62fe18f85ab41213029b4531e04300d06092a864886f70d01010b0500302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d6248301e170d3236303632303033323331375a170d3339313233313233353935395a302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d624830820122300d06092a864886f70d01010105000382010f003082010a02820101009e4188d9ecc047e1cfea6302451668ed4f434f011397b7e7a97a9d9e211aec3bd80e15491779a4ad14ae615802f2a24f6702ec1ed050af66417257a4d9e2ca3eca5c49b2c912dcb49afe21a4de9976803602896e5330e64ae9971307bb4951f84b08134cc50e435842da6145789901fc925e7e9f961dd0f4b7c1ff30b244aa1415746ccdf284e6d6e98123b805f3866afc48dad00ea943fc9693bd3162d2830985d5f6ee4f3e6ef563d165f9607650b78be9682ebe9d3fc26f3463354950a03924563ab7214c52660025ab2f495661ee51c67dd432fad5734898801bb945789ab3a5dc8a5657481bcb29d7be3874538cffd962d970b67b46f6491bd082e4fcf10203010001a38183308180301f0603551d250418301606082b06010505070303060a2b0601040182370a030d305d0603551d010456305480101d3878ce01432c3cb47d064e36d6ff66a12e302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d62488210d274e62fe18f85ab41213029b4531e04300d06092a864886f70d01010b05000382010100110d64c7c12061728e74e49225828ae8bd07679936b07c4bfcecbd7646e8ba9b136c55f849f2e5a6a574d94e7ebd42ec7dd090daff8ea217b4f8e83cb05065430184781a3479c5036e362bced55df052ccb6da91598775aa0df133d500fd06b02cfbbba89c8b5f2262d1b4810ce91d976292140d4d15d7be5c133871dc7c4040bec1386fe1318c5af9f2c7d9220a3b1f727388ff3595ccefa41a567d319d9360308d00b7a55aa37fa3011f459f1cdb80750b03c0a06664ca145052db67500ec92d5c42b74ad5af9ad5d3a984eb4fdab20844c1128f1a578061d8d3e25f96df8d7e2b9c4295fecbc725608b8e8a487e1468a5737fe6d7096b3b54146adf4c680c	makecert.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore\Certificates\7338A852EECE4225A8AF1A1A53D3E6B3097B61C9\Blob = 0200000001000000bc0000001c0000006c0000000100000000000000000000000000000002000000630065006600350036003900390063002d0035006500380032002d0034003300330037002d0039006100370030002d0036003800630032006200370030003300380037003800640000000000000000004d006900630072006f0073006f006600740020005300740072006f006e0067002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000000300000001000000140000007338a852eece4225a8af1a1a53d3e6b3097b61c920000000010000006a030000308203663082024ea0030201020210d274e62fe18f85ab41213029b4531e04300d06092a864886f70d01010b0500302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d6248301e170d3236303632303033323331375a170d3339313233313233353935395a302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d624830820122300d06092a864886f70d01010105000382010f003082010a02820101009e4188d9ecc047e1cfea6302451668ed4f434f011397b7e7a97a9d9e211aec3bd80e15491779a4ad14ae615802f2a24f6702ec1ed050af66417257a4d9e2ca3eca5c49b2c912dcb49afe21a4de9976803602896e5330e64ae9971307bb4951f84b08134cc50e435842da6145789901fc925e7e9f961dd0f4b7c1ff30b244aa1415746ccdf284e6d6e98123b805f3866afc48dad00ea943fc9693bd3162d2830985d5f6ee4f3e6ef563d165f9607650b78be9682ebe9d3fc26f3463354950a03924563ab7214c52660025ab2f495661ee51c67dd432fad5734898801bb945789ab3a5dc8a5657481bcb29d7be3874538cffd962d970b67b46f6491bd082e4fcf10203010001a38183308180301f0603551d250418301606082b06010505070303060a2b0601040182370a030d305d0603551d010456305480101d3878ce01432c3cb47d064e36d6ff66a12e302c312a302806035504031321537465696e62657267204d6564696120546563686e6f6c6f6769657320476d62488210d274e62fe18f85ab41213029b4531e04300d06092a864886f70d01010b05000382010100110d64c7c12061728e74e49225828ae8bd07679936b07c4bfcecbd7646e8ba9b136c55f849f2e5a6a574d94e7ebd42ec7dd090daff8ea217b4f8e83cb05065430184781a3479c5036e362bced55df052ccb6da91598775aa0df133d500fd06b02cfbbba89c8b5f2262d1b4810ce91d976292140d4d15d7be5c133871dc7c4040bec1386fe1318c5af9f2c7d9220a3b1f727388ff3595ccefa41a567d319d9360308d00b7a55aa37fa3011f459f1cdb80750b03c0a06664ca145052db67500ec92d5c42b74ad5af9ad5d3a984eb4fdab20844c1128f1a578061d8d3e25f96df8d7e2b9c4295fecbc725608b8e8a487e1468a5737fe6d7096b3b54146adf4c680c	makecert.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7338A852EECE4225A8AF1A1A53D3E6B3097B61C9	certmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7338A852EECE4225A8AF1A1A53D3E6B3097B61C9	signtool.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore	certmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\SystemCertificates\PrivateCertStore\Certificates	certmgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5420	Activation Manager Unlocker b14.tmp
5420	Activation Manager Unlocker b14.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5420	Activation Manager Unlocker b14.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 5420	5548	Activation Manager Unlocker b14.exe	89
PID 5420 wrote to memory of 3216	5420	Activation Manager Unlocker b14.tmp	90
PID 5420 wrote to memory of 4384	5420	Activation Manager Unlocker b14.tmp	92
PID 5420 wrote to memory of 5712	5420	Activation Manager Unlocker b14.tmp	94
PID 5420 wrote to memory of 4748	5420	Activation Manager Unlocker b14.tmp	96
PID 5420 wrote to memory of 1468	5420	Activation Manager Unlocker b14.tmp	98

C:\Users\Admin\AppData\Local\Temp\Activation Manager Unlocker b14.exe
"C:\Users\Admin\AppData\Local\Temp\Activation Manager Unlocker b14.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Users\Admin\AppData\Local\Temp\is-LU0AS.tmp\Activation Manager Unlocker b14.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LU0AS.tmp\Activation Manager Unlocker b14.tmp" /SL5="$702BA,3497816,1282560,C:\Users\Admin\AppData\Local\Temp\Activation Manager Unlocker b14.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\certmgr.exe
    "C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\certmgr.exe" /del /all /s PrivateCertStore
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:3216
- - C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\makecert.exe
    "C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\makecert.exe" -r -a SHA256 -eku "1.3.6.1.5.5.7.3.3,1.3.6.1.4.1.311.10.3.13" -n CN="Steinberg Media Technologies GmbH" -pe -ss PrivateCertStore SMTG.cer
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:4384
- - C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\certmgr.exe
    "C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\certmgr.exe" -add C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\SMTG.cer -s -r localMachine ROOT
    3⤵
    - Executes dropped EXE
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    PID:5712
- - C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\signtool.exe
    "C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\signtool.exe" sign /fd SHA256 /v /s PrivateCertStore /a /n "Steinberg Media Technologies GmbH" "C:\Program Files\Common Files\Steinberg\Activation Manager\license-engine-access.dll"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\signtool.exe
    "C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\signtool.exe" sign /fd SHA256 /v /s PrivateCertStore /a /n "Steinberg Media Technologies GmbH" "C:\Program Files\Common Files\Steinberg\Activation Manager\SteinbergLicenseEngine.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SteinbergLicenseEngine.exe

Path C:\Program Files\Common Files\Steinberg\Activation Manager\SteinbergLicenseEngine.exe
Size 5.5MB
SHA256 805928b5312c7a698e53db16482a08eefea85f83a7409764f1491683cfa39dc8
MD5 7b018b22d27d449aa69c9a21dd411401
SHA1 f714a7b377fa5503d8eca2d75b84f336844174d8
SHA512 2fed8e87c036d2a61ce64585ba0dd73f8275e10a0f80fc35782fb9aff3f030eb1842bcbb64dfbf6f37deccc92d90353c551b58c3d5e8c0836401ce8f1287e150
SSDEEP 98304:GcPt1/Vraw27jjcwIgWEU5pjr4v059P8JjvtAo84G8Pj6bdbDht:1PNaw2nIgWEUTs859P8JjvtAohq
TLSH
T1C3467D5776A901EDD5BBD17CCA579A03E6B2744603219BDF03A086AA1F13BE48F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license-engine-access.dll

Path C:\Program Files\Common Files\Steinberg\Activation Manager\license-engine-access.dll
Size 3.2MB
SHA256 623434b04027d4fe97c1d3aee19c357235c7c944c8ea8148d4a3da3f6483c426
MD5 32c764037fcb7d9f3e3fb1021bc29e35
SHA1 5ee1c2fda14d0254d8c914485f55d6d52760563f
SHA512 e2551411b69bbb1a90834cd0bc609d1c8362fb4c10be4530eae7b330f6a088833c81115e37150b1c83fb8b056f37a6488e94182fc1819f8874995934e7195a52
SSDEEP 49152:dxq8NUz7lbI4rVBUsRMm5f+1eS/inLxCwzfjqewd3V1FK3Dg/YaghKnNAHC4dFbE:D455RPQwjjR+VzK3EJx6bdbpo
TLSH
T176F57C5B729801A8D9BBD17CCA978B07E7B2740543718FCF02A186A91F17BE51B3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMTG.cer

Path C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\SMTG.cer
Size 874B
SHA256 9841ac52babc8b9cd3dae8c65179b152fb88597ce3a8df29efe4db8c7e25bd06
MD5 c302887b49233919f7c2736f4443671b
SHA1 7338a852eece4225a8af1a1a53d3e6b3097b61c9
SHA512 cfb003d88fb727aa7388f6f27f0df6afb90de130e806107965a1c9259c7a0f2f29d71b8e109f53d086d71cce0a5698c78619473f7006ddc4804de03c6c9b970f
TLSH
T144116378197CEAA16507871C1A1AF91F164519C05B21061FA279CD8377757EB5E8C20D
MD5 SHA1 SHA512 TLSH

Submit Download

certmgr.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\certmgr.exe
Size 80KB
SHA256 68040976ea73a1c4a14e40fedbcb886edb7ae97b006b9540c74c0f0d313dc78b
MD5 8ac6ffb0abc20398bbd8f3c7c0519609
SHA1 ac7e9abf0ac98c30346f3cb2a3c35cebd510a4c8
SHA512 780773a4cc900fbe38a1dd220d105c8c25ddc833f2cc7e5df3a88b32744988e45325deb46c95decba137b2457029f33432b4667c684524798efa4a02c515adb7
SSDEEP 1536:erg7MM+iaHyUtiBNFN4POTcVFu7Qr28IVYw+WXsA9i9vYMao:p1vaHyUton6eczuuIVt+WXsNwo
TLSH
T1D183951963FC2098F9F756B996329214CA33B8712F30D6AF02D8C17D4F73A919971B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

makecert.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\makecert.exe
Size 61KB
SHA256 d184933b6917faf559bd250c7f2d47d1bc9bba98442aa0f4b48d4371357c81dd
MD5 934b19d32e1dc15d4cc2b8dee12de758
SHA1 1dec6a49062d05764ae1864e04621a2af143bbd8
SHA512 89e8f6bab807873c8e20fbe3fd825642e9ce974af446226847f13da1e7e28255c9f106cd8d8eb0fb5127cf08ecd36977110306e67f3017adfbeb93706061f690
SSDEEP 768:Isr/UyQMvXBm83JfOF5cnYhs1+su0KgUWhHbTJ/vaarFdPiyI7:h/UeXBmI81su0h5HbTJ/vaarFdKb7
TLSH
T1E553081163E80481FEF26BB88A7256529A33B9A66F31C6DF025CC15C1F73FD1A934726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

signtool.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IHUDR.tmp\signtool.exe
Size 448KB
SHA256 a36f5e81ce208137acc8fa9c00547c020fa10f044583002ccd23799b7f64078e
MD5 8a90e91a512dbf56d0d8d87b9a673e53
SHA1 e7126fe4cdd96f12e5ca9ca3246a1b905c941a44
SHA512 6df1da08a81c21710cfb483b48209dfbb3bb36ef146e366b384c3be1c7034d313a116a23b87b1f3c9fb0f24158472dc37119fe5139434bfea6a34dc7f03bfb0e
SSDEEP 6144:RTHSBSd/wEHB5ZYpW7KlFTOEO+LseAFwstnz4iVeUe0kz:1y4+Eh5ZuVycLseeSz
TLSH
T1D2A4D619ABF90855F0F3E67889B68241EA73BC655B31D2CF1199853D1F23ED0E934B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Activation Manager Unlocker b14.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LU0AS.tmp\Activation Manager Unlocker b14.tmp
Size 3.9MB
SHA256 983d1dc87b88d1c1d6fc1c34eb1ab74815877f6632cb841d288313b427e33f03
MD5 079c130259b93f1397cbce293aafa599
SHA1 de7dfe4f0cfa03f68966463b157f44e17a90fddb
SHA512 d833ec16f0a110f7b5b8b4468e7a03ba95eeecbe90dc5d552a1c8417a9af386d2056b86d50ba8e4ce992911f48f36f915ad55b71bf89680fe98ce8f5eb8cd161
SSDEEP 49152:krHHFnKA0otwLU/g2SmYXFuaYQ4mQVHYEXQcmpeDxjT/T333tn:krnwboEuM4mQiEC0DN3339
TLSH
T1F8164A13F644ED3AD06A3A395633C950893B7F62A52ADC5796F83D4CCF360403E2B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5420-6-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/5420-42-0x0000000000400000-0x00000000007FC000-memory.dmp

Download

memory/5420-43-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/5420-44-0x0000000000400000-0x00000000007FC000-memory.dmp

Download

memory/5548-0-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/5548-41-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/5548-45-0x0000000000400000-0x0000000000547000-memory.dmp

Download