Analysis
- max time kernel
148s - max time network
149s - platform
windows7_x64 - resource
win7v20201028 - submitted
01/12/2020, 22:11
Static task
static1
Behavioral task
behavioral1
Sample
productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe
- Size 374KB
- Sample201201-vxw4prcvsa
- SHA256 30b040107c6934062082db4dd5e5988e6737f45dd00725065cbfb88b849ec05f
- MD5 43a864f4a0b4723600be5aa8eda46937
- SHA1 cb62a60a015f913a27dd59ff465a31341d27a5bd
- SHA512 d20ee3a96788d5d5250ba9c818ad9495630cd119cf055c0f2b2f12074b0c64fe2ee80be2cb02c6dad390404d28bd9ff8aa8e1558dc685621efaf3cf16eb4119c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Registers COM server for autorun 1 TTPs
- Executes dropped EXE 2 IoCs
pid Process 1000 SlimCleanerPlus.exe 1632 DriverUpdate-setup.exe - Loads dropped DLL 26 IoCs
pid Process 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 1644 Rundll32.exe 1644 Rundll32.exe 1644 Rundll32.exe 1644 Rundll32.exe 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 1000 SlimCleanerPlus.exe 2408 MsiExec.exe 2408 MsiExec.exe 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 868 Process not Found 868 Process not Found 868 Process not Found 868 Process not Found 868 Process not Found 868 Process not Found - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\DriverUpdate = "cmd /c \"start \"\" \"C:\\Program Files\\DriverUpdate\\DriverUpdate.exe\" /delay=60 /mode=toaster \"" MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - JavaScript code in executable 2 IoCs
resource yara_rule behavioral1/files/0x000300000001313b-42.dat js behavioral1/files/0x000300000001315a-127.dat js - Drops file in Program Files directory 29 IoCs
description ioc Process File created C:\Program Files\SlimWare Utilities\Services\BsSndRpt64.exe msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\BugSplatRC64.dll msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\dbghelp.dll msiexec.exe File created C:\Program Files\DriverUpdate\lib-inappbrowser.dll msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.ProxyStub.dll msiexec.exe File created C:\Program Files\DriverUpdate\InAppBrowserProxy.dll msiexec.exe File created C:\Program Files\DriverUpdate\DriverUpdate.exe msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.ProxyStub.dll msiexec.exe File opened for modification C:\Program Files\DriverUpdate\DriverUpdate.exe MsiExec.exe File created C:\Program Files\SlimWare Utilities\Services\BsSndRpt.exe msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\BugSplat.dll msiexec.exe File created C:\Program Files\DriverUpdate\BsSndRpt.exe msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe msiexec.exe File created C:\Program Files\DriverUpdate\UninstallStub.exe msiexec.exe File created C:\Program Files\DriverUpdate\dbghelp.dll msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\DriverUpdate.UpdateLauncher.exe msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\SlimWare.Core.dll msiexec.exe File created C:\Program Files\DriverUpdate\SlimWare.Messaging.dll msiexec.exe File created C:\Program Files\DriverUpdate\SlimWare.PushNotification.Services.dll msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\BugSplat64.dll msiexec.exe File created C:\Program Files\DriverUpdate\BugSplat.dll msiexec.exe File created C:\Program Files\DriverUpdate\BugSplatRc.dll msiexec.exe File created C:\Program Files\DriverUpdate\Open-Source Licenses.txt msiexec.exe File created C:\Program Files\DriverUpdate\SlimWare.DriverUpdate.Services.dll msiexec.exe File created C:\Program Files\DriverUpdate\UnifiedLogger.dll msiexec.exe File created C:\Program Files\SlimWare Utilities\Services\BugSplatRC.dll msiexec.exe File created C:\Program Files\DriverUpdate\dbghelp-app.dll msiexec.exe File created C:\Program Files\DriverUpdate\htmlayout.dll msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSID3D6.tmp msiexec.exe File opened for modification C:\Windows\Installer\{42F25DDC-1AEF-428B-A479-ED2201B43DA6}\Icon.exe msiexec.exe File opened for modification C:\Windows\Installer\f74c68c.ipi msiexec.exe File created C:\Windows\Installer\f74c68a.msi msiexec.exe File opened for modification C:\Windows\Installer\f74c68a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICCA4.tmp msiexec.exe File created C:\Windows\Installer\f74c68c.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIDE33.tmp msiexec.exe File created C:\Windows\Installer\{42F25DDC-1AEF-428B-A479-ED2201B43DA6}\Icon.exe msiexec.exe File created C:\Windows\Installer\f74c68e.msi msiexec.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "1103" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "2012" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\DriverUpdate.exe = "11001" MsiExec.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15121" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "3206" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "3306" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21613" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "22005" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\staticimgfarm.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "2337" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15175" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "19787" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "172" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16280" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16224" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18544" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "3306" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "436" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05a37dc37c8d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15557" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16319" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "19211" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21445" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "318" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "61" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "3118" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21869" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17875211-342B-11EB-9964-C611B4A1F110} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2610" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "1679" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "57" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "3059" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15121" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21701" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "6115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "3059" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "2987" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "19267" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "17133" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\staticimgfarm.com\Total = "273" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21095" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "3442" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "172" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "269" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "529" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "3442" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "399" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "14848" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "3059" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "318" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "3118" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "3442" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "297" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15162" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "1679" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18165" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18377" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "529" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "3374" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "529" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18637" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "529" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "1198" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21357" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "32" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "127" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15498" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "436" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21801" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "1767" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "3118" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21545" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "3374" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15650" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "2987" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "318" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "20120" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "3374" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "32" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "313629500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "1679" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "61" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "770" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "399" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "14848" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "269" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18108" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18235" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "3374" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "61" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "497" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21226" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "3206" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "3306" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21769" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "172" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000033044fc40189d459fe40d0e3dcc9b660000000002000000000010660000000100002000000092d9f408081e53519860d2c727c79b9f1496e23150da50b7956bb04c32198f3a000000000e8000000002000020000000494e35d093b256e6cc7f04edf1104a6ba2aac94fbaa8d9c30d5e1a8ec59a32e7900000008849bfd22fcc1a6972378d92df2e43a1291ca7366f1f079a3a8249d82901fb2b8dfe6fbdbd9d54d9817f6eb836cb215ec3c8b2b65f0055384e0f214875165e352e037727864e1db0030d184aa86685327fe7c5a7d5991204a7665bcba00e18797be37a036a5b8e8c98b413c83611df301544fa5a33ce2382dfbd22777f2c99eb709da1874b343e7a276e73a99bd8d6394000000069041068c8fd64748473f7c4449573a5e693effcb2925dab4355445329cea990a53ff2128d90c731d71a98cae9d599a1c023a62f11dafd36ea9e0ba8f248690c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "127" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000033044fc40189d459fe40d0e3dcc9b660000000002000000000010660000000100002000000081c31d857ff1a269c19cdd5d177f3575c92a46a46cb06af459526906ca9e87bf000000000e80000000020000200000008536d5ad437e55d052238ee1b08e2bebc3f1445ca501a01275b95f196bcf6eea20000000ec6ad2f67054f3dab62e338ce23dac9be1c03aa96f6011c962da022ad7583a534000000048360f7b2b536fc5e2e6a095d10f7ae8913075e27784ac3c4e97bc3cbd847a9a57238bd3ebdb24fba1c5a1d06f7e7f15df8d2f00a6ed975d77629c91ab06c019 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\staticimgfarm.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18426" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "377" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21298" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "1103" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "1159" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "1198" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15178" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "377" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "1767" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "19306" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "497" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\DriverUpdate.exe = "11001" MsiExec.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\staticimgfarm.com\Total = "225" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "41" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15390" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "672" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15439" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "377" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "54" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "57" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "54" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "2012" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "399" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "1159" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "54" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "436" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1" productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "19875" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "1198" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21937" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16888" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "41" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "57" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "2987" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "624" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21513" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "3306" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "2139" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ak.staticimgfarm.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ak.staticimgfarm.com\ = "273" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "41" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "3274" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "41" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "377" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16800" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6388" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "57" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "54" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "2012" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21167" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "269" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18162" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "1159" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "1767" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "1767" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "1103" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "1103" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "1679" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "3059" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "269" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "6115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "2337" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15248" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "127" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "1159" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18485" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "2987" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "2139" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "1198" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "3206" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\myway.com\Total = "297" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ak.staticimgfarm.com\ = "225" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "127" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "436" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "3118" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "3442" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\hp.myway.com\ = "297" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\useinsider.com\Total = "3274" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "3274" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "318" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\ibood.com\Total = "2012" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.ibood.com\ = "3274" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\iboodnl.api.useinsider.com\ = "3206" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2412" IEXPLORE.EXE - Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://hp.myway.com/productmanualsguide/ttab02/index.html?n=7868963B&p2=^CQW^xdm100^TTAB02^us&ptb=B0472A38-E8F6-4E08-8810-24437E5CCB06&si=1qa1&coid=ad89e6240e9a44989b04b561ca5d55ae" productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe - Modifies registry class 166 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BAF61B64-5D1A-4108-97CB-A10B7DDF730E}\ = "DriverUpdate.UpdateLauncher" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Downloaded Installers\\{42F25DDC-1AEF-428B-A479-ED2201B43DA6}\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\NumMethods\ = "11" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F6A8CE42-CB2D-4920-85E7-24966D63D4B9}\ = "SlimWare.Services" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\0\win64\ = "C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Services.exe" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\FLAGS msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F6A8CE42-CB2D-4920-85E7-24966D63D4B9}\LocalService = "SlimWareServices" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32\ThreadingModel = "Free" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\Version msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Downloaded Installers\\{42F25DDC-1AEF-428B-A479-ED2201B43DA6}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\LocalServer32\ = "\"C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Services.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0\0\win64 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\ProductIcon = "C:\\Windows\\Installer\\{42F25DDC-1AEF-428B-A479-ED2201B43DA6}\\Icon.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\TypeLib\ = "{58A8BF1A-3608-41EA-AAD1-581AB79105E6}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\NumMethods\ = "9" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\TypeLib\ = "{31E87E80-E113-49FD-9789-A97E83CEA4F1}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\NumMethods\ = "8" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\LocalizedString = "@C:\\Program Files\\SlimWare Utilities\\Services\\DriverUpdate.UpdateLauncher.exe,-100" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\ = "PSFactoryBuffer" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\ = "SlimWareServices" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\ = "SlimWareSession" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\FLAGS\ = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\PackageCode = "C0A7CE3DA80AD7D4692E9B3F1C660859" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32\ = "\"C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Session.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\ProxyStubClsid32\ = "{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\BaseInterface\ = "{00000000-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\ = "SlimWare Services Session Server" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\0\win64 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\Version = "84410378" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0\FLAGS\ = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\NumMethods\ = "4" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\ProxyStubClsid32\ = "{BDF76960-B341-4592-BDBA-DFC8C74165A9}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\{BAF61B64-5D1A-4108-97CB-A10B7DDF730E} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\0\win64 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\BaseInterface msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\{6D3BC646-CFCD-4098-8495-B7BD0DF13133} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0\ = "DriverUpdate.UpdateLauncher" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\ = "SlimWare Services Session" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\NumMethods\ = "7" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0\0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0\FLAGS msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\LocalServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\0\win64 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\0\win64\ = "C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Session.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\InprocServer32\ = "C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Session.ProxyStub.dll" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\ProxyStubClsid32\ = "{BDF76960-B341-4592-BDBA-DFC8C74165A9}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\ = "IJobLauncher" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\TypeLib\ = "{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\Version\ = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CDD52F24FEA1B8244A97DE22104BD36A msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0\0\win64\ = "C:\\Program Files\\SlimWare Utilities\\Services\\DriverUpdate.UpdateLauncher.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\LocalServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\Version\ = "1.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32\ = "C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Services.ProxyStub.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\AppID = "{BAF61B64-5D1A-4108-97CB-A10B7DDF730E}" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\TypeLib\ = "{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\TypeLib\Version = "1.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\ = "PSFactoryBuffer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\TypeLib\ = "{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\BaseInterface msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\ = "DJobLauncherEvents" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\TypeLib\ = "{31E87E80-E113-49FD-9789-A97E83CEA4F1}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\ = "ISlimWareSessionServerFactory" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\TypeLib msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\FLAGS\ = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\Elevation msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\AppID = "{F6A8CE42-CB2D-4920-85E7-24966D63D4B9}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\ProxyStubClsid32 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\Elevation\Enabled = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\50D2BAFD096C90345A82B25A790BDF69\CDD52F24FEA1B8244A97DE22104BD36A msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\BaseInterface msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\FLAGS msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\SourceList\PackageName = "setup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\BaseInterface\ = "{00020400-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\{F6A8CE42-CB2D-4920-85E7-24966D63D4B9} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6D3BC646-CFCD-4098-8495-B7BD0DF13133}\ = "SlimWare.Session" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\0\win64 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\LocalServer32\ = "\"C:\\Program Files\\SlimWare Utilities\\Services\\DriverUpdate.UpdateLauncher.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0\0\win64 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\ = "ISlimWareSession" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\TypeLib\ = "{58A8BF1A-3608-41EA-AAD1-581AB79105E6}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\BaseInterface\ = "{6D5140C1-7436-11CE-8034-00AA006009FA}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\TypeLib\ = "{31E87E80-E113-49FD-9789-A97E83CEA4F1}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\Version\ = "1.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CDD52F24FEA1B8244A97DE22104BD36A\Application msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\AppID = "{6D3BC646-CFCD-4098-8495-B7BD0DF13133}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\ = "Update Launcher Server" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\Version msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\ProductName = "DriverUpdate" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\50D2BAFD096C90345A82B25A790BDF69 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\Version msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\ = "ISlimWareSessionServer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9} msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a SlimCleanerPlus.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 SlimCleanerPlus.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 2408 MsiExec.exe 2408 MsiExec.exe 2408 MsiExec.exe 2408 MsiExec.exe 2192 msiexec.exe 2192 msiexec.exe 1820 iexplore.exe 1820 iexplore.exe 1820 iexplore.exe 1820 iexplore.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1728 IEXPLORE.EXE 2948 IEXPLORE.EXE - Suspicious use of AdjustPrivilegeToken 76 IoCs
description pid Process Token: SeShutdownPrivilege 1632 DriverUpdate-setup.exe Token: SeIncreaseQuotaPrivilege 1632 DriverUpdate-setup.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeSecurityPrivilege 2192 msiexec.exe Token: SeCreateTokenPrivilege 1632 DriverUpdate-setup.exe Token: SeAssignPrimaryTokenPrivilege 1632 DriverUpdate-setup.exe Token: SeLockMemoryPrivilege 1632 DriverUpdate-setup.exe Token: SeIncreaseQuotaPrivilege 1632 DriverUpdate-setup.exe Token: SeMachineAccountPrivilege 1632 DriverUpdate-setup.exe Token: SeTcbPrivilege 1632 DriverUpdate-setup.exe Token: SeSecurityPrivilege 1632 DriverUpdate-setup.exe Token: SeTakeOwnershipPrivilege 1632 DriverUpdate-setup.exe Token: SeLoadDriverPrivilege 1632 DriverUpdate-setup.exe Token: SeSystemProfilePrivilege 1632 DriverUpdate-setup.exe Token: SeSystemtimePrivilege 1632 DriverUpdate-setup.exe Token: SeProfSingleProcessPrivilege 1632 DriverUpdate-setup.exe Token: SeIncBasePriorityPrivilege 1632 DriverUpdate-setup.exe Token: SeCreatePagefilePrivilege 1632 DriverUpdate-setup.exe Token: SeCreatePermanentPrivilege 1632 DriverUpdate-setup.exe Token: SeBackupPrivilege 1632 DriverUpdate-setup.exe Token: SeRestorePrivilege 1632 DriverUpdate-setup.exe Token: SeShutdownPrivilege 1632 DriverUpdate-setup.exe Token: SeDebugPrivilege 1632 DriverUpdate-setup.exe Token: SeAuditPrivilege 1632 DriverUpdate-setup.exe Token: SeSystemEnvironmentPrivilege 1632 DriverUpdate-setup.exe Token: SeChangeNotifyPrivilege 1632 DriverUpdate-setup.exe Token: SeRemoteShutdownPrivilege 1632 DriverUpdate-setup.exe Token: SeUndockPrivilege 1632 DriverUpdate-setup.exe Token: SeSyncAgentPrivilege 1632 DriverUpdate-setup.exe Token: SeEnableDelegationPrivilege 1632 DriverUpdate-setup.exe Token: SeManageVolumePrivilege 1632 DriverUpdate-setup.exe Token: SeImpersonatePrivilege 1632 DriverUpdate-setup.exe Token: SeCreateGlobalPrivilege 1632 DriverUpdate-setup.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe Token: SeRestorePrivilege 2192 msiexec.exe Token: SeTakeOwnershipPrivilege 2192 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1820 iexplore.exe 1820 iexplore.exe 1820 iexplore.exe - Suspicious use of SetWindowsHookEx 25 IoCs
pid Process 1820 iexplore.exe 1820 iexplore.exe 240 IEXPLORE.EXE 240 IEXPLORE.EXE 1820 iexplore.exe 1820 iexplore.exe 652 IEXPLORE.EXE 652 IEXPLORE.EXE 1820 iexplore.exe 1820 iexplore.exe 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 240 IEXPLORE.EXE 240 IEXPLORE.EXE 240 IEXPLORE.EXE 240 IEXPLORE.EXE 1820 iexplore.exe 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 1820 iexplore.exe 1820 iexplore.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1644 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 31 PID 1368 wrote to memory of 1644 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 31 PID 1368 wrote to memory of 1644 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 31 PID 1368 wrote to memory of 1644 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 31 PID 1368 wrote to memory of 1644 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 31 PID 1368 wrote to memory of 1644 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 31 PID 1368 wrote to memory of 1644 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 31 PID 1368 wrote to memory of 1000 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 32 PID 1368 wrote to memory of 1000 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 32 PID 1368 wrote to memory of 1000 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 32 PID 1368 wrote to memory of 1000 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 32 PID 1368 wrote to memory of 1000 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 32 PID 1368 wrote to memory of 1000 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 32 PID 1368 wrote to memory of 1000 1368 productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe 32 PID 1820 wrote to memory of 240 1820 iexplore.exe 34 PID 1820 wrote to memory of 240 1820 iexplore.exe 34 PID 1820 wrote to memory of 240 1820 iexplore.exe 34 PID 1820 wrote to memory of 240 1820 iexplore.exe 34 PID 1820 wrote to memory of 652 1820 iexplore.exe 35 PID 1820 wrote to memory of 652 1820 iexplore.exe 35 PID 1820 wrote to memory of 652 1820 iexplore.exe 35 PID 1820 wrote to memory of 652 1820 iexplore.exe 35 PID 1820 wrote to memory of 1728 1820 iexplore.exe 36 PID 1820 wrote to memory of 1728 1820 iexplore.exe 36 PID 1820 wrote to memory of 1728 1820 iexplore.exe 36 PID 1820 wrote to memory of 1728 1820 iexplore.exe 36 PID 1000 wrote to memory of 1632 1000 SlimCleanerPlus.exe 37 PID 1000 wrote to memory of 1632 1000 SlimCleanerPlus.exe 37 PID 1000 wrote to memory of 1632 1000 SlimCleanerPlus.exe 37 PID 1000 wrote to memory of 1632 1000 SlimCleanerPlus.exe 37 PID 1000 wrote to memory of 1632 1000 SlimCleanerPlus.exe 37 PID 1000 wrote to memory of 1632 1000 SlimCleanerPlus.exe 37 PID 1000 wrote to memory of 1632 1000 SlimCleanerPlus.exe 37 PID 2192 wrote to memory of 2408 2192 msiexec.exe 40 PID 2192 wrote to memory of 2408 2192 msiexec.exe 40 PID 2192 wrote to memory of 2408 2192 msiexec.exe 40 PID 2192 wrote to memory of 2408 2192 msiexec.exe 40 PID 2192 wrote to memory of 2408 2192 msiexec.exe 40 PID 1820 wrote to memory of 2948 1820 iexplore.exe 42 PID 1820 wrote to memory of 2948 1820 iexplore.exe 42 PID 1820 wrote to memory of 2948 1820 iexplore.exe 42 PID 1820 wrote to memory of 2948 1820 iexplore.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe"C:\Users\Admin\AppData\Local\Temp\productmanualsguide.ad89e6240e9a44989b04b561ca5d55ae.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\Rundll32.exe"Rundll32.exe" "C:\Users\Admin\AppData\Local\ProductManualsGuideTooltab\TooltabExtension.dll",A -hp=https://hp.myway.com/productmanualsguide/ttab02/index.html -ua="(Windows NT 6.1; Win64; MSIE 11.0; Build 7601; SP 1)" -ul=https://anx.mindspark.com/anx.gif?anxa=%251&anxe=%252&anxt=B0472A38-E8F6-4E08-8810-24437E5CCB06&anxtv=2.8.1.1000&anxp=^CQW^xdm100^TTAB02^us&anxsi=1qa1&anxv=%253&anxd=2020-12-01&anxr=%254 -hu=SHOW2⤵
- Loads dropped DLL
PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\nss55BF.tmp\SlimCleanerPlus.exeSI_MODE=toaster SI_DELAY=60 SI_LAUNCH=onreboot @P2_ORIGIN=^CQW^xdm100^TTAB02^us @P2=^SW2^xdm110 @UL_STUBID=ad89e6240e9a44989b04b561ca5d55ae2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\DriverUpdate-setup.exe"C:\Users\Admin\AppData\Local\Temp\DriverUpdate-setup.exe" SI_DELAY=60 SI_LAUNCH=onreboot3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:240
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:209926 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:652
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:472072 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:734240 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2948
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding C743F45F47568E27DFE1A37D5E76A7C92⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2408
-