7177c05a6f7a7759098d5f94b67a8a5c168a4718f5ac04bd4743bf34d1af8945

Analysis

max time kernel
150s
max time network
136s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SlimCleanerPlus.exe
Size

247KB
MD5

69484c39e6aa358b57617b6e6e300d5a
SHA1

f9665fae82d5f02250b25825e36de974593623f3
SHA256

7177c05a6f7a7759098d5f94b67a8a5c168a4718f5ac04bd4743bf34d1af8945
SHA512

0e7ee6f2243edf62d4af0b7bd034080d3a4c4d56e0efe44888ff097906479a13936dfed53b037d129f0785857560ed89ce97ad0d64d41306e71a5dd4e1a17f06

Score

10^/10

persistence upx

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 640 created 3944 640 svchost.exe hdd.exe

description	pid	process	target process
PID 640 created 3944	640	svchost.exe	hdd.exe

Executes dropped EXE 11 IoCs

Processes:

DriverUpdate-setup.exeDriverUpdate.exeSlimWare.Services.exeSlimWare.Session.exeSlimWare.Session.exehdd.exeDriverUpdate.exeSlimWare.Services.exeSlimWare.Session.exeSlimWare.Session.exeDriverUpdate.exe

pid	process
3292	DriverUpdate-setup.exe
2956	DriverUpdate.exe
2652	SlimWare.Services.exe
3080	SlimWare.Session.exe
2916	SlimWare.Session.exe
3944	hdd.exe
1748	DriverUpdate.exe
3208	SlimWare.Services.exe
936	SlimWare.Session.exe
1444	SlimWare.Session.exe
1144	DriverUpdate.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\SlimWare Utilities Inc\DriverUpdate\htmlayout.dll	upx
\Users\Admin\AppData\Local\SlimWare Utilities Inc\DriverUpdate\htmlayout.dll	upx

Loads dropped DLL 38 IoCs

Processes:

MsiExec.exeDriverUpdate.exeSlimWare.Services.exeSlimWare.Session.exeSlimWare.Session.exeMsiExec.exeDriverUpdate.exeSlimWare.Services.exeSlimWare.Session.exeSlimWare.Session.exeDriverUpdate.exe

pid	process
2120	MsiExec.exe
2120	MsiExec.exe
2956	DriverUpdate.exe
2652	SlimWare.Services.exe
3080	SlimWare.Session.exe
3080	SlimWare.Session.exe
2652	SlimWare.Services.exe
3080	SlimWare.Session.exe
2652	SlimWare.Services.exe
3080	SlimWare.Session.exe
3080	SlimWare.Session.exe
3080	SlimWare.Session.exe
3080	SlimWare.Session.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2916	SlimWare.Session.exe
2916	SlimWare.Session.exe
2916	SlimWare.Session.exe
2704	MsiExec.exe
2704	MsiExec.exe
2704	MsiExec.exe
1748	DriverUpdate.exe
3208	SlimWare.Services.exe
936	SlimWare.Session.exe
936	SlimWare.Session.exe
3208	SlimWare.Services.exe
936	SlimWare.Session.exe
3208	SlimWare.Services.exe
936	SlimWare.Session.exe
936	SlimWare.Session.exe
1444	SlimWare.Session.exe
1444	SlimWare.Session.exe
1444	SlimWare.Session.exe
936	SlimWare.Session.exe
936	SlimWare.Session.exe
1748	DriverUpdate.exe
1748	DriverUpdate.exe
1144	DriverUpdate.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DriverUpdate.exeDriverUpdate.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	DriverUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverUpdate = "\"C:\\Program Files\\DriverUpdate\\DriverUpdate.exe\" -boot"	DriverUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	DriverUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverUpdate = "\"C:\\Program Files\\DriverUpdate\\DriverUpdate.exe\" -boot"	DriverUpdate.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverUpdate\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe

JavaScript code in executable 4 IoCs

Processes:

yara_rule
js
js
C:\Users\Admin\AppData\Local\Downloaded Installers\{42F25DDC-1AEF-428B-A479-ED2201B43DA6}\setup.msi	js
C:\Users\Public\Documents\Downloaded Installers\{836CC232-FC4F-427A-8944-425D623EAB45}\setup.msi	js

Drops file in Program Files directory 58 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Program Files\DriverUpdate\InAppBrowserProxy.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BugSplatRC.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\DriverUpdate.exe	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\BugSplatRC.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.ProxyStub.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\UnifiedLogger.dll	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\lib-inappbrowser.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\lib-inappbrowser.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\SlimWare.PushNotification.Services.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\SlimWare.Core.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\SlimWare.Messaging.dll	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\BugSplatRc.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BsSndRpt.exe	msiexec.exe
File created	C:\Program Files\DriverUpdate\htmlayout.dll	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\Open-Source Licenses.txt	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\UnifiedLogger.dll	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\BsSndRpt64.exe	msiexec.exe
File created	C:\Program Files\DriverUpdate\Open-Source Licenses.txt	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\SlimWare.DriverUpdate.Services.dll	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\BugSplat64.dll	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\dbghelp.dll	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\htmlayout.dll	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.ProxyStub.dll	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\DriverUpdate.exe	MsiExec.exe
File created	C:\Program Files\DriverUpdate\dbghelp.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\BugSplat.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.ProxyStub.dll	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\DriverUpdate.UpdateLauncher.exe	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\BsSndRpt.exe	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\dbghelp.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BugSplat.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BugSplatRC64.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.ProxyStub.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\UninstallStub.exe	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\SlimWare.Messaging.dll	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\BugSplat.dll	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\BugSplatRC64.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\dbghelp-app.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe	msiexec.exe
File created	C:\Program Files\DriverUpdate\InAppBrowserProxy.dll	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\DriverUpdate.exe	msiexec.exe
File created	C:\Program Files\DriverUpdate\BsSndRpt.exe	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\DriverUpdate.UpdateLauncher.exe	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\UninstallStub.exe	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\dbghelp-app.dll	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\BsSndRpt.exe	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\BugSplat.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\SlimWare.DriverUpdate.Services.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BugSplat64.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BsSndRpt64.exe	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\DriverUpdate.exe	MsiExec.exe
File created	C:\Program Files\DriverUpdate\BugSplatRc.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\dbghelp.dll	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\SlimWare.PushNotification.Services.dll	msiexec.exe
File opened for modification	C:\Program Files\SlimWare Utilities\Services\SlimWare.Core.dll	msiexec.exe

Drops file in Windows directory 27 IoCs

Processes:

msiexec.exeSlimWare.Session.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{42F25DDC-1AEF-428B-A479-ED2201B43DA6}\Icon.exe	msiexec.exe
File opened for modification	C:\Windows\Tasks\DriverUpdate_update_Admin.job	SlimWare.Session.exe
File created	C:\Windows\Installer\SourceHash{836CC232-FC4F-427A-8944-425D623EAB45}	msiexec.exe
File opened for modification	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Tasks\DriverUpdate_update_Admin.job	SlimWare.Session.exe
File opened for modification	C:\Windows\Installer\MSI2523.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2802.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A16.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f745f31.msi	msiexec.exe
File created	C:\Windows\Installer\f745f55.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FE8.tmp	msiexec.exe
File created	C:\Windows\Installer\f745f30.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI68D2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{42F25DDC-1AEF-428B-A479-ED2201B43DA6}	msiexec.exe
File created	C:\Windows\Installer\{42F25DDC-1AEF-428B-A479-ED2201B43DA6}\Icon.exe	msiexec.exe
File created	C:\Windows\Installer\f745f31.msi	msiexec.exe
File created	C:\Windows\Installer\{836CC232-FC4F-427A-8944-425D623EAB45}\Icon.exe	msiexec.exe
File created	C:\Windows\Installer\f745f2d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2030.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f745f2d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D76.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{836CC232-FC4F-427A-8944-425D623EAB45}\Icon.exe	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SlimWare.Session.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Address	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\RemovalPolicy	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceType	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\LowerFilters	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	SlimWare.Session.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Driver	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\RemovalPolicy	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs	SlimWare.Session.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Address	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceCharacteristics	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs	SlimWare.Session.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	SlimWare.Session.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	SlimWare.Session.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UINumber	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UINumberDescFormat	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceType	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UINumberDescFormat	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\LocationInformation	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\LocationInformation	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities	SlimWare.Session.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UpperFilters	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Driver	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceCharacteristics	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\UpperFilters	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\UINumber	SlimWare.Session.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\LowerFilters	SlimWare.Session.exe

Modifies Control Panel 1 IoCs
evasion

Processes:

MicrosoftEdge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors MicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

MsiExec.exeMsiExec.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\DriverUpdate.exe = "11001"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\DriverUpdate.exe = "11001"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\DriverUpdate.exe = "11001"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\DriverUpdate.exe = "11001"	MsiExec.exe

Modifies data under HKEY_USERS 111 IoCs

Processes:

SlimWare.Services.exeSlimWare.Services.exemsiexec.exeSlimWare.Session.exeSlimWare.Session.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	SlimWare.Services.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\19\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SlimWare.Services.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\19\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	SlimWare.Services.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\18	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	SlimWare.Services.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\19\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	SlimWare.Services.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	SlimWare.Services.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SlimWare.Session.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	SlimWare.Services.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\19\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	SlimWare.Session.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	SlimWare.Services.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\19\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	SlimWare.Services.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	SlimWare.Session.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	SlimWare.Services.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	SlimWare.Session.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	SlimWare.Services.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	SlimWare.Services.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	SlimWare.Services.exe

Modifies registry class 506 IoCs

Processes:

msiexec.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CDD52F24FEA1B8244A97DE22104BD36A	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\0\win64	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\Version	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\slimware.com\Total = "209"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\NumMethods\ = "9"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 998267c856add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\TypeLib\ = "{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\ = "SlimWareSession"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDD52F24FEA1B8244A97DE22104BD36A\ProductIcon = "C:\\Windows\\Installer\\{42F25DDC-1AEF-428B-A479-ED2201B43DA6}\\Icon.exe"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\NumMethods	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\TypeLib	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\TypeLib	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\AppID = "{BAF61B64-5D1A-4108-97CB-A10B7DDF730E}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = d090e820b9ead601	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "39"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\FLAGS\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 998267c856add601	MicrosoftEdge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\slimware.com\NumberOfSubdoma = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\slimware.com\ = "209"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\0\win64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\AppID = "{6D3BC646-CFCD-4098-8495-B7BD0DF13133}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\LocalServer32	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "118"	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CDD52F24FEA1B8244A97DE22104BD36A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\slimware.com\NumberOfSubdoma = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\0	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

DriverUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	DriverUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	DriverUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	DriverUpdate.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

MsiExec.exemsiexec.exeDriverUpdate.exeMsiExec.exeDriverUpdate.exehdd.exe

pid	process
2120	MsiExec.exe
2120	MsiExec.exe
2120	MsiExec.exe
2120	MsiExec.exe
212	msiexec.exe
212	msiexec.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2704	MsiExec.exe
2704	MsiExec.exe
2704	MsiExec.exe
2704	MsiExec.exe
212	msiexec.exe
212	msiexec.exe
2704	MsiExec.exe
2704	MsiExec.exe
2704	MsiExec.exe
2704	MsiExec.exe
212	msiexec.exe
212	msiexec.exe
1748	DriverUpdate.exe
1748	DriverUpdate.exe
1748	DriverUpdate.exe
1748	DriverUpdate.exe
1748	DriverUpdate.exe
1748	DriverUpdate.exe
1748	DriverUpdate.exe
1748	DriverUpdate.exe
1748	DriverUpdate.exe
1748	DriverUpdate.exe
3944	hdd.exe
3944	hdd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

4424 MicrosoftEdgeCP.exe
4424 MicrosoftEdgeCP.exe

pid	process
4424	MicrosoftEdgeCP.exe
4424	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 265 IoCs

Processes:

DriverUpdate-setup.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	3292	DriverUpdate-setup.exe
Token: SeIncreaseQuotaPrivilege	3292	DriverUpdate-setup.exe
Token: SeSecurityPrivilege	212	msiexec.exe
Token: SeCreateTokenPrivilege	3292	DriverUpdate-setup.exe
Token: SeAssignPrimaryTokenPrivilege	3292	DriverUpdate-setup.exe
Token: SeLockMemoryPrivilege	3292	DriverUpdate-setup.exe
Token: SeIncreaseQuotaPrivilege	3292	DriverUpdate-setup.exe
Token: SeMachineAccountPrivilege	3292	DriverUpdate-setup.exe
Token: SeTcbPrivilege	3292	DriverUpdate-setup.exe
Token: SeSecurityPrivilege	3292	DriverUpdate-setup.exe
Token: SeTakeOwnershipPrivilege	3292	DriverUpdate-setup.exe
Token: SeLoadDriverPrivilege	3292	DriverUpdate-setup.exe
Token: SeSystemProfilePrivilege	3292	DriverUpdate-setup.exe
Token: SeSystemtimePrivilege	3292	DriverUpdate-setup.exe
Token: SeProfSingleProcessPrivilege	3292	DriverUpdate-setup.exe
Token: SeIncBasePriorityPrivilege	3292	DriverUpdate-setup.exe
Token: SeCreatePagefilePrivilege	3292	DriverUpdate-setup.exe
Token: SeCreatePermanentPrivilege	3292	DriverUpdate-setup.exe
Token: SeBackupPrivilege	3292	DriverUpdate-setup.exe
Token: SeRestorePrivilege	3292	DriverUpdate-setup.exe
Token: SeShutdownPrivilege	3292	DriverUpdate-setup.exe
Token: SeDebugPrivilege	3292	DriverUpdate-setup.exe
Token: SeAuditPrivilege	3292	DriverUpdate-setup.exe
Token: SeSystemEnvironmentPrivilege	3292	DriverUpdate-setup.exe
Token: SeChangeNotifyPrivilege	3292	DriverUpdate-setup.exe
Token: SeRemoteShutdownPrivilege	3292	DriverUpdate-setup.exe
Token: SeUndockPrivilege	3292	DriverUpdate-setup.exe
Token: SeSyncAgentPrivilege	3292	DriverUpdate-setup.exe
Token: SeEnableDelegationPrivilege	3292	DriverUpdate-setup.exe
Token: SeManageVolumePrivilege	3292	DriverUpdate-setup.exe
Token: SeImpersonatePrivilege	3292	DriverUpdate-setup.exe
Token: SeCreateGlobalPrivilege	3292	DriverUpdate-setup.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

DriverUpdate.exeDriverUpdate.exehdd.exe

pid process

2956 DriverUpdate.exe
2956 DriverUpdate.exe
1748 DriverUpdate.exe
3944 hdd.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

DriverUpdate.exeDriverUpdate.exehdd.exe

pid process

2956 DriverUpdate.exe
2956 DriverUpdate.exe
1748 DriverUpdate.exe
3944 hdd.exe

Suspicious use of SetWindowsHookEx 445 IoCs

Processes:

DriverUpdate.exe

pid	process
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe
2956	DriverUpdate.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

SlimCleanerPlus.exemsiexec.exesvchost.exeDriverUpdate.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 576 wrote to memory of 3292	576	SlimCleanerPlus.exe	DriverUpdate-setup.exe
PID 576 wrote to memory of 3292	576	SlimCleanerPlus.exe	DriverUpdate-setup.exe
PID 576 wrote to memory of 3292	576	SlimCleanerPlus.exe	DriverUpdate-setup.exe
PID 212 wrote to memory of 2120	212	msiexec.exe	MsiExec.exe
PID 212 wrote to memory of 2120	212	msiexec.exe	MsiExec.exe
PID 212 wrote to memory of 2704	212	msiexec.exe	MsiExec.exe
PID 212 wrote to memory of 2704	212	msiexec.exe	MsiExec.exe
PID 640 wrote to memory of 1748	640	svchost.exe	DriverUpdate.exe
PID 640 wrote to memory of 1748	640	svchost.exe	DriverUpdate.exe
PID 640 wrote to memory of 1748	640	svchost.exe	DriverUpdate.exe
PID 1748 wrote to memory of 4056	1748	DriverUpdate.exe	LaunchWinApp.exe
PID 1748 wrote to memory of 4056	1748	DriverUpdate.exe	LaunchWinApp.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4424 wrote to memory of 4488	4424	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\SlimCleanerPlus.exe
"C:\Users\Admin\AppData\Local\Temp\SlimCleanerPlus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Users\Admin\AppData\Local\Temp\DriverUpdate-setup.exe
"C:\Users\Admin\AppData\Local\Temp\DriverUpdate-setup.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 58F93456409176C113B96A0769C90BF3
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2120

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding B3E2DE0CD66D6043E693F35F8DBDDBDA
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2704

C:\Program Files\DriverUpdate\DriverUpdate.exe
"C:\Program Files\DriverUpdate\DriverUpdate.exe" /byUser
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2956

C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe
"C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:2652

C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe
"C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:3080

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2208

C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe
"C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2916

C:\Users\Admin\AppData\Local\SlimWare Utilities Inc\DriverUpdate\Updates\hdd.exe
"C:\Users\Admin\AppData\Local\SlimWare Utilities Inc\DriverUpdate\Updates\hdd.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3944

C:\Program Files\DriverUpdate\DriverUpdate.exe
"C:\Program Files\DriverUpdate\DriverUpdate.exe" -installscan
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://slimware.com/register/driverupdate?&guid=14b1e30e-7d49-4130-a56b-411789241f11&lang=en&installer_data=ewogICAidXBsIiA6ICJZVG8yT250ek9qRXlPaUoxYzJWeVUyVm5iV1Z1ZEhNaU8wODZPRG9pYzNS%0D%0Aa1EyeGhjM01pT2pFNmUzTTZNVFE2SWxOdlpuUjNZWEpsVlhCa1lYUmxJanRQT2pnNkluTjBaRU5z%0D%0AWVhOeklqb3lPbnR6T2pZNklsVndaR0YwWlNJN2N6b3hNRG9pTWpBeU1DMHhNaTB4TmlJN2N6bzNP%0D%0AaUpXWlhKemFXOXVJanR6T2pZNklqVXVPQzR4TmlJN2ZYMXpPakV4T2lKaWNtOTNjMlZ5Vkhsd1pT%0D%0ASTdZam93TzNNNk1UUTZJbUp5YjNkelpYSldaWEp6YVc5dUlqdGlPakE3Y3pveE5Ub2lZbkp2ZDNO%0D%0AbGNreGhibWQxWVdkbElqdHpPakE2SWlJN2N6b3hNRG9pY0d4aGRHWnZjbTFQVXlJN2N6bzNPaUpY%0D%0AYVc1a2IzZHpJanR6T2pFM09pSndiR0YwWm05eWJVOVRWbVZ5YzJsdmJpSTdZam93TzMwPSIsCiAg%0D%0AICJ1c2VyU2VnbWVudHMiIDogIk86ODpcInN0ZENsYXNzXCI6MTp7czoxNDpcIlNvZnR3YXJlVXBk%0D%0AYXRlXCI7Tzo4Olwic3RkQ2xhc3NcIjoyOntzOjY6XCJVcGRhdGVcIjtzOjEwOlwiMjAyMC0xMi0x%0D%0ANlwiO3M6NzpcIlZlcnNpb25cIjtzOjY6XCI1LjguMTZcIjt9fSIKfQo=&config=YTo1OntzOjY6Im1lbW9yeSI7czo2OiI0LjAgR0IiO3M6NToibW9kZWwiO3M6NDoiODBURyI7czo4%0D%0AOiJncmFwaGljcyI7czozMToiTWljcm9zb2Z0IEJhc2ljIERpc3BsYXkgQWRhcHRlciI7czo5OiJw%0D%0Acm9jZXNzb3IiO3M6MjM6IlBlcnNvY29uIFByb2Nlc3NvciAyLjUrIjtzOjEyOiJtYW51ZmFjdHVy%0D%0AZXIiO3M6NjoiTEVOT1ZPIjt9&machineId=52AA65E3-63C4-4AB8-8ED2-906CCCEADE93&installId=29F56AD6-E42E-431E-BB5D-8B4C03D5DE85&productVersion=5.8.16.54"
3⤵
PID:4056

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:640

C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe
"C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:3208

C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe
"C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:936

C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe
"C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2660

C:\Program Files\DriverUpdate\DriverUpdate.exe
"C:\Program Files\DriverUpdate\DriverUpdate.exe" "C:\Program Files\DriverUpdate\DriverUpdate.exe" -installresults
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
PID:4164

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4212

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4424

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\DriverUpdate\BugSplat.dll
MD5
e294d13f8b64989a2b15b558f567d7ba

SHA1
e10626ae59f1c888ed48c7be51e9e8b491259599

SHA256
6fd184e4e2b1d4ca2314f4d16b0e86a0e398054038a2235086d588f02bf39c67

SHA512
5292aaae51e82daf55e6dbe68182b253f238e5cbd50fd342bc51cb82ff13b64c2fba4fa97ddd07bbf6283301c0f84f5f6b5a3a762e995fc54f6d4ed9807fd407

Download Submit
C:\Program Files\DriverUpdate\BugSplat.dll
MD5
e294d13f8b64989a2b15b558f567d7ba

SHA1
e10626ae59f1c888ed48c7be51e9e8b491259599

SHA256
6fd184e4e2b1d4ca2314f4d16b0e86a0e398054038a2235086d588f02bf39c67

SHA512
5292aaae51e82daf55e6dbe68182b253f238e5cbd50fd342bc51cb82ff13b64c2fba4fa97ddd07bbf6283301c0f84f5f6b5a3a762e995fc54f6d4ed9807fd407

Download Submit
C:\Program Files\DriverUpdate\DriverUpdate.exe
MD5
8af291afb5a9d7ddf7d0e2935068e2f1

SHA1
64604fa3dd2e2f13dfb7f844d93d0c712836d4a0

SHA256
47d5c386963dfdc42b673c597e9a67bdbffaa718b80be3d8d8e793857f03a057

SHA512
2da8158a93d4656bc511249d62909b404b0f761f0cfd4557d0d405d433cc370881823779fe04602651f3144e98b9cb66d7af622a23a7679249c6cd84c1dda2c7

Download Submit
C:\Program Files\DriverUpdate\DriverUpdate.exe
MD5
8af291afb5a9d7ddf7d0e2935068e2f1

SHA1
64604fa3dd2e2f13dfb7f844d93d0c712836d4a0

SHA256
47d5c386963dfdc42b673c597e9a67bdbffaa718b80be3d8d8e793857f03a057

SHA512
2da8158a93d4656bc511249d62909b404b0f761f0cfd4557d0d405d433cc370881823779fe04602651f3144e98b9cb66d7af622a23a7679249c6cd84c1dda2c7

Download Submit
C:\Program Files\DriverUpdate\DriverUpdate.exe
MD5
8a70193b4d03c2225199f106ed25be0a

SHA1
9038ec8ff8a977d2f003b819f10d1bcfe0c88d38

SHA256
e7321eb4fe557003ab89958e50123a92e41361dbe814267dd5dc2ff08c6b1b30

SHA512
99624961333af324c6af66df4445f50371a18156635a81cc55b9dd3869ead99cf3a140833de15e515ebe5eb706a7ef13242801b20a59d749ede0632283f572b5

Download Submit
C:\Program Files\DriverUpdate\DriverUpdate.exe
MD5
8a70193b4d03c2225199f106ed25be0a

SHA1
9038ec8ff8a977d2f003b819f10d1bcfe0c88d38

SHA256
e7321eb4fe557003ab89958e50123a92e41361dbe814267dd5dc2ff08c6b1b30

SHA512
99624961333af324c6af66df4445f50371a18156635a81cc55b9dd3869ead99cf3a140833de15e515ebe5eb706a7ef13242801b20a59d749ede0632283f572b5

Download Submit
C:\Program Files\DriverUpdate\SlimWare.DriverUpdate.Services.dll
MD5
2611df02d48c1ed0f7eda2f7b2020390

SHA1
e4999bbd0758f9f17cd97532f61308edb7dea385

SHA256
6941bf5e7a9022497bab9d9254335d214a6623ad20c9321879f18af2f0409494

SHA512
421aac2c3c04630d8fc4f87babfe757c6f3512051c56b91c8701c30f2e3d9071521c9c0d1958ae1846286f1b5d245101be2c7c41b6b06a961b954569a05e4e23

Download Submit
C:\Program Files\DriverUpdate\SlimWare.Messaging.dll
MD5
f26ee35dfdbf2ef289268dc8b244078c

SHA1
1523a81370fadbfa63c8ae84d81464e7ec6b83c3

SHA256
35f6bfc4f28df75e2b690f596b3eb3e3f0a5fb2fc664f325d803f7dfe036a309

SHA512
562dd87c48754d27d5d0815b99e16f79117e14e8271323755e266fc9a094fc6cccbf20bef50d1c3aad74340f2230f87d72fd3a98ac64dba88f4732936a753392

Download Submit
C:\Program Files\DriverUpdate\SlimWare.PushNotification.Services.dll
MD5
3384dcb5ad4b754ac81a287282384b6d

SHA1
14b223746d698793103274bf4c027c828b7e154d

SHA256
2b8c0c3a1dec6b036702cb900a9f90377246e164cdceea269c7b65dc5d3e0006

SHA512
23c50e771e10e7ba1c2cd2ee1f6aa9a6bf6e63b9ce44436344e33e2e57f3b1e8956b140461b00014274a0ec3e9907e2f91b025223099352dfee1815803a7d013

Download Submit
C:\Program Files\DriverUpdate\UnifiedLogger.dll
MD5
595836df7cdf3c1c51febd8a0f1d3ef9

SHA1
9c1a721c74982be20a1767affed8d24660a9b85c

SHA256
a45ae9e7bbf2f0a0ff3d92b4b24a24dee5fb06fa148a965465b07f79a0e8bd2f

SHA512
02f7626aa48318d3b7bc83a7c5ffba3e15197d4462727f3070444ca1009ecd122edeed89b899ea3f55d86ab46d1e808b1d42ccdc464652e4b6b533f60263c03b

Download Submit
C:\Program Files\SlimWare Utilities\Services\BugSplat64.dll
MD5
f1a2d92bb8738eab02b92c741a9c5299

SHA1
ac22734c386e3e2dabe9ac9767a23e8f01755d4f

SHA256
6859c336dc4f42dc70a542db8185948931907734978eeb7088d47256bd4199cd

SHA512
344ad89725e98636bae65b219f479a59c98e0131e2dbbab80c3c35443b776499d5c2a4e218ce62c0752cc67eb595c75b83775c54065a13986265885675b0cd99

Download Submit
C:\Program Files\SlimWare Utilities\Services\BugSplat64.dll
MD5
f1a2d92bb8738eab02b92c741a9c5299

SHA1
ac22734c386e3e2dabe9ac9767a23e8f01755d4f

SHA256
6859c336dc4f42dc70a542db8185948931907734978eeb7088d47256bd4199cd

SHA512
344ad89725e98636bae65b219f479a59c98e0131e2dbbab80c3c35443b776499d5c2a4e218ce62c0752cc67eb595c75b83775c54065a13986265885675b0cd99

Download Submit
C:\Program Files\SlimWare Utilities\Services\SlimWare.Core.dll
MD5
4ae1352e34bee2b1d51e92cb19be0343

SHA1
1b5d2fe506cc0de9c688693b8a4619ecdb92b30e

SHA256
c4fbabb2163face03d868132b691dc7ec774de246ebf822de21d92066baa5c61

SHA512
e677572469cc520210270febc7180d9b276b956cfe32346cc0825dce3a832c46f47d535719b5da966873924f48ae08110686676f6b089eec6e86c5d69ce5b4aa

Download Submit
C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe
MD5
995ff280e8d1390e246c6f0205726652

SHA1
48f3d6db71b30e6e8537afcbf709a63d6652504d

SHA256
30cadd9db505515b4c07d409a19acd6b74e5d7e09eea56c0a164d72a1da061f5

SHA512
666bb8988c77b176c69de9d7d3f69357f63927442d0fa04c56cbf6424bacbc38affb2397224f44a11ace72e1d6f81ceb4c56a235991d98b2500fc3df2b579747

Download Submit
C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe
MD5
995ff280e8d1390e246c6f0205726652

SHA1
48f3d6db71b30e6e8537afcbf709a63d6652504d

SHA256
30cadd9db505515b4c07d409a19acd6b74e5d7e09eea56c0a164d72a1da061f5

SHA512
666bb8988c77b176c69de9d7d3f69357f63927442d0fa04c56cbf6424bacbc38affb2397224f44a11ace72e1d6f81ceb4c56a235991d98b2500fc3df2b579747

Download Submit
C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe
MD5
cafa201c22f96d57102147b403c5dc47

SHA1
d311f72b61dce4ac963f01e708cb7bc216d19aa2

SHA256
e0f1740a80b80472ed0c00cf8fd1f5221305ab3ef61ee1ae0f4db832923f8211

SHA512
db5ac7794b278742a2b7f38547f000bd38be8d89a6599133981aeec784157264222c14cb9a9c577e2ac52a1dfab1db067d8c0e46eafd942dcd4941fe034ef677

Download Submit
C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.ProxyStub.dll
MD5
e8a388c2d46682f8e4534dcb4e791b2d

SHA1
58562a122c62ef6149e2a23f77c82ef2175bb929

SHA256
0f6ab9a939cb5a41fc33f37a09c33018d46d05c218e7973d44b1aba6231a9afa

SHA512
a455ed39670ce899cb475509a28fde81cdf58167b85a4460f60522aa92041e425a8b24dd27b9bff7d8466c139cdb0f4163f4e2b4c60b8d8d65d8030fa5b5a362

Download Submit
C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe
MD5
9e61f0cadd788cb37295c2f9e64a5fc5

SHA1
937975bdedded1adf7090f87d68e5086d44a144d

SHA256
754ffc8dbef9471a706ca0ab2f4d81c38d10fe764e0949adb02346fbb8f0c609

SHA512
bbf037a44c786ad8d1ffd2868da8baac33e329566d3377c862f5aec2daa8acdeb21eea4f2ee9ac77645a7f000d1b2cdc5e6bd7407d5f65f7701af0b336dbef60

Download Submit
C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe
MD5
9e61f0cadd788cb37295c2f9e64a5fc5

SHA1
937975bdedded1adf7090f87d68e5086d44a144d

SHA256
754ffc8dbef9471a706ca0ab2f4d81c38d10fe764e0949adb02346fbb8f0c609

SHA512
bbf037a44c786ad8d1ffd2868da8baac33e329566d3377c862f5aec2daa8acdeb21eea4f2ee9ac77645a7f000d1b2cdc5e6bd7407d5f65f7701af0b336dbef60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
MD5
f357eb4410a777a9c60906d56b7c52b1

SHA1
562c0bf5d1c5de1a3cf56a57a425f7258116bde8

SHA256
40d19aa62a6655f0f01eef57b71dce671ad824b8007641492c62e9ea78b7c081

SHA512
15b2074b173702f2e86e4852e3e94bd4b018aa03035bce05311833df36562dedf115b521c7f2a63c51ab582bf9083136e1d097c5167ac8c94e8f603e5cddafd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A19ADAD9D098E039450ABBEDD5616EB_0F3C35357610567825C1AF26DD5D8A86
MD5
5c0aa9f83b7eb0fdde43379e12ac24a4

SHA1
9f7d641b8be746dade5ed98c5457aece8e7b888b

SHA256
61bd32047515af10a69ddc96c95ef9e589baa4761319cce653eff0104693ee8f

SHA512
c1145491a6a55550573bf7ecb87255ec0f3e968423a15bbe84303a534117a07ad54d7be1a562e38f7bb32a81103ddf618b20b62c895a927e6a43d4430cc5d3d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
MD5
f0453022a3c4c7d62cba34ba5cea4c45

SHA1
35255f85ad99b7f033c40f1534c3c20bf7088f84

SHA256
bd62715094d50faf9134c39476dc4dcfc4231c254e152538e3661be17f93bba5

SHA512
60a6450748acda2f9dee36285ee8e2fca37d45e0b6edc06855ddc1f0d22b5f199f3d9d24a391af117c592065d6fe2ad7f5c713561b1ad1016dfa37d18826844a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_2280A2210A1DD6666EC3A552D924ABF6
MD5
317e10a92ac49a65f2f384f784438373

SHA1
721e8912330fd3540bd89d122dec20a34fd96a62

SHA256
3a1e9c79972dbf9af22bd14332ca9a97a2cb895dd6dfbbc156e4a68edddf0a34

SHA512
327528b2b0bd88072c6a8ba2958fc1165d572dfed900c60d04d76149486f8650cfab0c24c8734d0bc1122a8dc64fbbe80a25331e95e84d3b58b9a8fa89e9f8a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
MD5
a0ac65d628be0bbf85b15926929a2d5d

SHA1
5db37cbe67557179cb2916aa4248a3a017884b64

SHA256
4ed544b6eaaf594ec32fcac911e39add4a890d0768584112cf40924b670b64ce

SHA512
cf7cf82de3a215e71eb0955a8cdb7c5102d6ed3b8523714e68281a4679252d93a5372fc63534bb7a9e338d9d4198257d8213335aefc41802c1524ef7938b6a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A19ADAD9D098E039450ABBEDD5616EB_0F3C35357610567825C1AF26DD5D8A86
MD5
505e0ff09164892463b00b934845402c

SHA1
a1551f6373e6cee2ee665efac2d37924381feb47

SHA256
aa5afc6af12a46b646ce98dbbb893d2721a4010f03726526cdbfeea3815e0e1a

SHA512
2f2f240861851a14bf8a44779de72e439b9cc523cbcb75caa9ba11a3343ecb708cf56b9c10e07240445e7a8052db47c087419afb648fb82a4f7c175830af6a68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
MD5
b3f755e3da1ff531dbebc377797ccd66

SHA1
4662e325b0292db9c0d6ebba88eb617248cbbac7

SHA256
a0cbdd77273db76e2bf9a76d19513fb5fe5a045abdf35bbf9efff24456ecf545

SHA512
59138047afe1078c5f26ff272bcef2631566e9b5f4f7cecf72d2dbb218b67b94aace159e1f5c529ba35cfe968d87f9def062a41392e6e45c5fa7c514cf2d40dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_2280A2210A1DD6666EC3A552D924ABF6
MD5
d7ca387fb548ab5b3ab6b2fb3e0b6ad1

SHA1
df4d22629589ec67a53ca3643a62e65c5ed8ba01

SHA256
ce7ed253431473ed3cef150ff0d8c71bfe49458436dff8835225aea2df0d9106

SHA512
e841a2a08291d514b7717c5bd3aa24936e75e45645019b4fd82e556c07cd1b0cd3139afcd7b8afe471c50613cce7cfc34a02ba39dce94944bc99405d9432e960

Download Submit
C:\Users\Admin\AppData\Local\Downloaded Installers\{42F25DDC-1AEF-428B-A479-ED2201B43DA6}\setup.msi
MD5
801ba0fafddec68bac9810bc7f81b6c6

SHA1
ab903c9b132375c1adab91e4ef88f2971819c618

SHA256
1360e00043f228c856a0572c2df874736f38e82701f524e14eed196aaa9628bd

SHA512
aaab2600534902f4a89b60710770f8f0567115a1fd085838031844deaabfc81506739e8dfae22c94ab50c0476e14554eac169325b7ee02710eb4fde57c2c5517

Download Submit
C:\Users\Admin\AppData\Local\SlimWare Utilities Inc\DriverUpdate\Updates\hdd.exe
MD5
9b57d8f7ebf2e307a02430be0a1cdab1

SHA1
15aa078a2e52d95702a35a9d7cff2ec352c73913

SHA256
92dd3781f16d24879509cc96d5a8d3a648ba0249e7da7b1f829e0d4bc455528a

SHA512
387f35d43d2c8e6c1de420e6e3a4b73dc5822901761a2ca4d6e58a0579545ef441dfe3d86dbd1bc0b088f3fa302d13d98c544d6e4491fee9e88c8c0609cecb42

Download Submit
C:\Users\Admin\AppData\Local\SlimWare Utilities Inc\DriverUpdate\Updates\hdd.exe
MD5
9b57d8f7ebf2e307a02430be0a1cdab1

SHA1
15aa078a2e52d95702a35a9d7cff2ec352c73913

SHA256
92dd3781f16d24879509cc96d5a8d3a648ba0249e7da7b1f829e0d4bc455528a

SHA512
387f35d43d2c8e6c1de420e6e3a4b73dc5822901761a2ca4d6e58a0579545ef441dfe3d86dbd1bc0b088f3fa302d13d98c544d6e4491fee9e88c8c0609cecb42

Download Submit
C:\Users\Admin\AppData\Local\SlimWare Utilities Inc\DriverUpdate\settings.db
MD5
1e1067364e7e505759853a120c55573e

SHA1
7b23d564ff965db4d1b0bf11010a3b5449d7813d

SHA256
1c08d1f779d626569dcd221ab95b2c999467f09b4aa9c58b78ca75b34d828c29

SHA512
f7d25a8853d818540b6cbde2982d7c9c1527157e1f38bce5176b10fa146b8eae64c03c40017646248557ca36fb74c70328b4ddca4b47d002d96bfd8b9370aa48

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverUpdate-setup.exe
MD5
bbcc5cc6703387cbf4c33ec2a45dce4b

SHA1
2011027d000cf409be97759f36116e40f23fc49e

SHA256
55ca33616c468a86bd12044dd2f1628365511811878f47ce0fa868e0ce59d823

SHA512
d1cec1368c2246b3e3aab8191052ab6be0b7cdea496e37efb7f20fef73cb3e64be8fbd1d2c24882660e1f6bd8ced9cc9c9941f472182b9cefeae8161260535a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DriverUpdate-setup.exe
MD5
bbcc5cc6703387cbf4c33ec2a45dce4b

SHA1
2011027d000cf409be97759f36116e40f23fc49e

SHA256
55ca33616c468a86bd12044dd2f1628365511811878f47ce0fa868e0ce59d823

SHA512
d1cec1368c2246b3e3aab8191052ab6be0b7cdea496e37efb7f20fef73cb3e64be8fbd1d2c24882660e1f6bd8ced9cc9c9941f472182b9cefeae8161260535a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\SW2-install.log
MD5
a1dc68843b5a8caf79cbfa318b8cb651

SHA1
2ddbecd1b13c4cc60cc1e69097e090c6557e3dc7

SHA256
3575e371ddfb3046c8e3c53266f8c5a8e8e4110cae7ee0a8ff4e7f95dd44c435

SHA512
1f0a90b2d17d9b28289b93085669898f3800572a52ba55d1ab99da09572f3bade82d9f9bdcf7c4ab5f23ecb89090f37e66b94db673e07fcafbe6a5ce710df780

Download Submit
C:\Users\Public\Documents\Downloaded Installers\{836CC232-FC4F-427A-8944-425D623EAB45}\setup.msi
MD5
5ecb968f55f9c1841f82a4e930ee3c24

SHA1
465af397d6fcff13a08a56141d96bc32acf829a1

SHA256
b89865f15344b76778ab09865ea7c4f7119189d2aa775eb6a74567ceac398ea0

SHA512
72c86217fe05819f4892ef606a9c233e8959fd6ef77037a246aec5857b0bbd5ab37230af3ec54c35bedd6f48a2ed029cfbd7e4e44493487ff26a4a0ddb730336

Download Submit
C:\Windows\Installer\MSI2030.tmp
MD5
fb6cdb0cddd0f384701022b0d1e8d833

SHA1
6477ad19453f4935e9a72682eff59590fa8c6ffd

SHA256
24556d9695f166c495c738f265e1ad82de8883acb44ab78f882867f52339ee0a

SHA512
aba895fd39a6648a548a433fb6db72c2127573fc6f5e905a92b885e41fd3b118d454dc92ca8a88df84d92d11e762986dc14a11b5b7f0d739ef6d2d9187796143

Download Submit
C:\Windows\Installer\MSI2523.tmp
MD5
d2a8f90e612d94e082361d1e677096b8

SHA1
4d2765ab69e4aaedb8512315a78544fbde056229

SHA256
55f607d337ff05b247f9d4b7cafecd500d2058b4f2cd9702bf86bea18d8bb6e2

SHA512
83b932ca46fc64e1d2871daefff85169ccce5143c242f773851858531e7a6be9e3525618d6d020f09cccd8f31a8ba78a45cd75e739aed8cd7495d323e2df72c6

Download Submit
C:\Windows\Installer\MSI3C2A.tmp
MD5
fb6cdb0cddd0f384701022b0d1e8d833

SHA1
6477ad19453f4935e9a72682eff59590fa8c6ffd

SHA256
24556d9695f166c495c738f265e1ad82de8883acb44ab78f882867f52339ee0a

SHA512
aba895fd39a6648a548a433fb6db72c2127573fc6f5e905a92b885e41fd3b118d454dc92ca8a88df84d92d11e762986dc14a11b5b7f0d739ef6d2d9187796143

Download Submit
C:\Windows\Installer\MSI68D2.tmp
MD5
d2a8f90e612d94e082361d1e677096b8

SHA1
4d2765ab69e4aaedb8512315a78544fbde056229

SHA256
55f607d337ff05b247f9d4b7cafecd500d2058b4f2cd9702bf86bea18d8bb6e2

SHA512
83b932ca46fc64e1d2871daefff85169ccce5143c242f773851858531e7a6be9e3525618d6d020f09cccd8f31a8ba78a45cd75e739aed8cd7495d323e2df72c6

Download Submit
C:\Windows\Installer\MSI6FE8.tmp
MD5
d2a8f90e612d94e082361d1e677096b8

SHA1
4d2765ab69e4aaedb8512315a78544fbde056229

SHA256
55f607d337ff05b247f9d4b7cafecd500d2058b4f2cd9702bf86bea18d8bb6e2

SHA512
83b932ca46fc64e1d2871daefff85169ccce5143c242f773851858531e7a6be9e3525618d6d020f09cccd8f31a8ba78a45cd75e739aed8cd7495d323e2df72c6

Download Submit
\Program Files\DriverUpdate\BugSplat.dll
MD5
e294d13f8b64989a2b15b558f567d7ba

SHA1
e10626ae59f1c888ed48c7be51e9e8b491259599

SHA256
6fd184e4e2b1d4ca2314f4d16b0e86a0e398054038a2235086d588f02bf39c67

SHA512
5292aaae51e82daf55e6dbe68182b253f238e5cbd50fd342bc51cb82ff13b64c2fba4fa97ddd07bbf6283301c0f84f5f6b5a3a762e995fc54f6d4ed9807fd407

Download Submit
\Program Files\DriverUpdate\BugSplat.dll
MD5
e294d13f8b64989a2b15b558f567d7ba

SHA1
e10626ae59f1c888ed48c7be51e9e8b491259599

SHA256
6fd184e4e2b1d4ca2314f4d16b0e86a0e398054038a2235086d588f02bf39c67

SHA512
5292aaae51e82daf55e6dbe68182b253f238e5cbd50fd342bc51cb82ff13b64c2fba4fa97ddd07bbf6283301c0f84f5f6b5a3a762e995fc54f6d4ed9807fd407

Download Submit
\Program Files\DriverUpdate\SlimWare.DriverUpdate.Services.dll
MD5
2611df02d48c1ed0f7eda2f7b2020390

SHA1
e4999bbd0758f9f17cd97532f61308edb7dea385

SHA256
6941bf5e7a9022497bab9d9254335d214a6623ad20c9321879f18af2f0409494

SHA512
421aac2c3c04630d8fc4f87babfe757c6f3512051c56b91c8701c30f2e3d9071521c9c0d1958ae1846286f1b5d245101be2c7c41b6b06a961b954569a05e4e23

Download Submit
\Program Files\DriverUpdate\SlimWare.Messaging.dll
MD5
f26ee35dfdbf2ef289268dc8b244078c

SHA1
1523a81370fadbfa63c8ae84d81464e7ec6b83c3

SHA256
35f6bfc4f28df75e2b690f596b3eb3e3f0a5fb2fc664f325d803f7dfe036a309

SHA512
562dd87c48754d27d5d0815b99e16f79117e14e8271323755e266fc9a094fc6cccbf20bef50d1c3aad74340f2230f87d72fd3a98ac64dba88f4732936a753392

Download Submit
\Program Files\DriverUpdate\SlimWare.PushNotification.Services.dll
MD5
3384dcb5ad4b754ac81a287282384b6d

SHA1
14b223746d698793103274bf4c027c828b7e154d

SHA256
2b8c0c3a1dec6b036702cb900a9f90377246e164cdceea269c7b65dc5d3e0006

SHA512
23c50e771e10e7ba1c2cd2ee1f6aa9a6bf6e63b9ce44436344e33e2e57f3b1e8956b140461b00014274a0ec3e9907e2f91b025223099352dfee1815803a7d013

Download Submit
\Program Files\DriverUpdate\UnifiedLogger.dll
MD5
595836df7cdf3c1c51febd8a0f1d3ef9

SHA1
9c1a721c74982be20a1767affed8d24660a9b85c

SHA256
a45ae9e7bbf2f0a0ff3d92b4b24a24dee5fb06fa148a965465b07f79a0e8bd2f

SHA512
02f7626aa48318d3b7bc83a7c5ffba3e15197d4462727f3070444ca1009ecd122edeed89b899ea3f55d86ab46d1e808b1d42ccdc464652e4b6b533f60263c03b

Download Submit
\Program Files\SlimWare Utilities\Services\BugSplat64.dll
MD5
f1a2d92bb8738eab02b92c741a9c5299

SHA1
ac22734c386e3e2dabe9ac9767a23e8f01755d4f

SHA256
6859c336dc4f42dc70a542db8185948931907734978eeb7088d47256bd4199cd

SHA512
344ad89725e98636bae65b219f479a59c98e0131e2dbbab80c3c35443b776499d5c2a4e218ce62c0752cc67eb595c75b83775c54065a13986265885675b0cd99

Download Submit
\Program Files\SlimWare Utilities\Services\BugSplat64.dll
MD5
f1a2d92bb8738eab02b92c741a9c5299

SHA1
ac22734c386e3e2dabe9ac9767a23e8f01755d4f

SHA256
6859c336dc4f42dc70a542db8185948931907734978eeb7088d47256bd4199cd

SHA512
344ad89725e98636bae65b219f479a59c98e0131e2dbbab80c3c35443b776499d5c2a4e218ce62c0752cc67eb595c75b83775c54065a13986265885675b0cd99

Download Submit
\Program Files\SlimWare Utilities\Services\BugSplat64.dll
MD5
f1a2d92bb8738eab02b92c741a9c5299

SHA1
ac22734c386e3e2dabe9ac9767a23e8f01755d4f

SHA256
6859c336dc4f42dc70a542db8185948931907734978eeb7088d47256bd4199cd

SHA512
344ad89725e98636bae65b219f479a59c98e0131e2dbbab80c3c35443b776499d5c2a4e218ce62c0752cc67eb595c75b83775c54065a13986265885675b0cd99

Download Submit
\Program Files\SlimWare Utilities\Services\BugSplat64.dll
MD5
f1a2d92bb8738eab02b92c741a9c5299

SHA1
ac22734c386e3e2dabe9ac9767a23e8f01755d4f

SHA256
6859c336dc4f42dc70a542db8185948931907734978eeb7088d47256bd4199cd

SHA512
344ad89725e98636bae65b219f479a59c98e0131e2dbbab80c3c35443b776499d5c2a4e218ce62c0752cc67eb595c75b83775c54065a13986265885675b0cd99

Download Submit
\Program Files\SlimWare Utilities\Services\SlimWare.Core.dll
MD5
4ae1352e34bee2b1d51e92cb19be0343

SHA1
1b5d2fe506cc0de9c688693b8a4619ecdb92b30e

SHA256
c4fbabb2163face03d868132b691dc7ec774de246ebf822de21d92066baa5c61

SHA512
e677572469cc520210270febc7180d9b276b956cfe32346cc0825dce3a832c46f47d535719b5da966873924f48ae08110686676f6b089eec6e86c5d69ce5b4aa

Download Submit
\Program Files\SlimWare Utilities\Services\SlimWare.Core.dll
MD5
4ae1352e34bee2b1d51e92cb19be0343

SHA1
1b5d2fe506cc0de9c688693b8a4619ecdb92b30e

SHA256
c4fbabb2163face03d868132b691dc7ec774de246ebf822de21d92066baa5c61

SHA512
e677572469cc520210270febc7180d9b276b956cfe32346cc0825dce3a832c46f47d535719b5da966873924f48ae08110686676f6b089eec6e86c5d69ce5b4aa

Download Submit
\Program Files\SlimWare Utilities\Services\SlimWare.Core.dll
MD5
4ae1352e34bee2b1d51e92cb19be0343

SHA1
1b5d2fe506cc0de9c688693b8a4619ecdb92b30e

SHA256
c4fbabb2163face03d868132b691dc7ec774de246ebf822de21d92066baa5c61

SHA512
e677572469cc520210270febc7180d9b276b956cfe32346cc0825dce3a832c46f47d535719b5da966873924f48ae08110686676f6b089eec6e86c5d69ce5b4aa

Download Submit
\Program Files\SlimWare Utilities\Services\SlimWare.Session.ProxyStub.dll
MD5
e8a388c2d46682f8e4534dcb4e791b2d

SHA1
58562a122c62ef6149e2a23f77c82ef2175bb929

SHA256
0f6ab9a939cb5a41fc33f37a09c33018d46d05c218e7973d44b1aba6231a9afa

SHA512
a455ed39670ce899cb475509a28fde81cdf58167b85a4460f60522aa92041e425a8b24dd27b9bff7d8466c139cdb0f4163f4e2b4c60b8d8d65d8030fa5b5a362

Download Submit
\Program Files\SlimWare Utilities\Services\SlimWare.Session.ProxyStub.dll
MD5
e8a388c2d46682f8e4534dcb4e791b2d

SHA1
58562a122c62ef6149e2a23f77c82ef2175bb929

SHA256
0f6ab9a939cb5a41fc33f37a09c33018d46d05c218e7973d44b1aba6231a9afa

SHA512
a455ed39670ce899cb475509a28fde81cdf58167b85a4460f60522aa92041e425a8b24dd27b9bff7d8466c139cdb0f4163f4e2b4c60b8d8d65d8030fa5b5a362

Download Submit
\Program Files\SlimWare Utilities\Services\SlimWare.Session.ProxyStub.dll
MD5
e8a388c2d46682f8e4534dcb4e791b2d

SHA1
58562a122c62ef6149e2a23f77c82ef2175bb929

SHA256
0f6ab9a939cb5a41fc33f37a09c33018d46d05c218e7973d44b1aba6231a9afa

SHA512
a455ed39670ce899cb475509a28fde81cdf58167b85a4460f60522aa92041e425a8b24dd27b9bff7d8466c139cdb0f4163f4e2b4c60b8d8d65d8030fa5b5a362

Download Submit
\Users\Admin\AppData\Local\SlimWare Utilities Inc\DriverUpdate\htmlayout.dll
MD5
ee2540c23fc04dd39a17cc466ff3c946

SHA1
d61d77d4def107fc63350f457c32d06ac675ef19

SHA256
5c43198ee7e9e4c94f4700a8032d368d3854c6b7e2f04a930d23b373f55ee003

SHA512
00ec2be28622b295b7ecf34a02d48085c4f4d399e6ed94df13d6c79b076e05cafb3d3c702bca612b51c6773726776797677b2642555718f3512db2b9bc2845df

Download Submit
\Users\Admin\AppData\Local\SlimWare Utilities Inc\DriverUpdate\htmlayout.dll
MD5
ee2540c23fc04dd39a17cc466ff3c946

SHA1
d61d77d4def107fc63350f457c32d06ac675ef19

SHA256
5c43198ee7e9e4c94f4700a8032d368d3854c6b7e2f04a930d23b373f55ee003

SHA512
00ec2be28622b295b7ecf34a02d48085c4f4d399e6ed94df13d6c79b076e05cafb3d3c702bca612b51c6773726776797677b2642555718f3512db2b9bc2845df

Download Submit
\Windows\Installer\MSI2030.tmp
MD5
fb6cdb0cddd0f384701022b0d1e8d833

SHA1
6477ad19453f4935e9a72682eff59590fa8c6ffd

SHA256
24556d9695f166c495c738f265e1ad82de8883acb44ab78f882867f52339ee0a

SHA512
aba895fd39a6648a548a433fb6db72c2127573fc6f5e905a92b885e41fd3b118d454dc92ca8a88df84d92d11e762986dc14a11b5b7f0d739ef6d2d9187796143

Download Submit
\Windows\Installer\MSI2523.tmp
MD5
d2a8f90e612d94e082361d1e677096b8

SHA1
4d2765ab69e4aaedb8512315a78544fbde056229

SHA256
55f607d337ff05b247f9d4b7cafecd500d2058b4f2cd9702bf86bea18d8bb6e2

SHA512
83b932ca46fc64e1d2871daefff85169ccce5143c242f773851858531e7a6be9e3525618d6d020f09cccd8f31a8ba78a45cd75e739aed8cd7495d323e2df72c6

Download Submit
\Windows\Installer\MSI3C2A.tmp
MD5
fb6cdb0cddd0f384701022b0d1e8d833

SHA1
6477ad19453f4935e9a72682eff59590fa8c6ffd

SHA256
24556d9695f166c495c738f265e1ad82de8883acb44ab78f882867f52339ee0a

SHA512
aba895fd39a6648a548a433fb6db72c2127573fc6f5e905a92b885e41fd3b118d454dc92ca8a88df84d92d11e762986dc14a11b5b7f0d739ef6d2d9187796143

Download Submit
\Windows\Installer\MSI68D2.tmp
MD5
d2a8f90e612d94e082361d1e677096b8

SHA1
4d2765ab69e4aaedb8512315a78544fbde056229

SHA256
55f607d337ff05b247f9d4b7cafecd500d2058b4f2cd9702bf86bea18d8bb6e2

SHA512
83b932ca46fc64e1d2871daefff85169ccce5143c242f773851858531e7a6be9e3525618d6d020f09cccd8f31a8ba78a45cd75e739aed8cd7495d323e2df72c6

Download Submit
\Windows\Installer\MSI6FE8.tmp
MD5
d2a8f90e612d94e082361d1e677096b8

SHA1
4d2765ab69e4aaedb8512315a78544fbde056229

SHA256
55f607d337ff05b247f9d4b7cafecd500d2058b4f2cd9702bf86bea18d8bb6e2

SHA512
83b932ca46fc64e1d2871daefff85169ccce5143c242f773851858531e7a6be9e3525618d6d020f09cccd8f31a8ba78a45cd75e739aed8cd7495d323e2df72c6

Download Submit
memory/1748-61-0x0000000000000000-mapping.dmp

Download
memory/2120-10-0x0000000000000000-mapping.dmp

Download
memory/2704-53-0x0000000000000000-mapping.dmp

Download
memory/3292-2-0x0000000000000000-mapping.dmp

Download
memory/4056-69-0x0000000000000000-mapping.dmp

Download