0d31468dca0717410ff390c54b88f47f672502ecd9189a2b1c1693658a8ab8a1

Analysis

max time kernel
1099s
max time network
1169s
platform
windows7_x64
resource
win7-en-20210920
submitted
26-09-2021 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Acsc-Joint-Planning-Jpex-Answers.msi
Size

108.5MB
MD5

82dbf0d2b49de42dc700df7c96b41eb1
SHA1

509c08fd9805cf2034fec547c0fc962423a96a3b
SHA256

7ada6e666c34aacaf7c93d11ca2e563ec53da37fb23a181631809d0d5ef14387
SHA512

3d256fba291eb2f4a81ef53d8db8a333f3fb26a9a2c90e3c28bb0a944dc8bba2a2c8902232b14e6a9debdf93a2ff100faabb2be2053aac7fc2ccbdbd2f98fc83

Score

10^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

2 1324 msiexec.exe
4 1324 msiexec.exe

flow	pid	process
2	1324	msiexec.exe
4	1324	msiexec.exe

Executes dropped EXE 12 IoCs

Processes:

MSIA9F1.tmpMSIA9F1.tmpnitro_pro13.exeAddinSetupTool.exeAddinSetupTool.exeAddinSetupTool.exeAddinSetupTool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

pid	process
960	MSIA9F1.tmp
276	MSIA9F1.tmp
1372	nitro_pro13.exe
1532	AddinSetupTool.exe
1016	AddinSetupTool.exe
1600	AddinSetupTool.exe
1764	AddinSetupTool.exe
452
2916	software_reporter_tool.exe
1312	software_reporter_tool.exe
2276	software_reporter_tool.exe
1676	software_reporter_tool.exe

Registers new Print Monitor 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMSIA9F1.tmpMSIA9F1.tmpMsiExec.exeMsiExec.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exeMsiExec.exemsiexec.exeMsiExec.exerundll32.exe

pid	process
952	MsiExec.exe
960	MSIA9F1.tmp
276	MSIA9F1.tmp
276	MSIA9F1.tmp
276	MSIA9F1.tmp
276	MSIA9F1.tmp
276	MSIA9F1.tmp
276	MSIA9F1.tmp
276	MSIA9F1.tmp
276	MSIA9F1.tmp
276	MSIA9F1.tmp
276	MSIA9F1.tmp
952	MsiExec.exe
1836	MsiExec.exe
276	MSIA9F1.tmp
276	MSIA9F1.tmp
276	MSIA9F1.tmp
1136	MsiExec.exe
1560	rundll32.exe
1560	rundll32.exe
1560	rundll32.exe
1136	MsiExec.exe
1164	rundll32.exe
1164	rundll32.exe
1164	rundll32.exe
1136	MsiExec.exe
296	rundll32.exe
296	rundll32.exe
296	rundll32.exe
1136	MsiExec.exe
1816	rundll32.exe
1816	rundll32.exe
1816	rundll32.exe
1136	MsiExec.exe
1204	rundll32.exe
1204	rundll32.exe
1204	rundll32.exe
296	MsiExec.exe
296	MsiExec.exe
296	MsiExec.exe
780	msiexec.exe
780	msiexec.exe
780	msiexec.exe
780	msiexec.exe
780	msiexec.exe
932	MsiExec.exe
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
780	msiexec.exe
780	msiexec.exe
780	msiexec.exe
1244
932	MsiExec.exe
452
452
452
452
452
452
452
452
276	MSIA9F1.tmp
276	MSIA9F1.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

nitro_pro13.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	nitro_pro13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{7078916e-a680-44c9-9437-504aac249f57} = "\"C:\\ProgramData\\Package Cache\\{7078916e-a680-44c9-9437-504aac249f57}\\nitro_pro13.exe\" /burn.runonce"	nitro_pro13.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Drops file in System32 directory 39 IoCs

Processes:

msiexec.exeMsiExec.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\NxPdfCreator.ini	MsiExec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\de-DE\NxPdfUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\es-ES\NxPrinterMonitor13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\NxPrinterMonitorUI13.dll	MsiExec.exe
File created	C:\Windows\system32\es-ES\NxPrinterMonitorUI13.dll.mui	MsiExec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT5.DLL	MsiExec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\en-US\NxPdfUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\NxPrinterMonitor13.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\de-DE\NxPrinterMonitorUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\es-ES\NxPdfUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\it-IT\NxPdfUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\nl-NL\NxPdfUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\en-US\NxPrinterMonitor13.dll.mui	MsiExec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\NxPdfCreator.ppd	MsiExec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\PS5UI.DLL	MsiExec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT5.DLL	MsiExec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\fr-FR\NxPdfUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\fr-FR\NxPrinterMonitorUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\en-US\NxPrinterMonitorUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\fr-FR\NxPrinterMonitor13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\it-IT\NxPrinterMonitor13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\nl-NL\NxPrinterMonitorUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\de-DE\NxPrinterMonitor13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\it-IT\NxPrinterMonitorUI13.dll.mui	MsiExec.exe
File created	C:\Windows\system32\nl-NL\NxPrinterMonitor13.dll.mui	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\nitroui13.hlp	MsiExec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\NxPdfUI13.dll	MsiExec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exerundll32.exe

description	ioc	process
File created	C:\Program Files\Nitro\Pro\13\libffi-7.dll	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\CMAP\Identity-V	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\idrs_sentinel_software_protection15.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\nl-NL\NitroPDFPreviewHandler.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\es-ES\np_attachments.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\np_cloud_storage.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\np_digital_signature.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\KSCms-UHC-UCS2	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\cef\resources\locales\nb.pak	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\IRIS_OCR\resources\hebrew.ocr	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\de-DE\Nitro.Pro.ShellExtension.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\nl-NL\np_watermarks.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\UniJISX0213-UTF32-V	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\90msp-RKSJ-V	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\cef\resources\locales\fr.pak	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\UniJIS-UCS2-H	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\CMAP\UCS2-GBpc-EUC	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\fr-FR\np_signature_stamp.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\UniGB-UTF16-H	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\CMAP\90pv-RKSJ-H	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\en-US\np_links.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\nl\Nitro.OfficeAddin.Net.UI.13.resources.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\UniHojo-UTF8-H	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\ColorProfiles\AdobeRGB1998.icc	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\idrsasian215.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\ColorProfiles\JapanColor2001Uncoated.icc	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\fr-FR\NitroPDFPreviewHandler.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\es-ES\np_set_security.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\UniJISPro-UCS2-V	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\Adobe-Japan1-4	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\GBK2K-H	msiexec.exe
File created	C:\Program Files\Common Files\Nitro\Nitro.Pro.ShellExtension.Shim.dll	rundll32.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\Adobe-CNS1-1	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\stdole.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\iwObjects.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\en-US\Nitro.Pro.ShellExtension.dll.mui	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\it-IT\NitroPDFActiveX.ocx.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\es-ES\np_layers.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\es-ES\np_signature_stamp.dll.mui	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\npnitroie.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\cef\resources\cef_100_percent.pak	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\clgsapi32w.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\it-IT\np_objects.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\SpmlFlt.flt	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\it\Nitro.OfficeAddin.Net.UI.13.resources.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\es-ES\np_links.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\UniHojo-UTF16-H	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\CMAP\Adobe-CNS1-UCS2	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\KSCpc-EUC-V	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\x64\NxPrinterMonitor13.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\HKm471-B5-V	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\CMAP\GB-V	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\x86\Eztwain4.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\np_objects.dll	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\it-IT\np_web_dav.dll.mui	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\CMAP\Add-RKSJ-H	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\es-ES\np_convert_pdf.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\CMAP\HKm314-B5-V	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\en-US\np_bookmarks.dll.mui	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\CMAP\KSC-EUC-V	msiexec.exe
File created	C:\Program Files (x86)\Nitro\Pro\13\CMAP\UniKS-UTF8-V	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\fr-FR\NPNitroIE.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\txtFlt.flt	msiexec.exe
File created	C:\Program Files\Nitro\Pro\13\XlsxFlt.flt	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

rundll32.exemsiexec.exerundll32.exerundll32.exeDrvInst.exerundll32.exenitro_pro13.exerundll32.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI450E.tmp-\NitroCA.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB297.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2895.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F04.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\41e0a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41E2.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6790.tmp	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	nitro_pro13.exe
File created	C:\Windows\Installer\41e0c.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI340B.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI41E2.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F04.tmp-\NitroCA.dll	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfcm140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{24E8C965-90F0-44CE-B305-FEBA0D900919}\Professional.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\41e0c.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2895.tmp-\NitroCA.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI450E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI450E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F04.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI41E2.tmp-\NitroCA.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI54A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2895.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F04.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA7B.tmp	msiexec.exe
File created	C:\Windows\Installer\41e0a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI340B.tmp-\NitroCA.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{24E8C965-90F0-44CE-B305-FEBA0D900919}\Professional.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI450E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI66E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA7B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI67DF.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA7B.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\41e13.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2895.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfcm140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfcm140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI340B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091\13.47.4\mfcm140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA7B.tmp-\NitroCA.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI41E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\569C8E420F09EC443B50EFABD0099091	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exespoolsv.exeCertUtil.exeCertUtil.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne01:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	CertUtil.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Nitro PDF Creator = "winspool,Ne00:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne01:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne01:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Nitro PDF Creator = "winspool,Ne00:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	spoolsv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	CertUtil.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne01:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Nitro PDF Creator = "winspool,Ne00:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Nitro PDF Creator = "winspool,Ne00:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3BFAE61D-4A6D-4467-9E5E-FE5293D10F9F}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NitroPDFProfessional.MSOfficeAddin13	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NitroPDFProfessional.MSOfficeAddin13\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\Programmable\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{303CFFAB-5F7E-4440-9703-9486A6A23B47}\ = "_DNitroPDFEvents"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\MiscStatus\1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{A0D2E999-B4F8-476C-A662-E18CED74FEC4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\569C8E420F09EC443B50EFABD0099091\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{25C03D4C-0995-4585-A11C-D114695CE112}\TypeLib\Version = "d.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\VersionIndependentProgID\ = "NitroPDF.IE.ActiveDoc"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\NitroPDF.exe\SupportedTypes\.ppdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.Document.13\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}\ = "{cef53101-e1db-4950-9c03-53fab48081e2}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdf\OpenWithProgids\NitroPDF.FDFDoc.13	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\MiscStatus	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Nitro.Pro.ShellExtension.Shim\ = "{211B6F25-950C-49CD-AB86-A448EF85686A}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{D7570413-6651-467E-AF76-69BDD1265663}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pdf\Extension = ".pdf"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5563B2BD-8933-4875-9D95-C517BEBCA174}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xfdf\PerceivedType = "Document"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.fdf\old\Content Type = "application/vnd.fdf"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.IE.ActiveDoc.13\ = "NitroPDF.IE.ActiveDoc"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{211B6F25-950C-49CD-AB86-A448EF85686A}\ = "Nitro.Pro.ShellExtension.Shim"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{73BA4610-4C33-4056-9141-9C3E3DF75428}\13.0\0\win32\ = "C:\\Program Files\\Nitro\\Pro\\13\\npnitroie.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CEF53101-E1DB-4950-9C03-53FAB48081E2}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.FDFDoc.13	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xfdf\ = "NitroPDF.XFDFDoc.13"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3422E9DB-7B00-4552-B016-6FBF93C5A2D8}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{73BA4610-4C33-4056-9141-9C3E3DF75428}\13.0\0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3422E9DB-7B00-4552-B016-6FBF93C5A2D8}\d.0\0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\MiscStatus\1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7570413-6651-467E-AF76-69BDD1265663}\TypeLib\ = "{EEC52A4D-E930-4782-B5E9-D03F5A3EA15E}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\ToolboxBitmap32\ = "C:\\PROGRA~2\\Nitro\\Pro\\13\\NITROP~1.OCX, 1051"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A0D2E999-B4F8-476C-A662-E18CED74FEC4}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.Document	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\InstallPath = "C:\\Program Files\\Nitro\\Pro\\13\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\InstallPath = "C:\\Program Files (x86)\\Nitro\\Pro\\13\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7570413-6651-467E-AF76-69BDD1265663}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3BFAE61D-4A6D-4467-9E5E-FE5293D10F9F}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1846C90791F3DDE45AFFDD7F7F555C36\569C8E420F09EC443B50EFABD0099091	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\DisableLowILProcessIsolation = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\Version\ = "13.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A7B4EA1-8CA8-4629-B09A-FB4EE0632BA8}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\MiscStatus\1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31A8CFAE-8579-4EBA-A9D7-19426509F882}\TypeLib\ = "{3422E9DB-7B00-4552-B016-6FBF93C5A2D8}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A0D2E999-B4F8-476C-A662-E18CED74FEC4}\ = "NitroPDF Property Page"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{303CFFAB-5F7E-4440-9703-9486A6A23B47}\TypeLib\ = "{3422E9DB-7B00-4552-B016-6FBF93C5A2D8}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.PPDFDoc\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{A0D2E999-B4F8-476C-A662-E18CED74FEC4}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{25C03D4C-0995-4585-A11C-D114695CE112}\ = "_DNitroPDF"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.FDFDoc.13\shell\open\ = "&Open with Nitro Pro"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fdf	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

MSIA9F1.tmp

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1F3F1486B531882802E87B624D420295A0FC721A\Blob = 14000000010000001400000099c9104a7d78ba8956314ef5ec35733da41bed6e0300000001000000140000001f3f1486b531882802e87b624d420295a0fc721a2000000001000000b2050000308205ae30820396a00302010202045491a8b0300d06092a864886f70d01010b05003052310b300906035504061302434131153013060355040a130c4e6f74617269757320496e63312c302a060355040313234e6f74617269757320526f6f7420436572746966696361746520417574686f72697479301e170d3134313231373135333035315a170d3334313231373136303035315a3052310b300906035504061302434131153013060355040a130c4e6f74617269757320496e63312c302a060355040313234e6f74617269757320526f6f7420436572746966696361746520417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100ad52b99228385c513f5f6b51532ffcb9cdf3e7bdcf68f516736f2a5aa37e22cc5f2632bfd31fc75ee7b190ebc622f5e95e1912a212f3bc22f988d5f73b61c519c8e2636b8cf1db3f22a0fbdc59fa66f07e74c64ab10dc9521d8bb74e4cdd96cb98e60e40fbbd3a1ea42c905ede84d661e767002a330e3383f237a2be4ea8aa466d184846772634bf66816f2093fcf132f160f2162d9f4e441d9deb382d6da5584d01fbe25dc41e8affd542dc0c05a7f6e484e367ecd1a94f99de9fc60b941fe530b707a879f060eab3a19cc265379ae8b9c13c59ac600be606ed380758014ca57ed79cf36c334f20366b55ca4e566ff838eecf9465e5482f4d3e50cca94e39b6fe8a081175c6fd7b4abaa3f793b49d78e4a18ba8ec778228f79b91241ef1fccf91447be8065e2a6fca7789805d1060b9b671a25bb16627eaf7647c77e80a0a2f8f4853e2b42fa8341ff2e4c9f54bbe1b7311f61c995bb111d145deae1ae1b1c5437839bdc9eac0dc83fb0be2c2d5c93f4a41c59d3ee1f026029a536db7860f724f0c430baec45460364a834ec950a66d07faf00fc4f405f3d5661debe4bf1ca5fdb8e718373abb041a1b870dd2927b748e88ab8a3a3ed780a348579028cfd4435c94372e8baf12124eaa38a60db5891cf979646d65f711943ea1dc3e22c78329a966c4998fcd1a4df9c725acccf7abf3abe6b8fde3e9edcf2b39288abf3014930203010001a3818b308188302b0603551d1004243022800f32303134313231373135333035315a810f32303334313231373136303035315a300b0603551d0f040403020106301f0603551d2304183016801499c9104a7d78ba8956314ef5ec35733da41bed6e301d0603551d0e0416041499c9104a7d78ba8956314ef5ec35733da41bed6e300c0603551d13040530030101ff300d06092a864886f70d01010b05000382020100823fea774a0874e96d1b8ead79ddd9b110f19d774c17eb2d18e82f94c653665ea0a59152b2acfcc850940ec579aa0d26cd1546bd9bb3bcb57880df50cd5bde593ffba6ba00f972b143e5a09bdb6491a9be05d762fadb12bd3a86f07a6335fcda50343ce66fb442062a812b521d1e4ff7b5b2bc6c609ad4a728cea46e047fefde452b72325de6cf0d528f2f40b8d3dfc986cc090e536007c04f3acaf626065e469cbf0dbe1d5a61273a7d6193b5a75413deb1a09b49669bb337bda0ba4a65c822e0c4eff095cee89f0029a4f932129c703c10d7eba63c7f5550d54231fbbb09ea844acd6b73d68ca5946f84359a655a78080302fc47b37abe8c3e33672dd400aa6a9f381bf54e78d08bc56f2f2a3d823e5b50807041b5a860c0fefb5869b9d8c20c17a0184e061aff3f72b137ee896f7adca72f9cc957c8830b4b81f1d7362f1eecf7b82064fa8b0ae651b805ac547bec320ae3ce121d5172f8de7ddb4d4a7f9a84b00ab81071d8737a16aefcc5d46de4c79f0a176b73e301316df83afc1c9264a5c0d8a490c0e3f98e1931ad3676ecb7fb653cf4e0f8949be718941f2a0278719e425d0a6dbd3b7bca704af6c4e79da2ce4b98e296f3b1d6adc02138a2794640c7df48c007ae2fa256187a9ab9c31850161fa3e34cc39e602e602fe90ce159a11b33292b91123c7d8536a2781211e2c04563c58b74932ec2b45b1168c771c8e6	MSIA9F1.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\BB057F074C92DADB5E495243E259A03FE16BD687\Blob = 190000000100000010000000935256089850c567fd48611af2aeab56030000000100000014000000bb057f074c92dadb5e495243e259a03fe16bd6871400000001000000140000001d5a27f6e5ac17846bd1041e84ecd42cad3fd37f20000000010000003b060000308206373082041fa00302010202045491aeff300d06092a864886f70d01010b05003052310b300906035504061302434131153013060355040a130c4e6f74617269757320496e63312c302a060355040313234e6f74617269757320526f6f7420436572746966696361746520417574686f72697479301e170d3135303230353230333531305a170d3334313230353231303531305a304d310b300906035504061302434131153013060355040a130c4e6f74617269757320496e63312730250603550403131e4e6f74617269757320436572746966696361746520417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100ac6a1df7a086db0ba6befd4a23a4ab21984d89c8bcf3ddd436e55f7126579ddb5532e141517975a37b68981d3f1694cdbef994a1aa125ac4375c6d04259a345c45b781171e0eddbb1d8ebc5e8ef69c1550441700c833bf6db51fef9e5add708754998ad6d8817e6f41345cbf6163855596ca935087651755ac22bc730462186e949665318c9404cc6beedaa9a020d7d5200f5002c0d7d7e146fadb01a4e43f7f1edc945079d89f581910aa24175240bafb6e69b78ac2de262d852051fc165d06e9be1fef01f40a48b7ded40013f7ba0db660157c40a1636aca14965830c1ed0b9bd846c03e4bf611e5e33e48aadca7c545ff056e13139e7a731cb9f0975173c72030b72ebec624d590e6d4b523f4d85c37e120cfbc80abcc8737488d2ce46ea9b5d3a0e141610570ce33fd182ca3c654a432cb8441ff9e43972dd7a58aeae94ce6fbfe11f0e96d6860f1f4eebd97e3488be1ff8017f31cbaaafa96cd65a3d2cbb1fdf103abba0669d919f7d00a609ac18c584101a228a3eb91e95218436d4b35f90063a1beee130ab9a296ee0d4e4e41c2c9e81d1339bfc4c56fed4d2f1c80b8d3777a77c7b5de28ffda7e4e37006d73a59b692204c556b900f227ad503ee373b73203baf1aec7f619c097227afaf41493394fa381e087683fe53072460c11db2ffd85b60d6f83a6f01d85ca5ce0629ac6120eab906ce045d5e2336d2cb2623b0203010001a3820118308201143081b60603551d1f0481ae3081ab3081a8a081a5a081a2863b687474703a2f2f63726c2e6e6f7461726975732e636f6d2f6e6f7461726975735f726f6f745f63612f63726c2f63726c5f726f6f7461312e63726ca4633061310b300906035504061302434131153013060355040a130c4e6f74617269757320496e63312c302a060355040313234e6f74617269757320526f6f7420436572746966696361746520417574686f72697479310d300b0603550403130443524c31300b0603551d0f040403020106301f0603551d2304183016801499c9104a7d78ba8956314ef5ec35733da41bed6e301d0603551d0e041604141d5a27f6e5ac17846bd1041e84ecd42cad3fd37f300c0603551d13040530030101ff300d06092a864886f70d01010b050003820201006bb11e730b7c7e317812443268286b5619fff730de0d523d441246322b27cf3ac2cf0b84cee1eaf639a31fe632ef065e32e8f1b848510daa5393e8fa24fdc010099f9f667cef8546465fa42c6cfbb08bd3e0159227f6dd88bc593dd171681b52d5110c4ee90064735da1e6efc580efac284e3f56241a5c9fa08309703bac9bad6425012c6a092d60977778b887e3e53975381d894e1b761e95eacec59d5943cf8bbbde4ca66025abcf80e443190351683ef7bcea86e5200a63f5babeb3ff132a614a2284491263e516ba34421f4db8cf855fd944bb29f0bdedfcf420b4098405faa464af387fe74072ac6d26721f17fcfe7a0fba2d040b3e2c8f80f4f60ae389754250befb5d61f36db154ad1b97834c76313ad4223d3c380e687e716dbfdac80cb71765576dc1adb0ba07c2eb6139dae1137af1283b0a80c089691510775e70a56727c63b6a708014107e71d8950699a77131dc529a9c38c442770f47486c19c7af9bc8a498e79932b186875c99c1f84583ab71e892089f98d1926d36a1dab36ebe390500be5405521c85c2370793c7c64103ba5e05822933fdfcd74e8df98d5542d276bea7246b67b9764511d04c71b0f8eec2cac5f8d59650eb5760cc515937a6209a139baf59cfda1147a27839294035531b0e508cd18dc25703c9269b599dcdb299fc92af7e8af81e8a4a3310335bed04db5c1448a7022163574082a450	MSIA9F1.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1F3F1486B531882802E87B624D420295A0FC721A\Blob = 190000000100000010000000966a561e588d8a1e3b3d5e2934b1cfd60300000001000000140000001f3f1486b531882802e87b624d420295a0fc721a14000000010000001400000099c9104a7d78ba8956314ef5ec35733da41bed6e2000000001000000b2050000308205ae30820396a00302010202045491a8b0300d06092a864886f70d01010b05003052310b300906035504061302434131153013060355040a130c4e6f74617269757320496e63312c302a060355040313234e6f74617269757320526f6f7420436572746966696361746520417574686f72697479301e170d3134313231373135333035315a170d3334313231373136303035315a3052310b300906035504061302434131153013060355040a130c4e6f74617269757320496e63312c302a060355040313234e6f74617269757320526f6f7420436572746966696361746520417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100ad52b99228385c513f5f6b51532ffcb9cdf3e7bdcf68f516736f2a5aa37e22cc5f2632bfd31fc75ee7b190ebc622f5e95e1912a212f3bc22f988d5f73b61c519c8e2636b8cf1db3f22a0fbdc59fa66f07e74c64ab10dc9521d8bb74e4cdd96cb98e60e40fbbd3a1ea42c905ede84d661e767002a330e3383f237a2be4ea8aa466d184846772634bf66816f2093fcf132f160f2162d9f4e441d9deb382d6da5584d01fbe25dc41e8affd542dc0c05a7f6e484e367ecd1a94f99de9fc60b941fe530b707a879f060eab3a19cc265379ae8b9c13c59ac600be606ed380758014ca57ed79cf36c334f20366b55ca4e566ff838eecf9465e5482f4d3e50cca94e39b6fe8a081175c6fd7b4abaa3f793b49d78e4a18ba8ec778228f79b91241ef1fccf91447be8065e2a6fca7789805d1060b9b671a25bb16627eaf7647c77e80a0a2f8f4853e2b42fa8341ff2e4c9f54bbe1b7311f61c995bb111d145deae1ae1b1c5437839bdc9eac0dc83fb0be2c2d5c93f4a41c59d3ee1f026029a536db7860f724f0c430baec45460364a834ec950a66d07faf00fc4f405f3d5661debe4bf1ca5fdb8e718373abb041a1b870dd2927b748e88ab8a3a3ed780a348579028cfd4435c94372e8baf12124eaa38a60db5891cf979646d65f711943ea1dc3e22c78329a966c4998fcd1a4df9c725acccf7abf3abe6b8fde3e9edcf2b39288abf3014930203010001a3818b308188302b0603551d1004243022800f32303134313231373135333035315a810f32303334313231373136303035315a300b0603551d0f040403020106301f0603551d2304183016801499c9104a7d78ba8956314ef5ec35733da41bed6e301d0603551d0e0416041499c9104a7d78ba8956314ef5ec35733da41bed6e300c0603551d13040530030101ff300d06092a864886f70d01010b05000382020100823fea774a0874e96d1b8ead79ddd9b110f19d774c17eb2d18e82f94c653665ea0a59152b2acfcc850940ec579aa0d26cd1546bd9bb3bcb57880df50cd5bde593ffba6ba00f972b143e5a09bdb6491a9be05d762fadb12bd3a86f07a6335fcda50343ce66fb442062a812b521d1e4ff7b5b2bc6c609ad4a728cea46e047fefde452b72325de6cf0d528f2f40b8d3dfc986cc090e536007c04f3acaf626065e469cbf0dbe1d5a61273a7d6193b5a75413deb1a09b49669bb337bda0ba4a65c822e0c4eff095cee89f0029a4f932129c703c10d7eba63c7f5550d54231fbbb09ea844acd6b73d68ca5946f84359a655a78080302fc47b37abe8c3e33672dd400aa6a9f381bf54e78d08bc56f2f2a3d823e5b50807041b5a860c0fefb5869b9d8c20c17a0184e061aff3f72b137ee896f7adca72f9cc957c8830b4b81f1d7362f1eecf7b82064fa8b0ae651b805ac547bec320ae3ce121d5172f8de7ddb4d4a7f9a84b00ab81071d8737a16aefcc5d46de4c79f0a176b73e301316df83afc1c9264a5c0d8a490c0e3f98e1931ad3676ecb7fb653cf4e0f8949be718941f2a0278719e425d0a6dbd3b7bca704af6c4e79da2ce4b98e296f3b1d6adc02138a2794640c7df48c007ae2fa256187a9ab9c31850161fa3e34cc39e602e602fe90ce159a11b33292b91123c7d8536a2781211e2c04563c58b74932ec2b45b1168c771c8e6	MSIA9F1.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\BB057F074C92DADB5E495243E259A03FE16BD687	MSIA9F1.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\BB057F074C92DADB5E495243E259A03FE16BD687\Blob = 1400000001000000140000001d5a27f6e5ac17846bd1041e84ecd42cad3fd37f030000000100000014000000bb057f074c92dadb5e495243e259a03fe16bd68720000000010000003b060000308206373082041fa00302010202045491aeff300d06092a864886f70d01010b05003052310b300906035504061302434131153013060355040a130c4e6f74617269757320496e63312c302a060355040313234e6f74617269757320526f6f7420436572746966696361746520417574686f72697479301e170d3135303230353230333531305a170d3334313230353231303531305a304d310b300906035504061302434131153013060355040a130c4e6f74617269757320496e63312730250603550403131e4e6f74617269757320436572746966696361746520417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100ac6a1df7a086db0ba6befd4a23a4ab21984d89c8bcf3ddd436e55f7126579ddb5532e141517975a37b68981d3f1694cdbef994a1aa125ac4375c6d04259a345c45b781171e0eddbb1d8ebc5e8ef69c1550441700c833bf6db51fef9e5add708754998ad6d8817e6f41345cbf6163855596ca935087651755ac22bc730462186e949665318c9404cc6beedaa9a020d7d5200f5002c0d7d7e146fadb01a4e43f7f1edc945079d89f581910aa24175240bafb6e69b78ac2de262d852051fc165d06e9be1fef01f40a48b7ded40013f7ba0db660157c40a1636aca14965830c1ed0b9bd846c03e4bf611e5e33e48aadca7c545ff056e13139e7a731cb9f0975173c72030b72ebec624d590e6d4b523f4d85c37e120cfbc80abcc8737488d2ce46ea9b5d3a0e141610570ce33fd182ca3c654a432cb8441ff9e43972dd7a58aeae94ce6fbfe11f0e96d6860f1f4eebd97e3488be1ff8017f31cbaaafa96cd65a3d2cbb1fdf103abba0669d919f7d00a609ac18c584101a228a3eb91e95218436d4b35f90063a1beee130ab9a296ee0d4e4e41c2c9e81d1339bfc4c56fed4d2f1c80b8d3777a77c7b5de28ffda7e4e37006d73a59b692204c556b900f227ad503ee373b73203baf1aec7f619c097227afaf41493394fa381e087683fe53072460c11db2ffd85b60d6f83a6f01d85ca5ce0629ac6120eab906ce045d5e2336d2cb2623b0203010001a3820118308201143081b60603551d1f0481ae3081ab3081a8a081a5a081a2863b687474703a2f2f63726c2e6e6f7461726975732e636f6d2f6e6f7461726975735f726f6f745f63612f63726c2f63726c5f726f6f7461312e63726ca4633061310b300906035504061302434131153013060355040a130c4e6f74617269757320496e63312c302a060355040313234e6f74617269757320526f6f7420436572746966696361746520417574686f72697479310d300b0603550403130443524c31300b0603551d0f040403020106301f0603551d2304183016801499c9104a7d78ba8956314ef5ec35733da41bed6e301d0603551d0e041604141d5a27f6e5ac17846bd1041e84ecd42cad3fd37f300c0603551d13040530030101ff300d06092a864886f70d01010b050003820201006bb11e730b7c7e317812443268286b5619fff730de0d523d441246322b27cf3ac2cf0b84cee1eaf639a31fe632ef065e32e8f1b848510daa5393e8fa24fdc010099f9f667cef8546465fa42c6cfbb08bd3e0159227f6dd88bc593dd171681b52d5110c4ee90064735da1e6efc580efac284e3f56241a5c9fa08309703bac9bad6425012c6a092d60977778b887e3e53975381d894e1b761e95eacec59d5943cf8bbbde4ca66025abcf80e443190351683ef7bcea86e5200a63f5babeb3ff132a614a2284491263e516ba34421f4db8cf855fd944bb29f0bdedfcf420b4098405faa464af387fe74072ac6d26721f17fcfe7a0fba2d040b3e2c8f80f4f60ae389754250befb5d61f36db154ad1b97834c76313ad4223d3c380e687e716dbfdac80cb71765576dc1adb0ba07c2eb6139dae1137af1283b0a80c089691510775e70a56727c63b6a708014107e71d8950699a77131dc529a9c38c442770f47486c19c7af9bc8a498e79932b186875c99c1f84583ab71e892089f98d1926d36a1dab36ebe390500be5405521c85c2370793c7c64103ba5e05822933fdfcd74e8df98d5542d276bea7246b67b9764511d04c71b0f8eec2cac5f8d59650eb5760cc515937a6209a139baf59cfda1147a27839294035531b0e508cd18dc25703c9269b599dcdb299fc92af7e8af81e8a4a3310335bed04db5c1448a7022163574082a450	MSIA9F1.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1F3F1486B531882802E87B624D420295A0FC721A	MSIA9F1.tmp

Runs net.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

powershell.exeMsiExec.exerundll32.exerundll32.exemsiexec.exechrome.exechrome.exechrome.exechrome.exesoftware_reporter_tool.exe

pid	process
1880	powershell.exe
1836	MsiExec.exe
296	rundll32.exe
1816	rundll32.exe
780	msiexec.exe
780	msiexec.exe
584	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
2896	chrome.exe
2092	chrome.exe
2916	software_reporter_tool.exe
2916	software_reporter_tool.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1324	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1324	msiexec.exe
Token: SeRestorePrivilege	780	msiexec.exe
Token: SeTakeOwnershipPrivilege	780	msiexec.exe
Token: SeSecurityPrivilege	780	msiexec.exe
Token: SeCreateTokenPrivilege	1324	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1324	msiexec.exe
Token: SeLockMemoryPrivilege	1324	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1324	msiexec.exe
Token: SeMachineAccountPrivilege	1324	msiexec.exe
Token: SeTcbPrivilege	1324	msiexec.exe
Token: SeSecurityPrivilege	1324	msiexec.exe
Token: SeTakeOwnershipPrivilege	1324	msiexec.exe
Token: SeLoadDriverPrivilege	1324	msiexec.exe
Token: SeSystemProfilePrivilege	1324	msiexec.exe
Token: SeSystemtimePrivilege	1324	msiexec.exe
Token: SeProfSingleProcessPrivilege	1324	msiexec.exe
Token: SeIncBasePriorityPrivilege	1324	msiexec.exe
Token: SeCreatePagefilePrivilege	1324	msiexec.exe
Token: SeCreatePermanentPrivilege	1324	msiexec.exe
Token: SeBackupPrivilege	1324	msiexec.exe
Token: SeRestorePrivilege	1324	msiexec.exe
Token: SeShutdownPrivilege	1324	msiexec.exe
Token: SeDebugPrivilege	1324	msiexec.exe
Token: SeAuditPrivilege	1324	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1324	msiexec.exe
Token: SeChangeNotifyPrivilege	1324	msiexec.exe
Token: SeRemoteShutdownPrivilege	1324	msiexec.exe
Token: SeUndockPrivilege	1324	msiexec.exe
Token: SeSyncAgentPrivilege	1324	msiexec.exe
Token: SeEnableDelegationPrivilege	1324	msiexec.exe
Token: SeManageVolumePrivilege	1324	msiexec.exe
Token: SeImpersonatePrivilege	1324	msiexec.exe
Token: SeCreateGlobalPrivilege	1324	msiexec.exe
Token: SeCreateTokenPrivilege	1324	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1324	msiexec.exe
Token: SeLockMemoryPrivilege	1324	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1324	msiexec.exe
Token: SeMachineAccountPrivilege	1324	msiexec.exe
Token: SeTcbPrivilege	1324	msiexec.exe
Token: SeSecurityPrivilege	1324	msiexec.exe
Token: SeTakeOwnershipPrivilege	1324	msiexec.exe
Token: SeLoadDriverPrivilege	1324	msiexec.exe
Token: SeSystemProfilePrivilege	1324	msiexec.exe
Token: SeSystemtimePrivilege	1324	msiexec.exe
Token: SeProfSingleProcessPrivilege	1324	msiexec.exe
Token: SeIncBasePriorityPrivilege	1324	msiexec.exe
Token: SeCreatePagefilePrivilege	1324	msiexec.exe
Token: SeCreatePermanentPrivilege	1324	msiexec.exe
Token: SeBackupPrivilege	1324	msiexec.exe
Token: SeRestorePrivilege	1324	msiexec.exe
Token: SeShutdownPrivilege	1324	msiexec.exe
Token: SeDebugPrivilege	1324	msiexec.exe
Token: SeAuditPrivilege	1324	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1324	msiexec.exe
Token: SeChangeNotifyPrivilege	1324	msiexec.exe
Token: SeRemoteShutdownPrivilege	1324	msiexec.exe
Token: SeUndockPrivilege	1324	msiexec.exe
Token: SeSyncAgentPrivilege	1324	msiexec.exe
Token: SeEnableDelegationPrivilege	1324	msiexec.exe
Token: SeManageVolumePrivilege	1324	msiexec.exe
Token: SeImpersonatePrivilege	1324	msiexec.exe
Token: SeCreateGlobalPrivilege	1324	msiexec.exe
Token: SeCreateTokenPrivilege	1324	msiexec.exe

Suspicious use of FindShellTrayWindow 52 IoCs

Processes:

msiexec.exechrome.exe

pid	process
1324	msiexec.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exe

pid	process
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe
1740	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exemsiexec.exeMSIA9F1.tmpMsiExec.exeMSIA9F1.tmpMsiExec.exe

description	pid	process	target process
PID 1324 wrote to memory of 960	1324	msiexec.exe	MSIA9F1.tmp
PID 1324 wrote to memory of 960	1324	msiexec.exe	MSIA9F1.tmp
PID 1324 wrote to memory of 960	1324	msiexec.exe	MSIA9F1.tmp
PID 1324 wrote to memory of 960	1324	msiexec.exe	MSIA9F1.tmp
PID 1324 wrote to memory of 960	1324	msiexec.exe	MSIA9F1.tmp
PID 1324 wrote to memory of 960	1324	msiexec.exe	MSIA9F1.tmp
PID 1324 wrote to memory of 960	1324	msiexec.exe	MSIA9F1.tmp
PID 780 wrote to memory of 952	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 952	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 952	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 952	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 952	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 952	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 952	780	msiexec.exe	MsiExec.exe
PID 960 wrote to memory of 276	960	MSIA9F1.tmp	MSIA9F1.tmp
PID 960 wrote to memory of 276	960	MSIA9F1.tmp	MSIA9F1.tmp
PID 960 wrote to memory of 276	960	MSIA9F1.tmp	MSIA9F1.tmp
PID 960 wrote to memory of 276	960	MSIA9F1.tmp	MSIA9F1.tmp
PID 960 wrote to memory of 276	960	MSIA9F1.tmp	MSIA9F1.tmp
PID 960 wrote to memory of 276	960	MSIA9F1.tmp	MSIA9F1.tmp
PID 960 wrote to memory of 276	960	MSIA9F1.tmp	MSIA9F1.tmp
PID 952 wrote to memory of 1880	952	MsiExec.exe	powershell.exe
PID 952 wrote to memory of 1880	952	MsiExec.exe	powershell.exe
PID 952 wrote to memory of 1880	952	MsiExec.exe	powershell.exe
PID 952 wrote to memory of 1880	952	MsiExec.exe	powershell.exe
PID 780 wrote to memory of 1836	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 1836	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 1836	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 1836	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 1836	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 1836	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 1836	780	msiexec.exe	MsiExec.exe
PID 276 wrote to memory of 1372	276	MSIA9F1.tmp	nitro_pro13.exe
PID 276 wrote to memory of 1372	276	MSIA9F1.tmp	nitro_pro13.exe
PID 276 wrote to memory of 1372	276	MSIA9F1.tmp	nitro_pro13.exe
PID 276 wrote to memory of 1372	276	MSIA9F1.tmp	nitro_pro13.exe
PID 276 wrote to memory of 1372	276	MSIA9F1.tmp	nitro_pro13.exe
PID 276 wrote to memory of 1372	276	MSIA9F1.tmp	nitro_pro13.exe
PID 276 wrote to memory of 1372	276	MSIA9F1.tmp	nitro_pro13.exe
PID 780 wrote to memory of 1136	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 1136	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 1136	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 1136	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 1136	780	msiexec.exe	MsiExec.exe
PID 1136 wrote to memory of 1560	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1560	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1560	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1164	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1164	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1164	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 296	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 296	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 296	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1816	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1816	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1816	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1204	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1204	1136	MsiExec.exe	rundll32.exe
PID 1136 wrote to memory of 1204	1136	MsiExec.exe	rundll32.exe
PID 780 wrote to memory of 296	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 296	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 296	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 296	780	msiexec.exe	MsiExec.exe
PID 780 wrote to memory of 296	780	msiexec.exe	MsiExec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Acsc-Joint-Planning-Jpex-Answers.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\AppData\Local\Temp\MSIA9F1.tmp
"C:\Users\Admin\AppData\Local\Temp\MSIA9F1.tmp"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\Temp\{DE5C812E-E90E-46D0-9B32-AE72FC1977F5}\.cr\MSIA9F1.tmp
"C:\Windows\Temp\{DE5C812E-E90E-46D0-9B32-AE72FC1977F5}\.cr\MSIA9F1.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\MSIA9F1.tmp" -burn.filehandle.attached=180 -burn.filehandle.self=188
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.be\nitro_pro13.exe
"C:\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.be\nitro_pro13.exe" -q -burn.elevated BurnPipe.{058CB6FE-4623-41B0-9243-3DDE06076C52} {1E7D90CE-F07D-43C0-8164-72E392923EB7} 276
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:1372

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DFD0294685D9DBC4C95E20FCA73191E0 C
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssABFA.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiAB99.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrABBA.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrABCA.txt" -propSep " :<->: " -testPrefix "_testValue."
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1880

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 0E527122458EFC5C816EFAD999B6865A C
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1836

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding E147DB51537CC7AA3E632D15741085B7
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI2895.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_273001 1 NitroCA!NitroCA.CustomActions.CheckUniversalCRTInstalled
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1560

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI340B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_275747 6 NitroCA!NitroCA.CustomActions.GetOfficeBinaryType
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1164

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI3F04.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_278461 13 NitroCA!NitroCA.CustomActions.ClosePrompt
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:296

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI41E2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_279038 20 NitroCA!NitroCA.CustomActions.ClosePrompt_check
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1816

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI450E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_279912 27 NitroCA!NitroCA.CustomActions.ModifyMsiSourceList
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1204

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 00FA557DD6BB492715A4DF3824767103 M Global\MSI0000
2⤵
- Loads dropped DLL
PID:296

C:\Windows\syswow64\reg.exe
"reg.exe" copy HKLM\SOFTWARE\Classes\.fdf HKLM\SOFTWARE\Classes\NitroPDF.fdf\old /f
3⤵
- Modifies registry class
PID:1532

C:\Windows\syswow64\reg.exe
"reg.exe" copy HKLM\SOFTWARE\Classes\.pdf HKLM\SOFTWARE\Classes\NitroPDF.pdf\old /f
3⤵
PID:1592

C:\Windows\syswow64\reg.exe
"reg.exe" copy HKLM\SOFTWARE\Classes\.xfdf HKLM\SOFTWARE\Classes\NitroPDF.xfdf\old /f
3⤵
PID:1708

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding C16A9D4247CF90592E77075CD856C056 M Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:932

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSIAA7B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_305886 44 NitroCA!NitroCA.CustomActions.MoveShellExtensionToCommonFiles
3⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1840

C:\Windows\System32\net.exe
"C:\Windows\System32\net.exe" stop LPDSVC
3⤵
PID:588

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop LPDSVC
4⤵
PID:1300

C:\Windows\System32\net.exe
"C:\Windows\System32\net.exe" stop spooler
3⤵
PID:568

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop spooler
4⤵
PID:1708

C:\Windows\System32\net.exe
"C:\Windows\System32\net.exe" start spooler
3⤵
PID:1300

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start spooler
4⤵
PID:1724

C:\Windows\System32\net.exe
"C:\Windows\System32\net.exe" start LPDSVC
3⤵
PID:1280

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start LPDSVC
4⤵
PID:616

C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe
"C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe" /InstallExcelAddin 1
2⤵
- Executes dropped EXE
PID:1532

C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe
"C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe" /InstallOutlookAddin 1
2⤵
- Executes dropped EXE
PID:1016

C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe
"C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe" /InstallPowerPointAddin 1
2⤵
- Executes dropped EXE
PID:1600

C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe
"C:\Program Files\Nitro\Pro\13\AddinSetupTool.exe" /InstallWordAddin 1
2⤵
- Executes dropped EXE
PID:1764

C:\Windows\SysWOW64\CertUtil.exe
C:\Windows\SysWOW64\CertUtil –addstore –f "ca" "C:\Program Files\Nitro\Pro\13\notarius-certificate-authority.cer"
2⤵
- Modifies data under HKEY_USERS
PID:1560

C:\Windows\SysWOW64\CertUtil.exe
C:\Windows\SysWOW64\CertUtil –addstore –f "ca" "C:\Program Files\Nitro\Pro\13\notarius-root-certificate-authority.cer"
2⤵
- Modifies data under HKEY_USERS
PID:1064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1828

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot13" "" "" "66d15495b" "0000000000000000" "00000000000004EC" "00000000000003C0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:1764

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Modifies data under HKEY_USERS
PID:988

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc
1⤵
PID:1884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef53a4f50,0x7fef53a4f60,0x7fef53a4f70
2⤵
PID:980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1132 /prefetch:2
2⤵
PID:1172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1332 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1732 /prefetch:8
2⤵
PID:1328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1
2⤵
PID:1696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:1
2⤵
PID:1084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
2⤵
PID:1000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=500 /prefetch:8
2⤵
PID:2700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=992 /prefetch:8
2⤵
PID:2836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3528 /prefetch:8
2⤵
PID:3000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3088 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
2⤵
PID:2096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:8
2⤵
PID:1000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
2⤵
PID:2364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3628 /prefetch:8
2⤵
PID:2028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3640 /prefetch:8
2⤵
PID:1648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3532 /prefetch:8
2⤵
PID:2120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
2⤵
PID:824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
2⤵
PID:2604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3476 /prefetch:8
2⤵
PID:2580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1540 /prefetch:8
2⤵
PID:2744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1436 /prefetch:8
2⤵
PID:1552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3136 /prefetch:8
2⤵
PID:1048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
2⤵
PID:3044

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=90Y+6jQvmX2TYEwt5NvcD1Ws4rEe7XICeuCxqueo --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2916

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=93.269.200 --initial-client-data=0x160,0x164,0x168,0x134,0x16c,0x13fe09300,0x13fe09310,0x13fe09320
3⤵
- Executes dropped EXE
PID:1312

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_2916_THKOWPPECPIEOYZI" --sandboxed-process-id=2 --init-done-notifier=488 --sandbox-mojo-pipe-token=8188349697313221986 --mojo-platform-channel-handle=464 --engine=2
3⤵
- Executes dropped EXE
PID:2276

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\93.269.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_2916_THKOWPPECPIEOYZI" --sandboxed-process-id=3 --init-done-notifier=640 --sandbox-mojo-pipe-token=10349311345963889830 --mojo-platform-channel-handle=636
3⤵
- Executes dropped EXE
PID:1676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3416 /prefetch:8
2⤵
PID:2336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2024 /prefetch:8
2⤵
PID:2132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1104,4603204633215421723,15077031802193717978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:8
2⤵
PID:2580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
ab5c36d10261c173c5896f3478cdc6b7

SHA1
87ac53810ad125663519e944bc87ded3979cbee4

SHA256
f8e90fb0557fe49d7702cfb506312ac0b24c97802f9c782696db6d47f434e8e9

SHA512
e83e4eae44e7a9cbcd267dbfc25a7f4f68b50591e3bbe267324b1f813c9220d565b284994ded5f7d2d371d50e1ebfa647176ec8de9716f754c6b5785c6e897fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
82df59caeb61a84a94e6a0e4723447d3

SHA1
697245b62941b1bb644cbaa91abda65d743967a8

SHA256
1efb79ef65021f3b0e73e97b83c49fcffd09a1f031b302f3466be4a44ea0d6ae

SHA512
1798ab094bc268bd82e11d3084102fe8467cd902f84fde7eba60efa15bab8fc797b424700ccb5b95e50e6a968a2675e6146061f4adb86f504b66e7651db88cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA9F1.tmp
MD5
044a5d8e2f1356de889aedb11fdcc679

SHA1
4e8416eb12d209509d49998ebe714612709eb4d6

SHA256
e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7

SHA512
3cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA9F1.tmp
MD5
044a5d8e2f1356de889aedb11fdcc679

SHA1
4e8416eb12d209509d49998ebe714612709eb4d6

SHA256
e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7

SHA512
3cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAA01.tmp
MD5
c26c68e4a79fd2629714b17514411c40

SHA1
00138d8edea0918c4476da303415be399cf704c6

SHA256
55434961c0b4bed88ae6bfe6e0e61a3a3dcc392858f0e53c6c14c272200203ed

SHA512
6fc8028e6e52b6c9e74ac3ea6d19ed750047d46b7e4021d46e581b58367ffc11fb13b696dfa30a15305e94098a7fd12051ee37d32df91ef2ae1e2d9c642b02ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC0FB.tmp
MD5
55bd68162716cc435eb221b048567e73

SHA1
3e9ef3823a6ecb7ca7942a332e400ec3adb8c2bb

SHA256
76bb62394bef8acf9021f8e94219430515cb2734805e29684044a0a4a802469c

SHA512
f371443c8577cf55dd4e76c4fb5d90dff4bcc3e839b7c31183d5db0d4586d105237a8d3a34ed68b0bf64c90dfd99fe64ceac57b91a0ac7835d34ad574f4ccc87

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIC179.tmp
MD5
07ce413b1af6342187514871dc112c74

SHA1
8008f8bfeae99918b6323a3d1270dea63b3a8394

SHA256
0ba7e90fe2a0005e1e0dad53e2678916650c3b95ff9b666b802d128276c8ec46

SHA512
27df52bfcbc2d0ce3756a2526e632b5610d7047259b31aeeff12652de3e046bcd239e39c222a323654f475f1f913679b4fdd858303e0e105f7a300b6f6ed0fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nitro_Pro_20210926170134_000_NitroInstallationPackageId_x64_en.log
MD5
9072091906b76ded8a665470d181f78c

SHA1
b14c1ad3d3c45b8be07ec1a1f67adc2290ffa4b8

SHA256
87f1f03be527eac5ae857d750a479d01ac14694ebbb09981448ec0115ce41c0f

SHA512
a47684e49cb77876760910b00c5f76249df4d7c55abf47783a3fd7e8f20174d163084ac57303127f2db06be828aa75e52deade6f24e31f46acd0238bd6b07be1

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssABFA.ps1
MD5
0c95bc11cfca37f84a19de0529377e13

SHA1
41f409dbbab04ef35c4f6489af6f85fceb9c501a

SHA256
88748aae11029228d84aef0855f4bc084dfd70450db1f7029746d8bc85182f93

SHA512
8a52f3c40440e3129a367609ee4b6e9e98aa62edec48592be03bad1aadcd389e2e58e095f4ea3d6f9cb458aa7101fcb5afdff66658885bfa0634c74c086db568

Download Submit
C:\Users\Admin\AppData\Local\Temp\scrABBA.ps1
MD5
c803797d8af1ef2779336e1c31743a44

SHA1
66b903d47f23a52a428daf3f358ff9522a1761b0

SHA256
f8ffeda0cf4e3519a3af952f17ac137aa59b7d547612e5b6595dad4e26165027

SHA512
086b7ea1b3d07e2f3d2aa10927c9cd61a659cc168ccb67226cf3d142e9b14ce861ac866997838c1295904da86ec0d50873c0c359add2bf829f59596fde1d3385

Download Submit
C:\Windows\Installer\MSI2895.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
C:\Windows\Installer\MSI340B.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
C:\Windows\Installer\MSI3F04.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
C:\Windows\Installer\MSI41E2.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
C:\Windows\Installer\MSI450E.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
C:\Windows\Installer\MSI66E4.tmp
MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Windows\Installer\MSI6790.tmp
MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
C:\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.be\nitro_pro13.exe
MD5
044a5d8e2f1356de889aedb11fdcc679

SHA1
4e8416eb12d209509d49998ebe714612709eb4d6

SHA256
e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7

SHA512
3cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9

Download Submit
C:\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.be\nitro_pro13.exe
MD5
044a5d8e2f1356de889aedb11fdcc679

SHA1
4e8416eb12d209509d49998ebe714612709eb4d6

SHA256
e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7

SHA512
3cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9

Download Submit
C:\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\NitroInstallationPackageId_x64_en
MD5
ebb262917d5d14ef901d9de3c29e7527

SHA1
5f7bfb2d88879aa626ef16c56602d774eaddfff5

SHA256
45302c7f44a4f94854bfcf38790e5bbfe19ce549b1cea265243a7a67d6f39ddb

SHA512
420feb3dc10b30cecb85991a247bf4ff8d8dbca8a84254540d0ed9a760fa1b22846278558efa08bade32cfc9997b53c227a5b1b37834765ca5e1bbdb8310bb04

Download Submit
C:\Windows\Temp\{DE5C812E-E90E-46D0-9B32-AE72FC1977F5}\.cr\MSIA9F1.tmp
MD5
044a5d8e2f1356de889aedb11fdcc679

SHA1
4e8416eb12d209509d49998ebe714612709eb4d6

SHA256
e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7

SHA512
3cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9

Download Submit
C:\Windows\Temp\{DE5C812E-E90E-46D0-9B32-AE72FC1977F5}\.cr\MSIA9F1.tmp
MD5
044a5d8e2f1356de889aedb11fdcc679

SHA1
4e8416eb12d209509d49998ebe714612709eb4d6

SHA256
e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7

SHA512
3cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\MSIAA01.tmp
MD5
c26c68e4a79fd2629714b17514411c40

SHA1
00138d8edea0918c4476da303415be399cf704c6

SHA256
55434961c0b4bed88ae6bfe6e0e61a3a3dcc392858f0e53c6c14c272200203ed

SHA512
6fc8028e6e52b6c9e74ac3ea6d19ed750047d46b7e4021d46e581b58367ffc11fb13b696dfa30a15305e94098a7fd12051ee37d32df91ef2ae1e2d9c642b02ea

Download Submit
\Users\Admin\AppData\Local\Temp\MSIC0FB.tmp
MD5
55bd68162716cc435eb221b048567e73

SHA1
3e9ef3823a6ecb7ca7942a332e400ec3adb8c2bb

SHA256
76bb62394bef8acf9021f8e94219430515cb2734805e29684044a0a4a802469c

SHA512
f371443c8577cf55dd4e76c4fb5d90dff4bcc3e839b7c31183d5db0d4586d105237a8d3a34ed68b0bf64c90dfd99fe64ceac57b91a0ac7835d34ad574f4ccc87

Download Submit
\Users\Admin\AppData\Local\Temp\MSIC179.tmp
MD5
07ce413b1af6342187514871dc112c74

SHA1
8008f8bfeae99918b6323a3d1270dea63b3a8394

SHA256
0ba7e90fe2a0005e1e0dad53e2678916650c3b95ff9b666b802d128276c8ec46

SHA512
27df52bfcbc2d0ce3756a2526e632b5610d7047259b31aeeff12652de3e046bcd239e39c222a323654f475f1f913679b4fdd858303e0e105f7a300b6f6ed0fe5

Download Submit
\Windows\Installer\MSI2895.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
\Windows\Installer\MSI2895.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
\Windows\Installer\MSI2895.tmp-\NitroCA.dll
MD5
81cfdfc9cde37b8a847d8bc5326dc9d9

SHA1
dabcd11ca3dc797e39c2b1db28adba365b99c0d2

SHA256
2cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099

SHA512
983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143

Download Submit
\Windows\Installer\MSI2895.tmp-\NitroCA.dll
MD5
81cfdfc9cde37b8a847d8bc5326dc9d9

SHA1
dabcd11ca3dc797e39c2b1db28adba365b99c0d2

SHA256
2cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099

SHA512
983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143

Download Submit
\Windows\Installer\MSI340B.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
\Windows\Installer\MSI340B.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
\Windows\Installer\MSI340B.tmp-\NitroCA.dll
MD5
81cfdfc9cde37b8a847d8bc5326dc9d9

SHA1
dabcd11ca3dc797e39c2b1db28adba365b99c0d2

SHA256
2cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099

SHA512
983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143

Download Submit
\Windows\Installer\MSI340B.tmp-\NitroCA.dll
MD5
81cfdfc9cde37b8a847d8bc5326dc9d9

SHA1
dabcd11ca3dc797e39c2b1db28adba365b99c0d2

SHA256
2cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099

SHA512
983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143

Download Submit
\Windows\Installer\MSI3F04.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
\Windows\Installer\MSI3F04.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
\Windows\Installer\MSI3F04.tmp-\NitroCA.dll
MD5
81cfdfc9cde37b8a847d8bc5326dc9d9

SHA1
dabcd11ca3dc797e39c2b1db28adba365b99c0d2

SHA256
2cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099

SHA512
983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143

Download Submit
\Windows\Installer\MSI3F04.tmp-\NitroCA.dll
MD5
81cfdfc9cde37b8a847d8bc5326dc9d9

SHA1
dabcd11ca3dc797e39c2b1db28adba365b99c0d2

SHA256
2cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099

SHA512
983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143

Download Submit
\Windows\Installer\MSI41E2.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
\Windows\Installer\MSI41E2.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
\Windows\Installer\MSI41E2.tmp-\NitroCA.dll
MD5
81cfdfc9cde37b8a847d8bc5326dc9d9

SHA1
dabcd11ca3dc797e39c2b1db28adba365b99c0d2

SHA256
2cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099

SHA512
983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143

Download Submit
\Windows\Installer\MSI41E2.tmp-\NitroCA.dll
MD5
81cfdfc9cde37b8a847d8bc5326dc9d9

SHA1
dabcd11ca3dc797e39c2b1db28adba365b99c0d2

SHA256
2cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099

SHA512
983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143

Download Submit
\Windows\Installer\MSI450E.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
\Windows\Installer\MSI450E.tmp
MD5
c2894c0391639b486ddb8f8c9dc3873e

SHA1
fdbef2279fe4fb323749d30998cd239b51e4a2a2

SHA256
0590f42b227c3f2726954521e85527668fe49b2de81abed53e738aed15746b0c

SHA512
c4fb09eb6b58f588eac6d7a65587468e2adba4ffa9a95f490d889d77181071b19ac808e26ae5222a057fe0c00b36c90425dc289147949b502757293ce955d2db

Download Submit
\Windows\Installer\MSI450E.tmp-\NitroCA.dll
MD5
81cfdfc9cde37b8a847d8bc5326dc9d9

SHA1
dabcd11ca3dc797e39c2b1db28adba365b99c0d2

SHA256
2cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099

SHA512
983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143

Download Submit
\Windows\Installer\MSI450E.tmp-\NitroCA.dll
MD5
81cfdfc9cde37b8a847d8bc5326dc9d9

SHA1
dabcd11ca3dc797e39c2b1db28adba365b99c0d2

SHA256
2cbbbbebb66f535edea0fd4f2116e97802c84f1dce222cbbae1ede40b8ce5099

SHA512
983b38b7e49072bb32067e4a6500c6978ca26d95354b781546e1ad421f61e01e0d66ed3c3f85c2f30d49c4a2037f4c4dbd3e4d272963c215970e74b9c5010143

Download Submit
\Windows\Installer\MSI66E4.tmp
MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
\Windows\Installer\MSI6790.tmp
MD5
d773d9bd091e712df7560f576da53de8

SHA1
165cfbdce1811883360112441f7237b287cf0691

SHA256
e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7

SHA512
15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\BootstrapperCore.dll
MD5
c4f7146ddc56763ccdb1cb3c09478708

SHA1
bca088ab33cfb69adeae11a272e9c8a83f39a8c9

SHA256
886cb2a994461f091752fc7b21e3143c212efd8841c757909e74ac32761880da

SHA512
df2ca029e95f80fc5870e541db8b1d5a03266307bb5f7680ad630868a9a3c584b3a702fbec09c26fef7287c99f5d9d1f59cd59b74dcf740c9a8e7508e07d18b5

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\BootstrapperCore.dll
MD5
c4f7146ddc56763ccdb1cb3c09478708

SHA1
bca088ab33cfb69adeae11a272e9c8a83f39a8c9

SHA256
886cb2a994461f091752fc7b21e3143c212efd8841c757909e74ac32761880da

SHA512
df2ca029e95f80fc5870e541db8b1d5a03266307bb5f7680ad630868a9a3c584b3a702fbec09c26fef7287c99f5d9d1f59cd59b74dcf740c9a8e7508e07d18b5

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\GalaSoft.MvvmLight.WPF4.dll
MD5
1e40431b501d55fe8ba59cabb3ce5c17

SHA1
b8aef0f6829345d844960c3eaf96c41f76142f6c

SHA256
92ef1bdf8c8140e34e5ae1eb8d9b7afba9921e5ada6317c6cdd0da2712f7e000

SHA512
2ab5d887e717add46959a7193cbf1dbf73f2792130025e5712ae76058ce5923be8afdf3ed8d11ea6859b13126f88bb9e1099741c799ca90e3f7713955dd9638d

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\GalaSoft.MvvmLight.WPF4.dll
MD5
1e40431b501d55fe8ba59cabb3ce5c17

SHA1
b8aef0f6829345d844960c3eaf96c41f76142f6c

SHA256
92ef1bdf8c8140e34e5ae1eb8d9b7afba9921e5ada6317c6cdd0da2712f7e000

SHA512
2ab5d887e717add46959a7193cbf1dbf73f2792130025e5712ae76058ce5923be8afdf3ed8d11ea6859b13126f88bb9e1099741c799ca90e3f7713955dd9638d

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\NitroBA.dll
MD5
6726d4b46346ef40dd3ea4376ae7d259

SHA1
ffdaa10e1e3d1c7d7411f799a0889ce66014bc29

SHA256
3e96b189fa7a160396742cdc93564dfce3ad3993a3e21118cf9114c8cb45e963

SHA512
cd2a68f1ce4bc161b26466fa8f472803d7a10b339dff6c599e64863236ef59d9a0ed1b2f4168f8557b35d81d92edccdfd9d313096a88415838b6351af1ae249a

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\NitroBA.dll
MD5
6726d4b46346ef40dd3ea4376ae7d259

SHA1
ffdaa10e1e3d1c7d7411f799a0889ce66014bc29

SHA256
3e96b189fa7a160396742cdc93564dfce3ad3993a3e21118cf9114c8cb45e963

SHA512
cd2a68f1ce4bc161b26466fa8f472803d7a10b339dff6c599e64863236ef59d9a0ed1b2f4168f8557b35d81d92edccdfd9d313096a88415838b6351af1ae249a

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\PageTransitions.dll
MD5
ad69d408b05b98180b25d23b0a790f01

SHA1
5fdbdae2979685db500d2b031e2a430ce16e592e

SHA256
14090b63240c63bfe118a24b6f0112095f331ac46819f6f4ab62d8e9bbe4c646

SHA512
12323f7190fd785277965996cffe141a5b2d5b11679961db6aa6744b8157df7f9bd7b5b935d3ca2a7e0be7ca5f0f60fd8885b94ae7cd70aea1572e90a2599eac

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\PageTransitions.dll
MD5
ad69d408b05b98180b25d23b0a790f01

SHA1
5fdbdae2979685db500d2b031e2a430ce16e592e

SHA256
14090b63240c63bfe118a24b6f0112095f331ac46819f6f4ab62d8e9bbe4c646

SHA512
12323f7190fd785277965996cffe141a5b2d5b11679961db6aa6744b8157df7f9bd7b5b935d3ca2a7e0be7ca5f0f60fd8885b94ae7cd70aea1572e90a2599eac

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\mbahost.dll
MD5
d7c697ceb6f40ce91dabfcbe8df08e22

SHA1
49cd0213a1655dcdb493668083ab2d7f55135381

SHA256
b925d9d3e1e2c49bf05a1b0713e2750ee6e0c43c7adc9d3c3a1b9fb8c557c3df

SHA512
22ca87979ca68f10b5fda64c27913d0f2a12c359b04e4a6caa3645303fbd47cd598c805fd9a43c8f3e0934e9d2db85f7a4e1eff26cb33d233efc05ee2613cfc1

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\metrics.dll
MD5
aed8280e90f672f631d2aedebd6452bf

SHA1
390b96ce6b4b1a47c12d8932c5e8da6e51fdd38a

SHA256
a82332e0a9c9cee34f9a46d5e984901fa57a011f54e7b37b9716acf834746ced

SHA512
23a223fc4da00038ff6b584f0a2a4186f49eaf4d8cb28dfdfa795048a4a977aa39848cb83bbfd8f0555412fd04c802b122267266e33a5ddc49d3e0ff1e2eca4f

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\metrics.dll
MD5
aed8280e90f672f631d2aedebd6452bf

SHA1
390b96ce6b4b1a47c12d8932c5e8da6e51fdd38a

SHA256
a82332e0a9c9cee34f9a46d5e984901fa57a011f54e7b37b9716acf834746ced

SHA512
23a223fc4da00038ff6b584f0a2a4186f49eaf4d8cb28dfdfa795048a4a977aa39848cb83bbfd8f0555412fd04c802b122267266e33a5ddc49d3e0ff1e2eca4f

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.ba\metrics.dll
MD5
aed8280e90f672f631d2aedebd6452bf

SHA1
390b96ce6b4b1a47c12d8932c5e8da6e51fdd38a

SHA256
a82332e0a9c9cee34f9a46d5e984901fa57a011f54e7b37b9716acf834746ced

SHA512
23a223fc4da00038ff6b584f0a2a4186f49eaf4d8cb28dfdfa795048a4a977aa39848cb83bbfd8f0555412fd04c802b122267266e33a5ddc49d3e0ff1e2eca4f

Download Submit
\Windows\Temp\{08CD0F99-963B-4D10-9DA4-4418ECDD4109}\.be\nitro_pro13.exe
MD5
044a5d8e2f1356de889aedb11fdcc679

SHA1
4e8416eb12d209509d49998ebe714612709eb4d6

SHA256
e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7

SHA512
3cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9

Download Submit
\Windows\Temp\{DE5C812E-E90E-46D0-9B32-AE72FC1977F5}\.cr\MSIA9F1.tmp
MD5
044a5d8e2f1356de889aedb11fdcc679

SHA1
4e8416eb12d209509d49998ebe714612709eb4d6

SHA256
e4492ccb97078cc32ee4437404ce04f4404884800a81fb34243d0a64936f82d7

SHA512
3cb6beaf46ec6ca3aa5a645b51b1df7a26826d8e65eb8f6cd1be63488f7a372c1e7e266f2950489a3ae8b3c6ca60d72f25504e4942e096c5c2045177557c79b9

Download Submit
memory/276-96-0x0000000000DBA000-0x0000000000DBB000-memory.dmp

Filesize
4KB

Download
memory/276-65-0x0000000000000000-mapping.dmp

Download
memory/276-110-0x0000000002D70000-0x0000000002ECC000-memory.dmp

Filesize
1.4MB

Download
memory/276-74-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/276-78-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/276-83-0x0000000000DA3000-0x0000000000DA4000-memory.dmp

Filesize
4KB

Download
memory/276-81-0x0000000000DA1000-0x0000000000DA2000-memory.dmp

Filesize
4KB

Download
memory/276-95-0x0000000000DA9000-0x0000000000DBA000-memory.dmp

Filesize
68KB

Download
memory/276-94-0x0000000000DA4000-0x0000000000DA5000-memory.dmp

Filesize
4KB

Download
memory/276-91-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/276-87-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/276-80-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/296-163-0x000000001A7E5000-0x000000001A7E7000-memory.dmp

Filesize
8KB

Download
memory/296-190-0x0000000000000000-mapping.dmp

Download
memory/296-165-0x000000001A7EA000-0x000000001A7EB000-memory.dmp

Filesize
4KB

Download
memory/296-164-0x000000001A7E7000-0x000000001A7E8000-memory.dmp

Filesize
4KB

Download
memory/296-150-0x0000000000000000-mapping.dmp

Download
memory/296-162-0x000000001A7E3000-0x000000001A7E5000-memory.dmp

Filesize
8KB

Download
memory/296-161-0x000000001A7E0000-0x000000001A7E2000-memory.dmp

Filesize
8KB

Download
memory/568-216-0x0000000000000000-mapping.dmp

Download
memory/584-230-0x0000000000000000-mapping.dmp

Download
memory/588-214-0x0000000000000000-mapping.dmp

Download
memory/616-221-0x0000000000000000-mapping.dmp

Download
memory/824-275-0x0000000000000000-mapping.dmp

Download
memory/932-199-0x0000000000000000-mapping.dmp

Download
memory/952-57-0x0000000000000000-mapping.dmp

Download
memory/960-56-0x0000000000000000-mapping.dmp

Download
memory/960-59-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/980-227-0x0000000000000000-mapping.dmp

Download
memory/1000-259-0x0000000000000000-mapping.dmp

Download
memory/1000-243-0x0000000000000000-mapping.dmp

Download
memory/1016-211-0x0000000000000000-mapping.dmp

Download
memory/1048-290-0x0000000000000000-mapping.dmp

Download
memory/1064-224-0x0000000000000000-mapping.dmp

Download
memory/1084-239-0x0000000000000000-mapping.dmp

Download
memory/1136-118-0x0000000000000000-mapping.dmp

Download
memory/1164-141-0x0000000001D40000-0x0000000001D41000-memory.dmp

Filesize
4KB

Download
memory/1164-146-0x000000001A917000-0x000000001A918000-memory.dmp

Filesize
4KB

Download
memory/1164-147-0x000000001A91A000-0x000000001A91B000-memory.dmp

Filesize
4KB

Download
memory/1164-143-0x000000001A910000-0x000000001A912000-memory.dmp

Filesize
8KB

Download
memory/1164-144-0x000000001A913000-0x000000001A915000-memory.dmp

Filesize
8KB

Download
memory/1164-136-0x0000000000000000-mapping.dmp

Download
memory/1164-145-0x000000001A915000-0x000000001A917000-memory.dmp

Filesize
8KB

Download
memory/1172-231-0x00000000777E0000-0x00000000777E1000-memory.dmp

Filesize
4KB

Download
memory/1172-229-0x0000000000000000-mapping.dmp

Download
memory/1204-181-0x000000001A910000-0x000000001A912000-memory.dmp

Filesize
8KB

Download
memory/1204-182-0x000000001A913000-0x000000001A915000-memory.dmp

Filesize
8KB

Download
memory/1204-183-0x000000001A915000-0x000000001A917000-memory.dmp

Filesize
8KB

Download
memory/1204-187-0x000000001A917000-0x000000001A918000-memory.dmp

Filesize
4KB

Download
memory/1204-189-0x000000001A91A000-0x000000001A91B000-memory.dmp

Filesize
4KB

Download
memory/1204-173-0x0000000000000000-mapping.dmp

Download
memory/1280-220-0x0000000000000000-mapping.dmp

Download
memory/1300-215-0x0000000000000000-mapping.dmp

Download
memory/1300-218-0x0000000000000000-mapping.dmp

Download
memory/1312-296-0x0000000000000000-mapping.dmp

Download
memory/1324-54-0x000007FEFC051000-0x000007FEFC053000-memory.dmp

Filesize
8KB

Download
memory/1328-233-0x0000000000000000-mapping.dmp

Download
memory/1372-106-0x0000000000000000-mapping.dmp

Download
memory/1532-210-0x0000000000000000-mapping.dmp

Download
memory/1532-194-0x0000000000000000-mapping.dmp

Download
memory/1552-287-0x0000000000000000-mapping.dmp

Download
memory/1560-122-0x0000000000000000-mapping.dmp

Download
memory/1560-128-0x0000000002317000-0x0000000002318000-memory.dmp

Filesize
4KB

Download
memory/1560-222-0x0000000000000000-mapping.dmp

Download
memory/1560-125-0x0000000001D40000-0x0000000001D41000-memory.dmp

Filesize
4KB

Download
memory/1560-124-0x0000000002310000-0x0000000002312000-memory.dmp

Filesize
8KB

Download
memory/1560-126-0x0000000002313000-0x0000000002315000-memory.dmp

Filesize
8KB

Download
memory/1560-129-0x000000000231A000-0x000000000231B000-memory.dmp

Filesize
4KB

Download
memory/1560-132-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1560-127-0x0000000002315000-0x0000000002317000-memory.dmp

Filesize
8KB

Download
memory/1592-197-0x0000000000000000-mapping.dmp

Download
memory/1600-212-0x0000000000000000-mapping.dmp

Download
memory/1648-269-0x0000000000000000-mapping.dmp

Download
memory/1676-300-0x0000000000000000-mapping.dmp

Download
memory/1696-236-0x0000000000000000-mapping.dmp

Download
memory/1708-217-0x0000000000000000-mapping.dmp

Download
memory/1708-198-0x0000000000000000-mapping.dmp

Download
memory/1724-219-0x0000000000000000-mapping.dmp

Download
memory/1740-241-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/1764-213-0x0000000000000000-mapping.dmp

Download
memory/1816-159-0x0000000000000000-mapping.dmp

Download
memory/1816-176-0x000000001A2C0000-0x000000001A2C2000-memory.dmp

Filesize
8KB

Download
memory/1816-177-0x000000001A2C3000-0x000000001A2C5000-memory.dmp

Filesize
8KB

Download
memory/1816-178-0x000000001A2C5000-0x000000001A2C7000-memory.dmp

Filesize
8KB

Download
memory/1816-180-0x000000001A2CA000-0x000000001A2CB000-memory.dmp

Filesize
4KB

Download
memory/1816-179-0x000000001A2C7000-0x000000001A2C8000-memory.dmp

Filesize
4KB

Download
memory/1836-101-0x0000000000000000-mapping.dmp

Download
memory/1840-207-0x000000001AA05000-0x000000001AA07000-memory.dmp

Filesize
8KB

Download
memory/1840-208-0x000000001AA07000-0x000000001AA08000-memory.dmp

Filesize
4KB

Download
memory/1840-206-0x000000001AA03000-0x000000001AA05000-memory.dmp

Filesize
8KB

Download
memory/1840-205-0x000000001AA00000-0x000000001AA02000-memory.dmp

Filesize
8KB

Download
memory/1840-201-0x0000000000000000-mapping.dmp

Download
memory/1840-209-0x000000001AA0A000-0x000000001AA0B000-memory.dmp

Filesize
4KB

Download
memory/1840-202-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/1840-203-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/1880-93-0x00000000023D0000-0x000000000301A000-memory.dmp

Filesize
12.3MB

Download
memory/1880-82-0x00000000023D0000-0x000000000301A000-memory.dmp

Filesize
12.3MB

Download
memory/1880-68-0x0000000000000000-mapping.dmp

Download
memory/1880-84-0x00000000023D0000-0x000000000301A000-memory.dmp

Filesize
12.3MB

Download
memory/2028-266-0x0000000000000000-mapping.dmp

Download
memory/2092-255-0x0000000000000000-mapping.dmp

Download
memory/2096-257-0x0000000000000000-mapping.dmp

Download
memory/2120-271-0x0000000000000000-mapping.dmp

Download
memory/2132-310-0x0000000000000000-mapping.dmp

Download
memory/2276-298-0x0000000000000000-mapping.dmp

Download
memory/2276-304-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2276-305-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download
memory/2276-301-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2276-302-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download
memory/2276-303-0x0000000000CE0000-0x0000000000D20000-memory.dmp

Filesize
256KB

Download
memory/2336-307-0x0000000000000000-mapping.dmp

Download
memory/2364-263-0x0000000000000000-mapping.dmp

Download
memory/2580-313-0x0000000000000000-mapping.dmp

Download
memory/2580-281-0x0000000000000000-mapping.dmp

Download
memory/2604-278-0x0000000000000000-mapping.dmp

Download
memory/2700-246-0x0000000000000000-mapping.dmp

Download
memory/2744-284-0x0000000000000000-mapping.dmp

Download
memory/2836-249-0x0000000000000000-mapping.dmp

Download
memory/2896-251-0x0000000000000000-mapping.dmp

Download
memory/2916-295-0x0000000000000000-mapping.dmp

Download
memory/3000-253-0x0000000000000000-mapping.dmp

Download
memory/3044-293-0x0000000000000000-mapping.dmp

Download