bfdd77d54f9b6a3262e6de478cc836982fd4f035f3b5e78a85a72abc578eee55

Analysis

max time kernel
283s
max time network
295s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-12-2022 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Macrobond.x64.msi
Size

17.1MB
MD5

5fca46ed2be6a15b773727478f3dac75
SHA1

207b1b751181a681efe8983a89113e59cfdf7ede
SHA256

bfdd77d54f9b6a3262e6de478cc836982fd4f035f3b5e78a85a72abc578eee55
SHA512

2dfe3bafd55e3c3632fccfeed1d5406a32ef6f9650184227951221e82156906b05e9084803e5e46c08f66f5b5a5f56ce721c37cf3ec91d7521951f4d0f459532
SSDEEP

393216:cTIomVkuMRC3scJhMbDLqZeB+UlA8lQ/mlIHY:8mfMEXU+oQUGqlI4

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

Processes:

msiexec.exemsiexec.exe

flow pid process

2 1604 msiexec.exe
4 1604 msiexec.exe
6 1604 msiexec.exe
8 1604 msiexec.exe
11 908 msiexec.exe
12 908 msiexec.exe
13 908 msiexec.exe
Executes dropped EXE 1 IoCs

Processes:

MacroBond.exe

pid process

1828 MacroBond.exe

flow	pid	process
2	1604	msiexec.exe
4	1604	msiexec.exe
6	1604	msiexec.exe
8	1604	msiexec.exe
11	908	msiexec.exe
12	908	msiexec.exe
13	908	msiexec.exe

pid	process
1828	MacroBond.exe

Registers COM server for autorun 1 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F22A9A5C-E6F2-4FA8-8D1B-E928AB5DDF9B}\InprocServer32\Class = "Abacus.ComApi.Connection"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FE9448A-E111-3EB2-86C8-2DDE60FCDBCB}\InprocServer32\ = "C:\\Program Files\\Macrobond Financial\\Macrobond\\Abacus.Excel.Shim.x64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4C47339-61B4-4816-B9A2-C71DF0C4B0FA}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB4BBE6D-65FA-4C04-9161-95234523F21A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB4BBE6D-65FA-4C04-9161-95234523F21A}\InprocServer32\Class = "Abacus.EViews.MacrobondDatabaseManager"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F22A9A5C-E6F2-4FA8-8D1B-E928AB5DDF9B}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F4C47339-61B4-4816-B9A2-C71DF0C4B0FA}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\InProcServer32\ = "mscoree.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F22A9A5C-E6F2-4FA8-8D1B-E928AB5DDF9B}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F22A9A5C-E6F2-4FA8-8D1B-E928AB5DDF9B}\InprocServer32\Assembly = "Abacus.ComApi, Version=1.23.0.3853, Culture=neutral, PublicKeyToken=109bd21c6ab0cfcd"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F22A9A5C-E6F2-4FA8-8D1B-E928AB5DDF9B}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{9195B91E-8832-4E1F-9501-A150F0E3EC00}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9195B91E-8832-4E1F-9501-A150F0E3EC00}\InprocServer32\ = "C:\\Program Files\\Macrobond Financial\\Macrobond\\Abacus.Excel.Shim.x64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4C47339-61B4-4816-B9A2-C71DF0C4B0FA}\InprocServer32\ = "C:\\Program Files\\Macrobond Financial\\Macrobond\\Abacus.Excel.Shim.x64.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{62ABD77D-D272-4F5C-AC97-32268DD3B27B}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB4BBE6D-65FA-4C04-9161-95234523F21A}\InprocServer32\CodeBase = "file:///C:\\Program Files\\Macrobond Financial\\Macrobond\\Abacus.EViews.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{4FE9448A-E111-3EB2-86C8-2DDE60FCDBCB}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62ABD77D-D272-4F5C-AC97-32268DD3B27B}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\InProcServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BB4BBE6D-65FA-4C04-9161-95234523F21A}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{900046CB-9594-39D2-8F21-3D88A256FB34}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F22A9A5C-E6F2-4FA8-8D1B-E928AB5DDF9B}\InprocServer32\CodeBase = "file:///C:\\Program Files\\Macrobond Financial\\Macrobond\\Abacus.ComApi.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FE9448A-E111-3EB2-86C8-2DDE60FCDBCB}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62ABD77D-D272-4F5C-AC97-32268DD3B27B}\InprocServer32\ = "C:\\Program Files\\Macrobond Financial\\Macrobond\\Abacus.Excel.Shim.x64.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F22A9A5C-E6F2-4FA8-8D1B-E928AB5DDF9B}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB4BBE6D-65FA-4C04-9161-95234523F21A}\InprocServer32\Assembly = "Abacus.EViews, Version=1.23.0.3853, Culture=neutral, PublicKeyToken=109bd21c6ab0cfcd"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB4BBE6D-65FA-4C04-9161-95234523F21A}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9195B91E-8832-4E1F-9501-A150F0E3EC00}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{900046CB-9594-39D2-8F21-3D88A256FB34}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\LocalServer32\ = "C:\\Program Files\\Macrobond Financial\\Macrobond\\Macrobond.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\InProcServer32\Assembly = "Macrobond"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB4BBE6D-65FA-4C04-9161-95234523F21A}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{900046CB-9594-39D2-8F21-3D88A256FB34}\InprocServer32\ = "C:\\Program Files\\Macrobond Financial\\Macrobond\\Abacus.Office.Shim.x64.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\LocalServer32	msiexec.exe

Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

2032 MsiExec.exe
1212

pid	process
2032	MsiExec.exe
1212

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Program Files directory 55 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\Macrobond Financial\Macrobond\DocumentFormat.OpenXml.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.ComApi.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Office.dll.config	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.RibbonView.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Data.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Unity.Container.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.ComApi.tlb	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Excel.dll.config	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Office.Shim.x64.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\log4net.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\ToastIcon.png	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Bloomberglp.Blpapi.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\MacroBond.exe	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Excel.Shim.x64.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Framework.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\XamlToys.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Prism.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.EViews.dll.config	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\CommonServiceLocator.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\ICSharpCode.AvalonEdit.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Prism.Wpf.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.GridView.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.Input.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Excel.Shim.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\x64\SQLite.Interop.1.0.112.0.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\x86\SQLite.Interop.1.0.112.0.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\System.Memory.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Unity.Abstractions.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\x13as.exe	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Excel.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Office.Shim.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\System.Data.SQLite.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Framework.Analytics.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Clear Settings Wizard.exe	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.Navigation.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.EViews.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Clear Settings Wizard.exe.config	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Framework.WpfClient.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\LaunchMail.exe	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\MacroBond.exe.config	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.ComApi.dll.config	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Excel.Core.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Abacus.Office.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Prism.Unity.Wpf.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\VistaBridgeLibrary.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Antlr4.Runtime.Standard.dll	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\licenses.txt	msiexec.exe
File created	C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.Docking.dll	msiexec.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\6e15a4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6e15a5.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\6e15a5.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{EC456C6A-DE4C-4C14-AF60-C33BD1A84C4B}\appicon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{EC456C6A-DE4C-4C14-AF60-C33BD1A84C4B}\appicon.exe	msiexec.exe
File created	C:\Windows\Installer\6e15a7.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\6e15a4.msi	msiexec.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\Verb\1\ = "&Refresh,0,2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\DocObject	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\DataFormats\GetSet\0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\DataFormats	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{14375FA8-7B1D-43E5-8A37-F77C1084C33F}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|Macrobond Financial\|Macrobond\|Newtonsoft.Json.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|Macrobond Financial\|Macrobond\|Prism.Unity.Wpf.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{900046CB-9594-39D2-8F21-3D88A256FB34}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\ = "Macrobond document"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9195B91E-8832-4E1F-9501-A150F0E3EC00}\InprocServer32\ = "C:\\Program Files\\Macrobond Financial\\Macrobond\\Abacus.Excel.Shim.x64.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|Macrobond Financial\|Macrobond\|Unity.Abstractions.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62ABD77D-D272-4F5C-AC97-32268DD3B27B}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FE9448A-E111-3EB2-86C8-2DDE60FCDBCB}\ = "Macrobond Excel RealTimeDataProxy Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{2678AAEB-7F40-4B59-A05A-2D24D41F61B5}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A6C654CEC4ED41C4FA063CB31D8AC4B4\OpenXmlSdk = "Application"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62ABD77D-D272-4F5C-AC97-32268DD3B27B}\MiscStatus\1\ = "131217"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Mbnd.RTD\ = "Macrobond Excel RealTimeDataProxy Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{ABED755F-D22C-438A-B8B4-FEE8B63C437A}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F4C47339-61B4-4816-B9A2-C71DF0C4B0FA}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3939716B-C0CC-3D90-ABE9-C872032CD2EF}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{52191E20-CEDC-4A2D-AFED-FE65DADD59AE}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\Verb\0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D23DE9DE-0D6C-4313-ADE1-465623E6E897}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\ImplementedCategories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\DataFormats\GetSet\1\ = "3,1,32,1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABED755F-D22C-438A-B8B4-FEE8B63C437A}\AppID = "{1A978B6A-6FCA-4FBB-9021-77C4C3C2B0E3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\Verb\0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\AuxUserType\2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{D23DE9DE-0D6C-4313-ADE1-465623E6E897}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F4C47339-61B4-4816-B9A2-C71DF0C4B0FA}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{D23DE9DE-0D6C-4313-ADE1-465623E6E897}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\Verb\0\ = "&Open,0,2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62ABD77D-D272-4F5C-AC97-32268DD3B27B}\MiscStatus	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D23DE9DE-0D6C-4313-ADE1-465623E6E897}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3939716B-C0CC-3D90-ABE9-C872032CD2EF}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{473445E5-C00B-4A5D-85D5-AEF133256DB4}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4FE9448A-E111-3EB2-86C8-2DDE60FCDBCB}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\DocObject\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{473445E5-C00B-4A5D-85D5-AEF133256DB4}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4846506-04FE-42FA-895D-71DD25EB8845}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Macrobond.Connection	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|Macrobond Financial\|Macrobond\|Abacus.Excel.Core.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{900046CB-9594-39D2-8F21-3D88A256FB34}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Mbnd.mbnd\DefaultIcon\ = "\"C:\\Program Files\\Macrobond Financial\\Macrobond\\MacroBond.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB4BBE6D-65FA-4C04-9161-95234523F21A}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB4BBE6D-65FA-4C04-9161-95234523F21A}\ = "Macrobond EViews Database Manager"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|Macrobond Financial\|Macrobond\|Abacus.Excel.dll\Abacus.Excel,version="1.23.0.3853",culture="neutral",publicKeyToken="109BD21C6AB0CFCD",processorArchitecture="MSIL" = 2c0068006100780074005f0045004f004e00400033005000610035003700360042002b00350040004100700070006c00690063006100740069006f006e003e007e005a0069002500760038004f00490047003f00560048006a004900610074003000700024002d0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|Macrobond Financial\|Macrobond\|System.Threading.Tasks.Extensions.dll\System.Threading.Tasks.Extensions,version="4.2.0.1",culture="neutral",publicKeyToken="CC7B13FFCD2DDD51",processorAr = 2c0068006100780074005f0045004f004e00400033005000610035003700360042002b00350040004100620061006300750073002e004600720061006d00650077006f0072006b003e004c005f006f006c0025006200780073005e00420054007e007a005a0051005f00390055003200460000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\47B7A68AC559556499DAFDF5C9952472\A6C654CEC4ED41C4FA063CB31D8AC4B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6C654CEC4ED41C4FA063CB31D8AC4B4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{900046CB-9594-39D2-8F21-3D88A256FB34}\InprocServer32\ = "C:\\Program Files\\Macrobond Financial\\Macrobond\\Abacus.Office.Shim.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Abacus.EViewsDBManager\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D23DE9DE-0D6C-4313-ADE1-465623E6E897}\ = "IMetadata"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|Macrobond Financial\|Macrobond\|System.ValueTuple.dll\System.ValueTuple,version="4.0.3.0",culture="neutral",publicKeyToken="CC7B13FFCD2DDD51",processorArchitecture="MSIL" = 2c0068006100780074005f0045004f004e00400033005000610035003700360042002b00350040004100620061006300750073002e004600720061006d00650077006f0072006b003e003400520061005f0053003d0047005e007d0045003d0066006000260073006d002a006c0046002e0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6C654CEC4ED41C4FA063CB31D8AC4B4\PackageCode = "84B5D79CE0F0C98498949DA8583F0D3A"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\macrobond\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A1B30165-E7A3-4E11-8939-516603293A5C}\AuxUserType\3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F22A9A5C-E6F2-4FA8-8D1B-E928AB5DDF9B}\ = "Macrobond COM API"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files\|Macrobond Financial\|Macrobond\|System.Data.SQLite.dll\System.Data.SQLite,version="1.0.112.0",culture="neutral",publicKeyToken="DB937BC2D44FF139",processorArchitecture="MSIL" = 2c0068006100780074005f0045004f004e00400033005000610035003700360042002b00350040004100620061006300750073002e004600720061006d00650077006f0072006b003e0074002b00710079007500600078004300370045006e00330062007a0078006e006d00260033006b0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

908 msiexec.exe
908 msiexec.exe

pid	process
908	msiexec.exe
908	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1604	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1604	msiexec.exe
Token: SeRestorePrivilege	908	msiexec.exe
Token: SeTakeOwnershipPrivilege	908	msiexec.exe
Token: SeSecurityPrivilege	908	msiexec.exe
Token: SeCreateTokenPrivilege	1604	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1604	msiexec.exe
Token: SeLockMemoryPrivilege	1604	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1604	msiexec.exe
Token: SeMachineAccountPrivilege	1604	msiexec.exe
Token: SeTcbPrivilege	1604	msiexec.exe
Token: SeSecurityPrivilege	1604	msiexec.exe
Token: SeTakeOwnershipPrivilege	1604	msiexec.exe
Token: SeLoadDriverPrivilege	1604	msiexec.exe
Token: SeSystemProfilePrivilege	1604	msiexec.exe
Token: SeSystemtimePrivilege	1604	msiexec.exe
Token: SeProfSingleProcessPrivilege	1604	msiexec.exe
Token: SeIncBasePriorityPrivilege	1604	msiexec.exe
Token: SeCreatePagefilePrivilege	1604	msiexec.exe
Token: SeCreatePermanentPrivilege	1604	msiexec.exe
Token: SeBackupPrivilege	1604	msiexec.exe
Token: SeRestorePrivilege	1604	msiexec.exe
Token: SeShutdownPrivilege	1604	msiexec.exe
Token: SeDebugPrivilege	1604	msiexec.exe
Token: SeAuditPrivilege	1604	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1604	msiexec.exe
Token: SeChangeNotifyPrivilege	1604	msiexec.exe
Token: SeRemoteShutdownPrivilege	1604	msiexec.exe
Token: SeUndockPrivilege	1604	msiexec.exe
Token: SeSyncAgentPrivilege	1604	msiexec.exe
Token: SeEnableDelegationPrivilege	1604	msiexec.exe
Token: SeManageVolumePrivilege	1604	msiexec.exe
Token: SeImpersonatePrivilege	1604	msiexec.exe
Token: SeCreateGlobalPrivilege	1604	msiexec.exe
Token: SeCreateTokenPrivilege	1604	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1604	msiexec.exe
Token: SeLockMemoryPrivilege	1604	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1604	msiexec.exe
Token: SeMachineAccountPrivilege	1604	msiexec.exe
Token: SeTcbPrivilege	1604	msiexec.exe
Token: SeSecurityPrivilege	1604	msiexec.exe
Token: SeTakeOwnershipPrivilege	1604	msiexec.exe
Token: SeLoadDriverPrivilege	1604	msiexec.exe
Token: SeSystemProfilePrivilege	1604	msiexec.exe
Token: SeSystemtimePrivilege	1604	msiexec.exe
Token: SeProfSingleProcessPrivilege	1604	msiexec.exe
Token: SeIncBasePriorityPrivilege	1604	msiexec.exe
Token: SeCreatePagefilePrivilege	1604	msiexec.exe
Token: SeCreatePermanentPrivilege	1604	msiexec.exe
Token: SeBackupPrivilege	1604	msiexec.exe
Token: SeRestorePrivilege	1604	msiexec.exe
Token: SeShutdownPrivilege	1604	msiexec.exe
Token: SeDebugPrivilege	1604	msiexec.exe
Token: SeAuditPrivilege	1604	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1604	msiexec.exe
Token: SeChangeNotifyPrivilege	1604	msiexec.exe
Token: SeRemoteShutdownPrivilege	1604	msiexec.exe
Token: SeUndockPrivilege	1604	msiexec.exe
Token: SeSyncAgentPrivilege	1604	msiexec.exe
Token: SeEnableDelegationPrivilege	1604	msiexec.exe
Token: SeManageVolumePrivilege	1604	msiexec.exe
Token: SeImpersonatePrivilege	1604	msiexec.exe
Token: SeCreateGlobalPrivilege	1604	msiexec.exe
Token: SeCreateTokenPrivilege	1604	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1604 msiexec.exe
1604 msiexec.exe

pid	process
1604	msiexec.exe
1604	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 908 wrote to memory of 2032	908	msiexec.exe	MsiExec.exe
PID 908 wrote to memory of 2032	908	msiexec.exe	MsiExec.exe
PID 908 wrote to memory of 2032	908	msiexec.exe	MsiExec.exe
PID 908 wrote to memory of 2032	908	msiexec.exe	MsiExec.exe
PID 908 wrote to memory of 2032	908	msiexec.exe	MsiExec.exe
PID 908 wrote to memory of 2032	908	msiexec.exe	MsiExec.exe
PID 908 wrote to memory of 2032	908	msiexec.exe	MsiExec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Macrobond.x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1604

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 22AD8EF531330E20C05485FCA3E5C1F3 C
  2⤵
  - Loads dropped DLL
  PID:2032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1092

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000060" "00000000000003BC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1820

C:\Program Files\Macrobond Financial\Macrobond\MacroBond.exe
"C:\Program Files\Macrobond Financial\Macrobond\MacroBond.exe"
1⤵
- Executes dropped EXE
PID:1828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Macrobond Financial\Macrobond\Abacus.Framework.Analytics.dll

Filesize
2.2MB

MD5
a851e270a7b217ea6fa87ad860c2ec17

SHA1
14eaa9d6f806bbcc2b4662685ba9ee9194f8dbfd

SHA256
4081eaf06c905b6e259bfcb6861860765688d7035c1cf451bd7af75a250f81a6

SHA512
5345449d94858c218b48800ff417baa64099723d9e0c181734a10722432629cc5f68ec28090df3a2f8cde1e79fd2189e3091810fdc4fedff0757f0549c584461

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Abacus.Framework.WpfClient.dll

Filesize
6.3MB

MD5
6745ddbe10f0b8772c4b4759c88dfe19

SHA1
6dfffc07056220b9c59ca0efe0cb19e65eacc509

SHA256
424e10b979bf0bf4136328cca44efa65a62c08308eb1d5ed7833576b63535421

SHA512
a3f96f4ce8d12260378e0a05a55d03860761ef8d8cd5d7ce50c1bd8c94b7252cd635fb52dddb91e991e239469daa98eb97d8bd07b91f5b020843d34a65d50ae2

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Abacus.Framework.dll

Filesize
8.7MB

MD5
d47ac0572dffc893a3c27411cbcfa988

SHA1
cd404899d9882feaf8d4b242cb133a9d343bed40

SHA256
1f255c0e2efb55c653e997642ae338e08d737ddaf64a0a0e41f8778d399b8e60

SHA512
816ec9acf0bf55c296ba599a90430cf97cca1441ce10021736e7883a2388278f0953e764f8280f1657f4ac00ffa3faad70594224ba4adfe81b1695c6796a20c6

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\CommonServiceLocator.dll

Filesize
10KB

MD5
592a7202a6b5315ea7ce919a141431ab

SHA1
f49e0ff53fd1f084745b91f127640ce7d596a572

SHA256
102ec956fc5e3275fdd738bbcbe23dbf7215da8fbb1d7c184190317f583c3507

SHA512
938d48ec4bb96a71c1790bbeaaf673f51e7baebfe6342b6bf2958535bd3da57f12012e9846c17d87b49295964c60c061e50a55681efbeb841a561b510a5d4ac1

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\ICSharpCode.AvalonEdit.dll

Filesize
612KB

MD5
b4d5d46e50006e87b30e7d514e95173c

SHA1
bd3ba298eb7e4cdbfdf29e3992be7d32a4e792eb

SHA256
058f38f33f3f99f904ab9588447a234346c859718404b4e8a523673ed19cdbe7

SHA512
38ff7cada6cfa56af812a1d859aac4fb8b94df50454a9fecc55e4fdb159339f6ba885d0b57fe8c522227dd9280cda0ca21c6a073b6552923fa33f6e77d8f3bc5

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\MacroBond.exe

Filesize
3.5MB

MD5
a0909d723e31115368059a7b886e75bb

SHA1
ff09e80de3a353f9a09f54eee50085030bd5ac34

SHA256
e66a037a4b5e75650a555f4fa678947280a4dcc4aca5d191a71dca7f2673ed3e

SHA512
7d83ef22b8974927bd6db061f044d813fe8b067115ce4cea666e815aa857a2132caa8f14f74aa3c01b4b723cd25931d932fa6e34125dc6e9ea09d21a3b66a7a3

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\MacroBond.exe

Filesize
3.5MB

MD5
a0909d723e31115368059a7b886e75bb

SHA1
ff09e80de3a353f9a09f54eee50085030bd5ac34

SHA256
e66a037a4b5e75650a555f4fa678947280a4dcc4aca5d191a71dca7f2673ed3e

SHA512
7d83ef22b8974927bd6db061f044d813fe8b067115ce4cea666e815aa857a2132caa8f14f74aa3c01b4b723cd25931d932fa6e34125dc6e9ea09d21a3b66a7a3

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\MacroBond.exe.config

Filesize
2KB

MD5
d859983a4a46fa9c96753ea23ee40da5

SHA1
6c0531da3dacd5351ec394e6dc542a16ff43402b

SHA256
da02589b2dc934406ad8d6a6f4fed877f254666c25735e8578c8578e89b3e334

SHA512
fb77a6e8e6c4d6561e3d82088d3296f7989a19dcc91e2e629256e4c81c1ed718c9cd2d4db04dba75b9703a32b51e81a43477c52f9894252df4410b0eb7d48d41

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Prism.Unity.Wpf.dll

Filesize
29KB

MD5
cce587b8ff219b482e304e8d1105335d

SHA1
349e075ed476d9ebef6f939848a04221ab740151

SHA256
5429cd9cca2e972c2d0607767967b7e78db3dc4c74c874c96be66bf11c2c95cc

SHA512
fe3286efe04d229484f9a56b591409884c0cc58413bd54d0d10d245efee88f6060d0dd2d326ef02176c90a9c5f1e7245415515cdee43c8681c1555bdaeb7e312

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Prism.Wpf.dll

Filesize
143KB

MD5
f9fcc9bf77158750f4dc5f3ae063378f

SHA1
63b6c36c7d30e02abf873049e41a505f671e6c4a

SHA256
39849a5ad96c2f524c653e423a466aac1412d462f18a7c5264956b23c7f57d01

SHA512
8a5acf576ad98804ff258f2833d5f4bdbfeb8b181469d4ad37e5306fa116caba57c7de979bec37967ee78498268c8359e0a15aa813b07f3194dcfbd52cdba525

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Prism.dll

Filesize
74KB

MD5
3512d7bd528fa43472d63e413791784a

SHA1
103456791eaa487742bd71e1d4892d20dc46bbd1

SHA256
8c635d69f8b1e9bea6940d0f1fdf5a6604be8532018d9712cde0df1389d23a8c

SHA512
f923409e03419ccaeecf40d782dac50c016d06726b658b73e641182d0467c4cec478d75a3231107e6aa731c18693e344ba48869086a7a15da8852c9e3faf8b91

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\System.Data.SQLite.dll

Filesize
347KB

MD5
33a3462b1fa28f49024e44d2aebd1fb5

SHA1
b8f32e49a526250c93162a05b476e70a7e82b4b4

SHA256
106091aefe276e71a4e505506693cf4407b28e6d1e6ee36298dd9c650137bb3f

SHA512
933f62a9b8149ca316b971c0523ab8a5453b42bfb8b481fd54ed45f7e1d2cdff9beaebc3c815f67786a8324e7d19f069f3b7df3cf249fcb48be981a9a31ae329

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\System.Runtime.CompilerServices.Unsafe.dll

Filesize
23KB

MD5
a5aa80f49ad64689085755ab1ebf086e

SHA1
27e88cf0d2b34ea91efaa5cef9a763ee2722c824

SHA256
a79e1c30e9308afe4d680f0bfb82de3e8c1fe94aeca453ec4092c3ed4789ae6b

SHA512
f3dbd77e3a2ec3915b34d1387388abad45c99459ce03c06dc9a83d04f751b837c7b56cf9b4b7630f7fcd897a1d8057fce4cf761b1dc140a3928431b22b9b5b82

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\System.Threading.Tasks.Extensions.dll

Filesize
32KB

MD5
c42daf6e4d3ff217746cb71d58af0e24

SHA1
ae12ca6b7e9fbddbbdc90e3b7e91714ef664a2fb

SHA256
7bc92cdfb01fe6c0a6907342ddc489f66fa4886687197c4e423865a6622c2cac

SHA512
7f476d4d42cb53b4f9db5b20ae3213ffc1491190bc1412c0d4f952704cf7f5066c719a30c244ddc76cc7d1f3ba7c85e73e8a2ce78d31ae0efb7a52acfaa5250f

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.Docking.dll

Filesize
236KB

MD5
8b0a14883b6dac8d7b55eea15fe6d68d

SHA1
82d354aadffc6af844cc9c04a9a4f4430ef6df99

SHA256
f4a88f253c06d6700f2f8ace965f2eba7506db89de5fabd67c8cf8b91a638825

SHA512
9c865e7ffd754b5ce52cd35e4caa5afc193b73c06e291c67423382b1347f82cb964a66cbf122065bed9eddcf75135bef0eae2c0eb1bc92aac3069670703dad41

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.GridView.dll

Filesize
1.1MB

MD5
a1c579d829fd1a940ba4ae02d3306831

SHA1
9512816d7d19ef40e4f0271e0be8f702cac29049

SHA256
ae6cde74494d5d5f3a50d8ee16444f852859caf2751f9cceb8d5b8927428299e

SHA512
ca8b000a4ef20027562cd9429ad7be335be04064ccaf1ac8528c97146b37755499ff35e58e6680b02154c35cdb10a0d6137a52a81d8cc050978894e7109ffa6b

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.Input.dll

Filesize
598KB

MD5
5e535c840584129417ddb6080bfd7741

SHA1
f360b6d878478607b13bbf6b3fa5b789697e9129

SHA256
4f13d5ffbd3c678984ef770c4988f5a17bd7fb469e42602c068198eb41f59b32

SHA512
c5116dc9fe51116e9e2b957f6297e8b5e86a4f7a076517fc56e90e3eaffb9173ff1c94eafe7f78a4ac91b358ca70da54f41088a089b3e3014c6c8d1728c6d16f

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.Navigation.dll

Filesize
1.2MB

MD5
68058e28b3cccb46d3808e080e2af3c7

SHA1
35d995d3c5d02d601e1fd5fa3537898b5d84341b

SHA256
c8197f18bfde006c478c4d467d95a7a48d32cce8cb5abfa1aae6b2d138549a94

SHA512
6df7b1cbf5e8860c7dfdc56762ce3ba4c00059d0370e8770df96379337ecdbc3c211b545537c95373d8f41c98d7d29bf79dbc0cb336f54d16f07d3fc02f1eb3e

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.RibbonView.dll

Filesize
462KB

MD5
80d423f33b03d6b0084d619fb1f54e54

SHA1
1576ef0621bca438cfef4415fd1780df745fbd52

SHA256
7e619af4b5da76ae667acef1263754406ee424e7d0dba1c0aa48ddfebd34b131

SHA512
20f8356e69e378e87773d6945e15fe1390fa442b961132c9fdc3203c878736ec956e55993ff31d006f0cf29dd1097e129ec2e04a3cf064b7e23319f65443f150

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Controls.dll

Filesize
4.0MB

MD5
42fdb06ba4716ed34a5d0e550c0e4636

SHA1
a9188816419785d3997703707c5eeef088258bd6

SHA256
4a86de02a7a0c2cd8578c65023088080b029c615ab4423c51f3b0b2f9e988bd8

SHA512
f1f0f772b5de40f1c57a92bd83559382d929d168affc4bb6085bc3e4586c6f2a90479a7bda31d90316bd3c4859dc411ba168cc6e04fe946420e4082b4afee189

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Telerik.Windows.Data.dll

Filesize
465KB

MD5
ea9fd4f8c113f8285450eb3ff81e7688

SHA1
588c96ac41ca275a29ab07b3c3821187152aea12

SHA256
f7f56279b82738c3141bc2f849b6abccf38c10b6c26c1dca4c308150b5a062c8

SHA512
f7bfaa4bbe1913fc570bfcb94924fb8fce12fe16530ac0a99399e73988e0c35893c48762dc13867a9080ef20bd01b2ff119f5c49265160e8444a00eb625636cf

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Unity.Abstractions.dll

Filesize
63KB

MD5
5a95fd79b4d83d6d3ad0686f38cadfaf

SHA1
7f7f40c448aa0c1a2a957a2a6b41c5d17dc868e4

SHA256
b746ff26ccbaa6247aa1d7aa94bbbcc45ef497cd3c74cfb0b6e2003f28ceb18b

SHA512
b7664fec6b3d05df8d601007e2a684d30f6a6892c850b041ffacb2c64d1637b2bbdb63a8dd0757cf8bb109dc050e835b650160a2ba56b9305e1d441172d83255

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\Unity.Container.dll

Filesize
144KB

MD5
ac34a7c1e931680379565aba3fa076f8

SHA1
935306745cc71bdfe480621fd9dcf043d1158f18

SHA256
5e46353b93c4c20d04031a4a4da3f97b36685246c207aecb7cfbd32e2326b77e

SHA512
a2e1c132be8cecddad75cd85bf17a9e3b7ec5ef4da414dbcff9df08bb6c2aee2a498cf74c9e5fad570f55806dafe59a5a4c96b12a7c861d48831ded4fb54f08e

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\VistaBridgeLibrary.dll

Filesize
158KB

MD5
830912df50ac0e844e3e9ef497859851

SHA1
44ef811f64cbf94863185024eaa218d37febd89b

SHA256
185a3a39be30a0f4f0307a1981b74121fd847f8721f84f84c6d2da8acb26cb09

SHA512
57950853a1e93bdab30718005948d56598660a0b6973aeb42ffbc9659cd7d81791e0007eef2e51dd27cda3d35d6785df1a8212bc8ce223d36f5e89dad57b51eb

Download Submit
C:\Program Files\Macrobond Financial\Macrobond\log4net.dll

Filesize
270KB

MD5
f64b733eae44c8c66217386d5a0f2bf0

SHA1
92683e4fb8d3c7a544dce21e12f24dcc8b600e9c

SHA256
af5610c515d2244db98c662636264c8177e89b1afe407f88fd18a41d66f6e7e2

SHA512
74aae11529ab5efdbe4c6f7232ba4c24eef570b3bbfea94657940450b34f61503c36dfc560e252f35352bb3d8f54a7a317c9e52ad0b60b9bb666b0dd4913b40f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
982c3bc99ef8ac1abbcb1016f2f1efe5

SHA1
5fab2687b672318c6079e4049c9bc8218cba4964

SHA256
5936774e01887675c67dac1124be4036a5e74e750ff4ad9be1d0fa728d584f91

SHA512
c1f508b2c0d7b5fb591ba9a4e7170d382b1b35018ce1b11e064e94fa56b21a8fd89c59f93fbcbfed4e416a2d0379ed1d6f9d9f9883d9dab7d866ae785e1b8784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_E1E1589C6116923528C56ED227F256E1

Filesize
471B

MD5
4d28d983280edf7e36febd4e765c4910

SHA1
c93930d36b21c01c0a60d2640989c1f60c7dad68

SHA256
5a692c1d3ca905855916f348c159c871f5bae95846803c1015a7d3ae96063306

SHA512
8aa43bebca892a6a0d31af9e35d1fcbd124e7d57ea9ab49b101f797b4da5272a3f823e0cd4e4cc922a1f9faad9f18ceaea4644ef09ac55c137a7682799a31f2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6F0E55DF8A480361A1A27F82DAA1ABB7

Filesize
1KB

MD5
ff5fbc4290fa389e798467ebd7ae940b

SHA1
8ad5c9987e6f190bd6f5416e2de44ccd641d8cda

SHA256
2cf1ec6ab594113bd538df6d5c940e3319b424f8756d975888072c6ab558b771

SHA512
82953a78542f489b86e132cbeca57e2c32a297faa1f9df83148b19dfb002f2551b911110d4394dfa64fd48e4032931b03bafb0e6a972d70b8de4f5e9bbc8a06c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
434B

MD5
389f2d84096e682915db7cab2c4b55c1

SHA1
b13e0c68f9965ef100735e926701e3e9e4e91760

SHA256
02d1506106febd7a19b392a4c92a90b32979fcac7003505837f394e1884681c2

SHA512
cdde958b4ca5a431b761262fa294a4fcab69b199fc0f2b0196bba8a9df9e5b753fd77b6200dee2d2dc3963c135cbbfe9cb360d4161d7301c1392f33be7507e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_E1E1589C6116923528C56ED227F256E1

Filesize
430B

MD5
e5037ce70b951406d94146a16a6adf38

SHA1
e4d6b03dc3922033306f2c9316e2f301745b56ef

SHA256
13fd762abfc41717c01a93fa7aa1616ec8eeae2ac84851a6bdd43b692e2e35f1

SHA512
d9a9d74ad726d72cccba042c9620b59d280c55fe1af6cf58b9508594b841f6bb7bad3f088c1f3ae6b51a47564da750767af04f563e30b9d096beaca29bed2aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6F0E55DF8A480361A1A27F82DAA1ABB7

Filesize
246B

MD5
dacb10597ba14e5cee7aeb16deb48810

SHA1
585a3697034114456061f88b7d6a599ef6e06bae

SHA256
38ff5a2f7425554e35ac36b44ebef02b9c3883d75b24fb02848896478bca73a0

SHA512
671c3bbc8321c57d8f0759f0d72b680580a63831230fe15ac8b6ba1eafe64a3baf9c246d8af865e8d66527e65deddb3b80b023b0f2aea90aa4d91fdde8ee63b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bfaf9a8a5a2c6bda51c817d431862fe

SHA1
25de5bdc9d7d850b5d1d4f63c10b4f31e8f4a14f

SHA256
737a57359c34ad581526f0eb8e8fd92fc826b73be157e1bb9ac692af3c3696f4

SHA512
c5b479733f4003a12581582ab1e0710faf174b8240fa691a2034fe0290371801baf99e6e75eff34b751d53690afd3c01e99040bf58fd8572f1413ca5f0cd4b93

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9B56.tmp

Filesize
104KB

MD5
fab4aa95c57f441b701be7c2e81ee370

SHA1
fad06bb4bedbf22bccb2ab105a630f2c4435bbd4

SHA256
8ad1084de9a734b2d5c86f472f671cc324632b3a6ca5aaa0c360d93d4d08e148

SHA512
7ab85940f9c6144864fc5b5221eae30cb5800ee5fa270957109e8f182551806965fe1dfeffbe655d805aa2bb33b0896725236b4422d3a540d90fd55ce174ef48

Download Submit
\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files\Macrobond Financial\Macrobond\MacroBond.exe

Filesize
3.5MB

MD5
a0909d723e31115368059a7b886e75bb

SHA1
ff09e80de3a353f9a09f54eee50085030bd5ac34

SHA256
e66a037a4b5e75650a555f4fa678947280a4dcc4aca5d191a71dca7f2673ed3e

SHA512
7d83ef22b8974927bd6db061f044d813fe8b067115ce4cea666e815aa857a2132caa8f14f74aa3c01b4b723cd25931d932fa6e34125dc6e9ea09d21a3b66a7a3

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9B56.tmp

Filesize
104KB

MD5
fab4aa95c57f441b701be7c2e81ee370

SHA1
fad06bb4bedbf22bccb2ab105a630f2c4435bbd4

SHA256
8ad1084de9a734b2d5c86f472f671cc324632b3a6ca5aaa0c360d93d4d08e148

SHA512
7ab85940f9c6144864fc5b5221eae30cb5800ee5fa270957109e8f182551806965fe1dfeffbe655d805aa2bb33b0896725236b4422d3a540d90fd55ce174ef48

Download Submit
memory/1604-54-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download
memory/1828-89-0x000000001E320000-0x000000001E554000-memory.dmp

Filesize
2.2MB

Download
memory/1828-80-0x000000001DF20000-0x000000001E320000-memory.dmp

Filesize
4.0MB

Download
memory/1828-94-0x000000001BD16000-0x000000001BD35000-memory.dmp

Filesize
124KB

Download
memory/1828-98-0x000000001C750000-0x000000001C7CA000-memory.dmp

Filesize
488KB

Download
memory/1828-93-0x000000001BF20000-0x000000001C054000-memory.dmp

Filesize
1.2MB

Download
memory/1828-100-0x000000001E760000-0x000000001E7FC000-memory.dmp

Filesize
624KB

Download
memory/1828-91-0x000000001BED0000-0x000000001BF12000-memory.dmp

Filesize
264KB

Download
memory/1828-102-0x000000001C7D0000-0x000000001C84A000-memory.dmp

Filesize
488KB

Download
memory/1828-87-0x0000000002140000-0x0000000002156000-memory.dmp

Filesize
88KB

Download
memory/1828-85-0x000000001BD90000-0x000000001BE2C000-memory.dmp

Filesize
624KB

Download
memory/1828-104-0x0000000002360000-0x0000000002376000-memory.dmp

Filesize
88KB

Download
memory/1828-83-0x0000000000670000-0x0000000000678000-memory.dmp

Filesize
32KB

Download
memory/1828-106-0x000000001CD80000-0x000000001CDDE000-memory.dmp

Filesize
376KB

Download
memory/1828-82-0x0000000002060000-0x00000000020AA000-memory.dmp

Filesize
296KB

Download
memory/1828-108-0x000000001AB00000-0x000000001AB2A000-memory.dmp

Filesize
168KB

Download
memory/1828-96-0x000000001CC50000-0x000000001CD78000-memory.dmp

Filesize
1.2MB

Download
memory/1828-110-0x0000000000730000-0x000000000073C000-memory.dmp

Filesize
48KB

Download
memory/1828-78-0x000000001D660000-0x000000001DF20000-memory.dmp

Filesize
8.8MB

Download
memory/1828-112-0x00000000020B0000-0x00000000020B8000-memory.dmp

Filesize
32KB

Download
memory/1828-76-0x000000001C0F0000-0x000000001C746000-memory.dmp

Filesize
6.3MB

Download
memory/1828-114-0x000000001AFA0000-0x000000001AFC8000-memory.dmp

Filesize
160KB

Download
memory/1828-73-0x000000013F460000-0x000000013F7DE000-memory.dmp

Filesize
3.5MB

Download
memory/1828-116-0x000000001AB30000-0x000000001AB38000-memory.dmp

Filesize
32KB

Download
memory/1828-117-0x000000001AF40000-0x000000001AF4A000-memory.dmp

Filesize
40KB

Download
memory/1828-118-0x000000001AF50000-0x000000001AF5A000-memory.dmp

Filesize
40KB

Download
memory/1828-123-0x000000001BD16000-0x000000001BD35000-memory.dmp

Filesize
124KB

Download
memory/1828-120-0x000000001BCF0000-0x000000001BCFA000-memory.dmp

Filesize
40KB

Download
memory/1828-122-0x000000001CDE0000-0x000000001CE0E000-memory.dmp

Filesize
184KB

Download
memory/2032-56-0x0000000000000000-mapping.dmp

Download
memory/2032-57-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download