a787190afd25f855fdff8f4d42058a4820da10aa47772e50230e6e778921eea1

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2022 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ninite 7Zip KeePass 2 Steam VLC WinDirStat iTunes Installer.exe
Size

415KB
MD5

b346183f5462c7c00ff2d003e8196a7d
SHA1

94f102ad7c6717b14bb70ed277f6402ddc9100f7
SHA256

a787190afd25f855fdff8f4d42058a4820da10aa47772e50230e6e778921eea1
SHA512

7b74d3e94251baba46bcff6d33cf90236640df6700eae19b4b3c7d7ca253619027c6ca5eb4ae56d12c6d2590c4182698b10f16d1914f7d31c18920200dfe8ef0
SSDEEP

6144:phuGbXZA2zNMPMPwVtiN44zAi5NAOig3TBrCZMszqLi7ksvmacmWnZ1e:LuypA2hESwGRwg3TBPi7BvmZmwZI

Score

10^/10

discovery evasion persistence ransomware

Malware Config

Extracted

Path

C:\Program Files\7-Zip\History.txt

Ransom Note

HISTORY of the 7-Zip -------------------- 22.01 2022-07-15 ------------------------- - UDF support was improved to UDF version 2.60. - HFS and APFS support was improved. 22.00 2022-06-15 ------------------------- - 7-Zip now can extract APFS (Apple File System) images that can be used in DMG files. - 7-Zip now can create TAR archives in POSIX (pax) tar format with the switches -ttar -mm=pax or -ttar -mm=posix - 7-Zip now can store additional file timestamps with high precision (1 ns in Linux) in tar/pax archives with the following switches: -ttar -mm=pax -mtp=3 -mtc -mta - New switches for Linux version for TAR archives: -snoi : store owner/group ids in archive or set owner/group ids from archive to extracted files. -snon : store owner/group names in archive - New -snz switch to propagate Zone.Identifier stream to extracted files (Windows). - New option "Propagate Zone.Id stream" in Tools/Options/7-Zip menu. - New "Options" window in "Add to archive" allows to select what metadata must be included to archive. Also it allows to select new option "Do not change source files last access time". - Some bugs were fixed. 21.07 2021-12-26 ------------------------- - 7-Zip now can extract VHDX disk images (Microsoft Hyper-V Virtual Hard Disk v2 format). - New switches: -spm and -im!{file_path} to exclude directories from processing for specified paths that don't contain path separator character at the end of path. - In the "Add to Archive" window, now it is allowed to use -m prefix for "Parameters" field as in command line: -mparam. - The sorting order of files in archives was slightly changed to be more consistent for cases where the name of some directory is the same as the prefix part of the name of another directory or file. - TAR archives created by 7-Zip now are more consistent with archives created by GNU TAR program. 21.06 2021-11-24 ------------------------- - The window "Add to Archive" now allows to set a limit on memory usage (RAM) that will be used for compressing. - New switch -mmemuse={N}g / -mmemuse=p{N} to set a limit on memory usage (RAM) for compressing and decompressing. - Bug in versions 21.00-21.05 was fixed: 7-Zip didn't set attributes of directories during archive extracting. - Some bugs were fixed. 21.04 beta 2021-11-02 ------------------------- - 7-Zip now reduces the number of working CPU threads for compression, if RAM size is not enough for compression with big LZMA2 dictionary. - 7-Zip now can create and check "file.sha256" text files that contain the list of file names and SHA-256 checksums in format compatible with sha256sum program. 7-Zip can work with such checksum files as with archives, but these files don't contain real file data. The context menu commands to create and test "sha256" files: 7-Zip / CRC SHA / SHA-256 -> file.sha256 7-Zip / CRC SHA / Test Archive : Checksum The commands for command line version: 7z a -thash file.sha256 *.txt 7z t -thash file.sha256 7z t -thash -shd. file.sha256 New -shd{dir_path} switch to set the directory that is used to check files referenced by "file.sha256" file for "Test" operation. If -shd{dir_path} is not specified, 7-Zip uses the directory where "file.sha256" is stored. - New -xtd switch to exclude directory metadata records from processing. 21.03 beta 2021-07-20 ------------------------- - The maximum dictionary size for LZMA/LZMA2 compressing was increased to 4 GB (3840 MiB). - Minor speed optimizations in LZMA/LZMA2 compressing. 21.02 alpha 2021-05-06 ------------------------- - 7-Zip now writes additional field for filename in UTF-8 encoding to zip archives. It allows to extract correct file name from zip archives on different systems. - The command line version of 7-Zip for macOS was released. - The speed for LZMA and LZMA2 decompression in arm64 versions for macOS and Linux was increased by 20%-60%. - Some changes and improvements in ZIP, TAR and NSIS code. 21.01 alpha 2021-03-09 ------------------------- - The command line version of 7-Zip for Linux was released. - The improvements for speed of ARM64 version using hardware CPU instructions for AES, CRC-32, SHA-1 and SHA-256. - The bug in versions 18.02 - 21.00 was fixed: 7-Zip could not correctly extract some ZIP archives created with xz compression method. - Some bugs were fixed. 21.00 alpha 2021-01-19 ------------------------- - Some internal changes in code. - Some bugs were fixed. - New localizations: Tajik, Uzbek (Cyrillic) 20.02 alpha 2020-08-08 ------------------------- - The default number of LZMA2 chunks per solid block in 7z archive was increased to 64. It allows to increase the compression speed for big 7z archives, if there is a big number of CPU cores and threads. - The speed of PPMd compressing/decompressing was increased for 7z/ZIP/RAR archives. - The new -ssp switch. If the switch -ssp is specified, 7-Zip doesn't allow the system to modify "Last Access Time" property of source files for archiving and hashing operations. - Some bugs were fixed. - New localization: Swahili. 20.00 alpha 2020-02-06 ------------------------- - 7-Zip now supports new optional match finders for LZMA/LZMA2 compression: bt5 and hc5, that can work faster than bt4 and hc4 match finders for the data with big redundancy. - The compression ratio was improved for Fast and Fastest compression levels with the following default settings: - Fastest level (-mx1) : hc5 match finder with 256 KB dictionary. - Fast level (-mx3) : hc5 match finder with 4 MB dictionary. - Minor speed optimizations in multithreaded LZMA/LZMA2 compression for Normal/Maximum/Ultra compression levels. - bzip2 decoding code was updated to support bzip2 archives, created by lbzip2 program. - Some bugs were fixed. - New localization: Turkmen. 19.02 alpha 2019-09-05 ------------------------- - 7-Zip now can unpack files encoded with Base64 encoding (b64 filename extension). - 7-Zip now can use new x86/x64 hardware instructions for SHA-1 and SHA-256, supported by AMD Ryzen and latest Intel CPUs: Ice Lake and Goldmont. It increases - the speed of SHA-1/SHA-256 hash value calculation, - the speed of encryption/decryption in zip AES, - the speed of key derivation for encryption/decryption in 7z/zip/rar archives. - The speed of zip AES encryption and 7z/zip/rar AES decryption was increased with the following improvements: - 7-Zip now can use new x86/x64 VAES (AVX Vector AES) instructions, supported by Intel Ice Lake CPU. - The existing code of x86/x64 AES-NI was improved also. - There is 2% speed optimization in 7-Zip benchmark's decompression. - Some bugs were fixed. 19.00 2019-02-21 ------------------------- - Encryption strength for 7z archives was increased: the size of random initialization vector was increased from 64-bit to 128-bit, and the pseudo-random number generator was improved. - Some bugs were fixed. 18.06 2018-12-30 ------------------------- - The speed for LZMA/LZMA2 compressing was increased by 3-10%, and there are minor changes in compression ratio. - Some bugs were fixed. - The bug in 7-Zip 18.02-18.05 was fixed: there was memory leak in xz decoder. - 7-Zip 18.02-18.05 used only one CPU thread for bz2 archive creation. 18.05 2018-04-30 ------------------------- - The speed for LZMA/LZMA2 compressing was increased by 8% for fastest/fast compression levels and by 3% for normal/maximum compression levels. - 7-Zip now shows Properties (Info) window and CRC/SHA results window as "list view" window instead of "message box" window. - Some improvements in zip, hfs and dmg code. - Previous versions of 7-Zip could work incorrectly in "Large memory pages" mode in Windows 10 because of some BUG with "Large Pages" in Windows 10. Now 7-Zip doesn't use "Large Pages" on Windows 10 up to revision 1709 (16299). - The vulnerability in RAR unpacking code was fixed (CVE-2018-10115). - Some bugs were fixed. 18.03 beta 2018-03-04 ------------------------- - The speed for single-thread LZMA/LZMA2 decoding was increased by 30% in x64 version and by 3% in x86 version. - 7-Zip now can use multi-threading for 7z/LZMA2 decoding, if there are multiple independent data chunks in LZMA2 stream. - 7-Zip now can use multi-threading for xz decoding, if there are multiple blocks in xz stream. - New localization: Kabyle. - Some bugs were fixed. 18.01 2018-01-28 ------------------------- - 7-Zip now can unpack DMG archives that use LZFSE compression method. - 7-Zip now doesn't allow update operation for archives that have read-only attribute. - The BUG was fixed: extracting from tar with -si switch didn't set timestamps for directories. - Some bugs were fixed. 18.00 beta 2018-01-10 ------------------------- - 7-Zip now can unpack OBJ/COFF files. - new -sse switch to stop archive creating, if 7-Zip can't open some input file. - Some bugs were fixed. 17.01 beta 2017-08-28 ------------------------- - Minor speed optimization for LZMA2 (xz and 7z) multi-threading compression. 7-Zip now uses additional memory buffers for multi-block LZMA2 compression. CPU utilization was slightly improved. - 7-zip now creates multi-block xz archives by default. Block size can be specified with -ms[Size]{m|g} switch. - xz decoder now can unpack random block from multi-block xz archives. 7-Zip File Manager now can open nested multi-block xz archives (for example, image.iso.xz) without full unpacking of xz archive. - 7-Zip now can create zip archives from stdin to stdout. - 7-Zip command line: @listfile now doesn't work after -- switch. Use -i@listfile before -- switch instead. - The BUGs were fixed: 7-Zip could add unrequired alternate file streams to WIM archives, for commands that contain filename wildcards and -sns switch. 7-Zip 17.00 beta crashed for commands that write anti-item to 7z archive. 7-Zip 17.00 beta ignored "Use large memory pages" option. 17.00 beta 2017-04-29 ------------------------- - ZIP unpacking code was improved. - 7-Zip now reserves file space before writing to file (for extraction from archive). It can reduce file fragmentation. - Some bugs were fixed. 7-Zip could crash in some cases. - Internal changes in code. 16.04 2016-10-04 ------------------------- - The bug was fixed: 7-Zip 16.03 exe installer under Vista didn't create links in Start / Programs menu. - Some bugs were fixed in RAR code. 16.03 2016-09-28 ------------------------- - Installer and SFX modules now use some protection against DLL preloading attack. - Some bugs were fixed in 7z, NSIS, SquashFS, RAR5 and another code. 16.02 2016-05-21 ------------------------- - 7-Zip now can extract multivolume ZIP archives (z01, z02, ... , zip). - Some bugs were fixed. 15.14 2015-12-31 ------------------------- - 7-Zip File Manager: - The code for "Open file from archive" operation was improved. - The code for "Tools/Options" window was improved. - The BUG was fixed: there was incorrect mouse cursor capture for drag-and-drop operations from open archive to Explorer window. - Some bugs were fixed. - New localization: Yoruba. 15.12 2015-11-19 ------------------------- - The release version. 15.11 beta 2015-11-14 ------------------------- - Some bugs were fixed. 15.10 beta 2015-11-01 ------------------------- - The BUG in 9.21 - 15.09 was fixed: 7-Zip could ignore some parameters, specified for archive creation operation for gzip and bzip2 formats in "Add to Archive" window and in command line version (-m switch). - Some bugs were fixed. 15.09 beta 2015-10-16 ------------------------- - 7-Zip now can extract ext2 and multivolume VMDK images. - Some bugs were fixed. 15.08 beta 2015-10-01 ------------------------- - 7-Zip now can extract ext3 and ext4 (Linux file system) images. - Some bugs were fixed. 15.07 beta 2015-09-17 ------------------------- - 7-Zip now can extract GPT images and single file QCOW2, VMDK, VDI images. - 7-Zip now can extract solid WIM archives with LZMS compression. - Some bugs were fixed. 15.06 beta 2015-08-09 ------------------------- - 7-Zip now can extract RAR5 archives. - 7-Zip now doesn't sort files by type while adding to solid 7z archive. - new -mqs switch to sort files by type while adding to solid 7z archive. - The BUG in 7-Zip File Manager was fixed: The "Move" operation to open 7z archive didn't delete empty files. - The BUG in 15.05 was fixed: console version added some text to the end of stdout stream, is -so switch was used. - The BUG in 9.30 - 15.05 was fixed: 7-Zip could not open multivolume sfx RAR archive. - Some bugs were fixed. 15.05 beta 2015-06-14 ------------------------- - 7-Zip now uses new installer. - 7-Zip now can create 7z, xz and zip archives with 1536 MB dictionary for LZMA/LZMA2. - 7-Zip File Manager now can operate with alternate file streams at NTFS volumes via "File / Alternate Streams" menu command. - 7-Zip now can extract .zipx (WinZip) archives that use xz compression. - new optional "section size" parameter for BCJ2 filter for compression ratio improving. Example: -mf=BCJ2:d9M, if largest executable section in files is smaller than 9 MB. - Speed optimizations for BCJ2 filter and SHA-1 and SHA-256 calculation. - Console version now uses stderr stream for error messages. - Console version now shows names of processed files only in progress line by default. - new -bb[0-3] switch to set output log level. -bb1 shows names of processed files in log. - new -bs[o|e|p][0|1|2] switch to set stream for output messages; o: output, e: error, p: progress line; 0: disable, 1: stdout, 2: stderr. - new -bt switch to show execution time statistics. - new -myx[0-9] switch to set level of file analysis. - new -mmtf- switch to set single thread mode for filters. - The BUG was fixed: 7-Zip didn't restore NTFS permissions for folders during extracting from WIM archives. - The BUG was fixed: The command line version: if the command "rn" (Rename) was called with more than one pair of paths, 7-Zip used only first rename pair. - The BUG was fixed: 7-Zip crashed for ZIP/LZMA/AES/AES-NI. - The BUG in 15.01-15.02 was fixed: 7-Zip created incorrect ZIP archives, if ZipCrypto encryption was used. 7-Zip 9.20 can extract such incorrect ZIP archives. - Some bugs were fixed. 9.38 beta 2015-01-03 ------------------------- - Some bugs were fixed. 9.36 beta 2014-12-26 ------------------------- - The BUG in command line version was fixed: 7-Zip created temporary archive in current folder during update archive operation, if -w{Path} switch was not specified. The fixed 7-Zip creates temporary archive in folder that contains updated archive. - The BUG in 9.33-9.35 was fixed: 7-Zip silently ignored file reading errors during 7z or gz archive creation, and the created archive contained only part of file that was read before error. The fixed 7-Zip stops archive creation and it reports about error. - Some bugs were fixed. 9.35 beta 2014-12-07 ------------------------- - The BUG was fixed: 7-Zip crashed during ZIP archive creation, if the number of CPU threads was more than 64. - The BUG in 9.31-9.34 was fixed: 7-Zip could not correctly extract ISO archives that are larger than 4 GiB. - The BUG in 9.33-9.34 was fixed: The option "Compress shared files" and -ssw switch didn't work. - The BUG in 9.26-9.34 was fixed: 7-Zip File Manager could crash for some archives open in "Flat View" mode. - Some bugs were fixed. 9.34 alpha 2014-06-22 ------------------------- - The BUG in 9.33 was fixed: Command line version of 7-Zip could work incorrectly, if there is relative path in exclude filename optiton (-x) an

Signatures

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

Blocklisted process makes network request 5 IoCs

flow	pid	Process
90	1404	msiexec.exe
92	1404	msiexec.exe
94	1404	msiexec.exe
97	1404	msiexec.exe
98	1404	msiexec.exe

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
2736	Ninite.exe
3384	target.exe
100	target.exe
4424	target.exe
4652	steamservice.exe
4596	target.exe
3572	Un_A.exe
5096	target.exe
1412	vlc-cache-gen.exe
3436	7za.exe
4972	mDNSResponder.exe
640	SoftwareUpdate.exe
1088	AppleMobileDeviceService.exe

Registers COM server for autorun 1 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\axvlc.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	target.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32\ = "C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\OutlookChangeNotifierAddIn.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\InprocServer32	msiexec.exe

Loads dropped DLL 64 IoCs

pid	Process
3384	target.exe
3384	target.exe
4424	target.exe
4424	target.exe
4424	target.exe
4596	target.exe
4596	target.exe
4596	target.exe
4596	target.exe
5096	target.exe
5096	target.exe
5096	target.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe
1412	vlc-cache-gen.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	target.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	target.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dns-sd.exe	msiexec.exe
File created	C:\Windows\system32\dns-sd.exe	msiexec.exe
File created	C:\Windows\SysWOW64\dnssd.dll	msiexec.exe
File created	C:\Windows\system32\dnssd.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dnssdX.dll	msiexec.exe
File created	C:\Windows\system32\dnssdX.dll	msiexec.exe
File created	C:\Windows\SysWOW64\jdns_sd.dll	msiexec.exe
File created	C:\Windows\system32\jdns_sd.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo	Un_A.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll	target.exe
File created	C:\Program Files\iTunes\iTunes.Resources\el.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ru.lproj\SortPrefixes.plist	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\he.lproj\PrintingTemplates\12.Insert.MosaicBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Controllers\DOMStorageManager.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\th.lproj\ViewLineItemiTunesExtras.png	msiexec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll	target.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ms.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\de.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\AnimationCollection.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\CFNetwork.resources\he.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\el.lproj\License.rtf	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\TimelineView.css	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pt.lproj\StorePreOrderButton.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pl.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\AuditTreeElement.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_AU.lproj\PrintingTemplates\04.Playlist.Custom.xml	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	target.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	target.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll	Un_A.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileSync.exe	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\hu.lproj\PrintingTemplates\01.Playlist.Songs.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Base\Debouncer.js	msiexec.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt	target.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll	Un_A.exe
File created	C:\Program Files\iTunes\CFNetwork.resources\ca.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Images\Search.svg	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\CFNetwork.resources\English.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\Slider.css	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\com.apple.IE.client.exe	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ru.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\pt_PT.lproj\PrintingTemplates\15.Media.PlainPaper.SS.xml	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\en_GB.lproj\ParentalAdvisory.png	msiexec.exe
File created	C:\Program Files\iTunes\AuthKitWin.resources\th.lproj\AuthKitWinLocalized.dll	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\InlineSwatch.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\ru.lproj\[email protected]	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ComputedStyleDetailsPanel.js	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll	Un_A.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll	target.exe
File created	C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\fr_CA.lproj\PrintingTemplates\13.Insert.SingleSideBW.xml	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\SearchTabContentView.js	msiexec.exe
File created	C:\Program Files\iTunes\AVFoundationCF.resources\hu.lproj\AVCFMediaSelectionOption.strings	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\sk.lproj\DeviceCapacityBox.png	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\es.lproj\iPhone License.rtf	msiexec.exe
File created	C:\Program Files\qBittorrent\translations\qtbase_lv.qm	target.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\	Un_A.exe
File created	C:\Program Files (x86)\Bonjour\Bonjour.Resources\zh_TW.lproj\About Bonjour.rtf	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\com.apple.IE.client.resources\English.lproj\Localizable.strings	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\ResourceHeadersContentView.css	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\Resizer.css	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\tr.lproj\[email protected]	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	target.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\	Un_A.exe
File created	C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\syncli.exe	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Views\AuditTestGroupContentView.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\tr.lproj\TextStyles.plist	msiexec.exe
File created	C:\Program Files\iTunes\WebKit.resources\WebInspectorUI\Models\QueryResult.js	msiexec.exe
File created	C:\Program Files\iTunes\iTunes.Resources\vi.lproj\StoreRentButton.png	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	target.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll	target.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58085d.msi	msiexec.exe
File created	C:\Windows\Installer\{B292D163-23D2-4523-A699-1ABEC1875609}\AppleSoftwareUpdateIco.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI367A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{44325855-D4CA-4994-A27A-39FE50CE6A8E}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI122E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI414C.tmp	msiexec.exe
File created	C:\Windows\Installer\e580865.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{44B55B48-DEF1-4384-A4E0-10933F65B44A}	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\msvcp140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\SourceHash{44325855-D4CA-4994-A27A-39FE50CE6A8E}	msiexec.exe
File created	C:\Windows\Installer\e58085c.msi	msiexec.exe
File created	C:\Windows\Installer\e58085d.msi	msiexec.exe
File created	C:\Windows\Installer\{B292D163-23D2-4523-A699-1ABEC1875609}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37F3.tmp	msiexec.exe
File created	C:\Windows\Installer\{44325855-D4CA-4994-A27A-39FE50CE6A8E}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60F1.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\msvcp140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\vcruntime140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6173.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI123F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16F4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2397.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI27DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FFE.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\vccorlib140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\vcruntime140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCC2.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2638.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{B292D163-23D2-4523-A699-1ABEC1875609}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5583.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6153.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e580858.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\concrt140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6102.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\concrt140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File created	C:\Windows\Installer\wix{44325855-D4CA-4994-A27A-39FE50CE6A8E}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI5E20.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}	msiexec.exe
File created	C:\Windows\Installer\e580861.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\vcruntime140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60D1.tmp	msiexec.exe
File created	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico	msiexec.exe
File created	C:\Windows\Installer\e580860.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6132.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI823D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA69E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B292D163-23D2-4523-A699-1ABEC1875609}	msiexec.exe
File opened for modification	C:\Windows\Installer\{B292D163-23D2-4523-A699-1ABEC1875609}\AppleSoftwareUpdateIco.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\concrt140.dll.B796D14F_AD8C_3A96_B2B8_3D8FF8499DA8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\vccorlib140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\55852344AC4D49942AA793EF05ECA6E8\16.0.0\vccorlib140.dll.BC0B92F1_D156_35A8_A565_6689E8DDDA1F	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6131.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI821C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0006000000022f9e-143.dat	nsis_installer_1
behavioral2/files/0x0006000000022f9e-144.dat	nsis_installer_1

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	SoftwareUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SoftwareUpdate.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL\filenames\asl.log = "asl.184808_30Dec22.log"	AppleMobileDeviceService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Apple Inc.\ASL\filenames	AppleMobileDeviceService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.3gp2\DefaultIcon	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8D076AD6-9B6F-4150-A0FD-5D7E8C8CB02C}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.arj\shell\	Ninite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.squashfs\shell\	Ninite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mod\shell\Open	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rec\shell\Open\MultiSelectModel = "Player"	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.zpl\shell\Open\command	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54613049-40BF-4035-9E70-0A9312C0188D}\ = "IVLCPlaylist"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\.mp4	Un_A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.au\shell\Open\ = "Play"	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.amv\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2t\shell	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m1v\shell\PlayWithVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --no-playlist-enqueue \"%1\""	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wvx\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12E6A993-AE52-4F99-8B89-41F985E6C952}\VersionIndependentProgID\ = "OutlookChangeNotifier.Connect"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.cda\shell\PlayWithVLC\command	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wmv\shell\PlayWithVLC\command	Un_A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.qcp\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	target.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mka\shell	Un_A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.669\DefaultIcon\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.thp\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E0BD17B-2D3C-4656-B94D-03084F3FD9D4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\NumMethods\ = "9"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.flac\shell\PlayWithVLC	Un_A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mlp\DefaultIcon\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.divx\shell\AddToPlaylistVLC	target.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\7-Zip.swm\shell	Ninite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wvx\shell	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ts\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.flac\shell\Open\ = "Play"	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.3g2\shell	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.voc\shell\Open\MultiSelectModel = "Player"	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.TXTRecord.1\CLSID\ = "{AFEE063C-05BA-4248-A26E-168477F49734}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\ProxyStubClsid32\ = "{7FD72324-63E1-45AD-B337-4D525BD98DAD}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\magnet	target.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aifc\shell\Open\command	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wav\shell\Open	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wv\shell\Open\command	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpe\shell\ = "Open"	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tod\shell\Open\ = "Play"	target.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg4\shell\PlayWithVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	target.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg\shell	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rec\DefaultIcon	Un_A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F7E1C5D-4D91-48C9-B09E-3E45D502FFA0}\TypeLib\Version = "1.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp2v\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	target.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ogv\shell\AddToPlaylistVLC\command	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rar\shell	Un_A.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.nuv\DefaultIcon	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aiff\shell\AddToPlaylistVLC	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.vro\shell\AddToPlaylistVLC\command	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.webm\shell\AddToPlaylistVLC	target.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55852344AC4D49942AA793EF05ECA6E8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\57BB7E~1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.cab\shell\open\	Ninite.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.xz\shell\	Ninite.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ape\DefaultIcon	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp3\shell\Open	Un_A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.amr\shell\Open\MultiSelectModel = "Player"	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.amr\shell\Open\command	target.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.zip\shell	target.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\.m4a	target.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ra\shell\PlayWithVLC\command	Un_A.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Ninite 7Zip KeePass 2 Steam VLC WinDirStat iTunes Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Ninite 7Zip KeePass 2 Steam VLC WinDirStat iTunes Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Ninite 7Zip KeePass 2 Steam VLC WinDirStat iTunes Installer.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
2736	Ninite.exe
2736	Ninite.exe
5096	target.exe
5096	target.exe
5096	target.exe
5096	target.exe
1404	msiexec.exe
1404	msiexec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
2412	MsiExec.exe
1088	AppleMobileDeviceService.exe
1088	AppleMobileDeviceService.exe
4012	MsiExec.exe
4012	MsiExec.exe
4012	MsiExec.exe
4012	MsiExec.exe
4012	MsiExec.exe
4012	MsiExec.exe
4012	MsiExec.exe
4012	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTcbPrivilege	2736	Ninite.exe
Token: SeCreateTokenPrivilege	2736	Ninite.exe
Token: SeAssignPrimaryTokenPrivilege	2736	Ninite.exe
Token: SeLoadDriverPrivilege	2736	Ninite.exe
Token: SeBackupPrivilege	2736	Ninite.exe
Token: SeRestorePrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeTakeOwnershipPrivilege	2736	Ninite.exe
Token: SeLockMemoryPrivilege	2736	Ninite.exe
Token: SeIncreaseQuotaPrivilege	2736	Ninite.exe
Token: SeMachineAccountPrivilege	2736	Ninite.exe
Token: SeTcbPrivilege	2736	Ninite.exe
Token: SeSecurityPrivilege	2736	Ninite.exe
Token: SeSystemProfilePrivilege	2736	Ninite.exe
Token: SeSystemtimePrivilege	2736	Ninite.exe
Token: SeProfSingleProcessPrivilege	2736	Ninite.exe
Token: SeIncBasePriorityPrivilege	2736	Ninite.exe
Token: SeCreatePagefilePrivilege	2736	Ninite.exe
Token: SeCreatePermanentPrivilege	2736	Ninite.exe
Token: SeShutdownPrivilege	2736	Ninite.exe
Token: SeAuditPrivilege	2736	Ninite.exe
Token: SeSystemEnvironmentPrivilege	2736	Ninite.exe
Token: SeChangeNotifyPrivilege	2736	Ninite.exe
Token: SeRemoteShutdownPrivilege	2736	Ninite.exe
Token: SeUndockPrivilege	2736	Ninite.exe
Token: SeSyncAgentPrivilege	2736	Ninite.exe
Token: SeEnableDelegationPrivilege	2736	Ninite.exe
Token: SeManageVolumePrivilege	2736	Ninite.exe
Token: SeImpersonatePrivilege	2736	Ninite.exe
Token: SeCreateGlobalPrivilege	2736	Ninite.exe
Token: 31	2736	Ninite.exe
Token: 32	2736	Ninite.exe
Token: 33	2736	Ninite.exe
Token: 34	2736	Ninite.exe
Token: 35	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeAssignPrimaryTokenPrivilege	2736	Ninite.exe
Token: SeTcbPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeSecurityPrivilege	4652	steamservice.exe
Token: SeSecurityPrivilege	4652	steamservice.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe
Token: SeDebugPrivilege	2736	Ninite.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
640	SoftwareUpdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 2736	4400	Ninite 7Zip KeePass 2 Steam VLC WinDirStat iTunes Installer.exe	79
PID 4400 wrote to memory of 2736	4400	Ninite 7Zip KeePass 2 Steam VLC WinDirStat iTunes Installer.exe	79
PID 4400 wrote to memory of 2736	4400	Ninite 7Zip KeePass 2 Steam VLC WinDirStat iTunes Installer.exe	79
PID 2736 wrote to memory of 3384	2736	Ninite.exe	80
PID 2736 wrote to memory of 3384	2736	Ninite.exe	80
PID 2736 wrote to memory of 3384	2736	Ninite.exe	80
PID 2736 wrote to memory of 100	2736	Ninite.exe	81
PID 2736 wrote to memory of 100	2736	Ninite.exe	81
PID 2736 wrote to memory of 100	2736	Ninite.exe	81
PID 2736 wrote to memory of 4424	2736	Ninite.exe	83
PID 2736 wrote to memory of 4424	2736	Ninite.exe	83
PID 2736 wrote to memory of 4424	2736	Ninite.exe	83
PID 4424 wrote to memory of 4652	4424	target.exe	86
PID 4424 wrote to memory of 4652	4424	target.exe	86
PID 4424 wrote to memory of 4652	4424	target.exe	86
PID 2736 wrote to memory of 4596	2736	Ninite.exe	90
PID 2736 wrote to memory of 4596	2736	Ninite.exe	90
PID 2736 wrote to memory of 4596	2736	Ninite.exe	90
PID 2736 wrote to memory of 4244	2736	Ninite.exe	96
PID 2736 wrote to memory of 4244	2736	Ninite.exe	96
PID 2736 wrote to memory of 4244	2736	Ninite.exe	96
PID 4244 wrote to memory of 3572	4244	uninstall.exe	97
PID 4244 wrote to memory of 3572	4244	uninstall.exe	97
PID 4244 wrote to memory of 3572	4244	uninstall.exe	97
PID 3572 wrote to memory of 444	3572	Un_A.exe	99
PID 3572 wrote to memory of 444	3572	Un_A.exe	99
PID 3572 wrote to memory of 444	3572	Un_A.exe	99
PID 444 wrote to memory of 3164	444	regsvr32.exe	100
PID 444 wrote to memory of 3164	444	regsvr32.exe	100
PID 2736 wrote to memory of 4084	2736	Ninite.exe	101
PID 2736 wrote to memory of 4084	2736	Ninite.exe	101
PID 2736 wrote to memory of 4084	2736	Ninite.exe	101
PID 2736 wrote to memory of 5096	2736	Ninite.exe	103
PID 2736 wrote to memory of 5096	2736	Ninite.exe	103
PID 2736 wrote to memory of 5096	2736	Ninite.exe	103
PID 5096 wrote to memory of 1412	5096	target.exe	105
PID 5096 wrote to memory of 1412	5096	target.exe	105
PID 5096 wrote to memory of 340	5096	target.exe	107
PID 5096 wrote to memory of 340	5096	target.exe	107
PID 5096 wrote to memory of 340	5096	target.exe	107
PID 340 wrote to memory of 116	340	regsvr32.exe	108
PID 340 wrote to memory of 116	340	regsvr32.exe	108
PID 2736 wrote to memory of 3436	2736	Ninite.exe	109
PID 2736 wrote to memory of 3436	2736	Ninite.exe	109
PID 2736 wrote to memory of 3436	2736	Ninite.exe	109
PID 2736 wrote to memory of 1144	2736	Ninite.exe	112
PID 2736 wrote to memory of 1144	2736	Ninite.exe	112
PID 2736 wrote to memory of 1144	2736	Ninite.exe	112
PID 1404 wrote to memory of 2456	1404	msiexec.exe	115
PID 1404 wrote to memory of 2456	1404	msiexec.exe	115
PID 1404 wrote to memory of 3644	1404	msiexec.exe	116
PID 1404 wrote to memory of 3644	1404	msiexec.exe	116
PID 1404 wrote to memory of 3644	1404	msiexec.exe	116
PID 1404 wrote to memory of 3496	1404	msiexec.exe	117
PID 1404 wrote to memory of 3496	1404	msiexec.exe	117
PID 1404 wrote to memory of 3496	1404	msiexec.exe	117
PID 1404 wrote to memory of 820	1404	msiexec.exe	118
PID 1404 wrote to memory of 820	1404	msiexec.exe	118
PID 1404 wrote to memory of 2592	1404	msiexec.exe	119
PID 1404 wrote to memory of 2592	1404	msiexec.exe	119
PID 1404 wrote to memory of 2592	1404	msiexec.exe	119
PID 2736 wrote to memory of 4208	2736	Ninite.exe	121
PID 2736 wrote to memory of 4208	2736	Ninite.exe	121
PID 2736 wrote to memory of 4208	2736	Ninite.exe	121

C:\Users\Admin\AppData\Local\Temp\Ninite 7Zip KeePass 2 Steam VLC WinDirStat iTunes Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Ninite 7Zip KeePass 2 Steam VLC WinDirStat iTunes Installer.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\48304a39-8872-11ed-aecb-fe977829be37\Ninite.exe
  Ninite.exe "5bc502e7f20dcf848e1f4627c712a723a2842517" /fullpath "C:\Users\Admin\AppData\Local\Temp\Ninite 7Zip KeePass 2 Steam VLC WinDirStat iTunes Installer.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\4C127E~1\target.exe
    "C:\Users\Admin\AppData\Local\Temp\4C127E~1\target.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\4C127E~2\target.exe
    target.exe /S
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    PID:100
- - C:\Users\Admin\AppData\Local\Temp\4C127E~3\target.exe
    target.exe /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Program Files (x86)\Steam\bin\steamservice.exe
      "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- - C:\Users\Admin\AppData\Local\Temp\4C127E~4\target.exe
    C:\Users\Admin\AppData\Local\Temp\4C127E~4\target.exe /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies registry class
    PID:4596
- - C:\Program Files\VideoLAN\VLC\uninstall.exe
    "C:\Program Files\VideoLAN\VLC\uninstall.exe" /S
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" /S _?=C:\Program Files\VideoLAN\VLC\
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3572
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s /u "C:\Program Files\VideoLAN\VLC\axvlc.dll"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:444
      - C:\Windows\system32\regsvr32.exe
        
        /s /u "C:\Program Files\VideoLAN\VLC\axvlc.dll"
        6⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:3164
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Program Files (x86)\VideoLAN\VLC"
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Local\Temp\4CCBD5~1\target.exe
    target.exe /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
      "C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe" C:\Program Files\VideoLAN\VLC\plugins
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1412
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Program Files\VideoLAN\VLC\axvlc.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:340
    - - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files\VideoLAN\VLC\axvlc.dll"
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:116
- - C:\Users\Admin\AppData\Local\Temp\57BB7E~1\7za.exe
    "C:\Users\Admin\AppData\Local\Temp\57BB7E~1\7za.exe" x -y "C:\Users\Admin\AppData\Local\Temp\57BB7E~1\target.exe"
    3⤵
    - Executes dropped EXE
    PID:3436
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\57BB7E~1\Bonjour64.msi" /qn /norestart REBOOT=ReallySuppress ALLUSERS=1 /Le "C:\Users\Admin\AppData\Local\Temp\57BB7E~1\704d6118-8872-11ed-aecb-fe977829be37"
    3⤵
    PID:1144
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\57BB7E~1\AppleSoftwareUpdate.msi" /qn /norestart REBOOT=ReallySuppress ALLUSERS=1 /Le "C:\Users\Admin\AppData\Local\Temp\57BB7E~1\781daf14-8872-11ed-aecb-fe977829be37"
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\57BB7E~1\AppleMobileDeviceSupport64.msi" /qn /norestart REBOOT=ReallySuppress ALLUSERS=1 /Le "C:\Users\Admin\AppData\Local\Temp\57BB7E~1\781daf17-8872-11ed-aecb-fe977829be37"
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\57BB7E~1\iTunes64.msi" /qn /norestart REBOOT=ReallySuppress ALLUSERS=1 /Le "C:\Users\Admin\AppData\Local\Temp\57BB7E~1\801b5314-8872-11ed-aecb-fe977829be37"
    3⤵
    PID:4752

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7DBCEF65B35073EFF45BF2A465ABC05C
  2⤵
  PID:2456
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B14C9E8FEA70AB020D1436E8A750CEAD
  2⤵
  PID:3644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7248C5C625E956D1279277347BAD09F2 E Global\MSI0000
  2⤵
  PID:3496
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
  2⤵
  PID:820
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
  2⤵
  PID:2592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 51BF09D0633C970BDC8A8E32D4B14563
  2⤵
  PID:2276
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\ScriptingObjectModel.dll"
  2⤵
  PID:5052
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Apple Software Update\SoftwareUpdateAdmin.dll"
  2⤵
  - Modifies registry class
  PID:4720
- C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
  "C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe" /RegServer
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 516CFD35AF28BD1C59099A1647C04154 E Global\MSI0000
  2⤵
  PID:2100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 20BA0032649CD86D0E4A19C2B6AA80FD
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1AACB30A813087AA180ACEA6C4E67509
  2⤵
  PID:3384
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 98C0C07552E86FBF7FF39F45CDB9916F E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  PID:1700
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding AD7F7544C8C53D5D4459140E9497AD8D
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 664EE82A732B92124A461064B277A315
  2⤵
  PID:948
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A9F1C27972CFC282423B49DD72A3B317 E Global\MSI0000
  2⤵
  PID:3580

C:\Program Files\Bonjour\mDNSResponder.exe
"C:\Program Files\Bonjour\mDNSResponder.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:4972

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{16D99191-6280-4B33-A2F5-04805A0FC582}
1⤵
PID:4088

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.7MB

MD5
2de3f7cf6020b3bb6bc4199459a63016

SHA1
8a30e5e333a353eb069ab961a4c1918fcbb44623

SHA256
f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e

SHA512
5d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.7MB

MD5
2de3f7cf6020b3bb6bc4199459a63016

SHA1
8a30e5e333a353eb069ab961a4c1918fcbb44623

SHA256
f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e

SHA512
5d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
4KB

MD5
8ebd46495dd3b4ab05431c5c771d5657

SHA1
e426214322a729faddb5bc80053af5750c76683b

SHA256
70c39d5d5b16640165de19cee80da4a391035108cbc5f5009372a86954f0fe92

SHA512
53afd923f583eda4db580935a8cdd62413af8e830c04f2c12d15c55e905c114ec11a5e4483660601504c27e9350e9e47c6432f8f699464e11c5050fe846d7dc4

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
6KB

MD5
239c03a3dc1c27993da724736d086cef

SHA1
ff88246f8ea3502873dcbdc622378f006c58a2e6

SHA256
b387e2fb971297d3438acca130c53dfdd202ae2ca5b52d6503333734cda4fbfc

SHA512
656922e8f2dec46ef36efba5c85088c47b02e89f62b27559611fcbe6ef85c6cd8462a4532e2d2d7f4faa977ab24f0de6f5f72e3075f8889db9e6e60baa162a32

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
4KB

MD5
6def4d3cf1453d5fb69d22fca29892a4

SHA1
09fe62653e55668de75a9fc5b64949ea81eb4991

SHA256
60c29f3c57c44c58daf69be797bfede31967b1ddfc9bb68cb7ddaa0acda67c8c

SHA512
ee4f3f5dd8a8aadde9cff8f8aca8a45fa419c36fd8a4a7d3af9b71e1f7e5d9e1d01c329c70e6da53238822b536e35224e55004bf2e1af4ec17d5b56ccfc58549

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
4KB

MD5
03b664bd98485425c21cdf83bc358703

SHA1
0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

SHA256
fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

SHA512
4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
4KB

MD5
31a29061e51e245f74bb26d103c666ad

SHA1
271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

SHA256
56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

SHA512
f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
2fe6613e267857982d7df4368c9827ec

SHA1
d520c7427b283e3ff167b850ab15352e46d328d3

SHA256
2eba5f3f0b0dbcc2cd69c36c220a2355d1ba3cd67b6e25b5846c80e1604bcac0

SHA512
cf2fc8978adf54dce5700eda7d8beb4917c89bf5458131171eab95463e1b3a3315770f4baae07e498e8e36a8478f09e27054ca2d06b4542c86d8459360572be4

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
4KB

MD5
594be5b10d9f551e551cf20eae0e6dfc

SHA1
191c20f5cb0c27ecc5a055fa2379694f5e27a610

SHA256
e350ca62e777da4da6d25885be96d48e7ce3acf021a74f2a4902354a1bf03fbb

SHA512
e27bf6593a177c22e16ddf5a44d82b34b02063645a7fd63943b936028d9c433c89628038768a300c296c2d3bcab2ef6b8532a19f7283952d041865c704f62b0b

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
4KB

MD5
da69785dfbf494002f108dd73020183d

SHA1
34bb6061cdf120e7dced0402e588c3f712cf2dc0

SHA256
8cce22e7f13486f2bc612dcc8fa31d81038e6084a350fa10299d40c3a7f878c8

SHA512
db773783b63ed1d66a59272e05304c174b69f85d2838ae8049dffed6b6b30c2011fd9042dd652f9a1733a2b6891870b426cf1985d41921e5360c9b1ae1330e20

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
4KB

MD5
395286db3e67a59868e2662c326c541a

SHA1
716014d76622612a1bde2d4e1744d024f6d0b830

SHA256
02e48ee4e10354a2b2741d2e57ef565404753779f847906b5ae5c98ede06c01b

SHA512
64cdf1e6701ea57474051e338eee74859fc0ff4acd71ee0718a9b8cd698e94a9793c1901b6791fc0fc268c53fbc1e7e2f94ac1024f3f8765bf713954c194b0fe

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
6KB

MD5
b9e30df8cf272813b121133fcf259752

SHA1
16706f982f16d5feb9c808f94b8cfa50c23f5d80

SHA256
88919d7be26fb3e06401fc0254733d92fd743ecc56da4177b41613e1f094c3e8

SHA512
7beb65c0477b02742741a8ce23557f4f15e8cf1b1ef03a6bbadbf594bdf2cd686d7356d93719111d27b309a10ca75846765a13bb3eb4d0411785dfb13a675fc4

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
4KB

MD5
18aaaf5ffcdd21b1b34291e812d83063

SHA1
aa9c7ae8d51e947582db493f0fd1d9941880429f

SHA256
1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

SHA512
4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Filesize
4KB

MD5
8958371646901eac40807eeb2f346382

SHA1
55fb07b48a3e354f7556d7edb75144635a850903

SHA256
b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

SHA512
14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Filesize
5KB

MD5
7e1d15fc9ba66a868c5c6cb1c2822f83

SHA1
bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

SHA256
fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

SHA512
0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_korean.txt

Filesize
4KB

MD5
d75580775d67a85353189736222a8878

SHA1
ccb2275c8f5d119640064fd533ca15f30d93f331

SHA256
10720923c1048502c5191d6d1d8580e35e707b24d457941dae94a87371af989a

SHA512
757dd94a1e3debb2520855a3d00e44e3a98b5764caf9c16c8d088fc1a1f1024eed742f1051635721f4bf2c00d1dac11fd975c09a7f5df78d1863de88f9bbf9fe

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Filesize
4KB

MD5
d75580775d67a85353189736222a8878

SHA1
ccb2275c8f5d119640064fd533ca15f30d93f331

SHA256
10720923c1048502c5191d6d1d8580e35e707b24d457941dae94a87371af989a

SHA512
757dd94a1e3debb2520855a3d00e44e3a98b5764caf9c16c8d088fc1a1f1024eed742f1051635721f4bf2c00d1dac11fd975c09a7f5df78d1863de88f9bbf9fe

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

Filesize
4KB

MD5
7913f3f33839e3af9e10455df69866c2

SHA1
15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

SHA256
05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

SHA512
534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Filesize
4KB

MD5
5462f47e56b978659ef56f196db013f4

SHA1
4749824d4e909369f59217d4980963ff17353f3f

SHA256
cbfbe91d4a4661df814ea447c03f4ca872ef3e27073a1eb746faccbfe75afc8a

SHA512
5a437968fc06619cf553ced32dba9c7c948f4364f02c8017986e9a4f09e9832b849c7e0567485ca1beba34a258d29b2612ea3ed6045c81777e9a5201139f81a3

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Filesize
4KB

MD5
9b0b0e82f753cc115d87c7199885ad1b

SHA1
5743a4ab58684c1f154f84895d87f000b4e98021

SHA256
0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

SHA512
b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Filesize
4KB

MD5
eb8926608c5933f05a3f0090e551b15d

SHA1
a1012904d440c0e74dad336eac8793ac110f78f8

SHA256
2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

SHA512
9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

Filesize
4KB

MD5
31bd3d4d8de5af4642b21d586d5ee54d

SHA1
552bebb93c71cd8acd72558db1810530909fb276

SHA256
52f256ded29ce22945b5bc0ef7a227189dfa91da69265ec13283a7067c239071

SHA512
cea49fc70b18a1294ec7e564ff7f4d1ff7efeb0db1cf1b088da6adcecc282569380f225e9a150d1666c5c1977ba4de0a5d9d667c72cfb8569a50546b978e9132

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

Filesize
6KB

MD5
e04ad6c236b6c61fc53e2cb57ced87e8

SHA1
e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

SHA256
08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

SHA512
0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

Filesize
4KB

MD5
56dcf7b68f70826262a6ffaffe6b1c49

SHA1
12e4272ba0e4eabc610670cdc6941f942da1eb6a

SHA256
948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

SHA512
c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

Filesize
4KB

MD5
e9b8fccdb78bf9d275b79c75b2ff3e7b

SHA1
4b549411ed4db0f0a3699e76531353c226b06a76

SHA256
41ecfe0ffd6043a66a41bf9ea032712f2d1bbc19b434c6c666a107ee379f21e4

SHA512
4ce905a31f3a410712722271abd7e0a9a6c43646b61a321912b4a8e8f6fab68ab69add1d701c501bb069b8ecb65ecaf3bfa9be983933d0234a8c81c24bc6601f

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

Filesize
4KB

MD5
b2248784049e1af0c690be2af13a4ef3

SHA1
aec7461fa46b7f6d00ff308aa9d19c39b934c595

SHA256
4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

SHA512
f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

Filesize
4KB

MD5
5c7bc92e0d948e3bba3f26f64a22fe7e

SHA1
bd259397a312bee9b8262058c30e0e354eeea93a

SHA256
5e6b0978fe8e2d14905f46e089b06681d6dfe76dd0c1551c168171ac4de75969

SHA512
8a6e18ce3d38a9658172b1871255a9941c572114137e468f130956c73ff13f282a46074a1dda6404dbdbf317ecdaadf01324194b8f8c081f862037784f4946ba

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

Filesize
7KB

MD5
1a537a1d30fba1d3db449a9207b63835

SHA1
ab6903b4c8d6bd3571960b1218714b8d76b1880d

SHA256
49b6b664d50a1ae0c732bcfbbdd1db1812ddccf00bcf5f40200f0e7cff5542ee

SHA512
1215b0d017a6e3ea207edafe8edd500a91a7a971b2f989d8006fa65e475ae32ec00df3e8ec06b4077f64f5b789c536bfb9d8b9945ca0e0731d68e48876bd8459

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

Filesize
4KB

MD5
29f9a5ab4adfae371bf980b82de2cb57

SHA1
6f7ef52a09b99868dd7230f513630ffe473eddf8

SHA256
711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

SHA512
543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

Filesize
6KB

MD5
cadd7a2f359b22580bdd6281ea23744d

SHA1
e82e790a7561d0908aee8e3b1af97823e147f88b

SHA256
3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

SHA512
53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

Filesize
4KB

MD5
f8a86b74ce3b446e3111d1480b5feaf7

SHA1
af21c55fd6ac99e65db55af9b8f4ffe790c4382c

SHA256
8a049b6126e904dcb9ba5d8af21cc0ab25ca55221cf2cd48eea45504fe23083b

SHA512
70f8009f5940b10b77a6c152c8c73f3dd425fb9ac917014504e8116ef00032888de686271e0262cbe7a55c6e605e837dcfbeb54ece71e49646b1030195fa0845

Download Submit
C:\Program Files (x86)\Steam\steam.exe

Filesize
4.1MB

MD5
b4411620a3551834e4f699cc5a9b27e6

SHA1
5093960cc86613e310d13770b5adef00fe93f3eb

SHA256
3caf4a246169b2d30c6bf18fa0b7a4a01bbe933cfb781f3da4c6b3cb67b59d04

SHA512
47dde07212c2d5eea548d7794fc6bb9d86ced9a0848aaeab81fa8844fc5cab7eac58e386e96a81c663b914c85c0a7116033e2b2cfd18559d40aa6c83f9a6c024

Download Submit
C:\Program Files (x86)\WinDirStat\windirstat.exe

Filesize
636KB

MD5
24cd9a82fcfc658dd3ae7ba25c958ffb

SHA1
26e14a532e1e050eb20755a0b7a5fea99dd80588

SHA256
cc3ee246f2710dc9ba9e2a88e3192b88f1db4caa2eefb8641642a33df04e585c

SHA512
4de675be1f7d618d133ef24765a027840473e0c5bc93550d5e5fdbf078edc74c2241e6e3cd8753517e2954c7f09b9909028de7b727294d723fb5700658c7979d

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
668KB

MD5
5ab26ffd7b3c23a796138640b1737b48

SHA1
6dab8c3822a0cab5b621fd2b7f16aebb159bcb56

SHA256
eb775b0e8cc349032187c2329fefcf64f5feed4d148034c060e227adf6d38500

SHA512
2b40489f46e305f7e3455cac25e375711a6a1733861ee7bf1b800b86eaad2f40871c219924ddceb69b9748ae3cf9de59f0edffd7ed7b5e7f35d1239fe0333a78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Filesize
1KB

MD5
b89d30a196e2977bf88294e8c89d1098

SHA1
5d5b636874aba1c1943dc68a77bb1d9b304bbf4b

SHA256
cce265a282f51902920b92f9eac16ba9eb4242efbe5cbbf012b80b54f3afda7c

SHA512
26dc64a3fda66be9d3dbafd53b686cffe3948684e16f31e607eef4f1b07274d6e26b1420d6ba169ac315e085e7f2e0581a86408b4acd0aa3ade7b4e878bafa17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D6243C18F0F8F9AEC6638DD210F1984_2B02AD02E70319C9134B0D48D9CD9AB5

Filesize
471B

MD5
d093f2fcc977f87b48b728b928261dbd

SHA1
b482392a9753fd5b2dab25cb705acf172e959df9

SHA256
920d60cf99079cea9f49e8d82e73fa82161f9502a0f3c874a9765e072b8b2f34

SHA512
42f74463def25ef76d21ab735e7ff7d50708077b59aa1faedb127da4eb1d6bc5df9c6c9bfdd29e34ec824b83ea78cd23086b00fafd0d84b16abf35bc51daeae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
1KB

MD5
4be166c123119f44f0fba7954992ba31

SHA1
886e931560458f068a55066309cf94210c02fbe0

SHA256
8205066b4c87118be76e32e2b358d1eab208a602a2226bdb5db2c9fd922b600e

SHA512
31cca9529aa743dc1007d3d063c31a68a6913581880713fa56842782e312054e7261d5aa827d7f4cd81da5154865197dcf8a5e1d83b6dead8f9e56a5ccf04a0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
086270459a747b9db1f6e66a0ec23672

SHA1
4dcece02d153016b0ebd9a4d196e794294192ba8

SHA256
513978a50bc1349fd28d3d3908efb8c7215d94fa15d9dbe46e29f5d9ddd029e1

SHA512
0cf79ff7048148223d98aa68066dd5784274681b30c465c1f9b22d229c0592505fac5f2050f364be46288295100d4c6c24fab890b8847f76ed6757ae44a945e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Filesize
442B

MD5
9afed4805944cfe44fc4ad062a7f3e97

SHA1
109165e388960a2b2bcc2ec197647df2ce2762b2

SHA256
3833df9fa032724100c7904a3069589c2e5a58d1b0a35733405f412430979e26

SHA512
57c76e8b6f9de9a1d439ba0d53635d6d42815787ccd38d1d769d4fe48967e7606a408da2f94f88898ae280713c932a80c927ef6d87e49583e8f43983dc0d959e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D6243C18F0F8F9AEC6638DD210F1984_2B02AD02E70319C9134B0D48D9CD9AB5

Filesize
444B

MD5
5ff790978b44d68689ace35532aa4f64

SHA1
f88fcb20c883046c7f53ad05acc0d8829cf5a018

SHA256
0f4abe45b111c962bf594c02b331821cf7cee1a988f2229d15205984a87ff5b2

SHA512
f100e23e0a2c31d79c9cffefd566c85b316bd0b4b0daa35b7719bad519468b9e1cabfce6e027a6afcd4d3797573204867c2494cff81a6adc6f76a9537c7ad797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
6d13a053f7b3a1425d42a128d93a781a

SHA1
470a62513ecf168cef1c5ee7a148629821c006f3

SHA256
efebaa0030ced78ec768990a7e9cce4f31c09b0d71d3ed0b6570ebc96a340627

SHA512
9f9230d9ad0424a969a1dbe82242b0a17c9c444aae017ea42757dd717c095b55b229a3168cc40e8e893c5cdc7ed0476cd045c030224ffa3601198463fb7544b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
deefb75e2c70e559123f6d30a397ddc6

SHA1
c0dc11f8b31448ee0317766db0b7e3e26b72b0ab

SHA256
ac6bd209c315ad4e2cffc573f895910e33181fca38fecdc64e7bd4a5e36f48c0

SHA512
96f01b7b0aee48eb2b2a2c2e124b9ae5acb07c6e369ce8288d6d085474eb973f751b2f7c5e6138766c23571a74e056cde24960effb1acba3b7ad2bab18e24e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\48304a39-8872-11ed-aecb-fe977829be37\Ninite.exe

Filesize
1.6MB

MD5
9e089c7ee534d582a051db0d4bbc556e

SHA1
408c018d28cac8eb932488e05897ba33b9d91dec

SHA256
d99e5d2a4a6ee960237342fb9af6c75caed5bd102081a1b46857e339f6c4cabe

SHA512
27953a2d85ae42bf46e177a7012637987dc2ee4ba10214265561a0c2746b7970509704b981a2c1b809203b7f8b70b607caebcee29468627f451f3ae9c4ad11a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C127E~1\target.exe

Filesize
630KB

MD5
3abf1c149873e25d4e266225fbf37cbf

SHA1
6fa92dd2ca691c11dfbfc0a239e34369897a7fab

SHA256
370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd

SHA512
b6d9672a580a02299bc370deb1fd99b5ca10ab86456385870cdae522c185ae51f8d390a7c50fcb5c7898523f52c834bb73515ffc6d0b0bcde210640e815ece9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C127E~2\target.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C127E~3\target.exe

Filesize
2.2MB

MD5
70f3bc193dfa56b78f3e6e4f800f701f

SHA1
1e5598f2de49fed2e81f3dd8630c7346a2b89487

SHA256
3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

SHA512
3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C127E~4\target.exe

Filesize
27.9MB

MD5
404db076f2032e6b3a702eeeca870a9b

SHA1
e4e589ea269d5404936b0c52dce0c89cddf401f7

SHA256
14ceeccc4473e02417726cd01614b6c1cc9556ab3aa899118552af82d69db22a

SHA512
77ca3c49592ce0faa7c66d4af3bd9229939ac1e231fbf644fa48119eb0329365376dd7767eb2712107565c1f49bcc6ae056a9ff117eb2f6a2e462a42ae3ad6a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\4c127e9b-8872-11ed-aecb-fe977829be37\target.exe

Filesize
630KB

MD5
3abf1c149873e25d4e266225fbf37cbf

SHA1
6fa92dd2ca691c11dfbfc0a239e34369897a7fab

SHA256
370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd

SHA512
b6d9672a580a02299bc370deb1fd99b5ca10ab86456385870cdae522c185ae51f8d390a7c50fcb5c7898523f52c834bb73515ffc6d0b0bcde210640e815ece9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\4c127e9d-8872-11ed-aecb-fe977829be37\target.exe

Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\AppData\Local\Temp\4c127ea2-8872-11ed-aecb-fe977829be37\target.exe

Filesize
2.2MB

MD5
70f3bc193dfa56b78f3e6e4f800f701f

SHA1
1e5598f2de49fed2e81f3dd8630c7346a2b89487

SHA256
3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

SHA512
3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\4c127ea4-8872-11ed-aecb-fe977829be37\target.exe

Filesize
27.9MB

MD5
404db076f2032e6b3a702eeeca870a9b

SHA1
e4e589ea269d5404936b0c52dce0c89cddf401f7

SHA256
14ceeccc4473e02417726cd01614b6c1cc9556ab3aa899118552af82d69db22a

SHA512
77ca3c49592ce0faa7c66d4af3bd9229939ac1e231fbf644fa48119eb0329365376dd7767eb2712107565c1f49bcc6ae056a9ff117eb2f6a2e462a42ae3ad6a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa7D2.tmp\System.dll

Filesize
10KB

MD5
4125926391466fdbe8a4730f2374b033

SHA1
fdd23034ada72d2537939ac6755d7f7c0e9b3f0e

SHA256
6692bd93bcd04146831652780c1170da79aa3784c3c070d95fb1580e339de6c5

SHA512
32a1cf96842454b3c3641316ee39051ae024bdce9e88ac236eadad531f2c0a08d46b77d525f7d994c9a5af4cc9a391d30ee92b9ec782b7fb9a42c76f0f52a008

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa7D2.tmp\System.dll

Filesize
10KB

MD5
4125926391466fdbe8a4730f2374b033

SHA1
fdd23034ada72d2537939ac6755d7f7c0e9b3f0e

SHA256
6692bd93bcd04146831652780c1170da79aa3784c3c070d95fb1580e339de6c5

SHA512
32a1cf96842454b3c3641316ee39051ae024bdce9e88ac236eadad531f2c0a08d46b77d525f7d994c9a5af4cc9a391d30ee92b9ec782b7fb9a42c76f0f52a008

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1C15.tmp\System.dll

Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1C15.tmp\nsExec.dll

Filesize
6KB

MD5
c5b9fe538654a5a259cf64c2455c5426

SHA1
db45505fa041af025de53a0580758f3694b9444a

SHA256
7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7

SHA512
f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn1C15.tmp\nsExec.dll

Filesize
6KB

MD5
c5b9fe538654a5a259cf64c2455c5426

SHA1
db45505fa041af025de53a0580758f3694b9444a

SHA256
7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7

SHA512
f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss3328.tmp\System.dll

Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss3328.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinDirStat\Help (ENG).lnk

Filesize
1KB

MD5
10719b5e437a99c5c4b177c4b2edcf8d

SHA1
da93e88f80446a558f63267a91b5a51c70ed60a2

SHA256
2e7bda4948f8dbeb6c9af7bd70354b0d050602c90663a8baeeeb7d0d2f49100d

SHA512
f0dbc252199cdf64342136443e6bbeb5ff545b43a3e3ba9850f2028cde788a16152fc31fd94b134fe1091c9dc35fd9e02baaae54fd973c4d5aa88e017f5a4de5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinDirStat\Uninstall WinDirStat.lnk

Filesize
1KB

MD5
b9a73dc8e46395bd5e35d141c9314224

SHA1
24e4f2c2018e2e7a5b7555556597b8ddb9c17f1d

SHA256
4e39ffed24ccaaf8da5389b18875a81b73ab8750d09a411b54e70ded1bec8f34

SHA512
3dbbb3ccd6d34274a13c8d94e0db365c8b5b73368b1c0e1932065674c66e421f6a9c2a948771160bc13d2f98d6d4ceaf3dadcfe8ba77606773e06f730eacfec1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinDirStat\WinDirStat.lnk

Filesize
1KB

MD5
b98258f4622cc3dbf9f110a7dbad6159

SHA1
b65cd86a9950fb8e7f1d9c1eb47a1611e3456585

SHA256
34bfcc5fbfb62189a144290c64cd69822361cfd96ef68c0c04b9bd89e49e27a4

SHA512
0ae81b1b2b1636433ecc4d2fd19613b46f5e33301797b413c0329d012dd63c7d4a881f23ab3a04e18d85a5d90fc9a78777ced6c56377e3676158a370bc8b4153

Download Submit
C:\Users\Admin\Desktop\WinDirStat.lnk

Filesize
1KB

MD5
c9daa45d22471594b783cf4bf56a55d3

SHA1
1f77677f6da70a7d448c9fef7f1f269a5dcb557a

SHA256
a2dd6f5d34231235d8088967aa9031a3db79f07f441e398283c2cba651fa0d15

SHA512
69b41b435cb781a5f1aa19893e51980b9de4fec033b09376b0f86c244aedf8e0d3e50cabe6899f578b67af11bb974506aeae5825b44f59e8bbcb1f5e4800181c

Download Submit
C:\Users\Public\Desktop\Steam.lnk

Filesize
1KB

MD5
3852ec1cc88681a72446e8bc4d60225e

SHA1
865d7f7e44ade6ea27748f151fd7d6b100208d87

SHA256
a562cec4738b5bb03185faa4a7610386ced1f3f93b8996fdeba158bd6022bc26

SHA512
401f1704bd0e938db35dd1e89bb2924d5f51c919059c356fb3d77044eda7a9027e16c1ec3652f7876baef02de5d5bfcf8cce48f47beaedc642dcf2a3511d4b14

Download Submit
memory/100-152-0x0000000000000000-mapping.dmp

Download
memory/116-209-0x0000000000000000-mapping.dmp

Download
memory/340-208-0x0000000000000000-mapping.dmp

Download
memory/444-203-0x0000000000000000-mapping.dmp

Download
memory/640-221-0x0000000000000000-mapping.dmp

Download
memory/640-222-0x0000000002310000-0x000000000234F000-memory.dmp

Filesize
252KB

Download
memory/820-215-0x0000000000000000-mapping.dmp

Download
memory/948-235-0x0000000000000000-mapping.dmp

Download
memory/1144-211-0x0000000000000000-mapping.dmp

Download
memory/1412-207-0x0000000000000000-mapping.dmp

Download
memory/1700-228-0x0000000000000000-mapping.dmp

Download
memory/2100-224-0x0000000000000000-mapping.dmp

Download
memory/2276-218-0x0000000000000000-mapping.dmp

Download
memory/2412-226-0x0000000000000000-mapping.dmp

Download
memory/2456-212-0x0000000000000000-mapping.dmp

Download
memory/2592-216-0x0000000000000000-mapping.dmp

Download
memory/2736-132-0x0000000000000000-mapping.dmp

Download
memory/3164-204-0x0000000000000000-mapping.dmp

Download
memory/3384-227-0x0000000000000000-mapping.dmp

Download
memory/3384-142-0x0000000000000000-mapping.dmp

Download
memory/3436-210-0x0000000000000000-mapping.dmp

Download
memory/3496-214-0x0000000000000000-mapping.dmp

Download
memory/3572-202-0x0000000000000000-mapping.dmp

Download
memory/3580-236-0x0000000000000000-mapping.dmp

Download
memory/3644-213-0x0000000000000000-mapping.dmp

Download
memory/4012-230-0x0000000000000000-mapping.dmp

Download
memory/4012-231-0x000001C9D26C0000-0x000001C9D26F3000-memory.dmp

Filesize
204KB

Download
memory/4084-205-0x0000000000000000-mapping.dmp

Download
memory/4208-217-0x0000000000000000-mapping.dmp

Download
memory/4244-201-0x0000000000000000-mapping.dmp

Download
memory/4424-156-0x0000000000000000-mapping.dmp

Download
memory/4596-196-0x0000000000000000-mapping.dmp

Download
memory/4652-162-0x0000000000000000-mapping.dmp

Download
memory/4720-220-0x0000000000000000-mapping.dmp

Download
memory/4752-229-0x0000000000000000-mapping.dmp

Download
memory/5044-225-0x0000000000000000-mapping.dmp

Download
memory/5052-219-0x0000000000000000-mapping.dmp

Download
memory/5096-206-0x0000000000000000-mapping.dmp

Download