Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2023, 10:21

General

  • Target

    Aplicativo.msi

  • Size

    6.4MB

  • MD5

    9775e778c840ebea365009ff78e0f127

  • SHA1

    4647585ce90ef3cc299b2a35c50e8a28c1e98f9b

  • SHA256

    68b6df03608984d704b949fa4d0bb1de834417fac5c6ad4d0610723ebc6f66c4

  • SHA512

    919a679243ff2022361787c9a7bb5c70bfd2125568c2c370d151d8eb0d1a665bb6cc66fe6d820094b52f9ff6e0dff311d85d1c5b3db12469ac6866fbb879a969

  • SSDEEP

    98304:k9YAsqg//wYMlviK3mnJre74WU8hNpsQaUicrvbwTVaEfL0OmQ:zgl64OJreMWFN3iSDwRm

Malware Config

Signatures

  • Blocklisted process makes network request 7 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 32 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 30 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Aplicativo.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2548
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 55110CC736C135EE25DFB81BD722616F
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Drops file in Program Files directory
      PID:4544
    • C:\Windows\Installer\MSI918B.tmp
      "C:\Windows\Installer\MSI918B.tmp" http://bit.ly/3VNrTvV
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4528
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/3VNrTvV
        3⤵
        • Adds Run key to start application
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xc0,0x104,0x7ffa6dc246f8,0x7ffa6dc24708,0x7ffa6dc24718
          4⤵
            PID:4744
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
            4⤵
              PID:4304
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4616
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
              4⤵
                PID:4300
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
                4⤵
                  PID:3956
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                  4⤵
                    PID:1292
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 /prefetch:8
                    4⤵
                      PID:3324
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
                      4⤵
                        PID:2528
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5668 /prefetch:8
                        4⤵
                          PID:4276
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
                          4⤵
                            PID:1456
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
                            4⤵
                              PID:1336
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
                              4⤵
                                PID:4528
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                4⤵
                                  PID:720
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ff732515460,0x7ff732515470,0x7ff732515480
                                    5⤵
                                      PID:1964
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3800
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5264 /prefetch:8
                                    4⤵
                                      PID:3468
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3212 /prefetch:8
                                      4⤵
                                        PID:3744
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:396
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3712 /prefetch:8
                                        4⤵
                                          PID:3056
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:8
                                          4⤵
                                            PID:4064
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
                                            4⤵
                                              PID:1124
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,4515606113167871989,4507080554373912015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3684 /prefetch:8
                                              4⤵
                                                PID:4296
                                          • C:\Windows\Installer\MSIDD35.tmp
                                            "C:\Windows\Installer\MSIDD35.tmp" /HideWindow schtasks.exe /run /tn PackagedCWALauncher
                                            2⤵
                                            • Executes dropped EXE
                                            PID:2220
                                          • C:\Windows\Installer\MSIDD34.tmp
                                            "C:\Windows\Installer\MSIDD34.tmp" /DontWait /dir "C:\Program Files (x86)\Arbyrd\Arcadia\Archie\" "C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            PID:4040
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:2216
                                          • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe
                                            "C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            • Checks processor information in registry
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3420
                                            • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe
                                              "C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe" --local-service
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4480
                                            • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe
                                              "C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe" --local-control
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:4196
                                            • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe
                                              "C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --install-driver:printer --update-main --svc-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf" --sys-conf "C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf"
                                              2⤵
                                              • Executes dropped EXE
                                              • Checks computer location settings
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3028
                                              • C:\Windows\SysWOW64\expand.exe
                                                expand -F:* "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver"
                                                3⤵
                                                • Drops file in Windows directory
                                                PID:1744
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                "C:\Windows\System32\rundll32.exe" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\Admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"
                                                3⤵
                                                • Drops file in Windows directory
                                                • Modifies system certificate store
                                                PID:3296
                                          • C:\Windows\System32\schtasks.exe
                                            "C:\Windows\System32\schtasks.exe" /run /tn PackagedCWALauncher
                                            1⤵
                                              PID:1548
                                            • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\PackagedCWALauncher.exe
                                              "C:\Program Files (x86)\Arbyrd\Arcadia\Archie\PackagedCWALauncher.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: GetForegroundWindowSpam
                                              PID:4512
                                            • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
                                              "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2720
                                            • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
                                              "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --control
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:3584
                                            • C:\Program Files (x86)\AnyDesk\AnyDesk.exe
                                              "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-install
                                              1⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              PID:2560
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                              1⤵
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              PID:5024
                                              • C:\Windows\system32\DrvInst.exe
                                                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b7ef6422-815c-6842-b60f-8ea61a9406c9}\anydeskprintdriver.inf" "9" "49a18f3d7" "0000000000000150" "WinSta0\Default" "0000000000000134" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"
                                                2⤵
                                                • Drops file in System32 directory
                                                • Drops file in Windows directory
                                                • Checks SCSI registry key(s)
                                                • Modifies data under HKEY_USERS
                                                PID:2748
                                                • C:\Windows\system32\rundll32.exe
                                                  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{fd3a6c2e-f53c-f74f-ab0d-982e946ea074} Global\{e0078771-a395-b04e-b8e0-7b32eefdb86b} C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\anydeskprintdriver.inf C:\Windows\System32\DriverStore\Temp\{0e3e062a-42ec-b742-a545-8266ffaa6aef}\AnyDeskPrintDriver.cat
                                                  3⤵
                                                    PID:3872
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                                                1⤵
                                                • Drops file in Program Files directory
                                                PID:4484
                                                • C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4484_1096955000\msedgerecovery.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4484_1096955000\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.67 --sessionid={7ad5b235-bc4a-4d5e-9fab-6b406221e520} --system
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:4284
                                                  • C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4484_1096955000\MicrosoftEdgeUpdateSetup.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4484_1096955000\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    PID:4208
                                                    • C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\Temp\EU4E74.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Sets file execution options in registry
                                                      • Loads dropped DLL
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3972
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        PID:1940
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        PID:4860
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Registers COM server for autorun
                                                          • Loads dropped DLL
                                                          • Modifies registry class
                                                          PID:4184
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Registers COM server for autorun
                                                          • Loads dropped DLL
                                                          • Modifies registry class
                                                          PID:3556
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.169.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Registers COM server for autorun
                                                          • Loads dropped DLL
                                                          • Modifies registry class
                                                          PID:2804
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REQ0ODhEODktNDlGNi00ODg1LTk3NkItQUYyN0NFMDc5MEU5fSIgdXNlcmlkPSJ7QzExQzU5MEItMzBFMy00RDNDLUI2MzAtOEIzQ0EwNTMxQjk4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezRBMzVDQ0NCLTI0NEYtNDBCQi1CMkM4LThCOTMzRjY5MDZGRX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7bTQ2SzVLNXoxdnZrTkxIcjRjMXgvaENqZTdaUUxkcUt5WjVOd2d6VjNBOD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE2OS4zMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTkxNzY3MjA5NyIgaW5zdGFsbF90aW1lX21zPSI2NzYiLz48L2FwcD48L3JlcXVlc3Q-
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:4488
                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4872
                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                1⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Drops file in Program Files directory
                                                • Modifies data under HKEY_USERS
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4628
                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDFDOTFEOUYtMzYyMi00QzcxLUJCMTItNjdGOTUxNDhBQTI0fSIgdXNlcmlkPSJ7QzExQzU5MEItMzBFMy00RDNDLUI2MzAtOEIzQ0EwNTMxQjk4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezgwNTIxNTYzLUQ2ODQtNDlCNS1BODQ3LUJBMEFDMTI2M0QwMn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cVdKU3pXd1BmZGNMUitYR0l2NnhyWmZpWU94aFBVMnMxTldtaldjYUZQZz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iODkuMC40Mzg5LjExNCIgbmV4dHZlcnNpb249Ijg5LjAuNDM4OS4xMTQiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDI0MTYwNTY3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:872
                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BB95670-9B97-4322-AC21-ED3A3E47C7A9}\MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2BB95670-9B97-4322-AC21-ED3A3E47C7A9}\MicrosoftEdgeUpdateSetup_X86_1.3.171.39.exe" /update /sessionid "{41C91D9F-3622-4C71-BB12-67F95148AA24}"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  PID:3248
                                                  • C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\MicrosoftEdgeUpdate.exe
                                                    "C:\Program Files (x86)\Microsoft\Temp\EU2C41.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{41C91D9F-3622-4C71-BB12-67F95148AA24}"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Sets file execution options in registry
                                                    • Loads dropped DLL
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:204
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Modifies registry class
                                                      PID:1292
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Modifies registry class
                                                      PID:4256
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Registers COM server for autorun
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        PID:3872
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Registers COM server for autorun
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        PID:1004
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Registers COM server for autorun
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        PID:2804
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDFDOTFEOUYtMzYyMi00QzcxLUJCMTItNjdGOTUxNDhBQTI0fSIgdXNlcmlkPSJ7QzExQzU5MEItMzBFMy00RDNDLUI2MzAtOEIzQ0EwNTMxQjk4fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7QUJDOUUzMDctMkREMy00N0Y2LTk5QzUtMzgwMjU0OTlFQTg4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTY5LjMxIiBuZXh0dmVyc2lvbj0iMS4zLjE3MS4zOSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjaHJvbWVyZWMzPTIwMjMwMlIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTY3MzQzNjMwNiI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ3MTk4NDU0OCIvPjwvYXBwPjwvcmVxdWVzdD4
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:4860
                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjkuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjkuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDFDOTFEOUYtMzYyMi00QzcxLUJCMTItNjdGOTUxNDhBQTI0fSIgdXNlcmlkPSJ7QzExQzU5MEItMzBFMy00RDNDLUI2MzAtOEIzQ0EwNTMxQjk4fSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezMxQ0RGQjAyLTEyMTAtNEYxRS1BNkJBLTI2NjNCODlFRjc0N30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE2OS4zMSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iUHJvZHVjdHNUb1JlZ2lzdGVyPSU3QkYzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNSU3RDtjaHJvbWVyZWMzPTIwMjMwMlIiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0Mzk2MzAxMzgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQzOTk0MTkzMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ0NjE5MjM3MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2RiOGM1YmY1LThmNmItNDMxMS1iMTU4LWI2YzRkYTNhZDBkMj9QMT0xNjc0MDM3NTYwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWNwR0gxNFFLWEwyeUt3dmY5V09MbmVYbmc4MyUyYk5mMHZyNVFNMHprQ0NqeG9uNTlQb2FOUFRmMGxSWFVKWHIzVEtwenh6SWo2cXFKMHZKUnBDcmh4bEElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDQ2MTkyMzcwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9kYjhjNWJmNS04ZjZiLTQzMTEtYjE1OC1iNmM0ZGEzYWQwZDI_UDE9MTY3NDAzNzU2MCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1jcEdIMTRRS1hMMnlLd3ZmOVdPTG5lWG5nODMlMmJOZjB2cjVRTTB6a0NDanhvbjU5UG9hTlBUZjBsUlhVSlhyM1RLcHp4eklqNnFxSjB2SlJwQ3JoeGxBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTU4NzE2MCIgdG90YWw9IjE1ODcxNjAiIGRvd25sb2FkX3RpbWVfbXM9IjM1OSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDQ2MzQ4NTM2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0NTE4MTc2NDIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48cGluZyByPSIxNTEiIHJkPSI1NzAzIiBwaW5nX2ZyZXNobmVzcz0iezAwRTEzNkNFLUNCM0EtNDJDNC05OTU3LTkxMTNBNDZCQUIzRn0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzMTc5MDk3MjgzODk0NzUwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9IjE1MSIgYWQ9Ii0xIiByZD0iNTcwMyIgcGluZ19mcmVzaG5lc3M9Ins3QzM5RDUwQy05N0RCLTQ1MjUtQkExMi0zRTEyQTYzNTg1QjF9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:940

                                              Network

                                              MITRE ATT&CK Enterprise v6

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\MSVCR100.dll

                                                Filesize

                                                756KB

                                                MD5

                                                ef3e115c225588a680acf365158b2f4a

                                                SHA1

                                                ecda6d3b4642d2451817833b39248778e9c2cbb0

                                                SHA256

                                                25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8

                                                SHA512

                                                d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a

                                              • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\PackagedCWALauncher.exe

                                                Filesize

                                                16KB

                                                MD5

                                                d10706dac1ec9ca4a80830df17bc4012

                                                SHA1

                                                b98c90460cfef059434b266dbed5c6a75a67d3d9

                                                SHA256

                                                eb57f739dc64a239bd8e131d4abf3d551440a47aff678ca8b9a46f70de60371e

                                                SHA512

                                                41f3574b867870d057988739cecda0eeeba58b7b09d87417d7deef185904188fd36478e0b6c9e7241f88d4a7029238d526a7862349e6a34d9367f876c2957dd6

                                              • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\PackagedCWALauncher.exe

                                                Filesize

                                                16KB

                                                MD5

                                                d10706dac1ec9ca4a80830df17bc4012

                                                SHA1

                                                b98c90460cfef059434b266dbed5c6a75a67d3d9

                                                SHA256

                                                eb57f739dc64a239bd8e131d4abf3d551440a47aff678ca8b9a46f70de60371e

                                                SHA512

                                                41f3574b867870d057988739cecda0eeeba58b7b09d87417d7deef185904188fd36478e0b6c9e7241f88d4a7029238d526a7862349e6a34d9367f876c2957dd6

                                              • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe

                                                Filesize

                                                3.8MB

                                                MD5

                                                9a1d9fe9b1223273c314632d04008384

                                                SHA1

                                                665cad3ed21f6443d1adacf18ca45dfaa8f52c99

                                                SHA256

                                                0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

                                                SHA512

                                                3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

                                              • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe

                                                Filesize

                                                3.8MB

                                                MD5

                                                9a1d9fe9b1223273c314632d04008384

                                                SHA1

                                                665cad3ed21f6443d1adacf18ca45dfaa8f52c99

                                                SHA256

                                                0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

                                                SHA512

                                                3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

                                              • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe

                                                Filesize

                                                3.8MB

                                                MD5

                                                9a1d9fe9b1223273c314632d04008384

                                                SHA1

                                                665cad3ed21f6443d1adacf18ca45dfaa8f52c99

                                                SHA256

                                                0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

                                                SHA512

                                                3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

                                              • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\any.exe

                                                Filesize

                                                3.8MB

                                                MD5

                                                9a1d9fe9b1223273c314632d04008384

                                                SHA1

                                                665cad3ed21f6443d1adacf18ca45dfaa8f52c99

                                                SHA256

                                                0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

                                                SHA512

                                                3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

                                              • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\jli.dll

                                                Filesize

                                                4.2MB

                                                MD5

                                                bf5ecef4749f7cf4b1665904594ad132

                                                SHA1

                                                262ce964149908054d6a978fa8332b8179f50847

                                                SHA256

                                                1543fed94c78df0101171f04da73604f7b163f2c7bb01f6d7e7e5eac291aca8e

                                                SHA512

                                                08bd4b95a079b7607678f6b9cb5cd748c80e4cf71b89ff4b5ea6fb88e6250c4b584386a6ce4030f114e8387a3f435a54d209ea00aac792ebafa93e270f07e3ca

                                              • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\jli.dll

                                                Filesize

                                                4.2MB

                                                MD5

                                                bf5ecef4749f7cf4b1665904594ad132

                                                SHA1

                                                262ce964149908054d6a978fa8332b8179f50847

                                                SHA256

                                                1543fed94c78df0101171f04da73604f7b163f2c7bb01f6d7e7e5eac291aca8e

                                                SHA512

                                                08bd4b95a079b7607678f6b9cb5cd748c80e4cf71b89ff4b5ea6fb88e6250c4b584386a6ce4030f114e8387a3f435a54d209ea00aac792ebafa93e270f07e3ca

                                              • C:\Program Files (x86)\Arbyrd\Arcadia\Archie\msvcr100.dll

                                                Filesize

                                                756KB

                                                MD5

                                                ef3e115c225588a680acf365158b2f4a

                                                SHA1

                                                ecda6d3b4642d2451817833b39248778e9c2cbb0

                                                SHA256

                                                25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8

                                                SHA512

                                                d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                                                Filesize

                                                9KB

                                                MD5

                                                403c971784ac3f9a35c1f5745fa74379

                                                SHA1

                                                c63a9566a37c6af361284c693c6e8e3e655f5d46

                                                SHA256

                                                c224d6617b7c9330a8eb2002ce9fa528fa3530c0d0ce011e5c5f6dba3859d7f0

                                                SHA512

                                                7b60c8f52b911cde5fec892015699395ecfdc53f9b0a808d4660ea85844598aec2d93ed049c3880b52a0667a15048c7ebf591f0fc78d4679d9def0f5e94ca886

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

                                                Filesize

                                                9KB

                                                MD5

                                                403c971784ac3f9a35c1f5745fa74379

                                                SHA1

                                                c63a9566a37c6af361284c693c6e8e3e655f5d46

                                                SHA256

                                                c224d6617b7c9330a8eb2002ce9fa528fa3530c0d0ce011e5c5f6dba3859d7f0

                                                SHA512

                                                7b60c8f52b911cde5fec892015699395ecfdc53f9b0a808d4660ea85844598aec2d93ed049c3880b52a0667a15048c7ebf591f0fc78d4679d9def0f5e94ca886

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

                                                Filesize

                                                2KB

                                                MD5

                                                4677e83279429923a594e48152970398

                                                SHA1

                                                1895a32bb4dae950322311cb2efe10e0fc196d53

                                                SHA256

                                                cd6b9dc5a6b33c79a078204f9dfbf8a4872f60bbb0b1de8f921bcad789798948

                                                SHA512

                                                390878d9ca1d1ae88c1e3c264587c4f508fa880c40c387111e568ab42119eed7d03a80bbf9eb111c40329f683adc4d57eec6b50a07d1e13b2cde9effbcb16707

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                                                Filesize

                                                312B

                                                MD5

                                                0c04ad1083dc5c7c45e3ee2cd344ae38

                                                SHA1

                                                f1cf190f8ca93000e56d49732e9e827e2554c46f

                                                SHA256

                                                6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

                                                SHA512

                                                6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                                                Filesize

                                                424B

                                                MD5

                                                ef6d05f1243987733ca566e64e1d647a

                                                SHA1

                                                65b35ad51b94a8673694903c072dcd199ab8600f

                                                SHA256

                                                6edd46335f840ca162169e6766d7a01a10bdffc77c60185fe775e3c3dcdf6e57

                                                SHA512

                                                7d4aad5a1d98d499d5bda2c2863489b0b8be7385f37d4ec93f0d83046ca9d3adf32a5af19a2a722ad48192e3d785a78501a41ed80d5ee4a1477cbb3cddb39f38

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

                                                Filesize

                                                424B

                                                MD5

                                                439d4e6a07b734ec262050a7113c8b98

                                                SHA1

                                                cb35de864cd0f3dd59d49740326186d41c3d496b

                                                SHA256

                                                6b7cce7c285a1d6244170a84556b4abb8872953f3cfe9e70ca99a382caf4a93d

                                                SHA512

                                                ba6a030596cdd078c568cb8c48026caa767b04ebbad1eb04e1b99bc657f73cf5d11c9add7672ad6cd048ff54d156f92164b84a1530e9816a7232eec12a6f21ff

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                                                Filesize

                                                1KB

                                                MD5

                                                5db1fcd45f9b948993e57756c173907e

                                                SHA1

                                                358c54b7eae659a2b1c21dd7aa5cf35855acf11f

                                                SHA256

                                                0d95073b3d1c5afef02378dbf2596be3f65dbb388005abe66833e3f998d7229c

                                                SHA512

                                                0403c7a8ac468d030215295e472fb07580e2e1d5c14805176b8231d4da0244bbe218238dc95604bb18b3a2d9f6aa83aaa1751c16fe83db5aa7e5d7d44c127462

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                                                Filesize

                                                1KB

                                                MD5

                                                5db1fcd45f9b948993e57756c173907e

                                                SHA1

                                                358c54b7eae659a2b1c21dd7aa5cf35855acf11f

                                                SHA256

                                                0d95073b3d1c5afef02378dbf2596be3f65dbb388005abe66833e3f998d7229c

                                                SHA512

                                                0403c7a8ac468d030215295e472fb07580e2e1d5c14805176b8231d4da0244bbe218238dc95604bb18b3a2d9f6aa83aaa1751c16fe83db5aa7e5d7d44c127462

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                                                Filesize

                                                1KB

                                                MD5

                                                056b1691f5ca79325c72b81ca47d61b8

                                                SHA1

                                                f340c6ac5bc3772130d1c29fd022a18aabd1f875

                                                SHA256

                                                140e4a0baf9cc077475b802251ad85a8fd595478392adfcf88ddfb465873cee9

                                                SHA512

                                                fb6ff3f1a4ebbc8d1f743213fc8f0dca7896f459f16d635f288ba267757361bd799217eb6f19663f023bc4b2286c3212e1a515cce70b32e1d72be62b25131057

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                                                Filesize

                                                1KB

                                                MD5

                                                056b1691f5ca79325c72b81ca47d61b8

                                                SHA1

                                                f340c6ac5bc3772130d1c29fd022a18aabd1f875

                                                SHA256

                                                140e4a0baf9cc077475b802251ad85a8fd595478392adfcf88ddfb465873cee9

                                                SHA512

                                                fb6ff3f1a4ebbc8d1f743213fc8f0dca7896f459f16d635f288ba267757361bd799217eb6f19663f023bc4b2286c3212e1a515cce70b32e1d72be62b25131057

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                                                Filesize

                                                1KB

                                                MD5

                                                056b1691f5ca79325c72b81ca47d61b8

                                                SHA1

                                                f340c6ac5bc3772130d1c29fd022a18aabd1f875

                                                SHA256

                                                140e4a0baf9cc077475b802251ad85a8fd595478392adfcf88ddfb465873cee9

                                                SHA512

                                                fb6ff3f1a4ebbc8d1f743213fc8f0dca7896f459f16d635f288ba267757361bd799217eb6f19663f023bc4b2286c3212e1a515cce70b32e1d72be62b25131057

                                              • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

                                                Filesize

                                                1KB

                                                MD5

                                                358abe004494ec57692ea84fd280ef79

                                                SHA1

                                                4e84e9e0efd32564120f73674341306e01df78e5

                                                SHA256

                                                4f7839558aa3605c2087965896b0f9b4643a54202d80a8e4a140207a676f6361

                                                SHA512

                                                c26bac1cf65b4664de001ab583c5913bb46f7d89f638558ed88f7b45fa85d87ea30f5208b2b23a5c358138a9594d2536f132165b763edb584333ceb0ec529aa9

                                              • C:\Windows\Installer\MSI8496.tmp

                                                Filesize

                                                337KB

                                                MD5

                                                dfe7442a09a0809f22e0806040a0202e

                                                SHA1

                                                e6f76a86fa46e8e2c659c1c326457e6eb6b253f6

                                                SHA256

                                                1cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d

                                                SHA512

                                                331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197

                                              • C:\Windows\Installer\MSI8496.tmp

                                                Filesize

                                                337KB

                                                MD5

                                                dfe7442a09a0809f22e0806040a0202e

                                                SHA1

                                                e6f76a86fa46e8e2c659c1c326457e6eb6b253f6

                                                SHA256

                                                1cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d

                                                SHA512

                                                331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197

                                              • C:\Windows\Installer\MSI87A4.tmp

                                                Filesize

                                                337KB

                                                MD5

                                                dfe7442a09a0809f22e0806040a0202e

                                                SHA1

                                                e6f76a86fa46e8e2c659c1c326457e6eb6b253f6

                                                SHA256

                                                1cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d

                                                SHA512

                                                331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197

                                              • C:\Windows\Installer\MSI87A4.tmp

                                                Filesize

                                                337KB

                                                MD5

                                                dfe7442a09a0809f22e0806040a0202e

                                                SHA1

                                                e6f76a86fa46e8e2c659c1c326457e6eb6b253f6

                                                SHA256

                                                1cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d

                                                SHA512

                                                331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197

                                              • C:\Windows\Installer\MSI87E4.tmp

                                                Filesize

                                                337KB

                                                MD5

                                                dfe7442a09a0809f22e0806040a0202e

                                                SHA1

                                                e6f76a86fa46e8e2c659c1c326457e6eb6b253f6

                                                SHA256

                                                1cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d

                                                SHA512

                                                331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197

                                              • C:\Windows\Installer\MSI87E4.tmp

                                                Filesize

                                                337KB

                                                MD5

                                                dfe7442a09a0809f22e0806040a0202e

                                                SHA1

                                                e6f76a86fa46e8e2c659c1c326457e6eb6b253f6

                                                SHA256

                                                1cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d

                                                SHA512

                                                331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197

                                              • C:\Windows\Installer\MSI8871.tmp

                                                Filesize

                                                611KB

                                                MD5

                                                d8d35c923abf8429b35edcd43fbb803a

                                                SHA1

                                                5184cd865807409c4e9ef0768f58c5fe68d897ff

                                                SHA256

                                                3ab49159965665944c8653c74ad21a4fa2ae807e7c0af6e069e71eae46155070

                                                SHA512

                                                c45f166b0fc04fc1ea6f15294879f2692ea2ed8efb773a57e7a08802824de87ed6d6d28bcd6b723884638450da5e470c9ac703076cd4797de84bc4b7b182a7e6

                                              • C:\Windows\Installer\MSI8871.tmp

                                                Filesize

                                                611KB

                                                MD5

                                                d8d35c923abf8429b35edcd43fbb803a

                                                SHA1

                                                5184cd865807409c4e9ef0768f58c5fe68d897ff

                                                SHA256

                                                3ab49159965665944c8653c74ad21a4fa2ae807e7c0af6e069e71eae46155070

                                                SHA512

                                                c45f166b0fc04fc1ea6f15294879f2692ea2ed8efb773a57e7a08802824de87ed6d6d28bcd6b723884638450da5e470c9ac703076cd4797de84bc4b7b182a7e6

                                              • C:\Windows\Installer\MSI918B.tmp

                                                Filesize

                                                107KB

                                                MD5

                                                47eb3f90716249abe63ae508e1da718a

                                                SHA1

                                                a31d824596f752a5fa613b3f96d19f1eb08f3f77

                                                SHA256

                                                69aeb1df4ddf4147938428839bf8af58bcbfb2eda5ce2cc34d4d2bb769b687ac

                                                SHA512

                                                b0732a8d26b66dc42eb14bb6dadbe865e394cb88154599fdd2590d267b05c9038e1bf1685a39c8930de08126ba9a0cb9b7b20ec69bb805a88ed5f9ba29b1a0a0

                                              • C:\Windows\Installer\MSI95C2.tmp

                                                Filesize

                                                337KB

                                                MD5

                                                dfe7442a09a0809f22e0806040a0202e

                                                SHA1

                                                e6f76a86fa46e8e2c659c1c326457e6eb6b253f6

                                                SHA256

                                                1cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d

                                                SHA512

                                                331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197

                                              • C:\Windows\Installer\MSI95C2.tmp

                                                Filesize

                                                337KB

                                                MD5

                                                dfe7442a09a0809f22e0806040a0202e

                                                SHA1

                                                e6f76a86fa46e8e2c659c1c326457e6eb6b253f6

                                                SHA256

                                                1cd91f56352a68ea6b2fe9f67f42f901b8b741e166c2aa6a3eccc71628ee229d

                                                SHA512

                                                331c295d0caee203ab3e789f5c1060c3c01e99168c44ea33eca5252f3bc2d50e4d7af7dbc7d5f70a4b5fa7c9754dabaa576594b12a68f71bb8e534891045a197

                                              • C:\Windows\Installer\MSI9798.tmp

                                                Filesize

                                                137KB

                                                MD5

                                                5d18d6ef2ea0a99a9a51e7411c74f764

                                                SHA1

                                                d694d2d5d9548b3ed921f5eda9024be5bcff71a3

                                                SHA256

                                                a04899b8472b24e658219a6f7f280d2deda028b440aa261a9f49a0c14ac3830c

                                                SHA512

                                                67d034beef69534cd77d082bee36d5ff2f22a7b194422357461353b491d92bf3be24ef1f58c507a44649f3685e389d57fa23f5baa1ca7314fd9376d878a99d00

                                              • C:\Windows\Installer\MSI9798.tmp

                                                Filesize

                                                137KB

                                                MD5

                                                5d18d6ef2ea0a99a9a51e7411c74f764

                                                SHA1

                                                d694d2d5d9548b3ed921f5eda9024be5bcff71a3

                                                SHA256

                                                a04899b8472b24e658219a6f7f280d2deda028b440aa261a9f49a0c14ac3830c

                                                SHA512

                                                67d034beef69534cd77d082bee36d5ff2f22a7b194422357461353b491d92bf3be24ef1f58c507a44649f3685e389d57fa23f5baa1ca7314fd9376d878a99d00

                                              • C:\Windows\Installer\MSI97C8.tmp

                                                Filesize

                                                177KB

                                                MD5

                                                fec86737e209820ab1d8200164d62c9f

                                                SHA1

                                                a4b22cd2c7c4d40df2e106064ea3bc4108764e5f

                                                SHA256

                                                89bdcea03c659f63f307629e11254191a290f62e05f465245cbae2f37d2bccf1

                                                SHA512

                                                23e31eb641a61fff1c80a8088fa296516e409b099c8643300326611aabbcf333fcc084607a00bf9376dffa7eb3b46c2ef931a8e61ecbb416832b35f02c0ae954

                                              • C:\Windows\Installer\MSI97C8.tmp

                                                Filesize

                                                177KB

                                                MD5

                                                fec86737e209820ab1d8200164d62c9f

                                                SHA1

                                                a4b22cd2c7c4d40df2e106064ea3bc4108764e5f

                                                SHA256

                                                89bdcea03c659f63f307629e11254191a290f62e05f465245cbae2f37d2bccf1

                                                SHA512

                                                23e31eb641a61fff1c80a8088fa296516e409b099c8643300326611aabbcf333fcc084607a00bf9376dffa7eb3b46c2ef931a8e61ecbb416832b35f02c0ae954

                                              • C:\Windows\Installer\MSI9875.tmp

                                                Filesize

                                                477KB

                                                MD5

                                                a267b52453fb899a95b14c8e4dca1073

                                                SHA1

                                                e22e41dc79e782019c7275ed9a76739ee391b17e

                                                SHA256

                                                dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7

                                                SHA512

                                                829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f

                                              • C:\Windows\Installer\MSI9875.tmp

                                                Filesize

                                                477KB

                                                MD5

                                                a267b52453fb899a95b14c8e4dca1073

                                                SHA1

                                                e22e41dc79e782019c7275ed9a76739ee391b17e

                                                SHA256

                                                dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7

                                                SHA512

                                                829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f

                                              • C:\Windows\Installer\MSI9903.tmp

                                                Filesize

                                                477KB

                                                MD5

                                                a267b52453fb899a95b14c8e4dca1073

                                                SHA1

                                                e22e41dc79e782019c7275ed9a76739ee391b17e

                                                SHA256

                                                dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7

                                                SHA512

                                                829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f

                                              • C:\Windows\Installer\MSI9903.tmp

                                                Filesize

                                                477KB

                                                MD5

                                                a267b52453fb899a95b14c8e4dca1073

                                                SHA1

                                                e22e41dc79e782019c7275ed9a76739ee391b17e

                                                SHA256

                                                dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7

                                                SHA512

                                                829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f

                                              • C:\Windows\Installer\MSI99FE.tmp

                                                Filesize

                                                177KB

                                                MD5

                                                fec86737e209820ab1d8200164d62c9f

                                                SHA1

                                                a4b22cd2c7c4d40df2e106064ea3bc4108764e5f

                                                SHA256

                                                89bdcea03c659f63f307629e11254191a290f62e05f465245cbae2f37d2bccf1

                                                SHA512

                                                23e31eb641a61fff1c80a8088fa296516e409b099c8643300326611aabbcf333fcc084607a00bf9376dffa7eb3b46c2ef931a8e61ecbb416832b35f02c0ae954

                                              • C:\Windows\Installer\MSI99FE.tmp

                                                Filesize

                                                177KB

                                                MD5

                                                fec86737e209820ab1d8200164d62c9f

                                                SHA1

                                                a4b22cd2c7c4d40df2e106064ea3bc4108764e5f

                                                SHA256

                                                89bdcea03c659f63f307629e11254191a290f62e05f465245cbae2f37d2bccf1

                                                SHA512

                                                23e31eb641a61fff1c80a8088fa296516e409b099c8643300326611aabbcf333fcc084607a00bf9376dffa7eb3b46c2ef931a8e61ecbb416832b35f02c0ae954

                                              • C:\Windows\Installer\MSI9B18.tmp

                                                Filesize

                                                477KB

                                                MD5

                                                a267b52453fb899a95b14c8e4dca1073

                                                SHA1

                                                e22e41dc79e782019c7275ed9a76739ee391b17e

                                                SHA256

                                                dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7

                                                SHA512

                                                829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f

                                              • C:\Windows\Installer\MSI9B18.tmp

                                                Filesize

                                                477KB

                                                MD5

                                                a267b52453fb899a95b14c8e4dca1073

                                                SHA1

                                                e22e41dc79e782019c7275ed9a76739ee391b17e

                                                SHA256

                                                dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7

                                                SHA512

                                                829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f

                                              • C:\Windows\Installer\MSIDBBC.tmp

                                                Filesize

                                                477KB

                                                MD5

                                                a267b52453fb899a95b14c8e4dca1073

                                                SHA1

                                                e22e41dc79e782019c7275ed9a76739ee391b17e

                                                SHA256

                                                dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7

                                                SHA512

                                                829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f

                                              • C:\Windows\Installer\MSIDBBC.tmp

                                                Filesize

                                                477KB

                                                MD5

                                                a267b52453fb899a95b14c8e4dca1073

                                                SHA1

                                                e22e41dc79e782019c7275ed9a76739ee391b17e

                                                SHA256

                                                dcf5ba5d7d9b4f8eb671d08cc84018f4bc483669cde713385cc8754a862b7cb7

                                                SHA512

                                                829c6e934d2b04d53a16ebf4358f201a37790f8527fb53e02b260488cd306e88fdcba4cde2a6b736950e043810c158c137b027afb39b02b90d8e9801168c0e0f

                                              • C:\Windows\Installer\MSIDD34.tmp

                                                Filesize

                                                107KB

                                                MD5

                                                47eb3f90716249abe63ae508e1da718a

                                                SHA1

                                                a31d824596f752a5fa613b3f96d19f1eb08f3f77

                                                SHA256

                                                69aeb1df4ddf4147938428839bf8af58bcbfb2eda5ce2cc34d4d2bb769b687ac

                                                SHA512

                                                b0732a8d26b66dc42eb14bb6dadbe865e394cb88154599fdd2590d267b05c9038e1bf1685a39c8930de08126ba9a0cb9b7b20ec69bb805a88ed5f9ba29b1a0a0

                                              • C:\Windows\Installer\MSIDD35.tmp

                                                Filesize

                                                107KB

                                                MD5

                                                47eb3f90716249abe63ae508e1da718a

                                                SHA1

                                                a31d824596f752a5fa613b3f96d19f1eb08f3f77

                                                SHA256

                                                69aeb1df4ddf4147938428839bf8af58bcbfb2eda5ce2cc34d4d2bb769b687ac

                                                SHA512

                                                b0732a8d26b66dc42eb14bb6dadbe865e394cb88154599fdd2590d267b05c9038e1bf1685a39c8930de08126ba9a0cb9b7b20ec69bb805a88ed5f9ba29b1a0a0

                                              • memory/2560-245-0x0000000000290000-0x00000000012E9000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/2560-242-0x0000000000290000-0x00000000012E9000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/2560-252-0x0000000000290000-0x00000000012E9000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/2720-249-0x0000000000290000-0x00000000012E9000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/2720-233-0x0000000000290000-0x00000000012E9000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/2720-235-0x0000000000290000-0x00000000012E9000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/3028-241-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/3028-232-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/3028-230-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/3420-201-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/3420-248-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/3420-190-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/3420-221-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/3584-250-0x0000000000290000-0x00000000012E9000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/3584-237-0x0000000000290000-0x00000000012E9000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/3584-239-0x0000000000290000-0x00000000012E9000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/4196-254-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/4196-202-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/4196-222-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/4480-203-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/4480-251-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB

                                              • memory/4480-223-0x0000000000A40000-0x0000000001A99000-memory.dmp

                                                Filesize

                                                16.3MB