a60db9fc0b290f4bea8bc5729b6878d97392156979c1a47498bb27269e16915a

Analysis

max time kernel
155s
max time network
155s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/02/2023, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EpicInstaller-14.2.1.msi
Size

152.5MB
MD5

353c216084477014c75d7d7545bd7353
SHA1

2b6ef6d830e7f0783eadb09d9b6134c91e0163c0
SHA256

a60db9fc0b290f4bea8bc5729b6878d97392156979c1a47498bb27269e16915a
SHA512

83c0ccd20db7b6ddfeed821b763040dbff9b25549ed5d0bf292b7138e1db405432f7a6e7a45ba9c471af7ccef3ba65f43662cbd51b50225aa21e573176cef090
SSDEEP

3145728:2yQOdRG/1UZt0MKOC2HOfiLRNOIflCO6BKiew2WOMVweEL:lqUPrlHROcwO+5z2WOMG

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

flow	pid	Process
2	692	msiexec.exe
4	692	msiexec.exe
6	692	msiexec.exe
8	692	msiexec.exe
12	1572	rundll32.exe
14	1572	rundll32.exe
15	1572	rundll32.exe
19	848	rundll32.exe
22	1592	rundll32.exe
24	608	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation	EpicGamesLauncher.exe

Executes dropped EXE 6 IoCs

pid	Process
880	DXSETUP.exe
1732	InstallChainer.exe
296	EpicOnlineServices.exe
1208	EpicOnlineServicesHost.exe
1780	EpicOnlineServicesUserHelper.exe
1336	EpicGamesLauncher.exe

Loads dropped DLL 64 IoCs

pid	Process
784	MsiExec.exe
784	MsiExec.exe
784	MsiExec.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1980	MsiExec.exe
1980	MsiExec.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1232	MsiExec.exe
1876	rundll32.exe
1876	rundll32.exe
1876	rundll32.exe
1876	rundll32.exe
1876	rundll32.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
880	DXSETUP.exe
1232	MsiExec.exe
1232	MsiExec.exe
1980	MsiExec.exe
1980	MsiExec.exe
1996	rundll32.exe
1996	rundll32.exe
1996	rundll32.exe
1996	rundll32.exe
1996	rundll32.exe
1980	MsiExec.exe
848	rundll32.exe
848	rundll32.exe
848	rundll32.exe
848	rundll32.exe
848	rundll32.exe
1980	MsiExec.exe
1732	InstallChainer.exe
1732	InstallChainer.exe
1980	MsiExec.exe
1704	rundll32.exe
1704	rundll32.exe
1704	rundll32.exe
1704	rundll32.exe
1704	rundll32.exe
1980	MsiExec.exe
1888	rundll32.exe
1888	rundll32.exe
1888	rundll32.exe
1888	rundll32.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1812	icacls.exe
1296	icacls.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SET5FDD.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET609A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dx11_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dcsx_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET5FDD.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET605A.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET609A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET60E9.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET6147.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET605A.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET60E9.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET6147.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	DXSETUP.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\curr\ms_Latn.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\khq.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\bs_Latn.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\NoiseBackground.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\ms.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\fr_NE.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\zone\guz.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Selection.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\en_GY.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\lang\br.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\ar_YE.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\lang\kn.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\zh_Hans_CN.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Binaries\Win32\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\fr_DZ.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\region\en_LS.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\rbnf\en.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\region\tl.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\service\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\mg_MG.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\curr\vun.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\curr\en_IO.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\epic_logo_filled_white.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\region\sr_Cyrl_XK.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\lang\bm.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\curr\fr_MG.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\api-ms-win-core-debug-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\mk.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\en_VC.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\Localization\App\zh-Hant\App.locres	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\curr\nmg.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\en_CC.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\CheckBox_Checked.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\curr\de_CH.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\ms_SG.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\region\en_TZ.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\mg.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Slate\Icons\icon_help_16x.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\ko_KR.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\curr\fr_DJ.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\es_EA.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\fi.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\region\dav.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\region\vi.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\en_BM.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\curr\ug_CN.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\CEF\Win32\Resources\locales\ca.pak	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\curr\en_LC.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\curr\en_LS.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\mua_CM.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\en_PN.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\lang\en_IN.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\region\en_BE.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\curr\en_BB.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\lang\mfe.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\rbnf\ky.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\settings_button_border.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\curr\nl_AW.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\region\en_SG.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\my_MM.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\ro_MD.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\zone\en_NG.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt53l\zone\ug_Arab.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt53l\curr\tzm_Latn.res	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI9F2C.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC17D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC597.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\6c58c3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI627E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\6c58bc.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B2E53202F9E1D3742A512B64F7F1603E\1.3.51\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E59.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA27.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA3EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FD8.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA3EE.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1C70.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI26CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA27.tmp	msiexec.exe
File created	C:\Windows\Installer\6c58be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DD3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3EE.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8D08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA27.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\6c58bf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DD3.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9F2C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3EE.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2911.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B2E53202F9E1D3742A512B64F7F1603E\1.3.51\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B2E53202F9E1D3742A512B64F7F1603E\1.3.51\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E59.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6E59.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2911.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5E39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI627E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9F2C.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC597.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{19695986-25CE-41AC-9C6F-54794653EDBA}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA27.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6BF7.tmp-\CustomActionManaged.dll	rundll32.exe
File created	C:\Windows\Installer\6c58bf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC597.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI26CF.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2911.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI627E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI627E.tmp-\CustomActionManaged.dll	rundll32.exe
File created	C:\Windows\Installer\{20235E2B-1E9F-473D-A215-B2467F1F06E3}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC597.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\6c58c1.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC518.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF06.tmp	msiexec.exe
File created	C:\Windows\Installer\{19695986-25CE-41AC-9C6F-54794653EDBA}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{20235E2B-1E9F-473D-A215-B2467F1F06E3}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\6c58bc.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BF7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E59.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC278.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C70.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\6c58bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c58bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6734.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BB8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2911.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DD3.tmp-\CustomAction.config	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rundll32.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Epic Games\Unreal Engine\Identifiers\MachineId = "07CE1D43463F90EA8D7E92BB50B96145"	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Epic Games\Unreal Engine	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Epic Games\Unreal Engine\Identifiers	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\SourceList\Net\1 = "C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Extras\\EOS\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell\open\command	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B2E53202F9E1D3742A512B64F7F1603E\VCRedist	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\SourceList\PackageName = "EpicOnlineServices.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\DefaultIcon	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\44F9670D954DF0540B48AC3E08267CB5\B2E53202F9E1D3742A512B64F7F1603E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\PackageCode = "16FEBE41519DB844C989654416C8A83E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\classes\com.epicgames.eos	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\DefaultIcon\ = "C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Binaries\\Win32\\EpicGamesLauncher.exe,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2BCFAA43FBEEC904B97FAF707FE4CEEA\68959691EC52CA14C9F645976435DEAB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B2E53202F9E1D3742A512B64F7F1603E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\ = "Epic Online Services Link"	EpicOnlineServicesUserHelper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\ = "open"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open\command\ = "\"C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Binaries\\Win32\\EpicGamesLauncher.exe\" %1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\DefaultIcon\ = "\"C:\\Program Files (x86)\\Epic Games\\Epic Online Services\\EpicOnlineServicesUserHelper.exe\",1"	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\ = "Epic Games Launcher Link"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\PackageCode = "6CFC1CFF01546914288211B7621F0B37"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B2E53202F9E1D3742A512B64F7F1603E\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\44F9670D954DF0540B48AC3E08267CB5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell\open	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell\open\command\ = "\"C:\\Program Files (x86)\\Epic Games\\Epic Online Services\\EpicOnlineServicesUserHelper.exe\" %1"	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\URL Protocol	EpicOnlineServicesUserHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\Version = "16973875"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\68959691EC52CA14C9F645976435DEAB\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2BCFAA43FBEEC904B97FAF707FE4CEEA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\Version = "33554468"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68959691EC52CA14C9F645976435DEAB\ProductIcon = "C:\\Windows\\Installer\\{19695986-25CE-41AC-9C6F-54794653EDBA}\\Installer.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell\ = "open"	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\ProductName = "Epic Games Launcher"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B2E53202F9E1D3742A512B64F7F1603E\ProductIcon = "C:\\Windows\\Installer\\{20235E2B-1E9F-473D-A215-B2467F1F06E3}\\Installer.ico"	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1980	MsiExec.exe
1980	MsiExec.exe
1980	MsiExec.exe
580	msiexec.exe
580	msiexec.exe
580	msiexec.exe
580	msiexec.exe
580	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	692	msiexec.exe
Token: SeRestorePrivilege	580	msiexec.exe
Token: SeTakeOwnershipPrivilege	580	msiexec.exe
Token: SeSecurityPrivilege	580	msiexec.exe
Token: SeCreateTokenPrivilege	692	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	692	msiexec.exe
Token: SeLockMemoryPrivilege	692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	692	msiexec.exe
Token: SeMachineAccountPrivilege	692	msiexec.exe
Token: SeTcbPrivilege	692	msiexec.exe
Token: SeSecurityPrivilege	692	msiexec.exe
Token: SeTakeOwnershipPrivilege	692	msiexec.exe
Token: SeLoadDriverPrivilege	692	msiexec.exe
Token: SeSystemProfilePrivilege	692	msiexec.exe
Token: SeSystemtimePrivilege	692	msiexec.exe
Token: SeProfSingleProcessPrivilege	692	msiexec.exe
Token: SeIncBasePriorityPrivilege	692	msiexec.exe
Token: SeCreatePagefilePrivilege	692	msiexec.exe
Token: SeCreatePermanentPrivilege	692	msiexec.exe
Token: SeBackupPrivilege	692	msiexec.exe
Token: SeRestorePrivilege	692	msiexec.exe
Token: SeShutdownPrivilege	692	msiexec.exe
Token: SeDebugPrivilege	692	msiexec.exe
Token: SeAuditPrivilege	692	msiexec.exe
Token: SeSystemEnvironmentPrivilege	692	msiexec.exe
Token: SeChangeNotifyPrivilege	692	msiexec.exe
Token: SeRemoteShutdownPrivilege	692	msiexec.exe
Token: SeUndockPrivilege	692	msiexec.exe
Token: SeSyncAgentPrivilege	692	msiexec.exe
Token: SeEnableDelegationPrivilege	692	msiexec.exe
Token: SeManageVolumePrivilege	692	msiexec.exe
Token: SeImpersonatePrivilege	692	msiexec.exe
Token: SeCreateGlobalPrivilege	692	msiexec.exe
Token: SeCreateTokenPrivilege	692	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	692	msiexec.exe
Token: SeLockMemoryPrivilege	692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	692	msiexec.exe
Token: SeMachineAccountPrivilege	692	msiexec.exe
Token: SeTcbPrivilege	692	msiexec.exe
Token: SeSecurityPrivilege	692	msiexec.exe
Token: SeTakeOwnershipPrivilege	692	msiexec.exe
Token: SeLoadDriverPrivilege	692	msiexec.exe
Token: SeSystemProfilePrivilege	692	msiexec.exe
Token: SeSystemtimePrivilege	692	msiexec.exe
Token: SeProfSingleProcessPrivilege	692	msiexec.exe
Token: SeIncBasePriorityPrivilege	692	msiexec.exe
Token: SeCreatePagefilePrivilege	692	msiexec.exe
Token: SeCreatePermanentPrivilege	692	msiexec.exe
Token: SeBackupPrivilege	692	msiexec.exe
Token: SeRestorePrivilege	692	msiexec.exe
Token: SeShutdownPrivilege	692	msiexec.exe
Token: SeDebugPrivilege	692	msiexec.exe
Token: SeAuditPrivilege	692	msiexec.exe
Token: SeSystemEnvironmentPrivilege	692	msiexec.exe
Token: SeChangeNotifyPrivilege	692	msiexec.exe
Token: SeRemoteShutdownPrivilege	692	msiexec.exe
Token: SeUndockPrivilege	692	msiexec.exe
Token: SeSyncAgentPrivilege	692	msiexec.exe
Token: SeEnableDelegationPrivilege	692	msiexec.exe
Token: SeManageVolumePrivilege	692	msiexec.exe
Token: SeImpersonatePrivilege	692	msiexec.exe
Token: SeCreateGlobalPrivilege	692	msiexec.exe
Token: SeCreateTokenPrivilege	692	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
692	msiexec.exe
692	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 784	580	msiexec.exe	28
PID 580 wrote to memory of 784	580	msiexec.exe	28
PID 580 wrote to memory of 784	580	msiexec.exe	28
PID 580 wrote to memory of 784	580	msiexec.exe	28
PID 580 wrote to memory of 784	580	msiexec.exe	28
PID 580 wrote to memory of 784	580	msiexec.exe	28
PID 580 wrote to memory of 784	580	msiexec.exe	28
PID 784 wrote to memory of 1944	784	MsiExec.exe	29
PID 784 wrote to memory of 1944	784	MsiExec.exe	29
PID 784 wrote to memory of 1944	784	MsiExec.exe	29
PID 784 wrote to memory of 1944	784	MsiExec.exe	29
PID 784 wrote to memory of 1944	784	MsiExec.exe	29
PID 784 wrote to memory of 1944	784	MsiExec.exe	29
PID 784 wrote to memory of 1944	784	MsiExec.exe	29
PID 580 wrote to memory of 1980	580	msiexec.exe	30
PID 580 wrote to memory of 1980	580	msiexec.exe	30
PID 580 wrote to memory of 1980	580	msiexec.exe	30
PID 580 wrote to memory of 1980	580	msiexec.exe	30
PID 580 wrote to memory of 1980	580	msiexec.exe	30
PID 580 wrote to memory of 1980	580	msiexec.exe	30
PID 580 wrote to memory of 1980	580	msiexec.exe	30
PID 1980 wrote to memory of 1572	1980	MsiExec.exe	31
PID 1980 wrote to memory of 1572	1980	MsiExec.exe	31
PID 1980 wrote to memory of 1572	1980	MsiExec.exe	31
PID 1980 wrote to memory of 1572	1980	MsiExec.exe	31
PID 1980 wrote to memory of 1572	1980	MsiExec.exe	31
PID 1980 wrote to memory of 1572	1980	MsiExec.exe	31
PID 1980 wrote to memory of 1572	1980	MsiExec.exe	31
PID 580 wrote to memory of 1232	580	msiexec.exe	32
PID 580 wrote to memory of 1232	580	msiexec.exe	32
PID 580 wrote to memory of 1232	580	msiexec.exe	32
PID 580 wrote to memory of 1232	580	msiexec.exe	32
PID 580 wrote to memory of 1232	580	msiexec.exe	32
PID 580 wrote to memory of 1232	580	msiexec.exe	32
PID 580 wrote to memory of 1232	580	msiexec.exe	32
PID 1232 wrote to memory of 1876	1232	MsiExec.exe	33
PID 1232 wrote to memory of 1876	1232	MsiExec.exe	33
PID 1232 wrote to memory of 1876	1232	MsiExec.exe	33
PID 1232 wrote to memory of 1876	1232	MsiExec.exe	33
PID 1232 wrote to memory of 1876	1232	MsiExec.exe	33
PID 1232 wrote to memory of 1876	1232	MsiExec.exe	33
PID 1232 wrote to memory of 1876	1232	MsiExec.exe	33
PID 580 wrote to memory of 880	580	msiexec.exe	35
PID 580 wrote to memory of 880	580	msiexec.exe	35
PID 580 wrote to memory of 880	580	msiexec.exe	35
PID 580 wrote to memory of 880	580	msiexec.exe	35
PID 580 wrote to memory of 880	580	msiexec.exe	35
PID 580 wrote to memory of 880	580	msiexec.exe	35
PID 580 wrote to memory of 880	580	msiexec.exe	35
PID 1232 wrote to memory of 1296	1232	MsiExec.exe	40
PID 1232 wrote to memory of 1296	1232	MsiExec.exe	40
PID 1232 wrote to memory of 1296	1232	MsiExec.exe	40
PID 1232 wrote to memory of 1296	1232	MsiExec.exe	40
PID 1232 wrote to memory of 1812	1232	MsiExec.exe	42
PID 1232 wrote to memory of 1812	1232	MsiExec.exe	42
PID 1232 wrote to memory of 1812	1232	MsiExec.exe	42
PID 1232 wrote to memory of 1812	1232	MsiExec.exe	42
PID 1980 wrote to memory of 1996	1980	MsiExec.exe	45
PID 1980 wrote to memory of 1996	1980	MsiExec.exe	45
PID 1980 wrote to memory of 1996	1980	MsiExec.exe	45
PID 1980 wrote to memory of 1996	1980	MsiExec.exe	45
PID 1980 wrote to memory of 1996	1980	MsiExec.exe	45
PID 1980 wrote to memory of 1996	1980	MsiExec.exe	45
PID 1980 wrote to memory of 1996	1980	MsiExec.exe	45

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EpicInstaller-14.2.1.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:692

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 46B2275F2EB6245CA781A4275E51F4C7 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5340.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7099246 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength
    3⤵
    - Loads dropped DLL
    PID:1944
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 05B67DF1A10356A7A367A44FDDF5C4DB
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI627E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7103162 9 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Modifies system certificate store
    PID:1572
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6BF7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7171069 36 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1996
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6E59.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7171693 42 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendEnd
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Modifies system certificate store
    PID:848
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9DD3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7183830 50 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherEpicGamesDirLoc
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1704
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9F2C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7184158 56 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherInstallDirLoc
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1888
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9FD8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7184329 62 CustomActionManaged!CustomActionManaged.CustomActions.SetServiceWrapperDirLoc
    3⤵
    - Drops file in Windows directory
    PID:1668
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA3EE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7185390 68 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:1592
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2911.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7219461 253 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:608
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CE71C04DE9DED922E93D595CC176DF56 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIEA27.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7137950 17 CustomActionManaged!CustomActionManaged.CustomActions.MoveChainerToFolder
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1876
- - C:\Windows\syswow64\icacls.exe
    "icacls.exe" "C:\Program Files (x86)\Epic Games\Launcher" /grant "BUILTIN\Users":(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:1296
- - C:\Windows\syswow64\icacls.exe
    "icacls.exe" "C:\ProgramData\Epic" /grant "BUILTIN\Users":(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:1812
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC597.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7194001 90 CustomActionManaged!CustomActionManaged.CustomActions.RegisterProductID
    3⤵
    - Drops file in Windows directory
    PID:1392
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1B46.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7216013 101 CustomActionManaged!CustomActionManaged.CustomActions.CopyServiceWrapper
    3⤵
    PID:1332
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1C70.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7216216 109 CustomActionManaged!CustomActionManaged.CustomActions.CreateRegistryKeys
    3⤵
    - Drops file in Windows directory
    PID:1612
- - C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServices.exe
    "C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServices.exe" --runApplication=createConfig
    3⤵
    - Executes dropped EXE
    PID:296
- - C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe
    "C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe" install
    3⤵
    - Executes dropped EXE
    PID:1208
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI26CF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7218868 246 CustomActionManaged!CustomActionManaged.CustomActions.ExecuteComponents
    3⤵
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:1520
  - - C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServicesUserHelper.exe
      "C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServicesUserHelper.exe" --setup
      4⤵
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:1780
- C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
  "C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:880
- C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe
  "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe" 30 "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\EpicOnlineServices.msi" "EOSPRODUCTID=EpicGamesLauncher" "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1732
- - C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe
    "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1620

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000060" "000000000000031C"
1⤵
- Modifies data under HKEY_USERS
PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\EPICGA~1\DIRECT~1\Apr2007_xinput_x86.cab

Filesize
52KB

MD5
c234df417c9b12e2d31c7fd1e17e4786

SHA1
92f32e74944e5166db72d3bfe8e6401d9f7521dd

SHA256
2acea6c8b9f6f7f89ec51365a1e49fbd0d8c42c53418bd0783dbf3f74a744e6d

SHA512
6cbae19794533ad9401f92b10bd9549638ba20ce38375de4f9d0e20af20d78819e46856151cc6818325af9ac774b8128e18fbebd2da5da4efbd417fc2af51dab

Download Submit
C:\PROGRA~2\EPICGA~1\DIRECT~1\Jun2010_D3DCompiler_43_x86.cab

Filesize
909KB

MD5
f7f554aa613eccf065575b8c69717ef7

SHA1
8417886d47c19cf6892f4080ddd5aaa1a49db3e9

SHA256
417eebd5b19f45c67c94c2d2ba8b774c0fc6d958b896d7b1ac12cf5a0ea06e0e

SHA512
618f6dbb5bd9d44a8f10d119f5ef644f168fe3d8db986994e8cce31d1f11ff9ac872b389d1f218a82ff8b397bface587f97ca21e8f77433dbadb2ac475e9e6c1

Download Submit
C:\PROGRA~2\EPICGA~1\DIRECT~1\Jun2010_d3dcsx_43_x86.cab

Filesize
744KB

MD5
44dba9557f956787b66f285776c3dccb

SHA1
4560c64f8b6bbdeedd85398f2e18404c389e4d8b

SHA256
e2c5a2cbba7f211b6ca72ff8e5f69cba1f83be06357311b19e64f582fd3d14e4

SHA512
25fbc95346bac890fee8d2a0805015af1eda5e0bb17b12d4eef52ca446775d08898fe5c13239e983a0f8c8dd13f8f2a5247a70e8e785e2bae42ff5ab1cca4156

Download Submit
C:\PROGRA~2\EPICGA~1\DIRECT~1\Jun2010_d3dx10_43_x86.cab

Filesize
192KB

MD5
a89b98ab89e0d4ff9dae412d49e27c51

SHA1
18803d4bcc83ad39f25ff9f899baf136c89c10f1

SHA256
a8cf71ffb80b683616d0621be96d3795b0ffda3877ed2d80cd958bfa393ddcfc

SHA512
0b96a04663d2fbfb21901af832a5362785fb0270d1be0ef136549f07e2625653f8facd129889a5f3489fc8a1270abe474e4f1626ea630a3185a36812545b4dfd

Download Submit
C:\PROGRA~2\EPICGA~1\DIRECT~1\Jun2010_d3dx11_43_x86.cab

Filesize
106KB

MD5
758c5a459978cb2c68a300a60da153be

SHA1
66d12509137f2b5e1a668df39e6ccce6402822c3

SHA256
a58cefe822e371d078eaf89319f832693352ba7d62079320074397f0f3425961

SHA512
f33d6fd3354310e6cc4b483eae955a9652e7f71ceef7c444bdef84251ffa6ec0b89886a2344d18e0a1ad5285123ad808904372289e1e1c8d14242483f0426588

Download Submit
C:\PROGRA~2\EPICGA~1\DIRECT~1\dxupdate.cab

Filesize
94KB

MD5
d495680aba28caafc4c071a6d0fe55ac

SHA1
5885ece90970eb10b6b95d6c52d934674835929e

SHA256
e18a5404b612e88fa8b403c9b33f064c0a89528db7ef9a79aa116908d0e6afed

SHA512
a25c647678661473b99462d7433c1d05af54823d404476e35315c11c93b3f5ece92c912560af0d9efe8f07e36ae68594362d73abf5d5de409a3f0a146fe31a10

Download Submit
C:\Program Files (x86)\Epic Games\DirectXRedist\DSETUP32.DLL

Filesize
1.5MB

MD5
d8fa7bb4fe10251a239ed75055dd6f73

SHA1
76c4bd2d8f359f7689415efc15e3743d35673ae8

SHA256
fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8

SHA512
73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4

Download Submit
C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe

Filesize
505KB

MD5
bf3f290275c21bdd3951955c9c3cf32c

SHA1
9fd00f3bb8a870112dae464f555fcd5e7f9200c0

SHA256
8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d

SHA512
d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249

Download Submit
C:\Program Files (x86)\Epic Games\DirectXRedist\dsetup.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\ThirdParty\NVIDIA\GeForceNOW\Win32\GfnRuntimeSdk.dll

Filesize
2.5MB

MD5
774dfeeab631f7f868b633b801c7221c

SHA1
5b86a6c82d7f745b728f49eb32acc00a6f7c9264

SHA256
46d618f9a23cf39c692471178f66ba08a687134a1a3eab4541fb121bf9810fa5

SHA512
2c7bc917079a7c0707bbfaf682994506eaa67311a49c96b0fd3431fe9c308bb12ff2561587318345e909a2d78e3f07860eb9071f224366f2c7f304615117740e

Download Submit
C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\ThirdParty\Windows\DirectX\x86\d3dcompiler_47.dll

Filesize
3.5MB

MD5
826cbc07958f18c4f9a5543d639dd0bf

SHA1
13d7b00b6c91c1481c8715aa8df5e7337a220b92

SHA256
060adc3f7c56c7c3ace3465bf979202538fd9decd15a7aa640d6994f014384da

SHA512
287f5e130dee1004fe105293372de912a63601deb36e6302e32b7fe1118ed42f5786b6f9190d08b4303bfc457aba0da9e69e844ca0d1bfefb61fc4ef6756f4dc

Download Submit
C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\EpicOnlineServices.msi

Filesize
108.8MB

MD5
2517299fa67020242316c30d31ae403b

SHA1
086d3fad252eda34c1db0d0ccedb2dd4ba2f9f2c

SHA256
f84c094771e050afe3afd0df3a08acba60bfa15b817ed9c44d777135674bebf2

SHA512
9a965e5537c960cb25dfa592fc832f379dc4ee9db069ba44c6404f99b8844fe19bd43523fc5d1745b73203c8a77f7f19d85b608e2ba2241d9b393f9cd9e7b7a2

Download Submit
C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe

Filesize
23KB

MD5
6d3402381c582403a16d4512e0323bf3

SHA1
454298d8983b713e0b1f846032088d62dd33a24b

SHA256
a73cd264fe588e6c16ef8d07de89138752a184e7496022a267e8857c5ddf55b2

SHA512
d0a4aed8706a61e39c649a5842f50fe670b950f73ce700d1fc7b39b712ef71e879b363452211ba61ebb6e9be7aa0203fd93f8f38d33f43fea0c60d03136a0134

Download Submit
C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\Microsoft.Deployment.WindowsInstaller.dll

Filesize
186KB

MD5
86237f12122e1b080a03b99c286b13f2

SHA1
ee936a265036af23b44f67db86de4049e28e3e85

SHA256
b7badf9d9a294b9e4123e562cdc41b6f45277d4d92b8d45fc0a51930e6e73c31

SHA512
3dbcd43f1362aa465f9fec2543eb1d560bc7d9d0870873ed4f53903534f416c80b37af742efc707e80f3559f1d4ee8b34ca9e1fc6c7ba8e4e5c017bc8e7d2ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
1373b57a94fac3d77b9d2c6289ed2cca

SHA1
b1c5e5cc9fb8ba841ea54b479b13adabb74ca52e

SHA256
8b08dfe356c4f5991477ab12818a8e5236834db01c96cb10ee1398e1763c5ed4

SHA512
2844d21f4fd6bdcd7ed94bc844e5964affaffe926e8058f60b1449d718f68734dd1f854b216954e8a3d1d354accab4ad5a9f004437b062f2669431187625149c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_9040490E275779DE86373A998E4711FB

Filesize
471B

MD5
63398409317791bdf1cd51662052fdbc

SHA1
cd163f857ddb893dd1ae450acfde5b4ec8760b36

SHA256
2184d2ed4ea779ed4ad47dcb0775fedb5fe2bc94757cd2b0450c7d6925b291b2

SHA512
494d311f0baff8005c98bf058948eb7aa6ca2f0e60d27d61d9c149224dd023056d594a8d2dd369e79c72c74240aace2a8799569dbab0b79e2313c0be08155385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
434B

MD5
8593acd3c98ef9508b6fe0a81526989d

SHA1
17affd23808ffead6c506b50df484489eea99604

SHA256
5d91c8a6ef8d9b4ed428abff37b02d21d32c4db745f45941ecceba1b5493140b

SHA512
8858e286d36ad3b9935f3899c9b49c53a2107d4430b9cfa264e463e7823844aabd798ca91839ad2be092a29bc9fefd356b702117d0be42a558be5db7dd63c153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_9040490E275779DE86373A998E4711FB

Filesize
434B

MD5
dd0f14ffa0bc17022c96a051fec6d6e7

SHA1
1324dd34b800385c295a1e5b0daf88e33bdfdbd8

SHA256
b4ded6df5a4e553d2b52c1e8211db653796911e97f8c29abfd315fa0ec098ee1

SHA512
7d39af8d431ef724c9976012157ddefdd8f41cf0e43071cc083a662e09f23606bea354e43a0d6f77a9e85c3d01a9a5d9a1e8489783fa214050e5f0e045dd3135

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c50fe1cf0e3fcf308dc4b1702913f277

SHA1
f6f8087183bf207b3944c201dadc24c2e154cdea

SHA256
5068e0041e73f6724b02b5ea7ff2943e1b1aca8857ce64a6db4e22a5bd8c23f2

SHA512
c4dea0281393381e03babc921dfb2f2f3f4bbd8ac317e6753506f692c9d200ff20dc64cd1cd59dbba0937aded0e8ec823e293c439df994917c57f23dc0baa40c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8b5d5da6b7417998c99fdcf9abfb015

SHA1
f32912469c0202ffd18b8137e84ab2f9afeea1a1

SHA256
e990c3788e6c0b88015f3629a2db436b64abc9c5a90736e6a796723d51cf4327

SHA512
aece86ae39da3cac954ba8fc0bb034044012081336fb5845c7c83249548d5255ec93547e560185579d9ac4fc289bc9610e495c28593487eeea28ef84e3597f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI472D.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5310.tmp

Filesize
113KB

MD5
4fdd16752561cf585fed1506914d73e0

SHA1
f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

SHA256
aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

SHA512
3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5340.tmp

Filesize
253KB

MD5
97cfbae35edf3dcaf1fa8631ade54def

SHA1
6f4a6813495544dcbf4a07d1bb1d0234845c3371

SHA256
604d6d98f1d084aa35a6029f14c4732cbecc220581de0f76f2eea462381ffa11

SHA512
13575188caa78c1916a3b3ecaf60ba2e1eb49dd5c4bac55eae0f672e6591b944c189944748fc59c53c687d9db6a2eb7ad0b1835e257f985d4a1a688f8724b967

Download Submit
C:\Windows\Installer\MSI5E39.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI627E.tmp

Filesize
253KB

MD5
97cfbae35edf3dcaf1fa8631ade54def

SHA1
6f4a6813495544dcbf4a07d1bb1d0234845c3371

SHA256
604d6d98f1d084aa35a6029f14c4732cbecc220581de0f76f2eea462381ffa11

SHA512
13575188caa78c1916a3b3ecaf60ba2e1eb49dd5c4bac55eae0f672e6591b944c189944748fc59c53c687d9db6a2eb7ad0b1835e257f985d4a1a688f8724b967

Download Submit
C:\Windows\Installer\MSI6734.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIEA27.tmp

Filesize
253KB

MD5
97cfbae35edf3dcaf1fa8631ade54def

SHA1
6f4a6813495544dcbf4a07d1bb1d0234845c3371

SHA256
604d6d98f1d084aa35a6029f14c4732cbecc220581de0f76f2eea462381ffa11

SHA512
13575188caa78c1916a3b3ecaf60ba2e1eb49dd5c4bac55eae0f672e6591b944c189944748fc59c53c687d9db6a2eb7ad0b1835e257f985d4a1a688f8724b967

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\DSETUP.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
\Program Files (x86)\Epic Games\DirectXRedist\dsetup32.dll

Filesize
1.5MB

MD5
d8fa7bb4fe10251a239ed75055dd6f73

SHA1
76c4bd2d8f359f7689415efc15e3743d35673ae8

SHA256
fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8

SHA512
73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4

Download Submit
\Users\Admin\AppData\Local\Temp\DX5CB1.tmp\dxupdate.dll

Filesize
173KB

MD5
7ed554b08e5b69578f9de012822c39c9

SHA1
036d04513e134786b4758def5aff83d19bf50c6e

SHA256
fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

SHA512
7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

Download Submit
\Users\Admin\AppData\Local\Temp\DX5CB1.tmp\dxupdate.dll

Filesize
173KB

MD5
7ed554b08e5b69578f9de012822c39c9

SHA1
036d04513e134786b4758def5aff83d19bf50c6e

SHA256
fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

SHA512
7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

Download Submit
\Users\Admin\AppData\Local\Temp\MSI472D.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5310.tmp

Filesize
113KB

MD5
4fdd16752561cf585fed1506914d73e0

SHA1
f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

SHA256
aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

SHA512
3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5340.tmp

Filesize
253KB

MD5
97cfbae35edf3dcaf1fa8631ade54def

SHA1
6f4a6813495544dcbf4a07d1bb1d0234845c3371

SHA256
604d6d98f1d084aa35a6029f14c4732cbecc220581de0f76f2eea462381ffa11

SHA512
13575188caa78c1916a3b3ecaf60ba2e1eb49dd5c4bac55eae0f672e6591b944c189944748fc59c53c687d9db6a2eb7ad0b1835e257f985d4a1a688f8724b967

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5340.tmp

Filesize
253KB

MD5
97cfbae35edf3dcaf1fa8631ade54def

SHA1
6f4a6813495544dcbf4a07d1bb1d0234845c3371

SHA256
604d6d98f1d084aa35a6029f14c4732cbecc220581de0f76f2eea462381ffa11

SHA512
13575188caa78c1916a3b3ecaf60ba2e1eb49dd5c4bac55eae0f672e6591b944c189944748fc59c53c687d9db6a2eb7ad0b1835e257f985d4a1a688f8724b967

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5340.tmp-\CustomActionManaged.dll

Filesize
34KB

MD5
ae28aacfd5a0fad37e9ecd641ed2fec5

SHA1
9c5332e427b3169c48228e12ea2bfe0fda080f8f

SHA256
d3201d9c514b87b6314f9b49d7e54ebfd32db16000488536b16b34c0f6ec8e75

SHA512
dbce3fa360bcd6acbf4ce19399c68663a0b3e9a8b1671e76d5f4192b2fc90d56eea8e0336898d42fe5e5be74ce3739d6e14296741bbf40060c53945b36394f22

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5340.tmp-\CustomActionManaged.dll

Filesize
34KB

MD5
ae28aacfd5a0fad37e9ecd641ed2fec5

SHA1
9c5332e427b3169c48228e12ea2bfe0fda080f8f

SHA256
d3201d9c514b87b6314f9b49d7e54ebfd32db16000488536b16b34c0f6ec8e75

SHA512
dbce3fa360bcd6acbf4ce19399c68663a0b3e9a8b1671e76d5f4192b2fc90d56eea8e0336898d42fe5e5be74ce3739d6e14296741bbf40060c53945b36394f22

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5340.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5340.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSI5E39.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
\Windows\Installer\MSI627E.tmp

Filesize
253KB

MD5
97cfbae35edf3dcaf1fa8631ade54def

SHA1
6f4a6813495544dcbf4a07d1bb1d0234845c3371

SHA256
604d6d98f1d084aa35a6029f14c4732cbecc220581de0f76f2eea462381ffa11

SHA512
13575188caa78c1916a3b3ecaf60ba2e1eb49dd5c4bac55eae0f672e6591b944c189944748fc59c53c687d9db6a2eb7ad0b1835e257f985d4a1a688f8724b967

Download Submit
\Windows\Installer\MSI627E.tmp

Filesize
253KB

MD5
97cfbae35edf3dcaf1fa8631ade54def

SHA1
6f4a6813495544dcbf4a07d1bb1d0234845c3371

SHA256
604d6d98f1d084aa35a6029f14c4732cbecc220581de0f76f2eea462381ffa11

SHA512
13575188caa78c1916a3b3ecaf60ba2e1eb49dd5c4bac55eae0f672e6591b944c189944748fc59c53c687d9db6a2eb7ad0b1835e257f985d4a1a688f8724b967

Download Submit
\Windows\Installer\MSI627E.tmp-\CustomActionManaged.dll

Filesize
34KB

MD5
ae28aacfd5a0fad37e9ecd641ed2fec5

SHA1
9c5332e427b3169c48228e12ea2bfe0fda080f8f

SHA256
d3201d9c514b87b6314f9b49d7e54ebfd32db16000488536b16b34c0f6ec8e75

SHA512
dbce3fa360bcd6acbf4ce19399c68663a0b3e9a8b1671e76d5f4192b2fc90d56eea8e0336898d42fe5e5be74ce3739d6e14296741bbf40060c53945b36394f22

Download Submit
\Windows\Installer\MSI627E.tmp-\CustomActionManaged.dll

Filesize
34KB

MD5
ae28aacfd5a0fad37e9ecd641ed2fec5

SHA1
9c5332e427b3169c48228e12ea2bfe0fda080f8f

SHA256
d3201d9c514b87b6314f9b49d7e54ebfd32db16000488536b16b34c0f6ec8e75

SHA512
dbce3fa360bcd6acbf4ce19399c68663a0b3e9a8b1671e76d5f4192b2fc90d56eea8e0336898d42fe5e5be74ce3739d6e14296741bbf40060c53945b36394f22

Download Submit
\Windows\Installer\MSI627E.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSI627E.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSI6734.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
\Windows\Installer\MSIEA27.tmp

Filesize
253KB

MD5
97cfbae35edf3dcaf1fa8631ade54def

SHA1
6f4a6813495544dcbf4a07d1bb1d0234845c3371

SHA256
604d6d98f1d084aa35a6029f14c4732cbecc220581de0f76f2eea462381ffa11

SHA512
13575188caa78c1916a3b3ecaf60ba2e1eb49dd5c4bac55eae0f672e6591b944c189944748fc59c53c687d9db6a2eb7ad0b1835e257f985d4a1a688f8724b967

Download Submit
\Windows\Installer\MSIEA27.tmp

Filesize
253KB

MD5
97cfbae35edf3dcaf1fa8631ade54def

SHA1
6f4a6813495544dcbf4a07d1bb1d0234845c3371

SHA256
604d6d98f1d084aa35a6029f14c4732cbecc220581de0f76f2eea462381ffa11

SHA512
13575188caa78c1916a3b3ecaf60ba2e1eb49dd5c4bac55eae0f672e6591b944c189944748fc59c53c687d9db6a2eb7ad0b1835e257f985d4a1a688f8724b967

Download Submit
\Windows\Installer\MSIEA27.tmp-\CustomActionManaged.dll

Filesize
34KB

MD5
ae28aacfd5a0fad37e9ecd641ed2fec5

SHA1
9c5332e427b3169c48228e12ea2bfe0fda080f8f

SHA256
d3201d9c514b87b6314f9b49d7e54ebfd32db16000488536b16b34c0f6ec8e75

SHA512
dbce3fa360bcd6acbf4ce19399c68663a0b3e9a8b1671e76d5f4192b2fc90d56eea8e0336898d42fe5e5be74ce3739d6e14296741bbf40060c53945b36394f22

Download Submit
\Windows\Installer\MSIEA27.tmp-\CustomActionManaged.dll

Filesize
34KB

MD5
ae28aacfd5a0fad37e9ecd641ed2fec5

SHA1
9c5332e427b3169c48228e12ea2bfe0fda080f8f

SHA256
d3201d9c514b87b6314f9b49d7e54ebfd32db16000488536b16b34c0f6ec8e75

SHA512
dbce3fa360bcd6acbf4ce19399c68663a0b3e9a8b1671e76d5f4192b2fc90d56eea8e0336898d42fe5e5be74ce3739d6e14296741bbf40060c53945b36394f22

Download Submit
\Windows\Installer\MSIEA27.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSIEA27.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
memory/692-54-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download
memory/784-57-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1208-173-0x0000000001100000-0x00000000011E6000-memory.dmp

Filesize
920KB

Download
memory/1332-168-0x00000000003F0000-0x0000000000402000-memory.dmp

Filesize
72KB

Download
memory/1336-183-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/1392-165-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/1392-164-0x0000000000A80000-0x0000000000AAE000-memory.dmp

Filesize
184KB

Download
memory/1572-90-0x0000000000520000-0x000000000054E000-memory.dmp

Filesize
184KB

Download
memory/1572-93-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/1704-154-0x00000000009E0000-0x00000000009F2000-memory.dmp

Filesize
72KB

Download
memory/1704-153-0x00000000009A0000-0x00000000009CE000-memory.dmp

Filesize
184KB

Download
memory/1732-150-0x0000000000470000-0x000000000049E000-memory.dmp

Filesize
184KB

Download
memory/1732-149-0x0000000000C00000-0x0000000000C08000-memory.dmp

Filesize
32KB

Download
memory/1876-107-0x00000000009C0000-0x00000000009CE000-memory.dmp

Filesize
56KB

Download
memory/1876-104-0x00000000008D0000-0x00000000008FE000-memory.dmp

Filesize
184KB

Download
memory/1888-157-0x0000000000A00000-0x0000000000A12000-memory.dmp

Filesize
72KB

Download
memory/1944-69-0x00000000008B0000-0x00000000008DE000-memory.dmp

Filesize
184KB

Download
memory/1944-72-0x0000000000930000-0x000000000093E000-memory.dmp

Filesize
56KB

Download
memory/1996-144-0x00000000008C0000-0x00000000008EE000-memory.dmp

Filesize
184KB

Download
memory/1996-145-0x0000000000920000-0x000000000092E000-memory.dmp

Filesize
56KB

Download