201ca9fb37606a5bd5aaccdd8061124b9b32cb778b10789196f932d42aa09442

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2023, 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

readerdc64.msi
Size

103.5MB
MD5

9abd796043712be98c84868224be10a7
SHA1

a6d7d7112cb0d6812f666a3b36163a4ea63912e7
SHA256

201ca9fb37606a5bd5aaccdd8061124b9b32cb778b10789196f932d42aa09442
SHA512

2e4a8768d2b377321bef74e53100e1d4ccc03d1e4ac21e8a889a9afd285ff284a64ad50f6d4725d72e61dd507a9a432e1b44338102780a05d6e9f6a74cc9cabd
SSDEEP

3145728:+T3L7pvwjAumOCqRoDbyCfeUtRyk6jqf:+T3PtQCwoDbyCWUtx6jq

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
6	4020	msiexec.exe
13	4020	msiexec.exe
17	4020	msiexec.exe
19	4020	msiexec.exe
100	2516	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	MSID8E.tmp

Executes dropped EXE 4 IoCs

pid	Process
3996	MSID8E.tmp
2348	BoxEditUpgradeService.exe
1120	Box Local Com Windows Service.exe
1240	Box Edit.exe

Loads dropped DLL 64 IoCs

pid	Process
2392	MsiExec.exe
2392	MsiExec.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
2392	MsiExec.exe
2392	MsiExec.exe
2392	MsiExec.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
4940	rundll32.exe
2392	MsiExec.exe
2392	MsiExec.exe
1272	rundll32.exe
1272	rundll32.exe
1272	rundll32.exe
1272	rundll32.exe
1272	rundll32.exe
2392	MsiExec.exe
2392	MsiExec.exe
2392	MsiExec.exe
2392	MsiExec.exe
2392	MsiExec.exe
2392	MsiExec.exe
2392	MsiExec.exe
1240	rundll32.exe
1240	rundll32.exe
1240	rundll32.exe
1240	rundll32.exe
1240	rundll32.exe
2392	MsiExec.exe
2008	rundll32.exe
2008	rundll32.exe
2008	rundll32.exe
2008	rundll32.exe
2008	rundll32.exe
2392	MsiExec.exe
4976	MsiExec.exe
4976	MsiExec.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
2348	BoxEditUpgradeService.exe
4976	MsiExec.exe
4260	rundll32.exe
4260	rundll32.exe
4260	rundll32.exe

Registers COM server for autorun 1 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\LocalServer32\ = "C:\\Program Files (x86)\\Box\\Box Local Com Server\\Box.Tools.ActiveX.exe"	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Box Edit = "C:\\Program Files (x86)\\Box\\Box Edit\\Box Edit.exe"	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Box\Box Edit\Box.Metrics.Wrappers.CSharp.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\Microsoft.Expression.Encoder.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\Microsoft.Expression.Encoder.dll_1	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\MindFusion.Diagramming.Wpf.xml	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.Notifications.Growl.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.LocalComServer.Environment.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box Device Trust.exe	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.WindowsEvents.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\Box.Metrics.Reporter.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Ionic.Zip.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\nb-NO\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.Edit.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\hi-IN\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\Box.Ipc.Pipes.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\SimpleInjector.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Microsoft.WindowsAPICodePack.Shell.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\Box.Tools.ActiveX.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\es-ES\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-GB\pytransform\_pytransform.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box Edit.exe	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\BoxEditUpgradeService.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.Ipc.Pipes.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\Box.Utilities.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-GB\python3.9.9amd64.exe	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.Notifications.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\UrbanBrain.ChatMapper.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\XML\PostureCheck.xml	rundll32.exe
File created	C:\Program Files (x86)\Box\Box Edit\System.IO.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\fr-CA\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\fr-FR\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\tr-TR\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\ActiproSoftware.Docking.Wpf351.xml	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\HttpServer.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\Box.WindowsEvents.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\it-IT\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\zh-TW\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\log4net.xml	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\RestSharp.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.Edit.Api.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-CA\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\ActiproSoftware.Shared.Wpf351.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\MetricsCollector.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\ru-RU\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.LocalComServer.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.Edit.Environment.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\Box.Metrics.Wrappers.CSharp.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.Utilities.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\filC734C542AB54487215D94E50B4708077	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-GB\PythonFramework.bat	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-GB\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\XML\boxedit.xml	rundll32.exe
File created	C:\Program Files (x86)\Box\Box Edit\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\Box.FileSharing.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\XML\boxedit.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\pl-PL\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\pt-BR\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\MindFusion.Diagramming.Wpf.dll_1	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\en-AU\MindFusion.Diagramming.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Local Com Server\Box.LocalComServer.Environment.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\ko-KR\Box Edit.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Box\Box Edit\zh-CN\Box Edit.resources.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI45D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DEF.tmp-\Box.LocalComServer.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3DEF.tmp-\LocalComServerIntegration.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3DEF.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F67.tmp-\log4net.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI963.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F67.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF67B.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9A3.tmp-\Box.Utilities.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB3A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F15.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3DEF.tmp-\log4net.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2FC2.tmp-\Box.Edit.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI238.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI52A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3A.tmp-\LocalComServerIntegration.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2C83.tmp-\log4net.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2DFB.tmp-\Microsoft.WindowsAPICodePack.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI238.tmp-\Box.Edit.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI579.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A3.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2DFB.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F67.tmp-\Box.Utilities.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI238.tmp-\Newtonsoft.Json.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A3.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2C83.tmp-\Box.LocalComServer.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F67.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9A3.tmp-\Box.LocalComServer.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB3A.tmp-\log4net.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF17.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2C83.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2F15.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2C83.tmp-\Box.Utilities.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2F15.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI307E.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2FC2.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF2F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3A.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB3A.tmp-\Microsoft.WindowsAPICodePack.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2C83.tmp-\LocalComServerIntegration.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2DFB.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF67B.tmp-\Box.Edit.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F67.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F67.tmp-\Microsoft.WindowsAPICodePack.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF67B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDA0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C83.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3DEF.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3F67.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI307E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI313B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F67.tmp-\Box.LocalComServer.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e56f0be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2DFB.tmp-\Box.LocalComServer.Installer.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI81.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI238.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3A.tmp-\CustomAction.config	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000789d96067ff55f5b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000789d96060000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900789d9606000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87A79FD-ADEB-418C-BECD-1B55AFF13DAE}\AppName = "Box.Tools.ActiveX.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87A79FD-ADEB-418C-BECD-1B55AFF13DAE}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87A79FD-ADEB-418C-BECD-1B55AFF13DAE}\AppName = "Box.Tools.ActiveX.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87A79FD-ADEB-418C-BECD-1B55AFF13DAE}\AppPath = "C:\\Program Files (x86)\\Box\\Box Local Com Server\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87A79FD-ADEB-418C-BECD-1B55AFF13DAE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87A79FD-ADEB-418C-BECD-1B55AFF13DAE}\AppPath = "C:\\Program Files (x86)\\Box\\Box Local Com Server\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87A79FD-ADEB-418C-BECD-1B55AFF13DAE}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87A79FD-ADEB-418C-BECD-1B55AFF13DAE}\Policy = "3"	msiexec.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	BoxEditUpgradeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Box Local Com Windows Service.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	BoxEditUpgradeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	BoxEditUpgradeService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Box Local Com Windows Service.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Box Local Com Windows Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Box Local Com Windows Service.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	BoxEditUpgradeService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29}\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\ProgID\ = "Box.BoxTools"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\PackageCode = "A46C8AED44062D7439608142807D8AD0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Box.BoxTools\CLSID\ = "{BA58190A-A733-4982-8AE2-E2021F0DD503}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\LocalServer32\ = "C:\\Program Files (x86)\\Box\\Box Local Com Server\\Box.Tools.ActiveX.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\Version = "68419584"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6BEEEB0B903743B4D8971EF7A0C71DE3\02A124724DB625E4688FDF7C1125AE14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\LocalServer32\ = "C:\\Program Files (x86)\\Box\\Box Local Com Server\\Box.Tools.ActiveX.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Box.BoxTools\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6BEEEB0B903743B4D8971EF7A0C71DE3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\SourceList\PackageName = "readerdc64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Box.BoxTools\ = "Box.BoxTools"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\ProgID\ = "Box.BoxTools"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\ProductIcon = "C:\\Windows\\Installer\\{27421A20-6BD4-4E52-86F8-FDC71152EA41}\\boxedit.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Box.BoxTools	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\ProductName = "Software"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	Box Edit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\ProgID	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\02A124724DB625E4688FDF7C1125AE14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BA58190A-A733-4982-8AE2-E2021F0DD503}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\02A124724DB625E4688FDF7C1125AE14\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\02A124724DB625E4688FDF7C1125AE14\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	msiexec.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1120	rundll32.exe
2392	MsiExec.exe
2392	MsiExec.exe
2392	MsiExec.exe
2392	MsiExec.exe
2392	MsiExec.exe
2392	MsiExec.exe
2692	msiexec.exe
2692	msiexec.exe
4976	MsiExec.exe
4976	MsiExec.exe
2348	BoxEditUpgradeService.exe
1120	Box Local Com Windows Service.exe
1120	Box Local Com Windows Service.exe
1240	Box Edit.exe
1240	Box Edit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4020	msiexec.exe
Token: SeSecurityPrivilege	2692	msiexec.exe
Token: SeCreateTokenPrivilege	4020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4020	msiexec.exe
Token: SeLockMemoryPrivilege	4020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4020	msiexec.exe
Token: SeMachineAccountPrivilege	4020	msiexec.exe
Token: SeTcbPrivilege	4020	msiexec.exe
Token: SeSecurityPrivilege	4020	msiexec.exe
Token: SeTakeOwnershipPrivilege	4020	msiexec.exe
Token: SeLoadDriverPrivilege	4020	msiexec.exe
Token: SeSystemProfilePrivilege	4020	msiexec.exe
Token: SeSystemtimePrivilege	4020	msiexec.exe
Token: SeProfSingleProcessPrivilege	4020	msiexec.exe
Token: SeIncBasePriorityPrivilege	4020	msiexec.exe
Token: SeCreatePagefilePrivilege	4020	msiexec.exe
Token: SeCreatePermanentPrivilege	4020	msiexec.exe
Token: SeBackupPrivilege	4020	msiexec.exe
Token: SeRestorePrivilege	4020	msiexec.exe
Token: SeShutdownPrivilege	4020	msiexec.exe
Token: SeDebugPrivilege	4020	msiexec.exe
Token: SeAuditPrivilege	4020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4020	msiexec.exe
Token: SeChangeNotifyPrivilege	4020	msiexec.exe
Token: SeRemoteShutdownPrivilege	4020	msiexec.exe
Token: SeUndockPrivilege	4020	msiexec.exe
Token: SeSyncAgentPrivilege	4020	msiexec.exe
Token: SeEnableDelegationPrivilege	4020	msiexec.exe
Token: SeManageVolumePrivilege	4020	msiexec.exe
Token: SeImpersonatePrivilege	4020	msiexec.exe
Token: SeCreateGlobalPrivilege	4020	msiexec.exe
Token: SeBackupPrivilege	4936	vssvc.exe
Token: SeRestorePrivilege	4936	vssvc.exe
Token: SeAuditPrivilege	4936	vssvc.exe
Token: SeBackupPrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeBackupPrivilege	3556	srtasks.exe
Token: SeRestorePrivilege	3556	srtasks.exe
Token: SeSecurityPrivilege	3556	srtasks.exe
Token: SeTakeOwnershipPrivilege	3556	srtasks.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeDebugPrivilege	1120	rundll32.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeBackupPrivilege	3556	srtasks.exe
Token: SeRestorePrivilege	3556	srtasks.exe
Token: SeSecurityPrivilege	3556	srtasks.exe
Token: SeTakeOwnershipPrivilege	3556	srtasks.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4020	msiexec.exe
1240	Box Edit.exe
4020	msiexec.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1240	Box Edit.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3556	2692	msiexec.exe	88
PID 2692 wrote to memory of 3556	2692	msiexec.exe	88
PID 2692 wrote to memory of 2392	2692	msiexec.exe	91
PID 2692 wrote to memory of 2392	2692	msiexec.exe	91
PID 2692 wrote to memory of 2392	2692	msiexec.exe	91
PID 2392 wrote to memory of 1120	2392	MsiExec.exe	92
PID 2392 wrote to memory of 1120	2392	MsiExec.exe	92
PID 2392 wrote to memory of 1120	2392	MsiExec.exe	92
PID 2392 wrote to memory of 4940	2392	MsiExec.exe	94
PID 2392 wrote to memory of 4940	2392	MsiExec.exe	94
PID 2392 wrote to memory of 4940	2392	MsiExec.exe	94
PID 2392 wrote to memory of 1272	2392	MsiExec.exe	95
PID 2392 wrote to memory of 1272	2392	MsiExec.exe	95
PID 2392 wrote to memory of 1272	2392	MsiExec.exe	95
PID 2392 wrote to memory of 1240	2392	MsiExec.exe	98
PID 2392 wrote to memory of 1240	2392	MsiExec.exe	98
PID 2392 wrote to memory of 1240	2392	MsiExec.exe	98
PID 2392 wrote to memory of 2008	2392	MsiExec.exe	99
PID 2392 wrote to memory of 2008	2392	MsiExec.exe	99
PID 2392 wrote to memory of 2008	2392	MsiExec.exe	99
PID 2692 wrote to memory of 3996	2692	msiexec.exe	100
PID 2692 wrote to memory of 3996	2692	msiexec.exe	100
PID 2692 wrote to memory of 3996	2692	msiexec.exe	100
PID 2692 wrote to memory of 4976	2692	msiexec.exe	101
PID 2692 wrote to memory of 4976	2692	msiexec.exe	101
PID 2692 wrote to memory of 4976	2692	msiexec.exe	101
PID 3996 wrote to memory of 4508	3996	MSID8E.tmp	102
PID 3996 wrote to memory of 4508	3996	MSID8E.tmp	102
PID 3996 wrote to memory of 4508	3996	MSID8E.tmp	102
PID 4976 wrote to memory of 4260	4976	MsiExec.exe	106
PID 4976 wrote to memory of 4260	4976	MsiExec.exe	106
PID 4976 wrote to memory of 4260	4976	MsiExec.exe	106
PID 4976 wrote to memory of 1272	4976	MsiExec.exe	107
PID 4976 wrote to memory of 1272	4976	MsiExec.exe	107
PID 4976 wrote to memory of 1272	4976	MsiExec.exe	107
PID 4976 wrote to memory of 3060	4976	MsiExec.exe	108
PID 4976 wrote to memory of 3060	4976	MsiExec.exe	108
PID 4976 wrote to memory of 3060	4976	MsiExec.exe	108
PID 4976 wrote to memory of 2564	4976	MsiExec.exe	109
PID 4976 wrote to memory of 2564	4976	MsiExec.exe	109
PID 4976 wrote to memory of 2564	4976	MsiExec.exe	109
PID 4976 wrote to memory of 872	4976	MsiExec.exe	110
PID 4976 wrote to memory of 872	4976	MsiExec.exe	110
PID 4976 wrote to memory of 872	4976	MsiExec.exe	110
PID 4976 wrote to memory of 4860	4976	MsiExec.exe	111
PID 4976 wrote to memory of 4860	4976	MsiExec.exe	111
PID 4976 wrote to memory of 4860	4976	MsiExec.exe	111
PID 4860 wrote to memory of 1240	4860	rundll32.exe	112
PID 4860 wrote to memory of 1240	4860	rundll32.exe	112
PID 4860 wrote to memory of 1240	4860	rundll32.exe	112
PID 4976 wrote to memory of 2516	4976	MsiExec.exe	113
PID 4976 wrote to memory of 2516	4976	MsiExec.exe	113
PID 4976 wrote to memory of 2516	4976	MsiExec.exe	113
PID 4976 wrote to memory of 4468	4976	MsiExec.exe	116
PID 4976 wrote to memory of 4468	4976	MsiExec.exe	116
PID 4976 wrote to memory of 4468	4976	MsiExec.exe	116
PID 4976 wrote to memory of 3888	4976	MsiExec.exe	117
PID 4976 wrote to memory of 3888	4976	MsiExec.exe	117
PID 4976 wrote to memory of 3888	4976	MsiExec.exe	117

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\readerdc64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4020

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 635D4B62E6D35EDE224BBB362CD2F70E
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF67B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240580250 3 Box.Edit.Installer.CustomActions!Box.Edit.Installer.CustomActions.RelaunchOnUpgradeCustomActions.GetAllOpenSessions
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI81.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240582828 189 Box.Edit.Installer.CustomActions!Box.Edit.Installer.CustomActions.CanaryMetricCustomAction.SavePreviousCanaryPerMachine
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4940
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI238.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240583281 194 Box.Edit.Installer.CustomActions!Box.Edit.Installer.CustomActions.UninstallBoxEditPerUserCustomAction.FindBoxEditsPerUser
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1272
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9A3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240585171 222 Box.LocalComServer.Installer.CustomActions!Box.LocalComServer.Installer.CustomActions.ApplicationSettingsCustomActions.Prepare
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1240
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB3A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240585625 226 Box.LocalComServer.Installer.CustomActions!Box.LocalComServer.Installer.CustomActions.ApplicationSettingsCustomActions.Prepare
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2008
- C:\Windows\Installer\MSID8E.tmp
  "C:\Windows\Installer\MSID8E.tmp" /DontWait /RunAsAdmin /HideWindow "C:\Program Files (x86)\Box\Box Edit\en-GB\PythonFramework.bat"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ""C:\Program Files (x86)\Box\Box Edit\en-GB\PythonFramework.bat" "
    3⤵
    PID:4508
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B6F31A9AE745EA5F035B0D541CEB1281 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2C83.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240594046 248 Box.LocalComServer.Installer.CustomActions!Box.LocalComServer.Installer.CustomActions.ApplicationSettingsCustomActions.Install
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:4260
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2DFB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240594421 252 Box.LocalComServer.Installer.CustomActions!Box.LocalComServer.Installer.CustomActions.ApplicationSettingsCustomActions.Install
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:1272
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2F15.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240594703 256 Box.Edit.Installer.CustomActions!Box.Edit.Installer.CustomActions.CreateInstallationIdCustomAction.CreateInstallationIdPerMachine
    3⤵
    - Drops file in Windows directory
    PID:3060
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2FC2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240594875 260 Box.Edit.Installer.CustomActions!Box.Edit.Installer.CustomActions.CreateMetricsFolderCustomAction.CreateMetricsFolderPerMachine
    3⤵
    - Drops file in Windows directory
    PID:2564
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI307E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240595062 264 Box.Edit.Installer.CustomActions!Box.Edit.Installer.CustomActions.RolloutIDCustomActions.CreateRolloutIdPerMachine
    3⤵
    - Drops file in Windows directory
    PID:872
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI313B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240595250 268 Box.Edit.Installer.CustomActions!Box.Edit.Installer.CustomActions.RelaunchOnUpgradeCustomActions.RelaunchEditWithPath
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Program Files (x86)\Box\Box Edit\Box Edit.exe
      "C:\Program Files (x86)\Box\Box Edit\Box Edit.exe"
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1240
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3226.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240595468 273 Box.Edit.Installer.CustomActions!Box.Edit.Installer.CustomActions.CanaryMetricCustomAction.SendCanaryMetricsPerMachine
    3⤵
    - Blocklisted process makes network request
    - Modifies data under HKEY_USERS
    PID:2516
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3DEF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240598500 279 Box.LocalComServer.Installer.CustomActions!Box.LocalComServer.Installer.CustomActions.ApplicationSettingsCustomActions.Commit
    3⤵
    - Drops file in Windows directory
    PID:4468
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3F67.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240598859 283 Box.LocalComServer.Installer.CustomActions!Box.LocalComServer.Installer.CustomActions.ApplicationSettingsCustomActions.Commit
    3⤵
    - Drops file in Windows directory
    PID:3888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Program Files (x86)\Box\Box Edit\BoxEditUpgradeService.exe
"C:\Program Files (x86)\Box\Box Edit\BoxEditUpgradeService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2348

C:\Program Files (x86)\Box\Box Local Com Server\Box Local Com Windows Service.exe
"C:\Program Files (x86)\Box\Box Local Com Server\Box Local Com Windows Service.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2480

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Box\Box Edit\Logs\BoxEdit_2023-02-06.log
1⤵
PID:3056

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Box\Box Edit\Logs\Verbose_BoxEdit_2023-02-06.log
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C42BC945025A34066DAB76EF3F80A05

Filesize
25KB

MD5
65ef0747c61fb6b73c0f181ffc8a4c28

SHA1
95f569fee6c72b1967efa4eda8eb4c2ba9ff3953

SHA256
636f96da50ede02b4807a5461dffdfe66fb43d4019e43049b9fd478cf59069af

SHA512
227158f2d50efce1a3ad3c6ac3a4e20b75b548fe9725740c33a1f8d988d5ae7ff87cea6eb794a37bde9817af101cf5039c684b7aae9427097a23c91ca44d6417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

Filesize
727B

MD5
dcba1cc19f2d5bba73b2a0593590d9fc

SHA1
59178350d6fe2313ac264cbeca4de7162998fd25

SHA256
8a9f5e6ead55364d979821f5c3180a9643dd27302d7665c06c78e62e062fb3e0

SHA512
894b2ab3ea95e34a7f919d507b1b9f251e31ce00f20f44e36fc95917dffc40fc158029122795d9093257697dc21620244ab7f51a19b9d2f2af8987e8908bd32a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C42BC945025A34066DAB76EF3F80A05

Filesize
314B

MD5
0e56051c48a67378579032b765823d70

SHA1
6a0f5d671b380a9a082f8e9b55049072ae1a861b

SHA256
6389cdf92e8d82e76e84e3c0d2211dce7e6111a3b088ed10279128c0a2820735

SHA512
cff42b942855e3b36e50b1eb58578dfa6cc718b446310dea1f987e5984a515f1c4bd6824279188d126296941f2f5c766cd823ffcbc05ccccc8a2e8dc2c196b3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

Filesize
478B

MD5
c385fec9a359917323a28897ffbbdb11

SHA1
cd2f5217cda45cc1fbb79199750fc6ef51406333

SHA256
1333f81ed63e4db19c952af0908ccae996cfc0ff3f71c6e04c79a12d2905be8f

SHA512
85a86b85b69c6789bb963cba5b2f7dc6848b95aed39b33fa7170b7fa3b9897c17bad7cef2419f8429f093f25f3487e1f428fafa58f7505f602abae9757a682f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
9bbfe11735bac43a2ed1be18d0655fe2

SHA1
61141928bb248fd6e9cd5084a9db05a9b980fb3a

SHA256
549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

SHA512
a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

Download Submit
C:\Windows\Installer\MSI1BA.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI1BA.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI238.tmp

Filesize
462KB

MD5
8bbdb484cbf4762c2c5624317f0c4b2d

SHA1
e55446a8ca3a275e8c3487ec4dc7a0de92021fcd

SHA256
570f03d28cdc2c69adb5d43cc5bd776a4e46eb66ba7d06c0a3d2629e1b06cb04

SHA512
4b4b3f9e74960577ff836f00135f4dee12e7f31e1744f3984d21ad3de03dd53a2c3ccda0f90b54bd807df2a197d7f857e55ab989ecc6bde57b0e5c0b4894dd7c

Download Submit
C:\Windows\Installer\MSI238.tmp

Filesize
462KB

MD5
8bbdb484cbf4762c2c5624317f0c4b2d

SHA1
e55446a8ca3a275e8c3487ec4dc7a0de92021fcd

SHA256
570f03d28cdc2c69adb5d43cc5bd776a4e46eb66ba7d06c0a3d2629e1b06cb04

SHA512
4b4b3f9e74960577ff836f00135f4dee12e7f31e1744f3984d21ad3de03dd53a2c3ccda0f90b54bd807df2a197d7f857e55ab989ecc6bde57b0e5c0b4894dd7c

Download Submit
C:\Windows\Installer\MSI238.tmp

Filesize
462KB

MD5
8bbdb484cbf4762c2c5624317f0c4b2d

SHA1
e55446a8ca3a275e8c3487ec4dc7a0de92021fcd

SHA256
570f03d28cdc2c69adb5d43cc5bd776a4e46eb66ba7d06c0a3d2629e1b06cb04

SHA512
4b4b3f9e74960577ff836f00135f4dee12e7f31e1744f3984d21ad3de03dd53a2c3ccda0f90b54bd807df2a197d7f857e55ab989ecc6bde57b0e5c0b4894dd7c

Download Submit
C:\Windows\Installer\MSI238.tmp-\Box.Edit.Installer.CustomActions.dll

Filesize
30KB

MD5
70faced2cda1eaa9a06aa1508fca1e79

SHA1
feb9c8b03404766acad04484876854ff53d169a6

SHA256
17901425494d78899cb78d859ff922c08a0c087b1380c8311f5b42b8d80680b4

SHA512
85c9d755f9e2ef1e0590c9686d2418fb962102301fd1b236ba2763f1fad96d7d7b4dc2fd391bccc99db2eae303b6457788ea0ea7b9ea2fedbe4b3bb9ea46006e

Download Submit
C:\Windows\Installer\MSI238.tmp-\Box.Edit.Installer.CustomActions.dll

Filesize
30KB

MD5
70faced2cda1eaa9a06aa1508fca1e79

SHA1
feb9c8b03404766acad04484876854ff53d169a6

SHA256
17901425494d78899cb78d859ff922c08a0c087b1380c8311f5b42b8d80680b4

SHA512
85c9d755f9e2ef1e0590c9686d2418fb962102301fd1b236ba2763f1fad96d7d7b4dc2fd391bccc99db2eae303b6457788ea0ea7b9ea2fedbe4b3bb9ea46006e

Download Submit
C:\Windows\Installer\MSI238.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSI238.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSI3FE.tmp

Filesize
380KB

MD5
3eb31b9a689d506f3b1d3738d28ab640

SHA1
1681fe3bbdcbe617a034b092ea77249dd4c3e986

SHA256
3a7d9cdd6be9ce0e4d01e9894242b497536336bf1850fb0a814a369c8a189c46

SHA512
2598e39f4fd139775bbb040218af802db722d4dca99a4230edfde282362b433c5e30c15d5385063aa76bff916031b0e43586ef05d2ada4edc3c1410371b98e09

Download Submit
C:\Windows\Installer\MSI3FE.tmp

Filesize
380KB

MD5
3eb31b9a689d506f3b1d3738d28ab640

SHA1
1681fe3bbdcbe617a034b092ea77249dd4c3e986

SHA256
3a7d9cdd6be9ce0e4d01e9894242b497536336bf1850fb0a814a369c8a189c46

SHA512
2598e39f4fd139775bbb040218af802db722d4dca99a4230edfde282362b433c5e30c15d5385063aa76bff916031b0e43586ef05d2ada4edc3c1410371b98e09

Download Submit
C:\Windows\Installer\MSI45D.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI45D.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI4CC.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI4CC.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI52A.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI52A.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI579.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI579.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI5E8.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI5E8.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI81.tmp

Filesize
462KB

MD5
8bbdb484cbf4762c2c5624317f0c4b2d

SHA1
e55446a8ca3a275e8c3487ec4dc7a0de92021fcd

SHA256
570f03d28cdc2c69adb5d43cc5bd776a4e46eb66ba7d06c0a3d2629e1b06cb04

SHA512
4b4b3f9e74960577ff836f00135f4dee12e7f31e1744f3984d21ad3de03dd53a2c3ccda0f90b54bd807df2a197d7f857e55ab989ecc6bde57b0e5c0b4894dd7c

Download Submit
C:\Windows\Installer\MSI81.tmp

Filesize
462KB

MD5
8bbdb484cbf4762c2c5624317f0c4b2d

SHA1
e55446a8ca3a275e8c3487ec4dc7a0de92021fcd

SHA256
570f03d28cdc2c69adb5d43cc5bd776a4e46eb66ba7d06c0a3d2629e1b06cb04

SHA512
4b4b3f9e74960577ff836f00135f4dee12e7f31e1744f3984d21ad3de03dd53a2c3ccda0f90b54bd807df2a197d7f857e55ab989ecc6bde57b0e5c0b4894dd7c

Download Submit
C:\Windows\Installer\MSI81.tmp

Filesize
462KB

MD5
8bbdb484cbf4762c2c5624317f0c4b2d

SHA1
e55446a8ca3a275e8c3487ec4dc7a0de92021fcd

SHA256
570f03d28cdc2c69adb5d43cc5bd776a4e46eb66ba7d06c0a3d2629e1b06cb04

SHA512
4b4b3f9e74960577ff836f00135f4dee12e7f31e1744f3984d21ad3de03dd53a2c3ccda0f90b54bd807df2a197d7f857e55ab989ecc6bde57b0e5c0b4894dd7c

Download Submit
C:\Windows\Installer\MSI81.tmp-\Box.Edit.Installer.CustomActions.dll

Filesize
30KB

MD5
70faced2cda1eaa9a06aa1508fca1e79

SHA1
feb9c8b03404766acad04484876854ff53d169a6

SHA256
17901425494d78899cb78d859ff922c08a0c087b1380c8311f5b42b8d80680b4

SHA512
85c9d755f9e2ef1e0590c9686d2418fb962102301fd1b236ba2763f1fad96d7d7b4dc2fd391bccc99db2eae303b6457788ea0ea7b9ea2fedbe4b3bb9ea46006e

Download Submit
C:\Windows\Installer\MSI81.tmp-\Box.Edit.Installer.CustomActions.dll

Filesize
30KB

MD5
70faced2cda1eaa9a06aa1508fca1e79

SHA1
feb9c8b03404766acad04484876854ff53d169a6

SHA256
17901425494d78899cb78d859ff922c08a0c087b1380c8311f5b42b8d80680b4

SHA512
85c9d755f9e2ef1e0590c9686d2418fb962102301fd1b236ba2763f1fad96d7d7b4dc2fd391bccc99db2eae303b6457788ea0ea7b9ea2fedbe4b3bb9ea46006e

Download Submit
C:\Windows\Installer\MSI81.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSI81.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSI9A3.tmp

Filesize
595KB

MD5
e10851b16c9302174e2881a8fae4a26e

SHA1
0e44b0c88c96e2e58cd08d3e4d9b682331aa4bfb

SHA256
f3e7ed5ebbf3084a2eccf2d94ab3696475025c2e32fd8df66d062cd23ed5be91

SHA512
280aacad04b52e3a0d98f4c527b1d6ebe4b09cfe7cf78c6212ba42aa2138a8a5c83808df2b2df36dffa1273a7676f3e46304d836ddd96cb2d8e60b8b75463963

Download Submit
C:\Windows\Installer\MSI9A3.tmp

Filesize
595KB

MD5
e10851b16c9302174e2881a8fae4a26e

SHA1
0e44b0c88c96e2e58cd08d3e4d9b682331aa4bfb

SHA256
f3e7ed5ebbf3084a2eccf2d94ab3696475025c2e32fd8df66d062cd23ed5be91

SHA512
280aacad04b52e3a0d98f4c527b1d6ebe4b09cfe7cf78c6212ba42aa2138a8a5c83808df2b2df36dffa1273a7676f3e46304d836ddd96cb2d8e60b8b75463963

Download Submit
C:\Windows\Installer\MSI9A3.tmp

Filesize
595KB

MD5
e10851b16c9302174e2881a8fae4a26e

SHA1
0e44b0c88c96e2e58cd08d3e4d9b682331aa4bfb

SHA256
f3e7ed5ebbf3084a2eccf2d94ab3696475025c2e32fd8df66d062cd23ed5be91

SHA512
280aacad04b52e3a0d98f4c527b1d6ebe4b09cfe7cf78c6212ba42aa2138a8a5c83808df2b2df36dffa1273a7676f3e46304d836ddd96cb2d8e60b8b75463963

Download Submit
C:\Windows\Installer\MSI9A3.tmp-\Box.LocalComServer.Installer.CustomActions.dll

Filesize
8KB

MD5
0f47f9b36eee26e94fd87c6470128daa

SHA1
1d43fdafca31344a5da56c2b2230a20ee9f9221b

SHA256
ed42c7abc78c36732b8370cac4946db5969c708b7397b69ab4b7e932af3f3012

SHA512
f3346185067d289b6b583a243d47aaa62521af3fbdfc801da6372d195836408a1ebe83b4243753e613c649e11bec4feacccd0fee481afc6d421e417a9d06e07c

Download Submit
C:\Windows\Installer\MSI9A3.tmp-\Box.LocalComServer.Installer.CustomActions.dll

Filesize
8KB

MD5
0f47f9b36eee26e94fd87c6470128daa

SHA1
1d43fdafca31344a5da56c2b2230a20ee9f9221b

SHA256
ed42c7abc78c36732b8370cac4946db5969c708b7397b69ab4b7e932af3f3012

SHA512
f3346185067d289b6b583a243d47aaa62521af3fbdfc801da6372d195836408a1ebe83b4243753e613c649e11bec4feacccd0fee481afc6d421e417a9d06e07c

Download Submit
C:\Windows\Installer\MSI9A3.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSI9A3.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIB3A.tmp

Filesize
595KB

MD5
e10851b16c9302174e2881a8fae4a26e

SHA1
0e44b0c88c96e2e58cd08d3e4d9b682331aa4bfb

SHA256
f3e7ed5ebbf3084a2eccf2d94ab3696475025c2e32fd8df66d062cd23ed5be91

SHA512
280aacad04b52e3a0d98f4c527b1d6ebe4b09cfe7cf78c6212ba42aa2138a8a5c83808df2b2df36dffa1273a7676f3e46304d836ddd96cb2d8e60b8b75463963

Download Submit
C:\Windows\Installer\MSIB3A.tmp

Filesize
595KB

MD5
e10851b16c9302174e2881a8fae4a26e

SHA1
0e44b0c88c96e2e58cd08d3e4d9b682331aa4bfb

SHA256
f3e7ed5ebbf3084a2eccf2d94ab3696475025c2e32fd8df66d062cd23ed5be91

SHA512
280aacad04b52e3a0d98f4c527b1d6ebe4b09cfe7cf78c6212ba42aa2138a8a5c83808df2b2df36dffa1273a7676f3e46304d836ddd96cb2d8e60b8b75463963

Download Submit
C:\Windows\Installer\MSIB3A.tmp

Filesize
595KB

MD5
e10851b16c9302174e2881a8fae4a26e

SHA1
0e44b0c88c96e2e58cd08d3e4d9b682331aa4bfb

SHA256
f3e7ed5ebbf3084a2eccf2d94ab3696475025c2e32fd8df66d062cd23ed5be91

SHA512
280aacad04b52e3a0d98f4c527b1d6ebe4b09cfe7cf78c6212ba42aa2138a8a5c83808df2b2df36dffa1273a7676f3e46304d836ddd96cb2d8e60b8b75463963

Download Submit
C:\Windows\Installer\MSIB3A.tmp-\Box.LocalComServer.Installer.CustomActions.dll

Filesize
8KB

MD5
0f47f9b36eee26e94fd87c6470128daa

SHA1
1d43fdafca31344a5da56c2b2230a20ee9f9221b

SHA256
ed42c7abc78c36732b8370cac4946db5969c708b7397b69ab4b7e932af3f3012

SHA512
f3346185067d289b6b583a243d47aaa62521af3fbdfc801da6372d195836408a1ebe83b4243753e613c649e11bec4feacccd0fee481afc6d421e417a9d06e07c

Download Submit
C:\Windows\Installer\MSIB3A.tmp-\Box.LocalComServer.Installer.CustomActions.dll

Filesize
8KB

MD5
0f47f9b36eee26e94fd87c6470128daa

SHA1
1d43fdafca31344a5da56c2b2230a20ee9f9221b

SHA256
ed42c7abc78c36732b8370cac4946db5969c708b7397b69ab4b7e932af3f3012

SHA512
f3346185067d289b6b583a243d47aaa62521af3fbdfc801da6372d195836408a1ebe83b4243753e613c649e11bec4feacccd0fee481afc6d421e417a9d06e07c

Download Submit
C:\Windows\Installer\MSIB3A.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIB3A.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSICC2.tmp

Filesize
548KB

MD5
f5cc49103be002b80429c0ebe73175b9

SHA1
8b7077a4348d2355a4470cbf53ffa524d3a28b9e

SHA256
5fad8ac0929c29ff522bde7025f17774f2e996137cb349844b9595250d457cba

SHA512
fe7f01ff6b9b476085961bf953f723e1ced8be9339802bfdb156bee3b20b0e5dce79726c5e40a7338beac35eceec5b516c46b8fd0f0722ed5d43ef2693be74a4

Download Submit
C:\Windows\Installer\MSICC2.tmp

Filesize
548KB

MD5
f5cc49103be002b80429c0ebe73175b9

SHA1
8b7077a4348d2355a4470cbf53ffa524d3a28b9e

SHA256
5fad8ac0929c29ff522bde7025f17774f2e996137cb349844b9595250d457cba

SHA512
fe7f01ff6b9b476085961bf953f723e1ced8be9339802bfdb156bee3b20b0e5dce79726c5e40a7338beac35eceec5b516c46b8fd0f0722ed5d43ef2693be74a4

Download Submit
C:\Windows\Installer\MSIF2F0.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF2F0.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIF67B.tmp

Filesize
462KB

MD5
8bbdb484cbf4762c2c5624317f0c4b2d

SHA1
e55446a8ca3a275e8c3487ec4dc7a0de92021fcd

SHA256
570f03d28cdc2c69adb5d43cc5bd776a4e46eb66ba7d06c0a3d2629e1b06cb04

SHA512
4b4b3f9e74960577ff836f00135f4dee12e7f31e1744f3984d21ad3de03dd53a2c3ccda0f90b54bd807df2a197d7f857e55ab989ecc6bde57b0e5c0b4894dd7c

Download Submit
C:\Windows\Installer\MSIF67B.tmp

Filesize
462KB

MD5
8bbdb484cbf4762c2c5624317f0c4b2d

SHA1
e55446a8ca3a275e8c3487ec4dc7a0de92021fcd

SHA256
570f03d28cdc2c69adb5d43cc5bd776a4e46eb66ba7d06c0a3d2629e1b06cb04

SHA512
4b4b3f9e74960577ff836f00135f4dee12e7f31e1744f3984d21ad3de03dd53a2c3ccda0f90b54bd807df2a197d7f857e55ab989ecc6bde57b0e5c0b4894dd7c

Download Submit
C:\Windows\Installer\MSIF67B.tmp

Filesize
462KB

MD5
8bbdb484cbf4762c2c5624317f0c4b2d

SHA1
e55446a8ca3a275e8c3487ec4dc7a0de92021fcd

SHA256
570f03d28cdc2c69adb5d43cc5bd776a4e46eb66ba7d06c0a3d2629e1b06cb04

SHA512
4b4b3f9e74960577ff836f00135f4dee12e7f31e1744f3984d21ad3de03dd53a2c3ccda0f90b54bd807df2a197d7f857e55ab989ecc6bde57b0e5c0b4894dd7c

Download Submit
C:\Windows\Installer\MSIF67B.tmp-\Box.Edit.Installer.CustomActions.dll

Filesize
30KB

MD5
70faced2cda1eaa9a06aa1508fca1e79

SHA1
feb9c8b03404766acad04484876854ff53d169a6

SHA256
17901425494d78899cb78d859ff922c08a0c087b1380c8311f5b42b8d80680b4

SHA512
85c9d755f9e2ef1e0590c9686d2418fb962102301fd1b236ba2763f1fad96d7d7b4dc2fd391bccc99db2eae303b6457788ea0ea7b9ea2fedbe4b3bb9ea46006e

Download Submit
C:\Windows\Installer\MSIF67B.tmp-\Box.Edit.Installer.CustomActions.dll

Filesize
30KB

MD5
70faced2cda1eaa9a06aa1508fca1e79

SHA1
feb9c8b03404766acad04484876854ff53d169a6

SHA256
17901425494d78899cb78d859ff922c08a0c087b1380c8311f5b42b8d80680b4

SHA512
85c9d755f9e2ef1e0590c9686d2418fb962102301fd1b236ba2763f1fad96d7d7b4dc2fd391bccc99db2eae303b6457788ea0ea7b9ea2fedbe4b3bb9ea46006e

Download Submit
C:\Windows\Installer\MSIF67B.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIF67B.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIFDA0.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIFDA0.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIFDF0.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIFDF0.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
fb8bcccdce4c065c1263eb44736617ee

SHA1
88639272bb9728a60a750e889de8ae2783d28f10

SHA256
eb9f36650485e255593a3e016d4b353c5e6746afc1dbbb9965b2669e7cc9e20c

SHA512
3ef8493dd02ee42f79eb7009c0dd7c1f7c48c87286cd71b73ab4b7700d711858dcfe7378ca6ecb471c0381f36b8726eddf9a24e06e74c60169708ad56bb5a016

Download Submit
\??\Volume{06969d78-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5dedb8aa-d1f5-4eb6-861a-ea0cd612fec0}_OnDiskSnapshotProp

Filesize
5KB

MD5
8d21ca53a2266e144b825af2abb7d7a8

SHA1
a361d77810e91b80bfe83cf938f114cad4234422

SHA256
b95720931a5d9133b9e3a0f398d54e6830414843b64674f7529d98799f01c6d5

SHA512
75289c16134bf230741a69475d1ce50e85e3d77234bdd3777dfb2ba9d413c551abaf1d5f0c381b8a02d7d1c23dc58bef5169a4067f5fdda8c4ecf0fa04add871

Download Submit
memory/1120-222-0x0000016EBA780000-0x0000016EBA790000-memory.dmp

Filesize
64KB

Download
memory/1120-221-0x0000016EB9FD0000-0x0000016EB9FEA000-memory.dmp

Filesize
104KB

Download
memory/1120-267-0x00007FFD889B0000-0x00007FFD89471000-memory.dmp

Filesize
10.8MB

Download
memory/1120-265-0x0000016ED47A0000-0x0000016ED4CC8000-memory.dmp

Filesize
5.2MB

Download
memory/1120-233-0x0000016ED4010000-0x0000016ED4032000-memory.dmp

Filesize
136KB

Download
memory/1120-232-0x0000016ED4080000-0x0000016ED4126000-memory.dmp

Filesize
664KB

Download
memory/1120-148-0x0000000002630000-0x000000000265E000-memory.dmp

Filesize
184KB

Download
memory/1120-151-0x0000000002620000-0x000000000262E000-memory.dmp

Filesize
56KB

Download
memory/1120-231-0x0000016ED3FC0000-0x0000016ED3FC8000-memory.dmp

Filesize
32KB

Download
memory/1120-230-0x0000016ED3FB0000-0x0000016ED3FBE000-memory.dmp

Filesize
56KB

Download
memory/1120-229-0x0000016ED3F80000-0x0000016ED3FA6000-memory.dmp

Filesize
152KB

Download
memory/1120-228-0x00007FFD889B0000-0x00007FFD89471000-memory.dmp

Filesize
10.8MB

Download
memory/1120-227-0x0000016ED3BE0000-0x0000016ED3C26000-memory.dmp

Filesize
280KB

Download
memory/1120-226-0x0000016EBA900000-0x0000016EBA90A000-memory.dmp

Filesize
40KB

Download
memory/1120-225-0x0000016EBA7D0000-0x0000016EBA7D8000-memory.dmp

Filesize
32KB

Download
memory/1120-224-0x0000016EBA7A0000-0x0000016EBA7A8000-memory.dmp

Filesize
32KB

Download
memory/1120-223-0x0000016EBA7B0000-0x0000016EBA7C4000-memory.dmp

Filesize
80KB

Download
memory/1240-249-0x0000000006DE0000-0x0000000006DE8000-memory.dmp

Filesize
32KB

Download
memory/1240-255-0x00000000097A0000-0x00000000097D8000-memory.dmp

Filesize
224KB

Download
memory/1240-195-0x0000000002FE0000-0x0000000002FE8000-memory.dmp

Filesize
32KB

Download
memory/1240-264-0x000000000D6B0000-0x000000000DBDC000-memory.dmp

Filesize
5.2MB

Download
memory/1240-262-0x000000000C930000-0x000000000C93A000-memory.dmp

Filesize
40KB

Download
memory/1240-261-0x0000000009850000-0x000000000985C000-memory.dmp

Filesize
48KB

Download
memory/1240-260-0x0000000009810000-0x0000000009818000-memory.dmp

Filesize
32KB

Download
memory/1240-259-0x00000000097F0000-0x00000000097F8000-memory.dmp

Filesize
32KB

Download
memory/1240-258-0x00000000097E0000-0x00000000097E8000-memory.dmp

Filesize
32KB

Download
memory/1240-257-0x0000000009780000-0x0000000009788000-memory.dmp

Filesize
32KB

Download
memory/1240-256-0x0000000009760000-0x000000000976E000-memory.dmp

Filesize
56KB

Download
memory/1240-254-0x0000000007280000-0x0000000007288000-memory.dmp

Filesize
32KB

Download
memory/1240-253-0x0000000006F50000-0x0000000006F5C000-memory.dmp

Filesize
48KB

Download
memory/1240-252-0x0000000006F70000-0x0000000006F82000-memory.dmp

Filesize
72KB

Download
memory/1240-251-0x0000000006F40000-0x0000000006F4A000-memory.dmp

Filesize
40KB

Download
memory/1240-250-0x0000000006F30000-0x0000000006F40000-memory.dmp

Filesize
64KB

Download
memory/1240-248-0x0000000006DD0000-0x0000000006DDE000-memory.dmp

Filesize
56KB

Download
memory/1240-247-0x0000000005C80000-0x0000000005C8A000-memory.dmp

Filesize
40KB

Download
memory/1240-246-0x0000000005AE0000-0x0000000005B3E000-memory.dmp

Filesize
376KB

Download
memory/1240-245-0x0000000005A40000-0x0000000005AD2000-memory.dmp

Filesize
584KB

Download
memory/1240-243-0x0000000000D80000-0x0000000000DB8000-memory.dmp

Filesize
224KB

Download
memory/2348-209-0x0000000000E30000-0x0000000000E4E000-memory.dmp

Filesize
120KB

Download
memory/2348-215-0x0000000004A50000-0x0000000004A5E000-memory.dmp

Filesize
56KB

Download
memory/2348-217-0x0000000004A80000-0x0000000004A88000-memory.dmp

Filesize
32KB

Download
memory/2348-218-0x0000000004ED0000-0x0000000004F76000-memory.dmp

Filesize
664KB

Download
memory/2348-219-0x00000000050D0000-0x00000000050F2000-memory.dmp

Filesize
136KB

Download
memory/2348-220-0x00000000056B0000-0x0000000005C54000-memory.dmp

Filesize
5.6MB

Download
memory/2348-214-0x0000000004A40000-0x0000000004A48000-memory.dmp

Filesize
32KB

Download
memory/2348-213-0x0000000004310000-0x0000000004318000-memory.dmp

Filesize
32KB

Download
memory/2348-212-0x0000000004320000-0x0000000004366000-memory.dmp

Filesize
280KB

Download
memory/2348-216-0x0000000004A70000-0x0000000004A7E000-memory.dmp

Filesize
56KB

Download
memory/2348-211-0x00000000042A0000-0x00000000042C2000-memory.dmp

Filesize
136KB

Download
memory/2348-210-0x0000000004260000-0x0000000004270000-memory.dmp

Filesize
64KB

Download
memory/2516-244-0x0000000005630000-0x00000000056D6000-memory.dmp

Filesize
664KB

Download
memory/4260-235-0x0000000005580000-0x000000000558A000-memory.dmp

Filesize
40KB

Download