bazarbackdoor | 10cba83ef3cbfdc6636647c9fe1c273ffd7e833cd88b93f9c9666e8449764a36

Analysis

max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2023 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

krisp-v1.21.1-x64.msi
Size

70.1MB
MD5

e2d02c2d0d744411a0a6e2935dea4f84
SHA1

fba0fcd0cff2c4ceda85c87ef2458558c8754401
SHA256

10cba83ef3cbfdc6636647c9fe1c273ffd7e833cd88b93f9c9666e8449764a36
SHA512

99681131e3cebee6416c4e08cbf766f36d8560a2c47eb160d4bdb6394bd038da9f58a2546f866d4a61c42423e08922e6ef1b432981f0f1d3f2d6931b9b926ae9
SSDEEP

1572864:5bT5TAvyIckmyh4kzaYBqYeTPpCQiyjTtSEOWfd9rdnYjNxYfw8A:5bTtCaEaYBaPiCrOAFYjrYfw

Score

10^/10

bazarbackdoor backdoor

Malware Config

Signatures

BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\Installer\e5750a0.msi	BazarBackdoorVar3

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exerundll32.exe

flow pid process

18 4956 msiexec.exe
20 4956 msiexec.exe
52 3196 rundll32.exe

flow	pid	process
18	4956	msiexec.exe
20	4956	msiexec.exe
52	3196	rundll32.exe

Drops file in Drivers directory 10 IoCs

Processes:

DrvInst.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\KrispVad.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET81C3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe
File created	C:\Windows\System32\drivers\SET83E5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET83E5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe
File created	C:\Windows\System32\drivers\SET81C3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\KrispVad.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe

Executes dropped EXE 1 IoCs

Processes:

Krisp.exe

pid process

488 Krisp.exe

pid	process
488	Krisp.exe

Loads dropped DLL 34 IoCs

Processes:

MsiExec.exerundll32.exeMsiExec.exerundll32.exeMsiExec.exerundll32.exeMsiExec.exeMsiExec.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid	process
3808	MsiExec.exe
3796	rundll32.exe
3796	rundll32.exe
3796	rundll32.exe
1516	MsiExec.exe
2148	rundll32.exe
2148	rundll32.exe
2148	rundll32.exe
3968	MsiExec.exe
1516	MsiExec.exe
1516	MsiExec.exe
3196	rundll32.exe
3196	rundll32.exe
3196	rundll32.exe
532	MsiExec.exe
1476	MsiExec.exe
1476	MsiExec.exe
1048	rundll32.exe
1048	rundll32.exe
1048	rundll32.exe
1476	MsiExec.exe
3676	rundll32.exe
1476	MsiExec.exe
2592	rundll32.exe
3676	rundll32.exe
3676	rundll32.exe
2592	rundll32.exe
2592	rundll32.exe
1516	MsiExec.exe
1516	MsiExec.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
3968	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in System32 directory 17 IoCs

Processes:

DrvInst.exeMsiExec.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET7570.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET756E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET7570.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET756E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET756F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET756F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.inf	DrvInst.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\Krisp\models\c5.w.68df54.thw	msiexec.exe
File created	C:\Program Files\Krisp\Driver\KrispVad.inf	msiexec.exe
File created	C:\Program Files\Krisp\System.IO.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\Krisp\License\CommandLineParser_license.txt	msiexec.exe
File created	C:\Program Files\Krisp\License\libresample_license.txt	msiexec.exe
File created	C:\Program Files\Krisp\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Net.Security.dll	msiexec.exe
File created	C:\Program Files\Krisp\License\WebRTC_license.txt	msiexec.exe
File created	C:\Program Files\Krisp\License\RestSharp_license.txt	msiexec.exe
File created	C:\Program Files\Krisp\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\Krisp\Krisp.exe.config	msiexec.exe
File created	C:\Program Files\Krisp\License\libsndfile_license.txt	msiexec.exe
File created	C:\Program Files\Krisp\License\Stateless_license.txt	msiexec.exe
File created	C:\Program Files\Krisp\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.IO.FileSystem.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files\Krisp\Krisp.exe	msiexec.exe
File created	C:\Program Files\Krisp\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\Krisp\Driver\krisp_device_speaker.ico	msiexec.exe
File created	C:\Program Files\Krisp\Driver\KrispVad.cat	msiexec.exe
File created	C:\Program Files\Krisp\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files\Krisp\ja-JP\Krisp.resources.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\Krisp\models.cfg	msiexec.exe
File created	C:\Program Files\Krisp\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\Krisp\License\WiX_Toolset_license.txt	msiexec.exe
File created	C:\Program Files\Krisp\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Linq.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Net.Requests.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\Krisp\aec-sdk.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Text.Encoding.dll	msiexec.exe
File created	C:\Program Files\Krisp\Gu.Wpf.Media.dll	msiexec.exe
File created	C:\Program Files\Krisp\HidLibrary.dll	msiexec.exe
File created	C:\Program Files\Krisp\P7x64.dll	msiexec.exe
File created	C:\Program Files\Krisp\Sentry.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.IdentityModel.Tokens.Jwt.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\Krisp\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files\Krisp\models\c5.w.73bbdf.cfg	msiexec.exe
File created	C:\Program Files\Krisp\Microsoft.IdentityModel.Logging.dll	msiexec.exe
File created	C:\Program Files\Krisp\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files\Krisp\RestSharp.dll	msiexec.exe
File created	C:\Program Files\Krisp\License\Sentry_license.txt	msiexec.exe
File created	C:\Program Files\Krisp\System.Threading.Thread.dll	msiexec.exe

Drops file in Windows directory 60 IoCs

Processes:

rundll32.exeMsiExec.exemsiexec.exerundll32.exeDrvInst.exerundll32.exerundll32.exerundll32.exeDrvInst.exerundll32.exesvchost.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIB484.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI537F.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB473.tmp-\InstallerHelper.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB473.tmp-\RestSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID5AA.tmp-\InstallerHelper.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7303.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI537F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5CC7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6035.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\{96422A65-DEFD-44E4-8D8E-AA688E2D399D}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\e5750a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6035.tmp-\RestSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI865D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5AA.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{96422A65-DEFD-44E4-8D8E-AA688E2D399D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6035.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6035.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6A96.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB473.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5AA.tmp-\RestSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6035.tmp-\InstallerHelper.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF2A9.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI865D.tmp-\InstallerHelper.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB484.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB473.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB473.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID5AA.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e5750a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB484.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB484.tmp-\InstallerHelper.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB484.tmp-\RestSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5CF7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5AA.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI537F.tmp-\RestSharp.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI537F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID56B.tmp	msiexec.exe
File created	C:\Windows\Installer\{96422A65-DEFD-44E4-8D8E-AA688E2D399D}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\c_media.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI865D.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI537F.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5F59.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5AA.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI537F.tmp-\InstallerHelper.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI865D.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI865D.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e5750a2.msi	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI865D.tmp-\RestSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB484.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB473.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6035.tmp	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DrvInst.exesvchost.exeMsiExec.exeDrvInst.exevssvc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000008ccb747e6bc781e30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800008ccb747e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809008ccb747e000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008ccb747e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008ccb747e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe

Modifies data under HKEY_USERS 44 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\PackageName = "krisp-v1.21.1-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\Version = "18153473"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D11B6272CDA335D4F81A41911191A3D8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\ProductIcon = "C:\\Windows\\Installer\\{96422A65-DEFD-44E4-8D8E-AA688E2D399D}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D11B6272CDA335D4F81A41911191A3D8\56A22469DFED4E44D8E8AA86E8D293D9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\ProductName = "Krisp"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\PackageCode = "2EEF834E1C955EC458B67DA548AB5437"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\56A22469DFED4E44D8E8AA86E8D293D9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\56A22469DFED4E44D8E8AA86E8D293D9\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\AuthorizedLUAApp = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exe

pid process

3192 msiexec.exe
3192 msiexec.exe
3968 MsiExec.exe
3968 MsiExec.exe
532 MsiExec.exe
532 MsiExec.exe
532 MsiExec.exe
532 MsiExec.exe

pid	process
3192	msiexec.exe
3192	msiexec.exe
3968	MsiExec.exe
3968	MsiExec.exe
532	MsiExec.exe
532	MsiExec.exe
532	MsiExec.exe
532	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4956	msiexec.exe
Token: SeSecurityPrivilege	3192	msiexec.exe
Token: SeCreateTokenPrivilege	4956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4956	msiexec.exe
Token: SeLockMemoryPrivilege	4956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4956	msiexec.exe
Token: SeMachineAccountPrivilege	4956	msiexec.exe
Token: SeTcbPrivilege	4956	msiexec.exe
Token: SeSecurityPrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeLoadDriverPrivilege	4956	msiexec.exe
Token: SeSystemProfilePrivilege	4956	msiexec.exe
Token: SeSystemtimePrivilege	4956	msiexec.exe
Token: SeProfSingleProcessPrivilege	4956	msiexec.exe
Token: SeIncBasePriorityPrivilege	4956	msiexec.exe
Token: SeCreatePagefilePrivilege	4956	msiexec.exe
Token: SeCreatePermanentPrivilege	4956	msiexec.exe
Token: SeBackupPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeShutdownPrivilege	4956	msiexec.exe
Token: SeDebugPrivilege	4956	msiexec.exe
Token: SeAuditPrivilege	4956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4956	msiexec.exe
Token: SeChangeNotifyPrivilege	4956	msiexec.exe
Token: SeRemoteShutdownPrivilege	4956	msiexec.exe
Token: SeUndockPrivilege	4956	msiexec.exe
Token: SeSyncAgentPrivilege	4956	msiexec.exe
Token: SeEnableDelegationPrivilege	4956	msiexec.exe
Token: SeManageVolumePrivilege	4956	msiexec.exe
Token: SeImpersonatePrivilege	4956	msiexec.exe
Token: SeCreateGlobalPrivilege	4956	msiexec.exe
Token: SeCreateTokenPrivilege	4956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4956	msiexec.exe
Token: SeLockMemoryPrivilege	4956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4956	msiexec.exe
Token: SeMachineAccountPrivilege	4956	msiexec.exe
Token: SeTcbPrivilege	4956	msiexec.exe
Token: SeSecurityPrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeLoadDriverPrivilege	4956	msiexec.exe
Token: SeSystemProfilePrivilege	4956	msiexec.exe
Token: SeSystemtimePrivilege	4956	msiexec.exe
Token: SeProfSingleProcessPrivilege	4956	msiexec.exe
Token: SeIncBasePriorityPrivilege	4956	msiexec.exe
Token: SeCreatePagefilePrivilege	4956	msiexec.exe
Token: SeCreatePermanentPrivilege	4956	msiexec.exe
Token: SeBackupPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeShutdownPrivilege	4956	msiexec.exe
Token: SeDebugPrivilege	4956	msiexec.exe
Token: SeAuditPrivilege	4956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4956	msiexec.exe
Token: SeChangeNotifyPrivilege	4956	msiexec.exe
Token: SeRemoteShutdownPrivilege	4956	msiexec.exe
Token: SeUndockPrivilege	4956	msiexec.exe
Token: SeSyncAgentPrivilege	4956	msiexec.exe
Token: SeEnableDelegationPrivilege	4956	msiexec.exe
Token: SeManageVolumePrivilege	4956	msiexec.exe
Token: SeImpersonatePrivilege	4956	msiexec.exe
Token: SeCreateGlobalPrivilege	4956	msiexec.exe
Token: SeCreateTokenPrivilege	4956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4956	msiexec.exe
Token: SeLockMemoryPrivilege	4956	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

4956 msiexec.exe
4956 msiexec.exe

pid	process
4956	msiexec.exe
4956	msiexec.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exesvchost.exeMsiExec.execmd.exemsiexec.exe

description	pid	process	target process
PID 3192 wrote to memory of 3808	3192	msiexec.exe	MsiExec.exe
PID 3192 wrote to memory of 3808	3192	msiexec.exe	MsiExec.exe
PID 3808 wrote to memory of 3796	3808	MsiExec.exe	rundll32.exe
PID 3808 wrote to memory of 3796	3808	MsiExec.exe	rundll32.exe
PID 3192 wrote to memory of 636	3192	msiexec.exe	srtasks.exe
PID 3192 wrote to memory of 636	3192	msiexec.exe	srtasks.exe
PID 3192 wrote to memory of 1516	3192	msiexec.exe	MsiExec.exe
PID 3192 wrote to memory of 1516	3192	msiexec.exe	MsiExec.exe
PID 1516 wrote to memory of 2148	1516	MsiExec.exe	rundll32.exe
PID 1516 wrote to memory of 2148	1516	MsiExec.exe	rundll32.exe
PID 3192 wrote to memory of 3968	3192	msiexec.exe	MsiExec.exe
PID 3192 wrote to memory of 3968	3192	msiexec.exe	MsiExec.exe
PID 3192 wrote to memory of 3968	3192	msiexec.exe	MsiExec.exe
PID 1516 wrote to memory of 3196	1516	MsiExec.exe	rundll32.exe
PID 1516 wrote to memory of 3196	1516	MsiExec.exe	rundll32.exe
PID 3192 wrote to memory of 532	3192	msiexec.exe	MsiExec.exe
PID 3192 wrote to memory of 532	3192	msiexec.exe	MsiExec.exe
PID 3192 wrote to memory of 532	3192	msiexec.exe	MsiExec.exe
PID 3192 wrote to memory of 1476	3192	msiexec.exe	MsiExec.exe
PID 3192 wrote to memory of 1476	3192	msiexec.exe	MsiExec.exe
PID 3568 wrote to memory of 5036	3568	svchost.exe	DrvInst.exe
PID 3568 wrote to memory of 5036	3568	svchost.exe	DrvInst.exe
PID 3568 wrote to memory of 3572	3568	svchost.exe	DrvInst.exe
PID 3568 wrote to memory of 3572	3568	svchost.exe	DrvInst.exe
PID 3568 wrote to memory of 1972	3568	svchost.exe	DrvInst.exe
PID 3568 wrote to memory of 1972	3568	svchost.exe	DrvInst.exe
PID 1476 wrote to memory of 1048	1476	MsiExec.exe	rundll32.exe
PID 1476 wrote to memory of 1048	1476	MsiExec.exe	rundll32.exe
PID 1476 wrote to memory of 3676	1476	MsiExec.exe	rundll32.exe
PID 1476 wrote to memory of 3676	1476	MsiExec.exe	rundll32.exe
PID 1476 wrote to memory of 2592	1476	MsiExec.exe	rundll32.exe
PID 1476 wrote to memory of 2592	1476	MsiExec.exe	rundll32.exe
PID 1516 wrote to memory of 864	1516	MsiExec.exe	rundll32.exe
PID 1516 wrote to memory of 864	1516	MsiExec.exe	rundll32.exe
PID 3192 wrote to memory of 1680	3192	msiexec.exe	cmd.exe
PID 3192 wrote to memory of 1680	3192	msiexec.exe	cmd.exe
PID 1680 wrote to memory of 3756	1680	cmd.exe	cmd.exe
PID 1680 wrote to memory of 3756	1680	cmd.exe	cmd.exe
PID 1680 wrote to memory of 3224	1680	cmd.exe	xcopy.exe
PID 1680 wrote to memory of 3224	1680	cmd.exe	xcopy.exe
PID 4956 wrote to memory of 488	4956	msiexec.exe	Krisp.exe
PID 4956 wrote to memory of 488	4956	msiexec.exe	Krisp.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\krisp-v1.21.1-x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4956

C:\Program Files\Krisp\Krisp.exe
"C:\Program Files\Krisp\Krisp.exe" -m
2⤵
- Executes dropped EXE
PID:488

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 49CBD64563557355B1769358C5BB3EE3 C
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3808

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA453.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240559281 1 InstallerHelper!InstallerHelper.CustomActions.GetOSVersion
3⤵
- Loads dropped DLL
PID:3796

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:636

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 1C65B093E5684C9885BDF75E0CF329AC
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI537F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240604218 2 InstallerHelper!InstallerHelper.CustomActions.GetOSVersion
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2148

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI6035.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240607296 32 InstallerHelper!InstallerHelper.CustomActions.SendInstallationAnalytics
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
PID:3196

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSID5AA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240637359 103 InstallerHelper!InstallerHelper.CustomActions.SleepForMagicTimeout
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:864

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B820B7D238BD0BC6E286E77638CF810B
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3968

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6E555101850771156E4315CE7629B201 E Global\MSI0000
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:532

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding BCBE558EAC324B5006F927D7E34F9706 E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI865D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240617062 73 InstallerHelper!InstallerHelper.CustomActions.AddInstallationGuid
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1048

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSIB473.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628859 78 InstallerHelper!InstallerHelper.CustomActions.KrispDevicePlug
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3676

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSIB484.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628984 79 InstallerHelper!InstallerHelper.CustomActions.SetDriverDisplayNames
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2592

C:\Windows\system32\cmd.exe
cmd /c echo F|xcopy /y C:\Users\Admin\AppData\Local\Temp\MSI69475.LOG "C:\Users\Admin\AppData\Local\\Krisp\\Logs\Krisp-1.21.1-install-success.log"
2⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo F"
3⤵
PID:3756

C:\Windows\system32\xcopy.exe
xcopy /y C:\Users\Admin\AppData\Local\Temp\MSI69475.LOG "C:\Users\Admin\AppData\Local\\Krisp\\Logs\Krisp-1.21.1-install-success.log"
3⤵
PID:3224

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Krisp\Driver\KrispVad.inf" "9" "42d05aeab" "000000000000013C" "WinSta0\Default" "0000000000000150" "208" "C:\Program Files\Krisp\Driver"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5036

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "0" "ROOT\KrispSimple\0000" "" "" "4a41b4dfb" "0000000000000000"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3572

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\KRISPSIMPLE\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11821b73e4:Krisp_VAD:0.9.4.0:root\krispsimple," "4c1ec1a23" "0000000000000154"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5750a1.rbs
Filesize
712KB

MD5
615fc6bae4158754e5c165e9a1bc961e

SHA1
c8d6f855e44787759a66df58fd2a7746b53a8a73

SHA256
43564281454451248719aa99bf71b6666c192a4d02e6ad5934c374fff90b336c

SHA512
6008b092f062fd84a609cc60ed625be4667679ec932129ed94301e401d2e578d35b8b70a0d12074940241e13aba6b28ecfc3b4e385d2b59eafac897482305260

Download Submit
C:\PROGRA~1\Krisp\Driver\KrispVad.cat
Filesize
10KB

MD5
4b250e3bb93ef588f7aec7edba7e546b

SHA1
f6355bbc73b0634b3aba4291301262e851c15f48

SHA256
72c0cfc94a3cc68a9d6fb3f158507749b27199221005b8766ce51b6cb375d0a9

SHA512
6efccb89ab7605520ae09c9c452f04277d1706002adba40ceab4e0385596133df16212ef3729276e8d8847bb54221ce572e876394fd6daa549a60a0d777fe730

Download Submit
C:\PROGRA~1\Krisp\Driver\KrispVad.sys
Filesize
54KB

MD5
351825097a91893cab9c2f628ba86163

SHA1
c2ec5b045741e944cac4e41617d87f828e572f00

SHA256
cbc1e1de4ce6d22658415b1b8c07be50b1e24326863133fc3d3ac5750457e2fc

SHA512
552d829b00fdd38ef82feba74de9b8ae0e6a7afb0cba08f01319354237f84f797ae0ddde917c4a008b52bac3f9bec1bc06431e267a7387e46cb4474e2f5d2f32

Download Submit
C:\Program Files\Krisp\Driver\KrispVad.inf
Filesize
6KB

MD5
97af85af56c5ce7e475498e9cb35133e

SHA1
01ebe8ef0a22071562fac4103534254dc4fffc0e

SHA256
9a7e1491f85e04eaee4458222b0c1b38749eec448f62c493c1f492882b06a422

SHA512
245357e042098d7141d6d0481b3afd63b4a2872addb5afe572e6edbac7b2674eaa63d638fc19fd52ccd187418f57f377b34fb459f87b69340dba7dbce2dd3a17

Download Submit
C:\Program Files\Krisp\Krisp.exe
Filesize
2.5MB

MD5
e14e3239cac4d41015693e67934fb0a3

SHA1
1d31b181b450479d106c20bb1ad84b4e89a20470

SHA256
54f49defa4f11bad32f26cc9704ea23d50f108c236b3c085d9729d6e730075bf

SHA512
8aeedb942c7eaf5efe2a322e6b13e206681d56ce5f98d164a56c62802fe811cb868259ebfdf827cb9202ea567ca3656193937271818859d21b1ad73713258281

Download Submit
C:\Program Files\Krisp\Krisp.exe.config
Filesize
23KB

MD5
79832ae3ccb39c8d4b360be4d72b7098

SHA1
43eb3a8dde5a7116afde16c12eb20770fbfe27de

SHA256
4f13152de4db5c855deb15352e058f7367c847524d638ebfa7d919835f1267cb

SHA512
9ca21185b106d53537a6bb19adf8b22d4ca99d180ae1ca39f893a7a61c995ed28471f56ff5062f0f95a7f22bcf6be91492c08164fa2382ada9b41a3e518b130b

Download Submit
C:\Program Files\Krisp\bqbp4jhv.newcfg
Filesize
23KB

MD5
02f22a49af6c2ebe5d05b28e60159154

SHA1
1243fd1c64a2e62a58734736929c4967e5a39dec

SHA256
e80253af09c1ea354a26c953eddf3db382a2480a8d666f172bc45eb9529dbfd9

SHA512
b80f7363466b62ee4620be75d49663f2ecf57eaa7d95739841794f25aadc834f3ac64537931ade2e11472dc071df99eadb2430e1e4535cc21bc3eb915ea79a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
Filesize
471B

MD5
4bb58e088b31084c9a1c60de7778d0b3

SHA1
8f28e6bc4a2846f4b27ce062bed108e7bb33a2cf

SHA256
b680707aab2970dcb952fd5908da0e005aa8f7fb9247c04d2da0b4ed410a9345

SHA512
71e0ce9e3730e3d546685add488eda1cbd2f05b84d07beea520f9c8fb9edbec9b3d5876e12bde6f9598845ea11c7dfa663ea677505ac41891f1f83b0297fb6b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_D18EFA015E0FCCFE81C9B5AC8BE295D4
Filesize
471B

MD5
9875c1ae3ab48a5a42ca951ffbfd2b7a

SHA1
a867074c55d3de4365cd0a4a290abe3fca79ded9

SHA256
904ab33616038c014207c8837a483d4bac1ba028a9f86ed2d27326ad3b6a3fcc

SHA512
3a7dfa865405cde419c68f1435dd6c8fdc896f53cb76e01729076c0e507f58497e1883bff1a5aa53b4cdb72b6db2b6d4996799fc21d6504a850c623aeda5e62d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
Filesize
396B

MD5
f1ab21d55b591694bb1095d8e58b8bb4

SHA1
aa7ca2336bb098e1bacf1f622eea8390669ebd0b

SHA256
2a9546577d383714d8f57d3699b5f6e7466f625c1e5f69d06cf0c97281594f05

SHA512
cc42684d48ae2a5442234403c3f9d91c1029d7ee8b2226013c62012a5ef9cd82d005e00bdccc3500c103e2ba8560d4f7d3849682f758651d47ede186d4d6b211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_D18EFA015E0FCCFE81C9B5AC8BE295D4
Filesize
412B

MD5
68e1fa53db0fb86de25f5440fede249f

SHA1
3d5907f0c42a5ef21049b6f44d2049ed3046343f

SHA256
28b43c8d004677fdf4cf62ebaa2327a2c87c650c3ceb6c70af02b64e1b29f7aa

SHA512
69b41843c801f453bbd869c64506d39d63b46b8db4bf279ba60035914b655bc67f0ebee923c38d65676f097ad14298fe4cf8b9581c871d033e27bd7d03908016

Download Submit
C:\Users\Admin\AppData\Local\Krisp\Krisp.exe_Url_umx0atrp0vhkedazz45qlo3visl5aucc\1.21.1.0\rs1uk1f4.newcfg
Filesize
318B

MD5
32edb68f066f5fd6ea12f82ab4d63f7a

SHA1
ba93669c7143705156d2cec63a7cc792adc5cd37

SHA256
515824626eccd4db8cf82ab90e6ecf32e6de090e47242157a2d37493cea1f885

SHA512
2ead41d509627f9a4a2930504fdc21d672e78b85f15531d1c3efcbf896dc6182c1f5f2d8bb648f596c0ae90a21c482c2638160a33785df60a47f565160392c5c

Download Submit
C:\Users\Admin\AppData\Local\Krisp\Krisp.exe_Url_umx0atrp0vhkedazz45qlo3visl5aucc\1.21.1.0\user.config
Filesize
317B

MD5
defb61abe48e6190e5019541cfea3327

SHA1
4bb5d585a5d1cb2151768c48891973e939079ea7

SHA256
f06961100e6df8295d7f653a169b3fb844328efc0addf5ddaf5c4a50586b7c1d

SHA512
a391a230eaf9973795f864b4a617e99808b71e3711b9a3c4c197f9fd0507bc9c9c0e58821e659bf0d379e2effe0ca6a3c0ee1a23e5b5e3e94c49ce00101a8f9a

Download Submit
C:\Users\Admin\AppData\Local\Krisp\Logs\Krisp-1.21.1-install-success.log
Filesize
483KB

MD5
e1b98aac5f415d8d8106a29c553a9ff7

SHA1
ca115efd5c4f42fc42a4ac19ea3f555c82535aaa

SHA256
470d259100e41642293210024c1fdf3b0156930816c8212824206f79d8589832

SHA512
5769ddd2dfde3c27de9fd70f5ea7d4928d67ee15cac6e33444d01a3c583ffa7dcecd7a2e856f72ddec64dd5a012f75a2fe26d11661c89b0d6d390faf1ded17b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Filesize
651B

MD5
00bfeb783aeff425ce898d55718d506d

SHA1
aac7a973dc1f9ca7abc529c7ea37ad7eaf491b8f

SHA256
d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580

SHA512
2209d5f4999cb36ebf26c6b8cb3195cc9fc0f0a103f4a28dd77b04605d7c6e79d47d806454c63b8d42bbe32864be7cdb56df3cccf71a6c27fe0b331d8304e1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI69475.LOG
Filesize
72KB

MD5
2e90a5668f9322986d029f6790ed9fbe

SHA1
39b0301d53f4611a36347e85ceb6adcc247c294d

SHA256
c6a12c3642436edc15f96a91346dda598c9afb9e3197286b9bb286650865ed54

SHA512
23e084b02bf3d1b52c87d863e7e751d9959269bbbc25ddc038dd1a4bbca892f493fa3de7a9108ae3c7b973579c2def905c7e374139b2e18f474a52783be8c5ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA453.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA453.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA453.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA453.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA453.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\INF\oem3.inf
Filesize
6KB

MD5
97af85af56c5ce7e475498e9cb35133e

SHA1
01ebe8ef0a22071562fac4103534254dc4fffc0e

SHA256
9a7e1491f85e04eaee4458222b0c1b38749eec448f62c493c1f492882b06a422

SHA512
245357e042098d7141d6d0481b3afd63b4a2872addb5afe572e6edbac7b2674eaa63d638fc19fd52ccd187418f57f377b34fb459f87b69340dba7dbce2dd3a17

Download Submit
C:\Windows\Installer\MSI537F.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSI537F.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSI537F.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSI537F.tmp-\CustomAction.config
Filesize
1KB

MD5
01c01d040563a55e0fd31cc8daa5f155

SHA1
3c1c229703198f9772d7721357f1b90281917842

SHA256
33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f

SHA512
9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5

Download Submit
C:\Windows\Installer\MSI537F.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSI537F.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSI537F.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSI537F.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSI5CF7.tmp
Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI5CF7.tmp
Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI5F59.tmp
Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI5F59.tmp
Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSI6035.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSI6035.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSI6035.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSI6035.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSI6035.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSI6035.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSI6035.tmp-\RestSharp.dll
Filesize
187KB

MD5
6122f53b28d172d5711b79427d89b409

SHA1
6bde48731f89b3bbbde7614898638a4f33121114

SHA256
676e00e8f81b6c25e122277d55a56d28924a4cc304f160ad1dfb803e8d2ea594

SHA512
a9e6d2bd3b62a7b37f7a0aa241f057e8266ed836b3df92ab4dc9d7ae7a9e928bd468d7d8e88e7ba1ca04ca443a0a552ca6419cea69cc3f9b3f2c7e7f7899a4b9

Download Submit
C:\Windows\Installer\MSI6A96.tmp
Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI6A96.tmp
Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI7303.tmp
Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\MSI7303.tmp
Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\MSI865D.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSI865D.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSI865D.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSI865D.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSI865D.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSI865D.tmp-\Newtonsoft.Json.dll
Filesize
683KB

MD5
6815034209687816d8cf401877ec8133

SHA1
1248142eb45eed3beb0d9a2d3b8bed5fe2569b10

SHA256
7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814

SHA512
3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721

Download Submit
C:\Windows\Installer\MSIB473.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSIB473.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSIB473.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSIB473.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSIB473.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSIB484.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSIB484.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSIB484.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSIB484.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSIB484.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSID56B.tmp
Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSID56B.tmp
Filesize
149KB

MD5
418322f7be2b68e88a93a048ac75a757

SHA1
09739792ff1c30f73dacafbe503630615922b561

SHA256
ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b

SHA512
253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef

Download Submit
C:\Windows\Installer\MSID5AA.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSID5AA.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSID5AA.tmp
Filesize
617KB

MD5
6985489e7d7d224e6d2cabc8c9cf71c0

SHA1
bcfc8b2eba0402f0d0913c362d192096aae71483

SHA256
a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38

SHA512
ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c

Download Submit
C:\Windows\Installer\MSID5AA.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSID5AA.tmp-\InstallerHelper.dll
Filesize
177KB

MD5
bab22511f48c61e6221044455297d7a6

SHA1
d57fe2e104c4b269b85880449e9217bde8a47b23

SHA256
7369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa

SHA512
4d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde

Download Submit
C:\Windows\Installer\MSIF2A9.tmp
Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIF2A9.tmp
Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\e5750a0.msi
Filesize
70.1MB

MD5
e2d02c2d0d744411a0a6e2935dea4f84

SHA1
fba0fcd0cff2c4ceda85c87ef2458558c8754401

SHA256
10cba83ef3cbfdc6636647c9fe1c273ffd7e833cd88b93f9c9666e8449764a36

SHA512
99681131e3cebee6416c4e08cbf766f36d8560a2c47eb160d4bdb6394bd038da9f58a2546f866d4a61c42423e08922e6ef1b432981f0f1d3f2d6931b9b926ae9

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt
Filesize
146KB

MD5
14548a5bde4afe6f0102c4dba4670cab

SHA1
d9cf060f3702ada34d148d01782f6134c2913ae0

SHA256
70c767cab146f6eb4dda9ed7cf1365ab042f7751d96bbc1032680bd9be886d38

SHA512
c109f0761bc2f3ac60304466431a0d6710d49ab51ce8070a32b3119c77b769a07e6b7960068d0f22b7415572bc22a8684e43d9a858d8bf54351c8427d1f2aecf

Download Submit
C:\Windows\System32\DriverStore\FileRepository\KRISPV~1.INF\KrispVad.sys
Filesize
54KB

MD5
351825097a91893cab9c2f628ba86163

SHA1
c2ec5b045741e944cac4e41617d87f828e572f00

SHA256
cbc1e1de4ce6d22658415b1b8c07be50b1e24326863133fc3d3ac5750457e2fc

SHA512
552d829b00fdd38ef82feba74de9b8ae0e6a7afb0cba08f01319354237f84f797ae0ddde917c4a008b52bac3f9bec1bc06431e267a7387e46cb4474e2f5d2f32

Download Submit
C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.PNF
Filesize
16KB

MD5
79b13648e03121462ed4f6e0385c3405

SHA1
fb4cf203b5b21fb7f94bbe77ebedab522fb58125

SHA256
b4c9328f6740d2ce7517efcd4141911fc92d1233f384927b7825e88615a3916c

SHA512
11da4aab650df04ceac9bd2ec4c4fb68c8cd21a6b783dabbc772072276e684d41948cb85a22751d9912d17e292c8135a8bd48922d62d1d7631df7f799d8681ed

Download Submit
C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.cat
Filesize
10KB

MD5
4b250e3bb93ef588f7aec7edba7e546b

SHA1
f6355bbc73b0634b3aba4291301262e851c15f48

SHA256
72c0cfc94a3cc68a9d6fb3f158507749b27199221005b8766ce51b6cb375d0a9

SHA512
6efccb89ab7605520ae09c9c452f04277d1706002adba40ceab4e0385596133df16212ef3729276e8d8847bb54221ce572e876394fd6daa549a60a0d777fe730

Download Submit
C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\krispvad.inf
Filesize
6KB

MD5
97af85af56c5ce7e475498e9cb35133e

SHA1
01ebe8ef0a22071562fac4103534254dc4fffc0e

SHA256
9a7e1491f85e04eaee4458222b0c1b38749eec448f62c493c1f492882b06a422

SHA512
245357e042098d7141d6d0481b3afd63b4a2872addb5afe572e6edbac7b2674eaa63d638fc19fd52ccd187418f57f377b34fb459f87b69340dba7dbce2dd3a17

Download Submit
C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.cat
Filesize
10KB

MD5
4b250e3bb93ef588f7aec7edba7e546b

SHA1
f6355bbc73b0634b3aba4291301262e851c15f48

SHA256
72c0cfc94a3cc68a9d6fb3f158507749b27199221005b8766ce51b6cb375d0a9

SHA512
6efccb89ab7605520ae09c9c452f04277d1706002adba40ceab4e0385596133df16212ef3729276e8d8847bb54221ce572e876394fd6daa549a60a0d777fe730

Download Submit
C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.inf
Filesize
6KB

MD5
97af85af56c5ce7e475498e9cb35133e

SHA1
01ebe8ef0a22071562fac4103534254dc4fffc0e

SHA256
9a7e1491f85e04eaee4458222b0c1b38749eec448f62c493c1f492882b06a422

SHA512
245357e042098d7141d6d0481b3afd63b4a2872addb5afe572e6edbac7b2674eaa63d638fc19fd52ccd187418f57f377b34fb459f87b69340dba7dbce2dd3a17

Download Submit
C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.sys
Filesize
54KB

MD5
351825097a91893cab9c2f628ba86163

SHA1
c2ec5b045741e944cac4e41617d87f828e572f00

SHA256
cbc1e1de4ce6d22658415b1b8c07be50b1e24326863133fc3d3ac5750457e2fc

SHA512
552d829b00fdd38ef82feba74de9b8ae0e6a7afb0cba08f01319354237f84f797ae0ddde917c4a008b52bac3f9bec1bc06431e267a7387e46cb4474e2f5d2f32

Download Submit
C:\Windows\System32\drivers\KrispVad.sys
Filesize
54KB

MD5
351825097a91893cab9c2f628ba86163

SHA1
c2ec5b045741e944cac4e41617d87f828e572f00

SHA256
cbc1e1de4ce6d22658415b1b8c07be50b1e24326863133fc3d3ac5750457e2fc

SHA512
552d829b00fdd38ef82feba74de9b8ae0e6a7afb0cba08f01319354237f84f797ae0ddde917c4a008b52bac3f9bec1bc06431e267a7387e46cb4474e2f5d2f32

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
2b4277241e927909683d373f2da1f342

SHA1
7161a2c6fcdb32b3bec53dd712f4c1ae61379125

SHA256
11a25c4f51b8fa363dd299848641812fb5a772295c893ca676c2498fc79a3a0b

SHA512
6433591d15472a11e3e981ab160d65ec969919dc17a08be737d5ece85df9e7f82acfd9b161a28a935ae45b5fe3d37fe4e11d4f95051c6c30491f432835e4bbd9

Download Submit
\??\Volume{7e74cb8c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{aa12286f-5c16-4607-b8b0-9716c45de606}_OnDiskSnapshotProp
Filesize
5KB

MD5
f7b8ab064d378d4b8a361791915a2d8b

SHA1
a139e7754aec93097865638df7303cd45bf8b315

SHA256
7942f2b0e39d076529daace90fe632bffbe6e6af8ee8c8beab25d9140e4a81b2

SHA512
f408aa9f24e0c93cdd7793a48713bf9fbf3556f85c6782adb8d7d4136ebfc6ef3b3d47947ff7d0db73972dfc5d868d54fe33af29b31dd1609b7cfd1f991a487d

Download Submit
memory/488-770-0x000001A92CF90000-0x000001A92CFAC000-memory.dmp

Filesize
112KB

Download
memory/488-768-0x000001A92C9B0000-0x000001A92CC38000-memory.dmp

Filesize
2.5MB

Download
memory/488-771-0x000001A92CFB0000-0x000001A92CFC2000-memory.dmp

Filesize
72KB

Download
memory/488-772-0x000001A92EA60000-0x000001A92EA92000-memory.dmp

Filesize
200KB

Download
memory/488-773-0x000001A948930000-0x000001A948940000-memory.dmp

Filesize
64KB

Download
memory/864-743-0x000002547D190000-0x000002547D1A0000-memory.dmp

Filesize
64KB

Download
memory/864-744-0x000002547D190000-0x000002547D1A0000-memory.dmp

Filesize
64KB

Download
memory/864-745-0x000002547D190000-0x000002547D1A0000-memory.dmp

Filesize
64KB

Download
memory/864-746-0x000002547D190000-0x000002547D1A0000-memory.dmp

Filesize
64KB

Download
memory/1048-539-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/1048-639-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/1048-534-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/1048-535-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/1048-536-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/1048-537-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/1048-634-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/1048-635-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/1048-636-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/1048-637-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/1048-638-0x0000021641790000-0x00000216417A0000-memory.dmp

Filesize
64KB

Download
memory/2592-696-0x0000023A34560000-0x0000023A34570000-memory.dmp

Filesize
64KB

Download
memory/2592-695-0x0000023A34560000-0x0000023A34570000-memory.dmp

Filesize
64KB

Download
memory/3196-236-0x0000017A732C0000-0x0000017A732F6000-memory.dmp

Filesize
216KB

Download
memory/3196-244-0x0000017A74F00000-0x0000017A74F10000-memory.dmp

Filesize
64KB

Download
memory/3196-245-0x0000017A75EC0000-0x0000017A763E8000-memory.dmp

Filesize
5.2MB

Download
memory/3196-240-0x0000017A74F00000-0x0000017A74F10000-memory.dmp

Filesize
64KB

Download
memory/3196-243-0x0000017A74F00000-0x0000017A74F10000-memory.dmp

Filesize
64KB

Download
memory/3196-239-0x0000017A74F00000-0x0000017A74F10000-memory.dmp

Filesize
64KB

Download
memory/3196-238-0x0000017A74F00000-0x0000017A74F10000-memory.dmp

Filesize
64KB

Download
memory/3676-682-0x0000029A2F210000-0x0000029A2F220000-memory.dmp

Filesize
64KB

Download
memory/3676-697-0x0000029A2F210000-0x0000029A2F220000-memory.dmp

Filesize
64KB

Download
memory/3676-688-0x0000029A2F210000-0x0000029A2F220000-memory.dmp

Filesize
64KB

Download
memory/3796-157-0x0000025893480000-0x0000025893490000-memory.dmp

Filesize
64KB

Download
memory/3796-158-0x0000025893480000-0x0000025893490000-memory.dmp

Filesize
64KB

Download
memory/3796-162-0x00000258ACF60000-0x00000258ACF90000-memory.dmp

Filesize
192KB

Download
memory/3796-155-0x0000025893480000-0x0000025893490000-memory.dmp

Filesize
64KB

Download
memory/3796-156-0x0000025893480000-0x0000025893490000-memory.dmp

Filesize
64KB

Download
memory/3796-154-0x0000025893490000-0x00000258934BE000-memory.dmp

Filesize
184KB

Download