Analysis
-
max time kernel
105s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2023 17:52
Behavioral task
behavioral1
Sample
krisp-v1.21.1-x64.msi
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
krisp-v1.21.1-x64.msi
Resource
win10v2004-20230221-en
General
-
Target
krisp-v1.21.1-x64.msi
-
Size
70.1MB
-
MD5
e2d02c2d0d744411a0a6e2935dea4f84
-
SHA1
fba0fcd0cff2c4ceda85c87ef2458558c8754401
-
SHA256
10cba83ef3cbfdc6636647c9fe1c273ffd7e833cd88b93f9c9666e8449764a36
-
SHA512
99681131e3cebee6416c4e08cbf766f36d8560a2c47eb160d4bdb6394bd038da9f58a2546f866d4a61c42423e08922e6ef1b432981f0f1d3f2d6931b9b926ae9
-
SSDEEP
1572864:5bT5TAvyIckmyh4kzaYBqYeTPpCQiyjTtSEOWfd9rdnYjNxYfw8A:5bTtCaEaYBaPiCrOAFYjrYfw
Malware Config
Signatures
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 1 IoCs
Processes:
resource yara_rule C:\Windows\Installer\e5750a0.msi BazarBackdoorVar3 -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exerundll32.exeflow pid process 18 4956 msiexec.exe 20 4956 msiexec.exe 52 3196 rundll32.exe -
Drops file in Drivers directory 10 IoCs
Processes:
DrvInst.exeDrvInst.exedescription ioc process File opened for modification C:\Windows\System32\drivers\KrispVad.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\drmk.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SET81C3.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\portcls.sys DrvInst.exe File created C:\Windows\System32\drivers\SET83E5.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\SET83E5.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\portcls.sys DrvInst.exe File created C:\Windows\System32\drivers\SET81C3.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\KrispVad.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\drmk.sys DrvInst.exe -
Executes dropped EXE 1 IoCs
Processes:
Krisp.exepid process 488 Krisp.exe -
Loads dropped DLL 34 IoCs
Processes:
MsiExec.exerundll32.exeMsiExec.exerundll32.exeMsiExec.exerundll32.exeMsiExec.exeMsiExec.exerundll32.exerundll32.exerundll32.exerundll32.exepid process 3808 MsiExec.exe 3796 rundll32.exe 3796 rundll32.exe 3796 rundll32.exe 1516 MsiExec.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 3968 MsiExec.exe 1516 MsiExec.exe 1516 MsiExec.exe 3196 rundll32.exe 3196 rundll32.exe 3196 rundll32.exe 532 MsiExec.exe 1476 MsiExec.exe 1476 MsiExec.exe 1048 rundll32.exe 1048 rundll32.exe 1048 rundll32.exe 1476 MsiExec.exe 3676 rundll32.exe 1476 MsiExec.exe 2592 rundll32.exe 3676 rundll32.exe 3676 rundll32.exe 2592 rundll32.exe 2592 rundll32.exe 1516 MsiExec.exe 1516 MsiExec.exe 864 rundll32.exe 864 rundll32.exe 864 rundll32.exe 3968 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Drops file in System32 directory 17 IoCs
Processes:
DrvInst.exeMsiExec.exedescription ioc process File created C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET7570.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.PNF MsiExec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MsiExec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET756E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET7570.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET756E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET756F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\SET756F.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.inf DrvInst.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files\Krisp\models\c5.w.68df54.thw msiexec.exe File created C:\Program Files\Krisp\Driver\KrispVad.inf msiexec.exe File created C:\Program Files\Krisp\System.IO.dll msiexec.exe File created C:\Program Files\Krisp\System.Net.NameResolution.dll msiexec.exe File created C:\Program Files\Krisp\System.Net.WebSockets.dll msiexec.exe File created C:\Program Files\Krisp\License\CommandLineParser_license.txt msiexec.exe File created C:\Program Files\Krisp\License\libresample_license.txt msiexec.exe File created C:\Program Files\Krisp\System.Diagnostics.Process.dll msiexec.exe File created C:\Program Files\Krisp\System.Dynamic.Runtime.dll msiexec.exe File created C:\Program Files\Krisp\System.Net.Security.dll msiexec.exe File created C:\Program Files\Krisp\License\WebRTC_license.txt msiexec.exe File created C:\Program Files\Krisp\License\RestSharp_license.txt msiexec.exe File created C:\Program Files\Krisp\System.Resources.Writer.dll msiexec.exe File created C:\Program Files\Krisp\System.Xml.XmlDocument.dll msiexec.exe File created C:\Program Files\Krisp\Krisp.exe.config msiexec.exe File created C:\Program Files\Krisp\License\libsndfile_license.txt msiexec.exe File created C:\Program Files\Krisp\License\Stateless_license.txt msiexec.exe File created C:\Program Files\Krisp\System.Collections.NonGeneric.dll msiexec.exe File created C:\Program Files\Krisp\System.Diagnostics.FileVersionInfo.dll msiexec.exe File created C:\Program Files\Krisp\System.IO.FileSystem.dll msiexec.exe File created C:\Program Files\Krisp\System.IO.FileSystem.Watcher.dll msiexec.exe File created C:\Program Files\Krisp\Krisp.exe msiexec.exe File created C:\Program Files\Krisp\System.Globalization.Calendars.dll msiexec.exe File created C:\Program Files\Krisp\Driver\krisp_device_speaker.ico msiexec.exe File created C:\Program Files\Krisp\Driver\KrispVad.cat msiexec.exe File created C:\Program Files\Krisp\System.Diagnostics.Debug.dll msiexec.exe File created C:\Program Files\Krisp\System.Reflection.Extensions.dll msiexec.exe File created C:\Program Files\Krisp\System.Runtime.Serialization.Formatters.dll msiexec.exe File created C:\Program Files\Krisp\ja-JP\Krisp.resources.dll msiexec.exe File created C:\Program Files\Krisp\System.Net.NetworkInformation.dll msiexec.exe File created C:\Program Files\Krisp\System.Runtime.Serialization.Json.dll msiexec.exe File created C:\Program Files\Krisp\System.Security.Principal.dll msiexec.exe File created C:\Program Files\Krisp\System.Xml.XPath.XDocument.dll msiexec.exe File created C:\Program Files\Krisp\System.Net.Primitives.dll msiexec.exe File created C:\Program Files\Krisp\models.cfg msiexec.exe File created C:\Program Files\Krisp\System.IO.UnmanagedMemoryStream.dll msiexec.exe File created C:\Program Files\Krisp\System.Net.WebHeaderCollection.dll msiexec.exe File created C:\Program Files\Krisp\System.Security.Cryptography.Csp.dll msiexec.exe File created C:\Program Files\Krisp\System.Xml.ReaderWriter.dll msiexec.exe File created C:\Program Files\Krisp\License\WiX_Toolset_license.txt msiexec.exe File created C:\Program Files\Krisp\System.Diagnostics.Tracing.dll msiexec.exe File created C:\Program Files\Krisp\System.Linq.dll msiexec.exe File created C:\Program Files\Krisp\System.Net.Requests.dll msiexec.exe File created C:\Program Files\Krisp\System.Xml.XDocument.dll msiexec.exe File created C:\Program Files\Krisp\aec-sdk.dll msiexec.exe File created C:\Program Files\Krisp\System.ComponentModel.Primitives.dll msiexec.exe File created C:\Program Files\Krisp\System.Runtime.dll msiexec.exe File created C:\Program Files\Krisp\System.Runtime.InteropServices.RuntimeInformation.dll msiexec.exe File created C:\Program Files\Krisp\System.Runtime.Numerics.dll msiexec.exe File created C:\Program Files\Krisp\System.Text.Encoding.dll msiexec.exe File created C:\Program Files\Krisp\Gu.Wpf.Media.dll msiexec.exe File created C:\Program Files\Krisp\HidLibrary.dll msiexec.exe File created C:\Program Files\Krisp\P7x64.dll msiexec.exe File created C:\Program Files\Krisp\Sentry.dll msiexec.exe File created C:\Program Files\Krisp\System.IdentityModel.Tokens.Jwt.dll msiexec.exe File created C:\Program Files\Krisp\System.Security.Claims.dll msiexec.exe File created C:\Program Files\Krisp\System.Security.Cryptography.Algorithms.dll msiexec.exe File created C:\Program Files\Krisp\System.Security.Cryptography.Encoding.dll msiexec.exe File created C:\Program Files\Krisp\models\c5.w.73bbdf.cfg msiexec.exe File created C:\Program Files\Krisp\Microsoft.IdentityModel.Logging.dll msiexec.exe File created C:\Program Files\Krisp\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files\Krisp\RestSharp.dll msiexec.exe File created C:\Program Files\Krisp\License\Sentry_license.txt msiexec.exe File created C:\Program Files\Krisp\System.Threading.Thread.dll msiexec.exe -
Drops file in Windows directory 60 IoCs
Processes:
rundll32.exeMsiExec.exemsiexec.exerundll32.exeDrvInst.exerundll32.exerundll32.exerundll32.exeDrvInst.exerundll32.exesvchost.exeDrvInst.exedescription ioc process File opened for modification C:\Windows\Installer\MSIB484.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI537F.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIB473.tmp-\InstallerHelper.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB473.tmp-\RestSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSID5AA.tmp-\InstallerHelper.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7303.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI537F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5CC7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6035.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\{96422A65-DEFD-44E4-8D8E-AA688E2D399D}\icon.ico msiexec.exe File created C:\Windows\Installer\e5750a0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6035.tmp-\RestSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI865D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID5AA.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{96422A65-DEFD-44E4-8D8E-AA688E2D399D} msiexec.exe File opened for modification C:\Windows\Installer\MSI6035.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6035.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6A96.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB473.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID5AA.tmp-\RestSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6035.tmp-\InstallerHelper.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF2A9.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI865D.tmp-\InstallerHelper.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB484.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB473.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB473.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSID5AA.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\e5750a0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB484.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB484.tmp-\InstallerHelper.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB484.tmp-\RestSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5CF7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID5AA.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI537F.tmp-\RestSharp.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI537F.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSID56B.tmp msiexec.exe File created C:\Windows\Installer\{96422A65-DEFD-44E4-8D8E-AA688E2D399D}\icon.ico msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\c_media.PNF MsiExec.exe File opened for modification C:\Windows\Installer\MSI865D.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI537F.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5F59.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID5AA.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI537F.tmp-\InstallerHelper.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI865D.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI865D.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\e5750a2.msi msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI865D.tmp-\RestSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB484.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB473.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI6035.tmp msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
DrvInst.exesvchost.exeMsiExec.exeDrvInst.exevssvc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000008ccb747e6bc781e30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800008ccb747e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809008ccb747e000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008ccb747e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008ccb747e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID MsiExec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DrvInst.exe -
Modifies data under HKEY_USERS 44 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe -
Modifies registry class 23 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\PackageName = "krisp-v1.21.1-x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\Version = "18153473" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D11B6272CDA335D4F81A41911191A3D8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\ProductIcon = "C:\\Windows\\Installer\\{96422A65-DEFD-44E4-8D8E-AA688E2D399D}\\icon.ico" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D11B6272CDA335D4F81A41911191A3D8\56A22469DFED4E44D8E8AA86E8D293D9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\ProductName = "Krisp" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\PackageCode = "2EEF834E1C955EC458B67DA548AB5437" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\56A22469DFED4E44D8E8AA86E8D293D9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\56A22469DFED4E44D8E8AA86E8D293D9\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\56A22469DFED4E44D8E8AA86E8D293D9\AuthorizedLUAApp = "0" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msiexec.exeMsiExec.exeMsiExec.exepid process 3192 msiexec.exe 3192 msiexec.exe 3968 MsiExec.exe 3968 MsiExec.exe 532 MsiExec.exe 532 MsiExec.exe 532 MsiExec.exe 532 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 4956 msiexec.exe Token: SeIncreaseQuotaPrivilege 4956 msiexec.exe Token: SeSecurityPrivilege 3192 msiexec.exe Token: SeCreateTokenPrivilege 4956 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4956 msiexec.exe Token: SeLockMemoryPrivilege 4956 msiexec.exe Token: SeIncreaseQuotaPrivilege 4956 msiexec.exe Token: SeMachineAccountPrivilege 4956 msiexec.exe Token: SeTcbPrivilege 4956 msiexec.exe Token: SeSecurityPrivilege 4956 msiexec.exe Token: SeTakeOwnershipPrivilege 4956 msiexec.exe Token: SeLoadDriverPrivilege 4956 msiexec.exe Token: SeSystemProfilePrivilege 4956 msiexec.exe Token: SeSystemtimePrivilege 4956 msiexec.exe Token: SeProfSingleProcessPrivilege 4956 msiexec.exe Token: SeIncBasePriorityPrivilege 4956 msiexec.exe Token: SeCreatePagefilePrivilege 4956 msiexec.exe Token: SeCreatePermanentPrivilege 4956 msiexec.exe Token: SeBackupPrivilege 4956 msiexec.exe Token: SeRestorePrivilege 4956 msiexec.exe Token: SeShutdownPrivilege 4956 msiexec.exe Token: SeDebugPrivilege 4956 msiexec.exe Token: SeAuditPrivilege 4956 msiexec.exe Token: SeSystemEnvironmentPrivilege 4956 msiexec.exe Token: SeChangeNotifyPrivilege 4956 msiexec.exe Token: SeRemoteShutdownPrivilege 4956 msiexec.exe Token: SeUndockPrivilege 4956 msiexec.exe Token: SeSyncAgentPrivilege 4956 msiexec.exe Token: SeEnableDelegationPrivilege 4956 msiexec.exe Token: SeManageVolumePrivilege 4956 msiexec.exe Token: SeImpersonatePrivilege 4956 msiexec.exe Token: SeCreateGlobalPrivilege 4956 msiexec.exe Token: SeCreateTokenPrivilege 4956 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4956 msiexec.exe Token: SeLockMemoryPrivilege 4956 msiexec.exe Token: SeIncreaseQuotaPrivilege 4956 msiexec.exe Token: SeMachineAccountPrivilege 4956 msiexec.exe Token: SeTcbPrivilege 4956 msiexec.exe Token: SeSecurityPrivilege 4956 msiexec.exe Token: SeTakeOwnershipPrivilege 4956 msiexec.exe Token: SeLoadDriverPrivilege 4956 msiexec.exe Token: SeSystemProfilePrivilege 4956 msiexec.exe Token: SeSystemtimePrivilege 4956 msiexec.exe Token: SeProfSingleProcessPrivilege 4956 msiexec.exe Token: SeIncBasePriorityPrivilege 4956 msiexec.exe Token: SeCreatePagefilePrivilege 4956 msiexec.exe Token: SeCreatePermanentPrivilege 4956 msiexec.exe Token: SeBackupPrivilege 4956 msiexec.exe Token: SeRestorePrivilege 4956 msiexec.exe Token: SeShutdownPrivilege 4956 msiexec.exe Token: SeDebugPrivilege 4956 msiexec.exe Token: SeAuditPrivilege 4956 msiexec.exe Token: SeSystemEnvironmentPrivilege 4956 msiexec.exe Token: SeChangeNotifyPrivilege 4956 msiexec.exe Token: SeRemoteShutdownPrivilege 4956 msiexec.exe Token: SeUndockPrivilege 4956 msiexec.exe Token: SeSyncAgentPrivilege 4956 msiexec.exe Token: SeEnableDelegationPrivilege 4956 msiexec.exe Token: SeManageVolumePrivilege 4956 msiexec.exe Token: SeImpersonatePrivilege 4956 msiexec.exe Token: SeCreateGlobalPrivilege 4956 msiexec.exe Token: SeCreateTokenPrivilege 4956 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4956 msiexec.exe Token: SeLockMemoryPrivilege 4956 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 4956 msiexec.exe 4956 msiexec.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
msiexec.exeMsiExec.exeMsiExec.exesvchost.exeMsiExec.execmd.exemsiexec.exedescription pid process target process PID 3192 wrote to memory of 3808 3192 msiexec.exe MsiExec.exe PID 3192 wrote to memory of 3808 3192 msiexec.exe MsiExec.exe PID 3808 wrote to memory of 3796 3808 MsiExec.exe rundll32.exe PID 3808 wrote to memory of 3796 3808 MsiExec.exe rundll32.exe PID 3192 wrote to memory of 636 3192 msiexec.exe srtasks.exe PID 3192 wrote to memory of 636 3192 msiexec.exe srtasks.exe PID 3192 wrote to memory of 1516 3192 msiexec.exe MsiExec.exe PID 3192 wrote to memory of 1516 3192 msiexec.exe MsiExec.exe PID 1516 wrote to memory of 2148 1516 MsiExec.exe rundll32.exe PID 1516 wrote to memory of 2148 1516 MsiExec.exe rundll32.exe PID 3192 wrote to memory of 3968 3192 msiexec.exe MsiExec.exe PID 3192 wrote to memory of 3968 3192 msiexec.exe MsiExec.exe PID 3192 wrote to memory of 3968 3192 msiexec.exe MsiExec.exe PID 1516 wrote to memory of 3196 1516 MsiExec.exe rundll32.exe PID 1516 wrote to memory of 3196 1516 MsiExec.exe rundll32.exe PID 3192 wrote to memory of 532 3192 msiexec.exe MsiExec.exe PID 3192 wrote to memory of 532 3192 msiexec.exe MsiExec.exe PID 3192 wrote to memory of 532 3192 msiexec.exe MsiExec.exe PID 3192 wrote to memory of 1476 3192 msiexec.exe MsiExec.exe PID 3192 wrote to memory of 1476 3192 msiexec.exe MsiExec.exe PID 3568 wrote to memory of 5036 3568 svchost.exe DrvInst.exe PID 3568 wrote to memory of 5036 3568 svchost.exe DrvInst.exe PID 3568 wrote to memory of 3572 3568 svchost.exe DrvInst.exe PID 3568 wrote to memory of 3572 3568 svchost.exe DrvInst.exe PID 3568 wrote to memory of 1972 3568 svchost.exe DrvInst.exe PID 3568 wrote to memory of 1972 3568 svchost.exe DrvInst.exe PID 1476 wrote to memory of 1048 1476 MsiExec.exe rundll32.exe PID 1476 wrote to memory of 1048 1476 MsiExec.exe rundll32.exe PID 1476 wrote to memory of 3676 1476 MsiExec.exe rundll32.exe PID 1476 wrote to memory of 3676 1476 MsiExec.exe rundll32.exe PID 1476 wrote to memory of 2592 1476 MsiExec.exe rundll32.exe PID 1476 wrote to memory of 2592 1476 MsiExec.exe rundll32.exe PID 1516 wrote to memory of 864 1516 MsiExec.exe rundll32.exe PID 1516 wrote to memory of 864 1516 MsiExec.exe rundll32.exe PID 3192 wrote to memory of 1680 3192 msiexec.exe cmd.exe PID 3192 wrote to memory of 1680 3192 msiexec.exe cmd.exe PID 1680 wrote to memory of 3756 1680 cmd.exe cmd.exe PID 1680 wrote to memory of 3756 1680 cmd.exe cmd.exe PID 1680 wrote to memory of 3224 1680 cmd.exe xcopy.exe PID 1680 wrote to memory of 3224 1680 cmd.exe xcopy.exe PID 4956 wrote to memory of 488 4956 msiexec.exe Krisp.exe PID 4956 wrote to memory of 488 4956 msiexec.exe Krisp.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\krisp-v1.21.1-x64.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Program Files\Krisp\Krisp.exe"C:\Program Files\Krisp\Krisp.exe" -m2⤵
- Executes dropped EXE
PID:488
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 49CBD64563557355B1769358C5BB3EE3 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA453.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240559281 1 InstallerHelper!InstallerHelper.CustomActions.GetOSVersion3⤵
- Loads dropped DLL
PID:3796 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:636
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1C65B093E5684C9885BDF75E0CF329AC2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI537F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240604218 2 InstallerHelper!InstallerHelper.CustomActions.GetOSVersion3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2148 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI6035.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240607296 32 InstallerHelper!InstallerHelper.CustomActions.SendInstallationAnalytics3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
PID:3196 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSID5AA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240637359 103 InstallerHelper!InstallerHelper.CustomActions.SleepForMagicTimeout3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:864 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B820B7D238BD0BC6E286E77638CF810B2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3968 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6E555101850771156E4315CE7629B201 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:532 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding BCBE558EAC324B5006F927D7E34F9706 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI865D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240617062 73 InstallerHelper!InstallerHelper.CustomActions.AddInstallationGuid3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1048 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB473.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628859 78 InstallerHelper!InstallerHelper.CustomActions.KrispDevicePlug3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3676 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB484.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628984 79 InstallerHelper!InstallerHelper.CustomActions.SetDriverDisplayNames3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2592 -
C:\Windows\system32\cmd.execmd /c echo F|xcopy /y C:\Users\Admin\AppData\Local\Temp\MSI69475.LOG "C:\Users\Admin\AppData\Local\\Krisp\\Logs\Krisp-1.21.1-install-success.log"2⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F"3⤵PID:3756
-
C:\Windows\system32\xcopy.exexcopy /y C:\Users\Admin\AppData\Local\Temp\MSI69475.LOG "C:\Users\Admin\AppData\Local\\Krisp\\Logs\Krisp-1.21.1-install-success.log"3⤵PID:3224
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files\Krisp\Driver\KrispVad.inf" "9" "42d05aeab" "000000000000013C" "WinSta0\Default" "0000000000000150" "208" "C:\Program Files\Krisp\Driver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5036 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "0" "ROOT\KrispSimple\0000" "" "" "4a41b4dfb" "0000000000000000"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3572 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\KRISPSIMPLE\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11821b73e4:Krisp_VAD:0.9.4.0:root\krispsimple," "4c1ec1a23" "0000000000000154"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:1972
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e5750a1.rbsFilesize
712KB
MD5615fc6bae4158754e5c165e9a1bc961e
SHA1c8d6f855e44787759a66df58fd2a7746b53a8a73
SHA25643564281454451248719aa99bf71b6666c192a4d02e6ad5934c374fff90b336c
SHA5126008b092f062fd84a609cc60ed625be4667679ec932129ed94301e401d2e578d35b8b70a0d12074940241e13aba6b28ecfc3b4e385d2b59eafac897482305260
-
C:\PROGRA~1\Krisp\Driver\KrispVad.catFilesize
10KB
MD54b250e3bb93ef588f7aec7edba7e546b
SHA1f6355bbc73b0634b3aba4291301262e851c15f48
SHA25672c0cfc94a3cc68a9d6fb3f158507749b27199221005b8766ce51b6cb375d0a9
SHA5126efccb89ab7605520ae09c9c452f04277d1706002adba40ceab4e0385596133df16212ef3729276e8d8847bb54221ce572e876394fd6daa549a60a0d777fe730
-
C:\PROGRA~1\Krisp\Driver\KrispVad.sysFilesize
54KB
MD5351825097a91893cab9c2f628ba86163
SHA1c2ec5b045741e944cac4e41617d87f828e572f00
SHA256cbc1e1de4ce6d22658415b1b8c07be50b1e24326863133fc3d3ac5750457e2fc
SHA512552d829b00fdd38ef82feba74de9b8ae0e6a7afb0cba08f01319354237f84f797ae0ddde917c4a008b52bac3f9bec1bc06431e267a7387e46cb4474e2f5d2f32
-
C:\Program Files\Krisp\Driver\KrispVad.infFilesize
6KB
MD597af85af56c5ce7e475498e9cb35133e
SHA101ebe8ef0a22071562fac4103534254dc4fffc0e
SHA2569a7e1491f85e04eaee4458222b0c1b38749eec448f62c493c1f492882b06a422
SHA512245357e042098d7141d6d0481b3afd63b4a2872addb5afe572e6edbac7b2674eaa63d638fc19fd52ccd187418f57f377b34fb459f87b69340dba7dbce2dd3a17
-
C:\Program Files\Krisp\Krisp.exeFilesize
2.5MB
MD5e14e3239cac4d41015693e67934fb0a3
SHA11d31b181b450479d106c20bb1ad84b4e89a20470
SHA25654f49defa4f11bad32f26cc9704ea23d50f108c236b3c085d9729d6e730075bf
SHA5128aeedb942c7eaf5efe2a322e6b13e206681d56ce5f98d164a56c62802fe811cb868259ebfdf827cb9202ea567ca3656193937271818859d21b1ad73713258281
-
C:\Program Files\Krisp\Krisp.exe.configFilesize
23KB
MD579832ae3ccb39c8d4b360be4d72b7098
SHA143eb3a8dde5a7116afde16c12eb20770fbfe27de
SHA2564f13152de4db5c855deb15352e058f7367c847524d638ebfa7d919835f1267cb
SHA5129ca21185b106d53537a6bb19adf8b22d4ca99d180ae1ca39f893a7a61c995ed28471f56ff5062f0f95a7f22bcf6be91492c08164fa2382ada9b41a3e518b130b
-
C:\Program Files\Krisp\bqbp4jhv.newcfgFilesize
23KB
MD502f22a49af6c2ebe5d05b28e60159154
SHA11243fd1c64a2e62a58734736929c4967e5a39dec
SHA256e80253af09c1ea354a26c953eddf3db382a2480a8d666f172bc45eb9529dbfd9
SHA512b80f7363466b62ee4620be75d49663f2ecf57eaa7d95739841794f25aadc834f3ac64537931ade2e11472dc071df99eadb2430e1e4535cc21bc3eb915ea79a05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44DFilesize
471B
MD54bb58e088b31084c9a1c60de7778d0b3
SHA18f28e6bc4a2846f4b27ce062bed108e7bb33a2cf
SHA256b680707aab2970dcb952fd5908da0e005aa8f7fb9247c04d2da0b4ed410a9345
SHA51271e0ce9e3730e3d546685add488eda1cbd2f05b84d07beea520f9c8fb9edbec9b3d5876e12bde6f9598845ea11c7dfa663ea677505ac41891f1f83b0297fb6b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_D18EFA015E0FCCFE81C9B5AC8BE295D4Filesize
471B
MD59875c1ae3ab48a5a42ca951ffbfd2b7a
SHA1a867074c55d3de4365cd0a4a290abe3fca79ded9
SHA256904ab33616038c014207c8837a483d4bac1ba028a9f86ed2d27326ad3b6a3fcc
SHA5123a7dfa865405cde419c68f1435dd6c8fdc896f53cb76e01729076c0e507f58497e1883bff1a5aa53b4cdb72b6db2b6d4996799fc21d6504a850c623aeda5e62d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44DFilesize
396B
MD5f1ab21d55b591694bb1095d8e58b8bb4
SHA1aa7ca2336bb098e1bacf1f622eea8390669ebd0b
SHA2562a9546577d383714d8f57d3699b5f6e7466f625c1e5f69d06cf0c97281594f05
SHA512cc42684d48ae2a5442234403c3f9d91c1029d7ee8b2226013c62012a5ef9cd82d005e00bdccc3500c103e2ba8560d4f7d3849682f758651d47ede186d4d6b211
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_D18EFA015E0FCCFE81C9B5AC8BE295D4Filesize
412B
MD568e1fa53db0fb86de25f5440fede249f
SHA13d5907f0c42a5ef21049b6f44d2049ed3046343f
SHA25628b43c8d004677fdf4cf62ebaa2327a2c87c650c3ceb6c70af02b64e1b29f7aa
SHA51269b41843c801f453bbd869c64506d39d63b46b8db4bf279ba60035914b655bc67f0ebee923c38d65676f097ad14298fe4cf8b9581c871d033e27bd7d03908016
-
C:\Users\Admin\AppData\Local\Krisp\Krisp.exe_Url_umx0atrp0vhkedazz45qlo3visl5aucc\1.21.1.0\rs1uk1f4.newcfgFilesize
318B
MD532edb68f066f5fd6ea12f82ab4d63f7a
SHA1ba93669c7143705156d2cec63a7cc792adc5cd37
SHA256515824626eccd4db8cf82ab90e6ecf32e6de090e47242157a2d37493cea1f885
SHA5122ead41d509627f9a4a2930504fdc21d672e78b85f15531d1c3efcbf896dc6182c1f5f2d8bb648f596c0ae90a21c482c2638160a33785df60a47f565160392c5c
-
C:\Users\Admin\AppData\Local\Krisp\Krisp.exe_Url_umx0atrp0vhkedazz45qlo3visl5aucc\1.21.1.0\user.configFilesize
317B
MD5defb61abe48e6190e5019541cfea3327
SHA14bb5d585a5d1cb2151768c48891973e939079ea7
SHA256f06961100e6df8295d7f653a169b3fb844328efc0addf5ddaf5c4a50586b7c1d
SHA512a391a230eaf9973795f864b4a617e99808b71e3711b9a3c4c197f9fd0507bc9c9c0e58821e659bf0d379e2effe0ca6a3c0ee1a23e5b5e3e94c49ce00101a8f9a
-
C:\Users\Admin\AppData\Local\Krisp\Logs\Krisp-1.21.1-install-success.logFilesize
483KB
MD5e1b98aac5f415d8d8106a29c553a9ff7
SHA1ca115efd5c4f42fc42a4ac19ea3f555c82535aaa
SHA256470d259100e41642293210024c1fdf3b0156930816c8212824206f79d8589832
SHA5125769ddd2dfde3c27de9fd70f5ea7d4928d67ee15cac6e33444d01a3c583ffa7dcecd7a2e856f72ddec64dd5a012f75a2fe26d11661c89b0d6d390faf1ded17b7
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.logFilesize
651B
MD500bfeb783aeff425ce898d55718d506d
SHA1aac7a973dc1f9ca7abc529c7ea37ad7eaf491b8f
SHA256d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580
SHA5122209d5f4999cb36ebf26c6b8cb3195cc9fc0f0a103f4a28dd77b04605d7c6e79d47d806454c63b8d42bbe32864be7cdb56df3cccf71a6c27fe0b331d8304e1ff
-
C:\Users\Admin\AppData\Local\Temp\MSI69475.LOGFilesize
72KB
MD52e90a5668f9322986d029f6790ed9fbe
SHA139b0301d53f4611a36347e85ceb6adcc247c294d
SHA256c6a12c3642436edc15f96a91346dda598c9afb9e3197286b9bb286650865ed54
SHA51223e084b02bf3d1b52c87d863e7e751d9959269bbbc25ddc038dd1a4bbca892f493fa3de7a9108ae3c7b973579c2def905c7e374139b2e18f474a52783be8c5ad
-
C:\Users\Admin\AppData\Local\Temp\MSIA453.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Users\Admin\AppData\Local\Temp\MSIA453.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Users\Admin\AppData\Local\Temp\MSIA453.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Users\Admin\AppData\Local\Temp\MSIA453.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Users\Admin\AppData\Local\Temp\MSIA453.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\INF\oem3.infFilesize
6KB
MD597af85af56c5ce7e475498e9cb35133e
SHA101ebe8ef0a22071562fac4103534254dc4fffc0e
SHA2569a7e1491f85e04eaee4458222b0c1b38749eec448f62c493c1f492882b06a422
SHA512245357e042098d7141d6d0481b3afd63b4a2872addb5afe572e6edbac7b2674eaa63d638fc19fd52ccd187418f57f377b34fb459f87b69340dba7dbce2dd3a17
-
C:\Windows\Installer\MSI537F.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSI537F.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSI537F.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSI537F.tmp-\CustomAction.configFilesize
1KB
MD501c01d040563a55e0fd31cc8daa5f155
SHA13c1c229703198f9772d7721357f1b90281917842
SHA25633d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
SHA5129c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5
-
C:\Windows\Installer\MSI537F.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSI537F.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSI537F.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSI537F.tmp-\Microsoft.Deployment.WindowsInstaller.dllFilesize
179KB
MD51a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
C:\Windows\Installer\MSI5CF7.tmpFilesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\Installer\MSI5CF7.tmpFilesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\Installer\MSI5F59.tmpFilesize
149KB
MD5418322f7be2b68e88a93a048ac75a757
SHA109739792ff1c30f73dacafbe503630615922b561
SHA256ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
SHA512253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef
-
C:\Windows\Installer\MSI5F59.tmpFilesize
149KB
MD5418322f7be2b68e88a93a048ac75a757
SHA109739792ff1c30f73dacafbe503630615922b561
SHA256ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
SHA512253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef
-
C:\Windows\Installer\MSI6035.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSI6035.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSI6035.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSI6035.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSI6035.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSI6035.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSI6035.tmp-\RestSharp.dllFilesize
187KB
MD56122f53b28d172d5711b79427d89b409
SHA16bde48731f89b3bbbde7614898638a4f33121114
SHA256676e00e8f81b6c25e122277d55a56d28924a4cc304f160ad1dfb803e8d2ea594
SHA512a9e6d2bd3b62a7b37f7a0aa241f057e8266ed836b3df92ab4dc9d7ae7a9e928bd468d7d8e88e7ba1ca04ca443a0a552ca6419cea69cc3f9b3f2c7e7f7899a4b9
-
C:\Windows\Installer\MSI6A96.tmpFilesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\Installer\MSI6A96.tmpFilesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\Installer\MSI7303.tmpFilesize
690KB
MD58deb7d2f91c7392925718b3ba0aade22
SHA1fc8e9b10c83e16eb0af1b6f10128f5c37b389682
SHA256cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4
SHA51237f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c
-
C:\Windows\Installer\MSI7303.tmpFilesize
690KB
MD58deb7d2f91c7392925718b3ba0aade22
SHA1fc8e9b10c83e16eb0af1b6f10128f5c37b389682
SHA256cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4
SHA51237f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c
-
C:\Windows\Installer\MSI865D.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSI865D.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSI865D.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSI865D.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSI865D.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSI865D.tmp-\Newtonsoft.Json.dllFilesize
683KB
MD56815034209687816d8cf401877ec8133
SHA11248142eb45eed3beb0d9a2d3b8bed5fe2569b10
SHA2567f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
SHA5123398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
-
C:\Windows\Installer\MSIB473.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSIB473.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSIB473.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSIB473.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSIB473.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSIB484.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSIB484.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSIB484.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSIB484.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSIB484.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSID56B.tmpFilesize
149KB
MD5418322f7be2b68e88a93a048ac75a757
SHA109739792ff1c30f73dacafbe503630615922b561
SHA256ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
SHA512253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef
-
C:\Windows\Installer\MSID56B.tmpFilesize
149KB
MD5418322f7be2b68e88a93a048ac75a757
SHA109739792ff1c30f73dacafbe503630615922b561
SHA256ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
SHA512253f62f5ce75df3e9ac3c62e2f06f30c7c6de6280fbfc830cdd15bf29cb8ee9ed878212f6df5d0ac6a5c9be0e6259f900eccee472a890f15dd3ff1f84958aeef
-
C:\Windows\Installer\MSID5AA.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSID5AA.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSID5AA.tmpFilesize
617KB
MD56985489e7d7d224e6d2cabc8c9cf71c0
SHA1bcfc8b2eba0402f0d0913c362d192096aae71483
SHA256a57a419a99d84fef10af39fc841c00dc24a8b625f0874c62132407f47425ee38
SHA512ea5cc073582057b15cffe673bc70ca6227991843cc6f6ca0a09a1263d76dddac00ff8372beb30c3d844fbc03e63e3274b08a9efd9a6cb4cc808622e96d55e41c
-
C:\Windows\Installer\MSID5AA.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSID5AA.tmp-\InstallerHelper.dllFilesize
177KB
MD5bab22511f48c61e6221044455297d7a6
SHA1d57fe2e104c4b269b85880449e9217bde8a47b23
SHA2567369e0afeceb6d3c90f8d949d8d85ebb50668f3b093804a4516f533b60fda2fa
SHA5124d3f3926c278adf0cc95bb38603f0508c0872f340e9d7857d2250d83517a182a017a0bde03faf4465645343a970f973504f0e1e10102b25b1fa98282655e3dde
-
C:\Windows\Installer\MSIF2A9.tmpFilesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\Installer\MSIF2A9.tmpFilesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\Installer\e5750a0.msiFilesize
70.1MB
MD5e2d02c2d0d744411a0a6e2935dea4f84
SHA1fba0fcd0cff2c4ceda85c87ef2458558c8754401
SHA25610cba83ef3cbfdc6636647c9fe1c273ffd7e833cd88b93f9c9666e8449764a36
SHA51299681131e3cebee6416c4e08cbf766f36d8560a2c47eb160d4bdb6394bd038da9f58a2546f866d4a61c42423e08922e6ef1b432981f0f1d3f2d6931b9b926ae9
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
146KB
MD514548a5bde4afe6f0102c4dba4670cab
SHA1d9cf060f3702ada34d148d01782f6134c2913ae0
SHA25670c767cab146f6eb4dda9ed7cf1365ab042f7751d96bbc1032680bd9be886d38
SHA512c109f0761bc2f3ac60304466431a0d6710d49ab51ce8070a32b3119c77b769a07e6b7960068d0f22b7415572bc22a8684e43d9a858d8bf54351c8427d1f2aecf
-
C:\Windows\System32\DriverStore\FileRepository\KRISPV~1.INF\KrispVad.sysFilesize
54KB
MD5351825097a91893cab9c2f628ba86163
SHA1c2ec5b045741e944cac4e41617d87f828e572f00
SHA256cbc1e1de4ce6d22658415b1b8c07be50b1e24326863133fc3d3ac5750457e2fc
SHA512552d829b00fdd38ef82feba74de9b8ae0e6a7afb0cba08f01319354237f84f797ae0ddde917c4a008b52bac3f9bec1bc06431e267a7387e46cb4474e2f5d2f32
-
C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.PNFFilesize
16KB
MD579b13648e03121462ed4f6e0385c3405
SHA1fb4cf203b5b21fb7f94bbe77ebedab522fb58125
SHA256b4c9328f6740d2ce7517efcd4141911fc92d1233f384927b7825e88615a3916c
SHA51211da4aab650df04ceac9bd2ec4c4fb68c8cd21a6b783dabbc772072276e684d41948cb85a22751d9912d17e292c8135a8bd48922d62d1d7631df7f799d8681ed
-
C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\KrispVad.catFilesize
10KB
MD54b250e3bb93ef588f7aec7edba7e546b
SHA1f6355bbc73b0634b3aba4291301262e851c15f48
SHA25672c0cfc94a3cc68a9d6fb3f158507749b27199221005b8766ce51b6cb375d0a9
SHA5126efccb89ab7605520ae09c9c452f04277d1706002adba40ceab4e0385596133df16212ef3729276e8d8847bb54221ce572e876394fd6daa549a60a0d777fe730
-
C:\Windows\System32\DriverStore\FileRepository\krispvad.inf_amd64_be20ca23f705b181\krispvad.infFilesize
6KB
MD597af85af56c5ce7e475498e9cb35133e
SHA101ebe8ef0a22071562fac4103534254dc4fffc0e
SHA2569a7e1491f85e04eaee4458222b0c1b38749eec448f62c493c1f492882b06a422
SHA512245357e042098d7141d6d0481b3afd63b4a2872addb5afe572e6edbac7b2674eaa63d638fc19fd52ccd187418f57f377b34fb459f87b69340dba7dbce2dd3a17
-
C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.catFilesize
10KB
MD54b250e3bb93ef588f7aec7edba7e546b
SHA1f6355bbc73b0634b3aba4291301262e851c15f48
SHA25672c0cfc94a3cc68a9d6fb3f158507749b27199221005b8766ce51b6cb375d0a9
SHA5126efccb89ab7605520ae09c9c452f04277d1706002adba40ceab4e0385596133df16212ef3729276e8d8847bb54221ce572e876394fd6daa549a60a0d777fe730
-
C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.infFilesize
6KB
MD597af85af56c5ce7e475498e9cb35133e
SHA101ebe8ef0a22071562fac4103534254dc4fffc0e
SHA2569a7e1491f85e04eaee4458222b0c1b38749eec448f62c493c1f492882b06a422
SHA512245357e042098d7141d6d0481b3afd63b4a2872addb5afe572e6edbac7b2674eaa63d638fc19fd52ccd187418f57f377b34fb459f87b69340dba7dbce2dd3a17
-
C:\Windows\System32\DriverStore\Temp\{a650734b-442e-c546-bd39-e13273a38f8e}\KrispVad.sysFilesize
54KB
MD5351825097a91893cab9c2f628ba86163
SHA1c2ec5b045741e944cac4e41617d87f828e572f00
SHA256cbc1e1de4ce6d22658415b1b8c07be50b1e24326863133fc3d3ac5750457e2fc
SHA512552d829b00fdd38ef82feba74de9b8ae0e6a7afb0cba08f01319354237f84f797ae0ddde917c4a008b52bac3f9bec1bc06431e267a7387e46cb4474e2f5d2f32
-
C:\Windows\System32\drivers\KrispVad.sysFilesize
54KB
MD5351825097a91893cab9c2f628ba86163
SHA1c2ec5b045741e944cac4e41617d87f828e572f00
SHA256cbc1e1de4ce6d22658415b1b8c07be50b1e24326863133fc3d3ac5750457e2fc
SHA512552d829b00fdd38ef82feba74de9b8ae0e6a7afb0cba08f01319354237f84f797ae0ddde917c4a008b52bac3f9bec1bc06431e267a7387e46cb4474e2f5d2f32
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.0MB
MD52b4277241e927909683d373f2da1f342
SHA17161a2c6fcdb32b3bec53dd712f4c1ae61379125
SHA25611a25c4f51b8fa363dd299848641812fb5a772295c893ca676c2498fc79a3a0b
SHA5126433591d15472a11e3e981ab160d65ec969919dc17a08be737d5ece85df9e7f82acfd9b161a28a935ae45b5fe3d37fe4e11d4f95051c6c30491f432835e4bbd9
-
\??\Volume{7e74cb8c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{aa12286f-5c16-4607-b8b0-9716c45de606}_OnDiskSnapshotPropFilesize
5KB
MD5f7b8ab064d378d4b8a361791915a2d8b
SHA1a139e7754aec93097865638df7303cd45bf8b315
SHA2567942f2b0e39d076529daace90fe632bffbe6e6af8ee8c8beab25d9140e4a81b2
SHA512f408aa9f24e0c93cdd7793a48713bf9fbf3556f85c6782adb8d7d4136ebfc6ef3b3d47947ff7d0db73972dfc5d868d54fe33af29b31dd1609b7cfd1f991a487d
-
memory/488-770-0x000001A92CF90000-0x000001A92CFAC000-memory.dmpFilesize
112KB
-
memory/488-768-0x000001A92C9B0000-0x000001A92CC38000-memory.dmpFilesize
2.5MB
-
memory/488-771-0x000001A92CFB0000-0x000001A92CFC2000-memory.dmpFilesize
72KB
-
memory/488-772-0x000001A92EA60000-0x000001A92EA92000-memory.dmpFilesize
200KB
-
memory/488-773-0x000001A948930000-0x000001A948940000-memory.dmpFilesize
64KB
-
memory/864-743-0x000002547D190000-0x000002547D1A0000-memory.dmpFilesize
64KB
-
memory/864-744-0x000002547D190000-0x000002547D1A0000-memory.dmpFilesize
64KB
-
memory/864-745-0x000002547D190000-0x000002547D1A0000-memory.dmpFilesize
64KB
-
memory/864-746-0x000002547D190000-0x000002547D1A0000-memory.dmpFilesize
64KB
-
memory/1048-539-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/1048-639-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/1048-534-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/1048-535-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/1048-536-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/1048-537-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/1048-634-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/1048-635-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/1048-636-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/1048-637-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/1048-638-0x0000021641790000-0x00000216417A0000-memory.dmpFilesize
64KB
-
memory/2592-696-0x0000023A34560000-0x0000023A34570000-memory.dmpFilesize
64KB
-
memory/2592-695-0x0000023A34560000-0x0000023A34570000-memory.dmpFilesize
64KB
-
memory/3196-236-0x0000017A732C0000-0x0000017A732F6000-memory.dmpFilesize
216KB
-
memory/3196-244-0x0000017A74F00000-0x0000017A74F10000-memory.dmpFilesize
64KB
-
memory/3196-245-0x0000017A75EC0000-0x0000017A763E8000-memory.dmpFilesize
5.2MB
-
memory/3196-240-0x0000017A74F00000-0x0000017A74F10000-memory.dmpFilesize
64KB
-
memory/3196-243-0x0000017A74F00000-0x0000017A74F10000-memory.dmpFilesize
64KB
-
memory/3196-239-0x0000017A74F00000-0x0000017A74F10000-memory.dmpFilesize
64KB
-
memory/3196-238-0x0000017A74F00000-0x0000017A74F10000-memory.dmpFilesize
64KB
-
memory/3676-682-0x0000029A2F210000-0x0000029A2F220000-memory.dmpFilesize
64KB
-
memory/3676-697-0x0000029A2F210000-0x0000029A2F220000-memory.dmpFilesize
64KB
-
memory/3676-688-0x0000029A2F210000-0x0000029A2F220000-memory.dmpFilesize
64KB
-
memory/3796-157-0x0000025893480000-0x0000025893490000-memory.dmpFilesize
64KB
-
memory/3796-158-0x0000025893480000-0x0000025893490000-memory.dmpFilesize
64KB
-
memory/3796-162-0x00000258ACF60000-0x00000258ACF90000-memory.dmpFilesize
192KB
-
memory/3796-155-0x0000025893480000-0x0000025893490000-memory.dmpFilesize
64KB
-
memory/3796-156-0x0000025893480000-0x0000025893490000-memory.dmpFilesize
64KB
-
memory/3796-154-0x0000025893490000-0x00000258934BE000-memory.dmpFilesize
184KB