dc2c8c8369c3dee48feb6b43b5467f22e6a0c939257207828104ed8d94b154d2

Analysis

max time kernel
292s
max time network
281s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
10-05-2023 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lorex.AdluminInstaller.msi
Size

6.5MB
MD5

ba9f849e3c6e57316548367f0f6a444b
SHA1

34b80863cddfd512be800f366f282eb58fdfc640
SHA256

dc2c8c8369c3dee48feb6b43b5467f22e6a0c939257207828104ed8d94b154d2
SHA512

93c324b2849e9642de25370d3e73f246384f00c2ef49c2d624f495447b856e4a74911066779650a35249bd8518cf4b4944c168982c3613f29f6a9405b74aa21d
SSDEEP

98304:ZiWF9TZpfEK0lk5xmY7aRGm7XCiiQO95anWA25u2tEYjTMy5rp5WpiSvv:r91pSlkqFGICii15HrgYjTMIrfWESvv

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exe

flow pid process

1 1020 msiexec.exe
3 1020 msiexec.exe
5 1020 msiexec.exe
7 1020 msiexec.exe
Executes dropped EXE 2 IoCs

Processes:

sentryagent.exeSysmon64.exe

pid process

1784 sentryagent.exe
96 Sysmon64.exe

flow	pid	process
1	1020	msiexec.exe
3	1020	msiexec.exe
5	1020	msiexec.exe
7	1020	msiexec.exe

pid	process
1784	sentryagent.exe
96	Sysmon64.exe

Loads dropped DLL 32 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exesentryagent.exe

pid	process
2672	MsiExec.exe
2672	MsiExec.exe
3700	MsiExec.exe
3700	MsiExec.exe
428	MsiExec.exe
428	MsiExec.exe
428	MsiExec.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe
1784	sentryagent.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

40 checkip.amazonaws.com

flow	ioc
40	checkip.amazonaws.com

Drops file in System32 directory 12 IoCs

Processes:

sentryagent.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_DDCB2DD85990061C1CEA5347464E8D24	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_DDCB2DD85990061C1CEA5347464E8D24	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	sentryagent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	sentryagent.exe

Drops file in Program Files directory 23 IoCs

Processes:

msiexec.exeMsiExec.exesentryagent.exe

description	ioc	process
File created	C:\Program Files (x86)\Sentry\SA\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\Sysmon.exe	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\config.xml	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\AdluminCommon.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\adlumind27br01ap01zl_johnson1a_sml_oFF_icon.ico	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\AWSSDK.Kinesis.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\candid.tmp	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\Sysmon64.exe	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\netstandard.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\Eula.txt	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\libzstd.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\AdluminTools.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\AWSSDK.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\sentryagent.exe	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\Microsoft.Win32.TaskScheduler.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\sentryagent.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\sentryagent.InstallState	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Sentry\SA\candid.tmp	sentryagent.exe
File created	C:\Program Files (x86)\Sentry\SA\ZstdNet.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\Sentry\SA\AdluminUpdater.exe	msiexec.exe

Drops file in Windows directory 13 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIED7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{904551C0-C463-4E7B-B54D-82F7D4EFE2F9}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\e570985.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{904551C0-C463-4E7B-B54D-82F7D4EFE2F9}	msiexec.exe
File created	C:\Windows\Installer\{904551C0-C463-4E7B-B54D-82F7D4EFE2F9}\_853F67D554F05449430E7E.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1215.tmp	msiexec.exe
File created	C:\Windows\Installer\e570987.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e570985.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC36.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

168 sc.exe
1016 sc.exe
696 sc.exe
1500 sc.exe

pid	process
168	sc.exe
1016	sc.exe
696	sc.exe
1500	sc.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sentryagent.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sentryagent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	sentryagent.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1644 schtasks.exe
4520 schtasks.exe
4496 schtasks.exe
Gathers network information 2 TTPs 8 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exe

pid process

2188 ipconfig.exe
2736 ipconfig.exe
1004 ipconfig.exe
4284 ipconfig.exe
4216 ipconfig.exe
3372 ipconfig.exe
4008 ipconfig.exe
3996 ipconfig.exe

pid	process
1644	schtasks.exe
4520	schtasks.exe
4496	schtasks.exe

pid	process
2188	ipconfig.exe
2736	ipconfig.exe
1004	ipconfig.exe
4284	ipconfig.exe
4216	ipconfig.exe
3372	ipconfig.exe
4008	ipconfig.exe
3996	ipconfig.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

sentryagent.exeMsiExec.exemsiexec.exeSysmon64.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sentryagent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sentryagent.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sentryagent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Sysmon64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sentryagent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sentryagent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	sentryagent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sentryagent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	sentryagent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\System Monitor	Sysmon64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sentryagent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	sentryagent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\System Monitor\EulaAccepted = "1"	Sysmon64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	Sysmon64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sentryagent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sentryagent.exe

Modifies registry class 49 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|ZstdNet.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|ZstdNet.dll\ZstdNet,Version="1.4.5.0",Culture="neutral",ProcessorArchitecture="MSIL" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e00280041002500550043002e002e00500075002e003f006b006c007e004f0045003f007a006400770000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|netstandard.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|Microsoft.Win32.TaskScheduler.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Net.Http.dll\System.Net.Http,Version="4.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B03F5F7F11D50A3A" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0078005100680073003700750025006b007700280042006e006a003f002a005300690076002400310000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminCommon.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminCommon.dll\AdluminCommon,Version="1.6.1.1",Culture="neutral",ProcessorArchitecture="MSIL" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e00770047006e0048002c00590067002b005200390024006000650036002c006400240051007a00410000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Buffers.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|sentryagent.exe	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\ProductName = "Adlumin"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\PackageName = "Lorex.AdluminInstaller.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Buffers.dll\System.Buffers,Version="4.0.3.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13FFCD2DDD51" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e004b0074005100700031004900350048002b007400340047002b007a0078005500390061007100380000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AWSSDK.Core.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AWSSDK.Kinesis.dll\AWSSDK.Kinesis,Version="3.3.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="885C28607F98E604" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0053003300650044004800610074005b004a0060005a002700390038002e002a00320069007700350000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\ProductIcon = "C:\\Windows\\Installer\\{904551C0-C463-4E7B-B54D-82F7D4EFE2F9}\\_853F67D554F05449430E7E.exe"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|Microsoft.Win32.TaskScheduler.dll\Microsoft.Win32.TaskScheduler,Version="2.9.1.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="E25603A88B3AA7DA" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0033006c0058004400240029003d004300380065004a004a006d0058006a002a005600290065006e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AWSSDK.Core.dll\AWSSDK.Core,Version="3.3.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="885C28607F98E604" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0032006d00250035003f0031003800540034005b00320035004a00670039005f00520029005700530000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Memory.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\PackageCode = "9717E01E34DB87145B5393ED497B910B"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AC710AF53FF38054FACD86AD67331D5B\0C155409364CB7E45BD4287F4DFE2E9F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|sentryagent.exe\sentryagent,Version="1.6.1.1",Culture="neutral",ProcessorArchitecture="x86" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e00640077003f0049003200750075003500450036004a004a002400360028002600300048007d00610000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\Version = "169738255"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminTools.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminTools.dll\AdluminTools,Version="1.6.1.1",Culture="neutral",ProcessorArchitecture="MSIL" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0057002900640062002600440058003600540056007d0071007b0055005f00420075005a005900430000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Net.Http.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C155409364CB7E45BD4287F4DFE2E9F\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C155409364CB7E45BD4287F4DFE2E9F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|netstandard.dll\netstandard,Version="2.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13FFCD2DDD51" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0071004e002d0078004b004d0056002d0045005a00550063004d007400760058005a0065004700740000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Runtime.CompilerServices.Unsafe.dll\System.Runtime.CompilerServices.Unsafe,Version="4.0.4.1",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B03F = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e004a0063006a003f006400480061004200760055007d005f00600061004900350041005e0068004f0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C155409364CB7E45BD4287F4DFE2E9F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminUpdater.exe	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AdluminUpdater.exe\AdluminUpdater,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0027005200350060003d006a002e006f005d00580043003f0033003f0046005a003f0054005e00480000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|AWSSDK.Kinesis.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Sentry\|SA\|System.Memory.dll\System.Memory,Version="4.0.1.1",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13FFCD2DDD51" = 660026004300470056007000770029003700410050002e00620056007800750073005d00420079003e0056002900470055003d004200540038002100720064004c0029006c0034004400520046004700480000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AC710AF53FF38054FACD86AD67331D5B	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

4968 reg.exe

pid	process
4968	reg.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

sentryagent.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	sentryagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	sentryagent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	sentryagent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

3216 msiexec.exe
3216 msiexec.exe

pid	process
3216	msiexec.exe
3216	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1020	msiexec.exe
Token: SeSecurityPrivilege	3216	msiexec.exe
Token: SeCreateTokenPrivilege	1020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1020	msiexec.exe
Token: SeLockMemoryPrivilege	1020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1020	msiexec.exe
Token: SeMachineAccountPrivilege	1020	msiexec.exe
Token: SeTcbPrivilege	1020	msiexec.exe
Token: SeSecurityPrivilege	1020	msiexec.exe
Token: SeTakeOwnershipPrivilege	1020	msiexec.exe
Token: SeLoadDriverPrivilege	1020	msiexec.exe
Token: SeSystemProfilePrivilege	1020	msiexec.exe
Token: SeSystemtimePrivilege	1020	msiexec.exe
Token: SeProfSingleProcessPrivilege	1020	msiexec.exe
Token: SeIncBasePriorityPrivilege	1020	msiexec.exe
Token: SeCreatePagefilePrivilege	1020	msiexec.exe
Token: SeCreatePermanentPrivilege	1020	msiexec.exe
Token: SeBackupPrivilege	1020	msiexec.exe
Token: SeRestorePrivilege	1020	msiexec.exe
Token: SeShutdownPrivilege	1020	msiexec.exe
Token: SeDebugPrivilege	1020	msiexec.exe
Token: SeAuditPrivilege	1020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1020	msiexec.exe
Token: SeChangeNotifyPrivilege	1020	msiexec.exe
Token: SeRemoteShutdownPrivilege	1020	msiexec.exe
Token: SeUndockPrivilege	1020	msiexec.exe
Token: SeSyncAgentPrivilege	1020	msiexec.exe
Token: SeEnableDelegationPrivilege	1020	msiexec.exe
Token: SeManageVolumePrivilege	1020	msiexec.exe
Token: SeImpersonatePrivilege	1020	msiexec.exe
Token: SeCreateGlobalPrivilege	1020	msiexec.exe
Token: SeCreateTokenPrivilege	1020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1020	msiexec.exe
Token: SeLockMemoryPrivilege	1020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1020	msiexec.exe
Token: SeMachineAccountPrivilege	1020	msiexec.exe
Token: SeTcbPrivilege	1020	msiexec.exe
Token: SeSecurityPrivilege	1020	msiexec.exe
Token: SeTakeOwnershipPrivilege	1020	msiexec.exe
Token: SeLoadDriverPrivilege	1020	msiexec.exe
Token: SeSystemProfilePrivilege	1020	msiexec.exe
Token: SeSystemtimePrivilege	1020	msiexec.exe
Token: SeProfSingleProcessPrivilege	1020	msiexec.exe
Token: SeIncBasePriorityPrivilege	1020	msiexec.exe
Token: SeCreatePagefilePrivilege	1020	msiexec.exe
Token: SeCreatePermanentPrivilege	1020	msiexec.exe
Token: SeBackupPrivilege	1020	msiexec.exe
Token: SeRestorePrivilege	1020	msiexec.exe
Token: SeShutdownPrivilege	1020	msiexec.exe
Token: SeDebugPrivilege	1020	msiexec.exe
Token: SeAuditPrivilege	1020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1020	msiexec.exe
Token: SeChangeNotifyPrivilege	1020	msiexec.exe
Token: SeRemoteShutdownPrivilege	1020	msiexec.exe
Token: SeUndockPrivilege	1020	msiexec.exe
Token: SeSyncAgentPrivilege	1020	msiexec.exe
Token: SeEnableDelegationPrivilege	1020	msiexec.exe
Token: SeManageVolumePrivilege	1020	msiexec.exe
Token: SeImpersonatePrivilege	1020	msiexec.exe
Token: SeCreateGlobalPrivilege	1020	msiexec.exe
Token: SeCreateTokenPrivilege	1020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1020	msiexec.exe
Token: SeLockMemoryPrivilege	1020	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1020 msiexec.exe
1020 msiexec.exe

pid	process
1020	msiexec.exe
1020	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exesentryagent.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3216 wrote to memory of 2672	3216	msiexec.exe	MsiExec.exe
PID 3216 wrote to memory of 2672	3216	msiexec.exe	MsiExec.exe
PID 3216 wrote to memory of 2672	3216	msiexec.exe	MsiExec.exe
PID 3216 wrote to memory of 4864	3216	msiexec.exe	srtasks.exe
PID 3216 wrote to memory of 4864	3216	msiexec.exe	srtasks.exe
PID 3216 wrote to memory of 3700	3216	msiexec.exe	MsiExec.exe
PID 3216 wrote to memory of 3700	3216	msiexec.exe	MsiExec.exe
PID 3216 wrote to memory of 3700	3216	msiexec.exe	MsiExec.exe
PID 3216 wrote to memory of 428	3216	msiexec.exe	MsiExec.exe
PID 3216 wrote to memory of 428	3216	msiexec.exe	MsiExec.exe
PID 3216 wrote to memory of 428	3216	msiexec.exe	MsiExec.exe
PID 1784 wrote to memory of 168	1784	sentryagent.exe	sc.exe
PID 1784 wrote to memory of 168	1784	sentryagent.exe	sc.exe
PID 1784 wrote to memory of 168	1784	sentryagent.exe	sc.exe
PID 1784 wrote to memory of 96	1784	sentryagent.exe	Sysmon64.exe
PID 1784 wrote to memory of 96	1784	sentryagent.exe	Sysmon64.exe
PID 1784 wrote to memory of 1016	1784	sentryagent.exe	sc.exe
PID 1784 wrote to memory of 1016	1784	sentryagent.exe	sc.exe
PID 1784 wrote to memory of 1016	1784	sentryagent.exe	sc.exe
PID 1784 wrote to memory of 696	1784	sentryagent.exe	sc.exe
PID 1784 wrote to memory of 696	1784	sentryagent.exe	sc.exe
PID 1784 wrote to memory of 696	1784	sentryagent.exe	sc.exe
PID 1784 wrote to memory of 1004	1784	sentryagent.exe	ipconfig.exe
PID 1784 wrote to memory of 1004	1784	sentryagent.exe	ipconfig.exe
PID 1784 wrote to memory of 1004	1784	sentryagent.exe	ipconfig.exe
PID 1784 wrote to memory of 4284	1784	sentryagent.exe	ipconfig.exe
PID 1784 wrote to memory of 4284	1784	sentryagent.exe	ipconfig.exe
PID 1784 wrote to memory of 4284	1784	sentryagent.exe	ipconfig.exe
PID 1784 wrote to memory of 4088	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4088	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4088	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 3484	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 3484	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 3484	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4324	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4324	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4324	1784	sentryagent.exe	cmd.exe
PID 4324 wrote to memory of 1500	4324	cmd.exe	sc.exe
PID 4324 wrote to memory of 1500	4324	cmd.exe	sc.exe
PID 4324 wrote to memory of 1500	4324	cmd.exe	sc.exe
PID 4088 wrote to memory of 4356	4088	cmd.exe	auditpol.exe
PID 4088 wrote to memory of 4356	4088	cmd.exe	auditpol.exe
PID 4088 wrote to memory of 4356	4088	cmd.exe	auditpol.exe
PID 3484 wrote to memory of 1644	3484	cmd.exe	schtasks.exe
PID 3484 wrote to memory of 1644	3484	cmd.exe	schtasks.exe
PID 3484 wrote to memory of 1644	3484	cmd.exe	schtasks.exe
PID 1784 wrote to memory of 4344	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4344	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4344	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4336	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4336	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4336	1784	sentryagent.exe	cmd.exe
PID 1784 wrote to memory of 4216	1784	sentryagent.exe	ipconfig.exe
PID 1784 wrote to memory of 4216	1784	sentryagent.exe	ipconfig.exe
PID 1784 wrote to memory of 4216	1784	sentryagent.exe	ipconfig.exe
PID 4088 wrote to memory of 4492	4088	cmd.exe	auditpol.exe
PID 4088 wrote to memory of 4492	4088	cmd.exe	auditpol.exe
PID 4088 wrote to memory of 4492	4088	cmd.exe	auditpol.exe
PID 4344 wrote to memory of 4520	4344	cmd.exe	schtasks.exe
PID 4344 wrote to memory of 4520	4344	cmd.exe	schtasks.exe
PID 4344 wrote to memory of 4520	4344	cmd.exe	schtasks.exe
PID 4336 wrote to memory of 4496	4336	cmd.exe	schtasks.exe
PID 4336 wrote to memory of 4496	4336	cmd.exe	schtasks.exe
PID 4336 wrote to memory of 4496	4336	cmd.exe	schtasks.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Lorex.AdluminInstaller.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1020

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 473CD41A2B07421A5C2C3AAFBA4DD741 C
2⤵
- Loads dropped DLL
PID:2672

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:4864

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4A6CDF1F74DA63A5AB66C384890C832D
2⤵
- Loads dropped DLL
PID:3700

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6ECAF70193C52EDD802B0F8E25EDE2A7 E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:428

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4316

C:\Program Files (x86)\Sentry\SA\sentryagent.exe
"C:\Program Files (x86)\Sentry\SA\sentryagent.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\sc.exe
"sc" queryex Sysmon64
2⤵
- Launches sc.exe
PID:168

C:\Program Files (x86)\Sentry\SA\Sysmon64.exe
"C:\Program Files (x86)\Sentry\SA\Sysmon64" -accepteula -i .\config.xml
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:96

C:\Windows\SysWOW64\sc.exe
"sc" qc Sysmon64
2⤵
- Launches sc.exe
PID:1016

C:\Windows\SysWOW64\sc.exe
"sc" qc Sysmon64
2⤵
- Launches sc.exe
PID:696

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:1004

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:4284

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C auditpol /set /subcategory:"Process Creation" && auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable && auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable && auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable && auditpol /set /subcategory:"File Share" /success:enable /failure:enable && auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable && auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable && reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Policies\Microsoft\Microsoft Antimalware" /v ThreatFileHashLogging /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Policies\Microsoft\Windows PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Policies\Microsoft\Windows PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Microsoft Antimalware" /v ThreatFileHashLogging /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Windows PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f && reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Windows PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4088

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"Process Creation"
3⤵
PID:4356

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable
3⤵
PID:4492

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
3⤵
PID:5076

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
3⤵
PID:4828

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"File Share" /success:enable /failure:enable
3⤵
PID:4840

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
3⤵
PID:4860

C:\Windows\SysWOW64\auditpol.exe
auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
3⤵
PID:4892

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:4968

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Microsoft Antimalware" /v ThreatFileHashLogging /t REG_DWORD /d 1 /f
3⤵
PID:5096

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f
3⤵
PID:504

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f
3⤵
PID:4756

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Microsoft Antimalware" /v ThreatFileHashLogging /t REG_DWORD /d 1 /f
3⤵
PID:5056

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Windows PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f
3⤵
PID:3956

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Wow6432Node\Policies\Microsoft\Windows PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f
3⤵
PID:3084

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /create /tn "SA Routine Update" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 10:52 /rl HIGHEST /ru "SYSTEM"
2⤵
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /create /tn "SA Routine Update" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 10:52 /rl HIGHEST /ru "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1644

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C sc failure sentryagent actions= restart/60000/restart/60000/""/60000 reset= 86400
2⤵
- Suspicious use of WriteProcessMemory
PID:4324

C:\Windows\SysWOW64\sc.exe
sc failure sentryagent actions= restart/60000/restart/60000/""/60000 reset= 86400
3⤵
- Launches sc.exe
PID:1500

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /create /tn "Adlumin1" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 20:13 /rl HIGHEST /ru "SYSTEM"
2⤵
- Suspicious use of WriteProcessMemory
PID:4344

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /create /tn "Adlumin1" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 20:13 /rl HIGHEST /ru "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:4520

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /create /tn "Adlumin2" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 04:26 /rl HIGHEST /ru "SYSTEM"
2⤵
- Suspicious use of WriteProcessMemory
PID:4336

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /create /tn "Adlumin2" /tr "cmd.exe /C net stop sentryagent & net start sentryagent" /sc daily /st 04:26 /rl HIGHEST /ru "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:4496

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:4216

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:3372

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:4008

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:3996

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:2188

C:\Windows\SysWOW64\ipconfig.exe
"ipconfig.exe" /all
2⤵
- Gathers network information
PID:2736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e570986.rbs
Filesize
14KB

MD5
230f98be38581079863021c07bc09adf

SHA1
e18b221bf96651baaeabab0b33bc960d327f762a

SHA256
788f2fa59747aaae936e74a37cd3aceebb10f67edd5da9e61f86f1ce712ee8bd

SHA512
b3f576cfe61cd1aae85c56e783662c455ef6c43eb07b41ab2420a3a1d0a56321414528198b36a10f67d76221fb70eea701bab12a54bb0d40fbc4ce24cae5f8b9

Download Submit
C:\Program Files (x86)\Sentry\SA\AWSSDK.Core.dll
Filesize
1.5MB

MD5
ef9915bc36b80a289f732b4fff4000e7

SHA1
fc4e5b725e3ad825b7372c877498f752a4961c77

SHA256
2c7598133925ea63ac61c43dddaf3b7e0de59122564bd9c42d3363a530ebc427

SHA512
8742e19f5d8dea1247bf63f751c9b82a193a8fb1a449222df0c1b1f8e86e685b22c4141e035bad2e6dd87e77445fa2bbd7a1948e35e3f45f70ddfec06853945a

Download Submit
C:\Program Files (x86)\Sentry\SA\AWSSDK.Kinesis.dll
Filesize
115KB

MD5
83ab5a05fde27136563d1c016be16bd3

SHA1
fa7e9402496abc4b31eb70801dae376e6acc78e9

SHA256
62464a81a6c64c2beeed738dcd57f2cf2449c993694e894402106213f06edc6e

SHA512
4eff62c7727999c216fb35af3323bb623fd8c68cd5c838cc586b36bd14be9c01f808af7e11d9b0646e1e3ddd88d4c9123f7cc144118ecfa918a7f58662309957

Download Submit
C:\Program Files (x86)\Sentry\SA\AdluminCommon.dll
Filesize
26KB

MD5
c7698d14156331bd4fe57b936ff1a1dc

SHA1
5aa451a5a26ba382e3b693927c3f13a59467a958

SHA256
87233077d7da0c215ecab66993fe55a3a3d62f7cde8e1ba579977d5a65dd5b0e

SHA512
c5fe522accf9f14c973715f2da5540f1c914cf6e24beae12f439f5aa24fc75ad523fcd035b2181787eee3d161f2696e6b16bb63fabadcf12eb1f12ee01b2548a

Download Submit
C:\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
C:\Program Files (x86)\Sentry\SA\Microsoft.Win32.TaskScheduler.dll
Filesize
326KB

MD5
6faa5bc69ea08d067b6b454918af3f69

SHA1
8e5ea5cf270aef4331291805a3e96a8fdbca0dd2

SHA256
6928bf7bb271eacf64ed826b46597f73111867009720167c070e214488c4c445

SHA512
f98c7cc55746f562c4ed0896f51d351bfe1ed309f3f2b3722bd424f50cb76b99264667a8b951eece7e49e29fcb73053963ef47ca4268377d714f5e94937b5299

Download Submit
C:\Program Files (x86)\Sentry\SA\Sysmon64.exe
Filesize
4.2MB

MD5
70b29632de85b610b5918b6fe0084333

SHA1
d5bb8d8a27052b68ec8952a35ef145bb3ba2cb19

SHA256
3267279461be7397ef6e2afe61f9396e42475577f8c76648dbcae1b831b6fd3e

SHA512
d7d16d0956300680f1431193d35ff22ec1789c712aa34570e67d6690de4f276fa539486d7b96ca5e52d9206be4bb732e31f978a8ce83d116afdb8db39fffe6c6

Download Submit
C:\Program Files (x86)\Sentry\SA\Sysmon64.exe
Filesize
4.2MB

MD5
70b29632de85b610b5918b6fe0084333

SHA1
d5bb8d8a27052b68ec8952a35ef145bb3ba2cb19

SHA256
3267279461be7397ef6e2afe61f9396e42475577f8c76648dbcae1b831b6fd3e

SHA512
d7d16d0956300680f1431193d35ff22ec1789c712aa34570e67d6690de4f276fa539486d7b96ca5e52d9206be4bb732e31f978a8ce83d116afdb8db39fffe6c6

Download Submit
C:\Program Files (x86)\Sentry\SA\System.Buffers.dll
Filesize
20KB

MD5
ecdfe8ede869d2ccc6bf99981ea96400

SHA1
2f410a0396bc148ed533ad49b6415fb58dd4d641

SHA256
accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb

SHA512
5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741

Download Submit
C:\Program Files (x86)\Sentry\SA\System.Memory.dll
Filesize
137KB

MD5
6fb95a357a3f7e88ade5c1629e2801f8

SHA1
19bf79600b716523b5317b9a7b68760ae5d55741

SHA256
8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7

SHA512
293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0

Download Submit
C:\Program Files (x86)\Sentry\SA\System.Runtime.CompilerServices.Unsafe.dll
Filesize
16KB

MD5
da04a75ddc22118ed24e0b53e474805a

SHA1
2d68c648a6a6371b6046e6c3af09128230e0ad32

SHA256
66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74

SHA512
26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8

Download Submit
C:\Program Files (x86)\Sentry\SA\ZstdNet.dll
Filesize
28KB

MD5
a261a10179fc33cc7c548830832e3ca2

SHA1
e804128ed18ea308d3130c5e7112715ad8903703

SHA256
6cb57c7b6c15e59dbded96d61ce922678529563ed8285f3cd851857fae599b71

SHA512
244e87ecc65d1d431dc7f97076ea53c54baef0eadbc8d413a51c4b7a780c7b9c2c63cb3e1a9dbb5cd90ee218dd9e9f29c114632b0ca4645b91c178185e86d1b3

Download Submit
C:\Program Files (x86)\Sentry\SA\config.xml
Filesize
124KB

MD5
18979278c56e93079e7e48f33fd38f67

SHA1
0006570f84b41b81c89d6df382ef793daccc13ec

SHA256
e4c2b8b0dc708bc41fc1ba73c41e79ef34454609291454dbb8e939e1a05f5d40

SHA512
ef7b109e1a26ad91676b2002700ab13b03a9f028267aa76cdef64a2f1cb0b5d162c86497990b1e696d1f6efca11aa6ce155b4bdd87628b32bfc2f3665edd184b

Download Submit
C:\Program Files (x86)\Sentry\SA\libzstd.DLL
Filesize
667KB

MD5
be4ee73d4d1e9f893088275087cf44ec

SHA1
b42ed1ae16f02c9a20117de4770374e322c15d2d

SHA256
6ea0ae72419b6e59bfa49f487c0cfccbfd4a315c4826df7f5eab549456eaf8a9

SHA512
87f3d221bac769b64c485a3a0576baa7dccf4575dc57cf76478c3de2a6fa2721c9c7d30091523d1d0f6d2b2c3f3792c21a6c6209630154e12394c45b2d524fa4

Download Submit
C:\Program Files (x86)\Sentry\SA\sentryagent.exe
Filesize
986KB

MD5
1f1a4445eea40e209ab4004485442fc9

SHA1
c4e6fd2b14c0ede680ed1cd710ad704a8744e511

SHA256
039d3ad8fce2249ca97b599bfe7a2bd3279819f6d6e9754bcbcd73d9c2a92d40

SHA512
b914343498657a6af94434245c064ff7bf8a36c78d48738b9c52a47480526af9f90f9b64f3050df53c693b0e08bd8b0a7e1a0c93578d4525641283272bc59218

Download Submit
C:\Program Files (x86)\Sentry\SA\sentryagent.exe
Filesize
986KB

MD5
1f1a4445eea40e209ab4004485442fc9

SHA1
c4e6fd2b14c0ede680ed1cd710ad704a8744e511

SHA256
039d3ad8fce2249ca97b599bfe7a2bd3279819f6d6e9754bcbcd73d9c2a92d40

SHA512
b914343498657a6af94434245c064ff7bf8a36c78d48738b9c52a47480526af9f90f9b64f3050df53c693b0e08bd8b0a7e1a0c93578d4525641283272bc59218

Download Submit
C:\Program Files (x86)\Sentry\SA\sentryagent.exe.config
Filesize
505B

MD5
a81add0e2fa1cb7b5e2cb4eef045b0a3

SHA1
150df3469ebcfd13143091868ec8801760f539c3

SHA256
f0a7ee916109df3d7bc5cd7aff67631b491e58d5b4ee64ded5143da7fef5db5d

SHA512
b5d12c804d60bf7f7de4a1b28223e246d3403da75a5f0273f2f52d9b34c838b2726c888ca05649eca9baf0200ab3bbd2b9d6805e7b30183cba4e9a8b21cdfd51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize
765B

MD5
d4a3ec1ea5b0d68a77473e547883fe3a

SHA1
192b440f6f37e3a9e503d3a152a8d71826b9476e

SHA256
033565c02acc84e15079d67238d9e34adb739ad374492e3e9f1ee9122200f262

SHA512
49b805cd205940d642ddd4cf9a18b4c951e45e5f89ae2f70da6e3a79b333610d9bdce05c9951fcfd498efad3767ec3e813f8843ec8d025e8f22690f8b201cdca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_DDCB2DD85990061C1CEA5347464E8D24
Filesize
637B

MD5
9b0f141bc891947dc8d663a82c5078c0

SHA1
d32a47d49264db5d1dcc537ec58c3cd5e5cc015b

SHA256
7269a7d055bcde9e1188a52000edfcaaf69947e2f177f9c1e391d76f8b6b814f

SHA512
635869873e8fa4cbf293496b06d79d3d65782caea2a79544e5f9ce26290589627e1365f2bb496b1a5daadb1f75ff3bee5c1fb2247ebd4114068f7d6fc5aaa904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize
1KB

MD5
8a136fb17bbbaeecd7ad8f3378d6a1fc

SHA1
db4f50914ecc3dcf530f37771fd88ec71e4b12be

SHA256
21868ebb658ac7a86059168b09c9e6607d9896446cc6e2c7603236293f7cef35

SHA512
251092408c254758e329d9ccddeea3896f25b7b308094db9d0e5a85ee0ecadfdd97950a89d38f64ee20581d43a4500ea288ab93aab1e8f17f0562971c7057c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize
484B

MD5
54307378b5584eef69aa460d2b42c0bf

SHA1
e5926f2c8372646f8e46a409d9d40880b8627768

SHA256
e812b800337893fea2b1c38a29dc8916befddfc23a2d7b6e7b7256dce2dd142b

SHA512
a17068c4161cd99e4236bf8271eb2d841416638c5c995d3eee8ae74ce013401d7deca213f3bfc1b735993aa861b1b7852dc461846f06d0f9bcc39e15c9b58029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_DDCB2DD85990061C1CEA5347464E8D24
Filesize
492B

MD5
e869c67a6ca4a8706b51e581ce359eca

SHA1
e8f8ced3446feb444bba10b7f8c504daa3e9fcc1

SHA256
cd825bb8cc225125e9ef2fc01d6c7574ae6843d6713b8ec69b58fe864584c4ef

SHA512
d05783f804ef06df184bd6872d2c55b05b3c38dea8889c731ae93b535671f59a4dea002a3c4a29104671bc7a9a40236b99267c83d15052d251e16049b01d1038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize
482B

MD5
0d2af85df6a5a75ff55c978ce1aab25d

SHA1
b1a2fa23d8c1421e27da657ff0b98a8bebd29578

SHA256
fb1ff2c8f7fae2cc050cd6f29bd1bfb06935be3ee346ca0080b104a21f92c836

SHA512
bd8f460553aaf6cc93b0997aec8f071c3fc33d03835cdce939857e53adad2126f35b8490d86e5270dc870e931210a6fcf7969639578c11ce812a11b8f92df9a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CFGC16.tmp
Filesize
152B

MD5
df6640211847a5b71f62b8187994ea38

SHA1
07c26fac7b1d538464497e6ca47b6ca8b465b8ba

SHA256
7d5f1726f0d15597fdd0fbcf8c27fd2ce668d80ebc39ca56f569f06957d510fb

SHA512
5530133a0992e2e956e10edccf02672eb410381bcdb7a6f0d46a78a6206141c9e9e63f7462c4ed83ddd9a3bb2b1f59627dca1a0b18ce8c9aea436ea17938f75f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI59DD.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5DD5.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Windows\Installer\MSI1215.tmp
Filesize
113KB

MD5
8fa4088a730b967d85df562fd5ef7d5e

SHA1
629db9229f4a4a691e14f38f4dbffba157fa1ce9

SHA256
cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36

SHA512
1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2

Download Submit
C:\Windows\Installer\MSIA70.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Windows\Installer\MSIA70.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Windows\Installer\MSIC36.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Windows\Installer\e570985.msi
Filesize
6.5MB

MD5
ba9f849e3c6e57316548367f0f6a444b

SHA1
34b80863cddfd512be800f366f282eb58fdfc640

SHA256
dc2c8c8369c3dee48feb6b43b5467f22e6a0c939257207828104ed8d94b154d2

SHA512
93c324b2849e9642de25370d3e73f246384f00c2ef49c2d624f495447b856e4a74911066779650a35249bd8518cf4b4944c168982c3613f29f6a9405b74aa21d

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
25.0MB

MD5
b875d698f5e6f8cb7f039655b50f266d

SHA1
d1b500bc4ccc918efce12698f3172985377dd342

SHA256
998c952fd91853e16e6c3e1706ec304be6e0909e88abc060b014dcd46ce46a72

SHA512
eb0cc491c93805aa601d8ce256743668b5450bd97c8fe8189a45f1aa0a069b5d44c959a3e9adb691671b015b806882cbcf631ba663013a8fa467b2c6efdfa223

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\Volume{ce598122-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a693e100-38ab-407c-b483-36b6da60c313}_OnDiskSnapshotProp
Filesize
5KB

MD5
2dd09d67666ecd3ce3136cf4f619b7a1

SHA1
8cd502e16f728330779a9a88f5e8c8dd4a83ce8c

SHA256
8c9ca619074ab3ba64037024a4ede16cc5d3385e24b4076efac2e41fec498a78

SHA512
785a9f39dfa651f17c01e0748f1f2288ed3a371d02eb8c076820f8fb230516288d2d366233c16ed98325ba3f76d94ccff0fa2520e8351f2a43d07dc4391129af

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Core.dll
Filesize
1.5MB

MD5
ef9915bc36b80a289f732b4fff4000e7

SHA1
fc4e5b725e3ad825b7372c877498f752a4961c77

SHA256
2c7598133925ea63ac61c43dddaf3b7e0de59122564bd9c42d3363a530ebc427

SHA512
8742e19f5d8dea1247bf63f751c9b82a193a8fb1a449222df0c1b1f8e86e685b22c4141e035bad2e6dd87e77445fa2bbd7a1948e35e3f45f70ddfec06853945a

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Core.dll
Filesize
1.5MB

MD5
ef9915bc36b80a289f732b4fff4000e7

SHA1
fc4e5b725e3ad825b7372c877498f752a4961c77

SHA256
2c7598133925ea63ac61c43dddaf3b7e0de59122564bd9c42d3363a530ebc427

SHA512
8742e19f5d8dea1247bf63f751c9b82a193a8fb1a449222df0c1b1f8e86e685b22c4141e035bad2e6dd87e77445fa2bbd7a1948e35e3f45f70ddfec06853945a

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Kinesis.dll
Filesize
115KB

MD5
83ab5a05fde27136563d1c016be16bd3

SHA1
fa7e9402496abc4b31eb70801dae376e6acc78e9

SHA256
62464a81a6c64c2beeed738dcd57f2cf2449c993694e894402106213f06edc6e

SHA512
4eff62c7727999c216fb35af3323bb623fd8c68cd5c838cc586b36bd14be9c01f808af7e11d9b0646e1e3ddd88d4c9123f7cc144118ecfa918a7f58662309957

Download Submit
\Program Files (x86)\Sentry\SA\AWSSDK.Kinesis.dll
Filesize
115KB

MD5
83ab5a05fde27136563d1c016be16bd3

SHA1
fa7e9402496abc4b31eb70801dae376e6acc78e9

SHA256
62464a81a6c64c2beeed738dcd57f2cf2449c993694e894402106213f06edc6e

SHA512
4eff62c7727999c216fb35af3323bb623fd8c68cd5c838cc586b36bd14be9c01f808af7e11d9b0646e1e3ddd88d4c9123f7cc144118ecfa918a7f58662309957

Download Submit
\Program Files (x86)\Sentry\SA\AdluminCommon.dll
Filesize
26KB

MD5
c7698d14156331bd4fe57b936ff1a1dc

SHA1
5aa451a5a26ba382e3b693927c3f13a59467a958

SHA256
87233077d7da0c215ecab66993fe55a3a3d62f7cde8e1ba579977d5a65dd5b0e

SHA512
c5fe522accf9f14c973715f2da5540f1c914cf6e24beae12f439f5aa24fc75ad523fcd035b2181787eee3d161f2696e6b16bb63fabadcf12eb1f12ee01b2548a

Download Submit
\Program Files (x86)\Sentry\SA\AdluminCommon.dll
Filesize
26KB

MD5
c7698d14156331bd4fe57b936ff1a1dc

SHA1
5aa451a5a26ba382e3b693927c3f13a59467a958

SHA256
87233077d7da0c215ecab66993fe55a3a3d62f7cde8e1ba579977d5a65dd5b0e

SHA512
c5fe522accf9f14c973715f2da5540f1c914cf6e24beae12f439f5aa24fc75ad523fcd035b2181787eee3d161f2696e6b16bb63fabadcf12eb1f12ee01b2548a

Download Submit
\Program Files (x86)\Sentry\SA\AdluminCommon.dll
Filesize
26KB

MD5
c7698d14156331bd4fe57b936ff1a1dc

SHA1
5aa451a5a26ba382e3b693927c3f13a59467a958

SHA256
87233077d7da0c215ecab66993fe55a3a3d62f7cde8e1ba579977d5a65dd5b0e

SHA512
c5fe522accf9f14c973715f2da5540f1c914cf6e24beae12f439f5aa24fc75ad523fcd035b2181787eee3d161f2696e6b16bb63fabadcf12eb1f12ee01b2548a

Download Submit
\Program Files (x86)\Sentry\SA\AdluminCommon.dll
Filesize
26KB

MD5
c7698d14156331bd4fe57b936ff1a1dc

SHA1
5aa451a5a26ba382e3b693927c3f13a59467a958

SHA256
87233077d7da0c215ecab66993fe55a3a3d62f7cde8e1ba579977d5a65dd5b0e

SHA512
c5fe522accf9f14c973715f2da5540f1c914cf6e24beae12f439f5aa24fc75ad523fcd035b2181787eee3d161f2696e6b16bb63fabadcf12eb1f12ee01b2548a

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\AdluminTools.dll
Filesize
246KB

MD5
2ee508f3c72b0a3619e3d0334b1ebe84

SHA1
5ca22ebb81aa3a2e7154646999d6b9763972ee75

SHA256
3a5d81fc1f70db30c7a0a460b8cdef7e332ef1ba9bbaf00ce4d316f003695c8e

SHA512
a9838806f8c960ab0553e3bc11cbc8b5a4272dc3c0024aebf05067389fffc1b465b521b620502f334d3311be0101e08d7a9d35f5b13b6e9050c8bcfee0448a84

Download Submit
\Program Files (x86)\Sentry\SA\Microsoft.Win32.TaskScheduler.dll
Filesize
326KB

MD5
6faa5bc69ea08d067b6b454918af3f69

SHA1
8e5ea5cf270aef4331291805a3e96a8fdbca0dd2

SHA256
6928bf7bb271eacf64ed826b46597f73111867009720167c070e214488c4c445

SHA512
f98c7cc55746f562c4ed0896f51d351bfe1ed309f3f2b3722bd424f50cb76b99264667a8b951eece7e49e29fcb73053963ef47ca4268377d714f5e94937b5299

Download Submit
\Program Files (x86)\Sentry\SA\Microsoft.Win32.TaskScheduler.dll
Filesize
326KB

MD5
6faa5bc69ea08d067b6b454918af3f69

SHA1
8e5ea5cf270aef4331291805a3e96a8fdbca0dd2

SHA256
6928bf7bb271eacf64ed826b46597f73111867009720167c070e214488c4c445

SHA512
f98c7cc55746f562c4ed0896f51d351bfe1ed309f3f2b3722bd424f50cb76b99264667a8b951eece7e49e29fcb73053963ef47ca4268377d714f5e94937b5299

Download Submit
\Program Files (x86)\Sentry\SA\System.Buffers.dll
Filesize
20KB

MD5
ecdfe8ede869d2ccc6bf99981ea96400

SHA1
2f410a0396bc148ed533ad49b6415fb58dd4d641

SHA256
accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb

SHA512
5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741

Download Submit
\Program Files (x86)\Sentry\SA\System.Buffers.dll
Filesize
20KB

MD5
ecdfe8ede869d2ccc6bf99981ea96400

SHA1
2f410a0396bc148ed533ad49b6415fb58dd4d641

SHA256
accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb

SHA512
5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741

Download Submit
\Program Files (x86)\Sentry\SA\System.Memory.dll
Filesize
137KB

MD5
6fb95a357a3f7e88ade5c1629e2801f8

SHA1
19bf79600b716523b5317b9a7b68760ae5d55741

SHA256
8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7

SHA512
293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0

Download Submit
\Program Files (x86)\Sentry\SA\System.Memory.dll
Filesize
137KB

MD5
6fb95a357a3f7e88ade5c1629e2801f8

SHA1
19bf79600b716523b5317b9a7b68760ae5d55741

SHA256
8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7

SHA512
293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0

Download Submit
\Program Files (x86)\Sentry\SA\System.Runtime.CompilerServices.Unsafe.dll
Filesize
16KB

MD5
da04a75ddc22118ed24e0b53e474805a

SHA1
2d68c648a6a6371b6046e6c3af09128230e0ad32

SHA256
66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74

SHA512
26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8

Download Submit
\Program Files (x86)\Sentry\SA\System.Runtime.CompilerServices.Unsafe.dll
Filesize
16KB

MD5
da04a75ddc22118ed24e0b53e474805a

SHA1
2d68c648a6a6371b6046e6c3af09128230e0ad32

SHA256
66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74

SHA512
26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8

Download Submit
\Program Files (x86)\Sentry\SA\ZstdNet.dll
Filesize
28KB

MD5
a261a10179fc33cc7c548830832e3ca2

SHA1
e804128ed18ea308d3130c5e7112715ad8903703

SHA256
6cb57c7b6c15e59dbded96d61ce922678529563ed8285f3cd851857fae599b71

SHA512
244e87ecc65d1d431dc7f97076ea53c54baef0eadbc8d413a51c4b7a780c7b9c2c63cb3e1a9dbb5cd90ee218dd9e9f29c114632b0ca4645b91c178185e86d1b3

Download Submit
\Program Files (x86)\Sentry\SA\ZstdNet.dll
Filesize
28KB

MD5
a261a10179fc33cc7c548830832e3ca2

SHA1
e804128ed18ea308d3130c5e7112715ad8903703

SHA256
6cb57c7b6c15e59dbded96d61ce922678529563ed8285f3cd851857fae599b71

SHA512
244e87ecc65d1d431dc7f97076ea53c54baef0eadbc8d413a51c4b7a780c7b9c2c63cb3e1a9dbb5cd90ee218dd9e9f29c114632b0ca4645b91c178185e86d1b3

Download Submit
\Program Files (x86)\Sentry\SA\libzstd.dll
Filesize
667KB

MD5
be4ee73d4d1e9f893088275087cf44ec

SHA1
b42ed1ae16f02c9a20117de4770374e322c15d2d

SHA256
6ea0ae72419b6e59bfa49f487c0cfccbfd4a315c4826df7f5eab549456eaf8a9

SHA512
87f3d221bac769b64c485a3a0576baa7dccf4575dc57cf76478c3de2a6fa2721c9c7d30091523d1d0f6d2b2c3f3792c21a6c6209630154e12394c45b2d524fa4

Download Submit
\Program Files (x86)\Sentry\SA\sentryagent.exe
Filesize
986KB

MD5
1f1a4445eea40e209ab4004485442fc9

SHA1
c4e6fd2b14c0ede680ed1cd710ad704a8744e511

SHA256
039d3ad8fce2249ca97b599bfe7a2bd3279819f6d6e9754bcbcd73d9c2a92d40

SHA512
b914343498657a6af94434245c064ff7bf8a36c78d48738b9c52a47480526af9f90f9b64f3050df53c693b0e08bd8b0a7e1a0c93578d4525641283272bc59218

Download Submit
\Program Files (x86)\Sentry\SA\sentryagent.exe
Filesize
986KB

MD5
1f1a4445eea40e209ab4004485442fc9

SHA1
c4e6fd2b14c0ede680ed1cd710ad704a8744e511

SHA256
039d3ad8fce2249ca97b599bfe7a2bd3279819f6d6e9754bcbcd73d9c2a92d40

SHA512
b914343498657a6af94434245c064ff7bf8a36c78d48738b9c52a47480526af9f90f9b64f3050df53c693b0e08bd8b0a7e1a0c93578d4525641283272bc59218

Download Submit
\Users\Admin\AppData\Local\Temp\MSI59DD.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5DD5.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
\Windows\Installer\MSI1215.tmp
Filesize
113KB

MD5
8fa4088a730b967d85df562fd5ef7d5e

SHA1
629db9229f4a4a691e14f38f4dbffba157fa1ce9

SHA256
cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36

SHA512
1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2

Download Submit
\Windows\Installer\MSIA70.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
\Windows\Installer\MSIC36.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
memory/428-212-0x00000000074C0000-0x00000000075B8000-memory.dmp

Filesize
992KB

Download
memory/428-228-0x0000000007460000-0x000000000749E000-memory.dmp

Filesize
248KB

Download
memory/428-208-0x00000000051C0000-0x00000000051DA000-memory.dmp

Filesize
104KB

Download
memory/428-213-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/428-218-0x0000000005260000-0x0000000005282000-memory.dmp

Filesize
136KB

Download
memory/428-219-0x0000000007AC0000-0x0000000007FBE000-memory.dmp

Filesize
5.0MB

Download
memory/428-220-0x00000000075C0000-0x0000000007652000-memory.dmp

Filesize
584KB

Download
memory/428-223-0x0000000007400000-0x0000000007412000-memory.dmp

Filesize
72KB

Download
memory/1784-297-0x00000000041D0000-0x00000000041E0000-memory.dmp

Filesize
64KB

Download
memory/1784-227-0x0000000004630000-0x0000000004672000-memory.dmp

Filesize
264KB

Download
memory/1784-264-0x00000000041D0000-0x00000000041E0000-memory.dmp

Filesize
64KB

Download
memory/1784-263-0x0000000004AA0000-0x0000000004C28000-memory.dmp

Filesize
1.5MB

Download
memory/1784-301-0x0000000005290000-0x000000000529E000-memory.dmp

Filesize
56KB

Download
memory/1784-257-0x00000000048E0000-0x0000000004904000-memory.dmp

Filesize
144KB

Download
memory/1784-251-0x0000000004890000-0x00000000048DA000-memory.dmp

Filesize
296KB

Download
memory/1784-305-0x0000000005960000-0x0000000005986000-memory.dmp

Filesize
152KB

Download
memory/1784-309-0x00000000052B0000-0x00000000052B8000-memory.dmp

Filesize
32KB

Download
memory/1784-233-0x00000000046B0000-0x00000000046FA000-memory.dmp

Filesize
296KB

Download
memory/1784-232-0x0000000001C50000-0x0000000001C5A000-memory.dmp

Filesize
40KB

Download
memory/1784-266-0x0000000004980000-0x00000000049E6000-memory.dmp

Filesize
408KB

Download
memory/1784-275-0x0000000005B70000-0x0000000005BC8000-memory.dmp

Filesize
352KB

Download
memory/1784-285-0x00000000041D0000-0x00000000041E0000-memory.dmp

Filesize
64KB

Download
memory/1784-267-0x00000000049F0000-0x0000000004A56000-memory.dmp

Filesize
408KB

Download
memory/1784-276-0x00000000059A0000-0x0000000005B62000-memory.dmp

Filesize
1.8MB

Download
memory/1784-279-0x00000000041D0000-0x00000000041E0000-memory.dmp

Filesize
64KB

Download
memory/1784-278-0x0000000005910000-0x0000000005928000-memory.dmp

Filesize
96KB

Download
memory/1784-315-0x00000000052A0000-0x00000000052AA000-memory.dmp

Filesize
40KB

Download
memory/1784-316-0x000000006E880000-0x000000006E92E000-memory.dmp

Filesize
696KB

Download
memory/1784-277-0x0000000006400000-0x000000000692C000-memory.dmp

Filesize
5.2MB

Download