bc9f2c161f77cebe74c42a14b099bd2bedb2d89de7595388c07c168eaa3a2208

Analysis

max time kernel
1799s
max time network
1800s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
22/05/2023, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

r3QRVAoL.html
Size

2KB
MD5

68a0551225a2df68d0ed12011f892342
SHA1

59b1ed9f33191dae9833f016ea0f6cf6ba962b78
SHA256

bc9f2c161f77cebe74c42a14b099bd2bedb2d89de7595388c07c168eaa3a2208
SHA512

d67709d14d235dbb7857683b7705095758295dc01039470c006a7ed1a914179adada4245f8adac87d85f8ea43b6d03a2f8c3ca0786c38a9082e875d9c7a02b04

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
8	VCREDI~2.EXE
2592	cardpeek.tmp
628	cardpeek.exe
2424	cardpeek.tmp
1768	cardpeek.exe
4604	cardpeek.exe

Loads dropped DLL 64 IoCs

pid	Process
32	MsiExec.exe
32	MsiExec.exe
4576	vcredist2012_x64.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe
628	cardpeek.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist2012_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20230522195414.log\" /repair ignored \"C:\\Users\\Admin\\Downloads\\FULL SOFTWARE\\FULL SOFTWARE\\X2-2022-EmvSolutions\\DRIVERS\\vcredist2005_x64.exe\" /burn.runonce"	vcredist2012_x64.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist2005_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist2005_x64.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	VCREDI~2.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File created	C:\Windows\system32\mfc110cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc110rus.dll	msiexec.exe
File created	C:\Windows\system32\vcomp110.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc110ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc110esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc110fra.dll	msiexec.exe
File created	C:\Windows\system32\msvcp110.dll	msiexec.exe
File created	C:\Windows\system32\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110.dll	msiexec.exe
File created	C:\Windows\system32\mfc110kor.dll	msiexec.exe
File created	C:\Windows\system32\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp110.dll	msiexec.exe
File created	C:\Windows\system32\mfc110.dll	msiexec.exe
File created	C:\Windows\system32\mfc110deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp110.dll	msiexec.exe
File created	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc110chs.dll	msiexec.exe
File created	C:\Windows\system32\mfcm110.dll	msiexec.exe
File created	C:\Windows\system32\vcamp110.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-V4QN9.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\pango-basic-fc.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libglib-2.0-0.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libgobject-2.0-0.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-R7B6P.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-L9D9L.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\pango-hangul-fc.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\zlib1.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-9HGF3.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-F8ALD.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-OMDHJ.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-DVB45.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libgtk-3-0.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-ISDIA.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-1I17D.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\pango-khmer-fc.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libgdk_pixbuf-2.0-0.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libintl-8.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-JV453.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libreadline6.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-0RK38.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-BDHTJ.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libexpat-1.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\share\glib-2.0\schemas\is-NKL71.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libgmodule-2.0-0.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-EGGV1.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-SKS2E.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-093A7.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libatk-1.0-0.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-833KV.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-06UTV.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-MTTTV.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\pango-basic-win32.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\pango-syriac-fc.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\share\glib-2.0\schemas\is-O2GHP.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\share\glib-2.0\schemas\is-24IBL.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-PL7PN.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\cardpeek.exe	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libfreetype-6.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libpangoft2-1.0-0.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-7H4OI.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Cardpeek\libpixman-1-0.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\etc\pango\is-HFMTI.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-P6D85.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\pango-arabic-lang.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-7GLRN.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-O5SMK.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-9I14V.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-I56TQ.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\pango-indic-lang.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\pthreadGC2.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-08V1N.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-UVE55.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libpangocairo-1.0-0.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\is-EU89S.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-GOQL7.tmp	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-EL4TV.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libeay32.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libffi-6.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libgdk-3-0.dll	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\pango-tibetan-fc.dll	cardpeek.tmp
File created	C:\Program Files (x86)\Cardpeek\lib\pango\1.6.0\modules\is-86CEB.tmp	cardpeek.tmp
File opened for modification	C:\Program Files (x86)\Cardpeek\libhistory6.dll	cardpeek.tmp

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230522195350285.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349403.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_79404cdd.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349700.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_3ed5eb6c.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230522195349514.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349514.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_18a05f69.manifest	msiexec.exe
File created	C:\Windows\Installer\e5f6609.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\mfc80JPN.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350285.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350201.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350306.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\e5f6606.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349403.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349514.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_18a05f69.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349700.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e986d26e.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350390.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB36.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230522195350359.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349514.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349700.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350201.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.manifest	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230522195349925.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230522195350261.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A89.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350359.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350390.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350261.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_3ed5eb6c.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350359.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\Installer\e5f6606.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230522195349700.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350261.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350285.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI68E4.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349514.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349700.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350306.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349403.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_79404cdd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349700.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e986d26e.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349700.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\mfc80DEU.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230522195349403.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230522195350306.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349514.0\msvcr80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230522195350390.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195349925.0\mfc80KOR.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230522195350201.0\vcomp.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230522195350201.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF21.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133292582379453122"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v11\ = "{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C9F8B73BF303523781852719CD9C700\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v11	vcredist2012_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11\DisplayName = "Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11\Version = "11.0.61030"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C9F8B73BF303523781852719CD9C700\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11	vcredist2012_x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3AEB2FCAE628F23AAB933F1E743AB79	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3AEB2FCAE628F23AAB933F1E743AB79\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v11	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11\ = "{37B8F9C7-03FB-3253-8781-2517C99D7C00}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v11\DisplayName = "Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimum_amd64,v11\Dependents\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}	vcredist2012_x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11\DisplayName = "Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf\VC_Redist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v11\Version = "11.0.61030"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11\Dependents\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}	vcredist2012_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimum_amd64,v11	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11\ = "{37B8F9C7-03FB-3253-8781-2517C99D7C00}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3AEB2FCAE628F23AAB933F1E743AB79\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C9F8B73BF303523781852719CD9C700	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C9F8B73BF303523781852719CD9C700\VC_Runtime_Additional	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2464	WINWORD.EXE
2464	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4836	chrome.exe
4836	chrome.exe
3220	msiexec.exe
3220	msiexec.exe
3220	msiexec.exe
3220	msiexec.exe
3220	msiexec.exe
3220	msiexec.exe
2592	cardpeek.tmp
2592	cardpeek.tmp

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3440	OpenWith.exe
5044	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
2088	msiexec.exe
2088	msiexec.exe
4576	vcredist2012_x64.exe
2592	cardpeek.tmp
1076	jcopenglish.exe
1076	jcopenglish.exe
3796	jcopenglish.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
3440	OpenWith.exe
1236	OpenWith.exe
4828	OpenWith.exe
3960	jcopenglish.exe
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
2464	WINWORD.EXE
3112	jcopenglish.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe
5044	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4120	4108	chrome.exe	66
PID 4108 wrote to memory of 4120	4108	chrome.exe	66
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 2640	4108	chrome.exe	69
PID 4108 wrote to memory of 5080	4108	chrome.exe	68
PID 4108 wrote to memory of 5080	4108	chrome.exe	68
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70
PID 4108 wrote to memory of 3480	4108	chrome.exe	70

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\r3QRVAoL.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9d65f9758,0x7ff9d65f9768,0x7ff9d65f9778
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1352 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:2
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1988 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4732 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2428 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2328 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4288 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4644 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=244,i,16994316862417988334,12499608819391722030,131072 /prefetch:8
  2⤵
  PID:2964

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c0
1⤵
PID:4220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4764

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_FULL SOFTWARE.zip\FULL SOFTWARE\X2-2022-EmvSolutions\Read Me.txt
1⤵
PID:3284

C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2A.exe
"C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2A.exe"
1⤵
PID:944

C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\DRIVERS\vcredist2005_x64.exe
"C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\DRIVERS\vcredist2005_x64.exe"
1⤵
- Adds Run key to start application
PID:4952
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i vcredist.msi
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2088

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3220
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C5C56732AC9B3FAEE13A46DD237B3CB7
  2⤵
  - Loads dropped DLL
  PID:32

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5020

C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\DRIVERS\vcredist2005_x86.exe
"C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\DRIVERS\vcredist2005_x86.exe"
1⤵
PID:944

C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\DRIVERS\vcredist2012_x64.exe
"C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\DRIVERS\vcredist2012_x64.exe" "C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\DRIVERS\vcredist2005_x64.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:2024
- C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\DRIVERS\vcredist2012_x64.exe
  "C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\DRIVERS\vcredist2012_x64.exe" "C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\DRIVERS\vcredist2005_x64.exe" -burn.unelevated BurnPipe.{CE602CF9-FCED-45F8-9111-61FCBCFA968B} {0DD00D98-16A8-4F62-B2BF-2FF8D4D06A0C} 2024
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:4576

C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\CARDPEEK READING\cardpeek.exe
"C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\CARDPEEK READING\cardpeek.exe"
1⤵
PID:1280
- C:\Users\Admin\AppData\Local\Temp\is-N4QSQ.tmp\cardpeek.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N4QSQ.tmp\cardpeek.tmp" /SL5="$402F6,6389762,56832,C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\CARDPEEK READING\cardpeek.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:2592
- - C:\Program Files (x86)\Cardpeek\cardpeek.exe
    "C:\Program Files (x86)\Cardpeek\cardpeek.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1236

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2-2022-EmvSolutions\Read Me.txt
1⤵
PID:1452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4828

C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\jcopenglish.exe
"C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\jcopenglish.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3960

C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2A.exe
"C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\X2A.exe"
1⤵
PID:2060

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\CURRENCY CODES\currency codes.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2464

C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\jcopenglish.exe
"C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\jcopenglish.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5044
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\cardtemp.dat"
  2⤵
  PID:1280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\cardtemp.dat"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    PID:2884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2884.0.541496543\1064991764" -parentBuildID 20221007134813 -prefsHandle 1644 -prefMapHandle 1620 -prefsLen 20810 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37a86f10-d114-4eac-84c4-541c33134134} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" 1724 1ca975a6258 gpu
      4⤵
      PID:3716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2884.1.100705612\1817206933" -parentBuildID 20221007134813 -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21671 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d19e29c1-41e0-4f24-a760-aec9d5c3cbaa} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" 2104 1ca8ad72b58 socket
      4⤵
      Checks processor information in registry
      PID:1700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2884.2.1471677031\1978430714" -childID 1 -isForBrowser -prefsHandle 2588 -prefMapHandle 2840 -prefsLen 21754 -prefMapSize 232645 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1139c33-9959-4c14-8f34-f7dc2a696990} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" 2552 1ca9a04ec58 tab
      4⤵
      PID:2176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2884.3.1187643922\74259161" -childID 2 -isForBrowser -prefsHandle 3212 -prefMapHandle 3200 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc3af50f-c916-4b96-8d6b-dd3d0f990e25} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" 3220 1ca9afba158 tab
      4⤵
      PID:1428
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2884.4.1260534463\220528146" -childID 3 -isForBrowser -prefsHandle 4860 -prefMapHandle 4856 -prefsLen 26718 -prefMapSize 232645 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {799f7409-5bcf-4a3e-a56f-89d27aede7a9} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" 4844 1ca9bda8a58 tab
      4⤵
      PID:4268
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2884.5.749222055\521451539" -childID 4 -isForBrowser -prefsHandle 4976 -prefMapHandle 4980 -prefsLen 26718 -prefMapSize 232645 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14ea203a-7911-47b9-a068-3a4be6c984e5} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" 4964 1ca9b973558 tab
      4⤵
      PID:3984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2884.6.1704989248\55388662" -childID 5 -isForBrowser -prefsHandle 5144 -prefMapHandle 5148 -prefsLen 26718 -prefMapSize 232645 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ede3185-f25c-42ec-9206-18cb88815129} 2884 "\\.\pipe\gecko-crash-server-pipe.2884" 4788 1ca9b973e58 tab
      4⤵
      PID:1884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:5100

C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\CARDPEEK READING\cardpeek.exe
"C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\CARDPEEK READING\cardpeek.exe"
1⤵
PID:3976
- C:\Users\Admin\AppData\Local\Temp\is-UIAT2.tmp\cardpeek.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UIAT2.tmp\cardpeek.tmp" /SL5="$802D8,6389762,56832,C:\Users\Admin\Downloads\FULL SOFTWARE\FULL SOFTWARE\CARDPEEK READING\cardpeek.exe"
  2⤵
  - Executes dropped EXE
  PID:2424

C:\Users\Admin\Desktop\jcopenglish.exe
"C:\Users\Admin\Desktop\jcopenglish.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1076

C:\Program Files (x86)\Cardpeek\cardpeek.exe
"C:\Program Files (x86)\Cardpeek\cardpeek.exe"
1⤵
- Executes dropped EXE
PID:1768

C:\Users\Admin\Desktop\jcopenglish.exe
"C:\Users\Admin\Desktop\jcopenglish.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:3796

C:\Program Files (x86)\Cardpeek\cardpeek.exe
"C:\Program Files (x86)\Cardpeek\cardpeek.exe"
1⤵
- Executes dropped EXE
PID:4604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5f660b.rbs

Filesize
11KB

MD5
b3e08725c040a1680cb7d78332ad940e

SHA1
05c4c601d7d6d1d903703df9a773e36e8789bc86

SHA256
613c30e97bd4eebfb388bff519b568aeaba28b39f5d24622a9918611cb000dd7

SHA512
13f13a974b52fb3ef6198f233ca211c410543333382c916fc3e24b060407aa90f450c87cf5fd68650e2bb3a5e116c79a3e8df767c34cbf63eef9a78b2d2087f1

Download Submit
C:\Config.Msi\e5f6611.rbs

Filesize
15KB

MD5
3be9565b884e8c372485b127663e9dbe

SHA1
cf0a17ab7959d291de9c2f1c9f23ebdb48b30c6b

SHA256
2afb9b0778a9008c6395aacf47c3faa6354a5d65cfdc50495fd6bf0e44542ca9

SHA512
2536f1181f832308f28a99434d2228a1246e637eda267eb74f08f50491d165f87ac63b4bb594768d8c6e7efd55a14e9ec008155ea9c06ae131e148f7e3ba56b0

Download Submit
C:\Program Files (x86)\Cardpeek\LIBEAY32.dll

Filesize
1.6MB

MD5
a9f8f35cc2caf8dba7167b91420a680b

SHA1
6fd1de054c228e7d1a515b08377a4b4993e79c4b

SHA256
c7da870ad431d2bac13b40963ee5e7fec8fbc7ca7bc2b40308374ba5149e3651

SHA512
4d92ecd79a87c44ec5a7ff652f726d781c1505f4c73d5f86ae20c512f601df3747d3da244dd57ea4396ed44c69d8587d6567be5f4ae8156bc462b8e9232bb8e2

Download Submit
C:\Program Files (x86)\Cardpeek\cardpeek.exe

Filesize
576KB

MD5
fe1f9ba878598635a90ee747b524e0cc

SHA1
de9fc8e7aa959abecf57caf785c3f54ece973a95

SHA256
d46a2b36ac59c40c72067013520218bffb359f8b2c6c2b443663527987695681

SHA512
e23a8c55c7b4089dcb37d04fcf04677fb50afdbed3d3408f2e48803d2801be63535a0761eb8f318a73df1923f0f77955a5f615972c9317ffae9ac5e765f162dd

Download Submit
C:\Program Files (x86)\Cardpeek\cardpeek.exe

Filesize
576KB

MD5
fe1f9ba878598635a90ee747b524e0cc

SHA1
de9fc8e7aa959abecf57caf785c3f54ece973a95

SHA256
d46a2b36ac59c40c72067013520218bffb359f8b2c6c2b443663527987695681

SHA512
e23a8c55c7b4089dcb37d04fcf04677fb50afdbed3d3408f2e48803d2801be63535a0761eb8f318a73df1923f0f77955a5f615972c9317ffae9ac5e765f162dd

Download Submit
C:\Program Files (x86)\Cardpeek\cardpeek.exe

Filesize
576KB

MD5
fe1f9ba878598635a90ee747b524e0cc

SHA1
de9fc8e7aa959abecf57caf785c3f54ece973a95

SHA256
d46a2b36ac59c40c72067013520218bffb359f8b2c6c2b443663527987695681

SHA512
e23a8c55c7b4089dcb37d04fcf04677fb50afdbed3d3408f2e48803d2801be63535a0761eb8f318a73df1923f0f77955a5f615972c9317ffae9ac5e765f162dd

Download Submit
C:\Program Files (x86)\Cardpeek\libcairo-2.dll

Filesize
908KB

MD5
b2e22212d725838193366b3e503fb6e1

SHA1
a0f19a5feb6c67d2f4e6e38ec3d41e651169451a

SHA256
31ebe67051122dfc2827806ca004e0921ab90d4b08b78361c5a6f5a2a3cb6eb5

SHA512
970f508496fbb8d3bc942582f8eb07a1ca52c6790554fc21f2de0536382dee5e1577e2586f0bd7ebda7bbdd7161bd0297c939f6f476cbae2a6f4cbe91372b53b

Download Submit
C:\Program Files (x86)\Cardpeek\libcurl-4.dll

Filesize
383KB

MD5
c3458361e917da7cb2776d4cbb3adcc1

SHA1
7791c51d217d0bf838ef1ce2392cf939de571582

SHA256
399a085f6f8bff870fb4929293fc8f72dccb265941b501f240406cb72e681e13

SHA512
9dc05ad0f94d6185e944eceb29dcf4ce63e462c1d39da08b94b69f4b0811ffe3fe1e8e8a20ce22e19624b7a2f7cb50ceb3130a699d2e60b3fe3f798184f6bb4d

Download Submit
C:\Program Files (x86)\Cardpeek\libfontconfig-1.dll

Filesize
336KB

MD5
957425c8b294e2b5cf23581fee3dc69f

SHA1
8f8b49607925bafa6243d8ddd8b5c583f29c785a

SHA256
5a66f7524f07c36d08153f3ae1d6ac4bc9ce93de8ff3deeebd03338716e7bbf8

SHA512
4a172d7797677bcba963b99de595314e5117affd15a7ed97d155b929698c8a7269f98c04f928e2e3a8c5cd7dfb015e2b528534af60d3bb9cea3c7036724a151d

Download Submit
C:\Program Files (x86)\Cardpeek\libfreetype-6.dll

Filesize
693KB

MD5
a526b4b0a4d14d32fe8808237a602528

SHA1
9af08267d8874aa10fa2673ecdc0e348c3d319ae

SHA256
e0362758ca53f3f33ac63e16f80c0d49b27b4b7a57f258b118dcfec475682005

SHA512
fa9418def8d90dc7f52ed3b5e6be67d7de36c7f7cb74f8b61b57a801e5c57805bcd89131590eebdfab86af92d560ab876539a57cbd9a43271f19f2cfa1b38c04

Download Submit
C:\Program Files (x86)\Cardpeek\libgdk-3-0.dll

Filesize
748KB

MD5
29cc8139773fd351c46f944176b773aa

SHA1
eb663413d1787c2b330146efc1eed5b9ed193854

SHA256
d51cb85a57096aaec125673d7959f97b666a43ac8698fce8f54ab4d401c13b0d

SHA512
6222dac9315e59ce5b94714d2e59fb7be27bb9e18b66f458dd473bb98da58062bacc27459dba11c098b01cbc5ed727ab1c0c722b1757346a5bca1b6a801be8df

Download Submit
C:\Program Files (x86)\Cardpeek\libgdk_pixbuf-2.0-0.dll

Filesize
320KB

MD5
b2336c0afc66b2269c0d41a8fdcb9d2d

SHA1
7fe256673abfd860d42e1c4682cfee57dc1db008

SHA256
702613c87d2906570498b0f9c10a26aace9ac6c7b91bef95a598684a1f6dfbd8

SHA512
db54e2104bba617016a35d294d9907c0c625eeabdbea2888816dff82a027e179759b97ef808719182c560427c18799edab9b23cefe5a9917a05747bfc6a895b1

Download Submit
C:\Program Files (x86)\Cardpeek\libgio-2.0-0.dll

Filesize
1.6MB

MD5
bfba144374c9d7ca4117cfef3c3b9e7f

SHA1
2261e6e60ffdf77c84b7cf68c39803097e3df58f

SHA256
d34a47cc1cd34559d442be40f322bb525264a2d64cfda97a48df6c787beb05b0

SHA512
069b1c5bea0980e46cc6948700fc60402afe435aa7a825594f1338784db9917c0d63079d5e88862cd417343d4adafaf81c42c00b323d3347279a9b50b3bf2a42

Download Submit
C:\Program Files (x86)\Cardpeek\libglib-2.0-0.dll

Filesize
1.4MB

MD5
c8f66ec0df02d7586991e9dd25c55032

SHA1
33bd91e7156a33e9b3a7c7aa152a4540ecb24779

SHA256
8dfb98eedcbf8d99f8cedb42892be243cd69b6057963df5bb965b93edbb005a4

SHA512
2fcfa11c394be852a2edf3a5da0afe91a418dcdf5cfa3fb5aa2924a4d220e67f03dc5bb1ecab3007a82863a30758de8468b3ad478705cf88eb7c9928a7c27df8

Download Submit
C:\Program Files (x86)\Cardpeek\libgobject-2.0-0.dll

Filesize
366KB

MD5
b2e869bf8dc0e29ca756d456754a0f67

SHA1
19ac91277e972d2a0dafc1ede4ed9557a38ae505

SHA256
6a114f9d6ce7c918a0930603d65776d727482e733035ac3d30a6be71a17ee556

SHA512
6f7267ed97298a192d4a2de61fbea5a382d74dcf25179d76b096ef12e8c4cb281bcd1a57f7746f85f6db739e0c87d1737f7ade461a6205fae604d00b29aedecc

Download Submit
C:\Program Files (x86)\Cardpeek\libgtk-3-0.dll

Filesize
5.8MB

MD5
4bb080c4cba63a1862fa4e9d6fabbc6c

SHA1
41fce959f8a510f39e26acb50d9524ed6dbf1a34

SHA256
8acde5326e00af0e920b76d22934d879d9e63fc0749ec3f0adc39736ea3b81f0

SHA512
2db3559013142a6fe85bd7e9b6eaa3c1f6e1a207b48dc90d9082006795c10c33fd6386c3f0f03f37bb451e005a6989b13f04e2c3ca2989fef86a114453233292

Download Submit
C:\Program Files (x86)\Cardpeek\libiconv-2.dll

Filesize
998KB

MD5
fb777411d9a9a6e301e61006552f79af

SHA1
b324476c32fd943ee212180e4493fe8e67585082

SHA256
fa6d371bb04ebbce03cb8259ea0ce71f5d1f15026754fddd062500a9803080e4

SHA512
76ff8123fb6a03497a653296d07ccec040c9b5d81543981d3e2e2095b3a3a70f82958174b9e3a020fff2e057405718329becc5fd4e2dde5ab6bf4eda2c7e81f5

Download Submit
C:\Program Files (x86)\Cardpeek\libpango-1.0-0.dll

Filesize
392KB

MD5
53e85495932378517673380bae5fbbac

SHA1
af17f87a32566d5bb59b90a78493a2e634270d65

SHA256
165c4164cd091550fd66f131db34070789d0dbe3ccd480924b5c9983aa53be9b

SHA512
e73324d2af48495286e8061c00eaf7b787493e9a748b57aec14f46a4b522520ce510ed7e1fc075d24655eef7a85a2bb26f90823c867979ed6602d6ff01292f34

Download Submit
C:\Program Files (x86)\Cardpeek\libpixman-1-0.dll

Filesize
2.6MB

MD5
9dadbf5c355389bc7a850676b8b5c11c

SHA1
06b17c3f786d2eba6fbef477339a53d535f5abc4

SHA256
be531e056024da8ad2ebf8c372ae98a3888172443a4ea96703963a818418b40f

SHA512
acf76328f581421706a94844c24a07cb820ed1863b8155b2615431d4e709fc51e836143fc75959d528ca62949acdf6025a46d4463a48b1af7a8c28844f2a38be

Download Submit
C:\Program Files (x86)\Cardpeek\libpng15-15.dll

Filesize
255KB

MD5
8a8ba8665099c2d580fbca2a5b91df93

SHA1
ba69fa9e20dcd49dbdd63f107df20185c6271a4f

SHA256
6cad91442c650949a44fa893ea7210ed8c146526b2ae1d5789957d12c593ec90

SHA512
5be15df327e66f0be3cd1ebb39504cf7d2c316639b5f15d6594a3c84dd6eb65c328e530c083060e9afb960391f34052712f2192e73e91edc32489db0aa4ef39f

Download Submit
C:\Program Files (x86)\Cardpeek\libreadline6.dll

Filesize
618KB

MD5
f137e8429e98efd83b220ce2f61d3929

SHA1
9e047d6e61510216dc756f2a7aebeff46d97b106

SHA256
74949df6fac237478cd82f02920bac3357d1eb1f2ae2f57068462218de6e9fd9

SHA512
1bd3f9e5ad8888d37d0a6c7572c7dd5db8dec2d96e5deb2ac303e457bd3edeedab2e09cc34cfabe0c2dcc4432a644015e7710b3024d68e7bddc386ce303db005

Download Submit
C:\Program Files (x86)\Cardpeek\lua52.dll

Filesize
170KB

MD5
47dc408cb01b4606bc5d8c8fa1e16237

SHA1
e7b1e896dcc89fb903ced7edefb6d386acd5d8bb

SHA256
2d24c9bde08201682316e8fb5d3b5da8d24653f94125ff603f50fdca805f6e12

SHA512
1e7f3c04429a45ebe48a9b880068702530cbcf057f4d4c71b89ed11e55bbfb322fffa180f07dd1dd6129df6a138118b9a18e8f532b6f0b20db71d35dbd501f86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022

Filesize
21KB

MD5
b1dfa46eee24480e9211c9ef246bbb93

SHA1
80437c519fac962873a5768f958c1c350766da15

SHA256
fc79a40b2172a04a5c2fe0d5111ebeb401b9a84ce80c6e9e5b96c9c73c9b0398

SHA512
44aefedf8a4c0c8cbc43c1260dc2bbc4605f83a189b6ef50e99058f54a58b61eb88af3f08164671bad4bd9c5e3b97b755f2fa433490bef56aa15cdf37fb412b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ef91594ffaca12373e7051bde18e7579

SHA1
ea8839ff748904c2ef93d23e262bcb17f4ca3d7b

SHA256
b32b50b3892184975b0531275e5d77e4610b04d323655abf4b924241b7d96b2c

SHA512
6ddb17195fdfb743eee366a2f3ef05a436682b971a02f78680976508171d0d1ae966518564bfc608a5d7e001a1c0b569709d957771c42fb48f0b94db1155a1d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\00\00000000

Filesize
145.0MB

MD5
71e54cc2997b38a037e7da0ea80dd2ef

SHA1
1d373b6c4dfdc9d94666ce00a2a078625a118add

SHA256
4511ec1a0931660502882bf43c11a6266e7be162b8c6fededc5e21e99db16d31

SHA512
e57ff0372b1e60df9ddaa4908553f1b1b302d94f4ca8302adf02cfec6b88d90f59b0c2b3d7665f87ee8ca2687fbcd2b67ae07838839d56164f5d6665252a8c9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
633b44d7a13236360e9ab06b113b97b6

SHA1
8b5f91cc945fcdc3f23b5a40035271eb9bfbad04

SHA256
960ad31b2b6796ccb8a68de486ef3aac51f0b00ac198eef9e37f268f9940e04b

SHA512
9896f40b98acf89d71b272130ee4f362224edba0734930d1ec1de41a51d2658dc9b2512a570a3a91d0cca196e9e2d4391f42f64c3528c8d7619f5d1c460be905

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
688B

MD5
2ff274c30702133a06280de5d84b1b43

SHA1
1b54d5abea9a28258beffe747dda3f5f61fa84d7

SHA256
98170ac4edb0e10d49ffa48f78c39966598c1521a21e361801b6ea7c35a1f271

SHA512
10ac614996b4463a27ba07643dbeb5b78c9504bc0bb7ca37bf3efc69a48777b477bee92075e1afb85b55da3438ea4e8ecf57ef19b8624179fe2a433936ef0c7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
973B

MD5
79881c00c921b22d980f67e43a9f32b0

SHA1
7c1859ff70c1fbe8c8fce13876ba5b60343bee26

SHA256
9b3d3c734550217959c5a382eddfdfe50f1b48ba12a53bd6ccc12a98c40c9ce1

SHA512
ec19a0d4c592d4f2427b2fa9a4a6c319397171cf2104dec72a88b767ccc6a2eb17b29080901e6d430768e79ea6af84c70433d8a3c1f10335cfab272e0d389a7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
536B

MD5
1ffefd6bdf811da49b2d8efb8e80ed70

SHA1
08ce9aee1e3d03d8c4a0aa95f54fbf09c80835b7

SHA256
fa8d306269ebdc47f82d793ff8e41285dfff886fbfa56c37ff8301a3f102b48e

SHA512
78b29ce7a1d89740fe2a9850135849c5923ed64961c7e064f3b5d7701d2ae9c1de6fc4bf760660d4fdcb533990c3ea40ac4a238d5f244faf3dc93d68a9864be1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
704B

MD5
7cf583ec3e99342e6e69d6d11b0e7c6d

SHA1
067948164c0e5259f93529a65678ceef47e9424e

SHA256
87de61e3326103155210450b998a077f78d819daa878161fd400720b7c6c269f

SHA512
62ff6908448afe6e2976717aabf4fdfbc27a03c5efeb13ee6677744a4974c4ff5afe10cf2cadead6f0946c15c0c8a44794fa5cb814463b3a158894634cb06f78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
704B

MD5
e671a6520635e6f4e88fbee4a220076e

SHA1
1dbea9c3b216083ae7c38ba1416a53c8017b7822

SHA256
dbd46ac1535f1d682b30f4e8f177c55cf567c033b523406a06842ec6b811e06e

SHA512
3450e4515bdefcc765ab175fa6bb73e016a74b86f6e4bd1d6b0e0be2ac6f3b864d2ece631000ced4723faff689f821824cfd94f0e4c2048d729eff2b19d10aa2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
94671fb774a94ef3ee12af157eedc8ac

SHA1
910b652670a4d7e48318e3215f58b0767a87650b

SHA256
be217967461efde7c0afff028bc0ab2034748faab6a9dc46ea271490bb5e8a15

SHA512
643d90193cd3b0782577f78f984c62f9c293ea5965b389110adce2a6998df006234ff2db40c738e5f923c6059f275f5a9a91e2fe4cf25e2329edfa4b7f8242fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c1e81d8d77ef3c49050104b4fa7312d3

SHA1
63ae1b8fa2f87396a1406a5c98b7778379678345

SHA256
e42cd639132cb71212520cb7eecfc926158a2c5d88a057ab65f2fd34df2c039f

SHA512
523da872830e0b90919f20403e21e65627580f4b3e15dd0c8fc74a87d8c000b7fadbf9ac3b47702c078e1bee3a7ea3db5bc7f650bd675e4a0125c43c8fc6d634

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
81bc9db746a0a3882120dd1a7530ed48

SHA1
b19cf72f01cbcd1d8b9f467ba04813dd73424aa7

SHA256
298473d3e31cd96d967da38eae0e281cf0c1ad1d51b568b71486b31dda2d809b

SHA512
3eb7e5f341b9823117107c856ecfb71119051bff52355a1d5ab42c9d6685e6d4cb68be798a312021439b6c52e0c0d38ac40cc75d92f1aa4eb5f2439ad72487a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f58a6f903fe0046727b5f9fe83fd0169

SHA1
f2f62e9bc4cdf9cc401d0f944bcaaa8c544e0642

SHA256
e8199650e252e7472806aabade537b03e3ad3ee093cb326c39ee3ec24878d656

SHA512
c5e7ed67f38788bf8081336f5da1d5fa5b5a3371b1bdc81a2d064be3b13df6f4961ad8c7281e5f9922fd9b29a96aff1f84bf54796fa201030a58259c211397d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ff981aa85a3fffd8a1cba52e5cc10fa4

SHA1
828230531e8d83fd049d687d0e39e2d5feea1945

SHA256
ba763204afdd419db862cc60b83f08d4a0c22658dd4fc98e130da26f1244e451

SHA512
84e8dbe986e7dc93114ba5778eafde494993f1702d9a9802383a992a7d804670f98d4ceb983e56c2bb595030e0c8b95dd14bbd02a20d8d2f89bda3493b338859

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
3b5eefe952153281d96e98e6ef221705

SHA1
9b64ef97972a159b489bfc1b09c9474db7c25dd9

SHA256
8cc915ea754d3dba3fc99728a34e3f2c4122e2e920b18c3ff02ae5fd536b82a3

SHA512
88500ddb3c53fc2388702ed9183f900f68c560148ba35f636e8e91aa6c44d50c694adb83dce1bba420930053cbc28543875326ed42fcfb5e78864016230cb5f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
52374fd689df25f1071c32c6cb312c93

SHA1
40a5c33402cb521718635da5e28dc88b525cb6f7

SHA256
5f8b8afd899b1e0fbe20f22ef8a5ee8d3b2d9197656cdf7f1e567e4e702a6ce0

SHA512
1460b249fc992822c4859925f3a0019c87a9a015e6183350090da45a614f418802eb6faf29b5bdf6eaeff9021ca0316065de988346713e6d6137c63c1f42770b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
79e41b5dd50af875f7f20b544a585abc

SHA1
59c3ab4ebd84b9e8edc8599be2d8d4e794d5f530

SHA256
bccd0834b3c4f1d00c8bb3f0eaa574935a457bdbe69e83cd850b068558f5c830

SHA512
2e361bc36483c23c625000b867b1c2ae13102044043d0fb9ba11904d2fb054fcd4ae827c4eb4949a536403486c7a4fa667bb9c0cb7c79b839e2af3dbe76f41ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
4ccec3fb51bcc3590db51350fb264c66

SHA1
bc4f049a98776ff2988162360cd9af1a0fdd5b74

SHA256
b4792f94e9383f0964dfa836a798ecb85df0d93d32f329c632d1c68f4d2b7eeb

SHA512
c509a362b0d190feb704401d98b9ee2b4e8648f90ea06d398cd27ecf6f335842d6c12a19d4db75e4b34774c817d6944851ce93ea3240f76f4aa181ca95747c7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
205cc2106ddc9278c3e0fcda23feaf9f

SHA1
5d4763104fade950dd25cddcc30fa1a1a90f0e88

SHA256
088f1a5be80b55c42273b5a2b230a08ef92d9ebccda99ebcc0862492b55d1e44

SHA512
973b4b842db4e80eaf9c731b7072cb2f57017ac2f96cd02bbc73c3ccb67830f68ce51872bdc55bf86e50e85e37d93d16fb74e607cb2f3512d30c12673c6b4371

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cdbb.TMP

Filesize
48B

MD5
b0f10e1a50ff6a6bbc646771148b380e

SHA1
1b06729faafb4df37917c24ec7979badf9afed92

SHA256
c30860e10f9d78086713485ca17a227c2848fe6f87492b11f217d85b2bb47502

SHA512
8ddc46c8625eb95617a9c24bdc5a58fe4835d6abbbcaaf8ae2e1c33dea324aeedfb08fbf33c68db07d0f6a34b6071d956f1e3c13a199a05922b42fadf8f0aecd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
151KB

MD5
0eb791e686b6badf21373aa6aeab4718

SHA1
0c6ef4789495c466ba0983722356315a58401ddb

SHA256
8ff0b6c1922b2d193e69bcfb2770a290b0dd0e7d8fe97eff4e5aa887d3929ea8

SHA512
754de0f8ca9efc706e62bdba25859bb2c5bcacb95fa2bb344ae8ee4686301c26b72e14fe1177caaccf45297186e7f097ebe49a3f69dddfdaaa051774a908d2da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
107KB

MD5
2ca03c278ea8dc161687ba6965dc02c4

SHA1
b609a481faa6584c9f4d1875d631a3416d390752

SHA256
2b64ab9f8e3c7e7d0ee4656937ef4dd4fd34e5931adbdfd728a8569c9f5c0fac

SHA512
061631bce04b69f60fe3511940b009623a4d706aaf74c675c36ef77d3879d41607a5ebc938fe7f59b12c27d909b801c4eeab7e8d10474bbfb1c130f9e36a9ec0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
99KB

MD5
c10279321ea4de328b842a2271b1e736

SHA1
3e72a9a3897536a4212b7e47c7f4b29c508e4961

SHA256
bc14c0c56fa69080483d11f8e1aee005324b0e90413b1ea960f15c338b8d05e9

SHA512
030bd386cbd4dbb5917c30245a1a6764fa880257817f9d941a1f14cef0742f972de1f0f616ffda33a59a90a6d51e222b145b4cd147a76994228c43068736d404

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
5bda9d0ea4d51684450251de0746c076

SHA1
7a3cb145eb95d43f2e428c033a2f3f0542575ae4

SHA256
c9ebaafbf8dbf967d266ebcd8c445945bed4b8d1c7c7847035f78fb8bb5d57dc

SHA512
d4f128c3fb6d7783fa381c47965e7fb385186e511d9169d1433a5ce081d83b18669d40423d32aacf08eeb9e843037cdc3aa6b92506ff923033726e11ba698aad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
826fa117ac4143d8768dda6c6e9202d8

SHA1
2f9b29fe0610660d188508bd0e1b00f7e87e1f3e

SHA256
8458e9e9e442bf95b5a279c01b673fa458fda8c2f5f6820b4025c60495c367f4

SHA512
1f2c62c991af1d6bad1803c6e544bbdd62d9c8df7c11bea05b1bb5eb28788f225d16e781ee71720f4de86662b6e4d34d49becfca8ce71bb9656195ec50431aff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe589824.TMP

Filesize
93KB

MD5
683baf164b0e23b4c83870058d848c23

SHA1
dca35ab9f5073cbf9870c9ad8ab56786dd64eb19

SHA256
5d6aca1ecc8361e197e2460cd060c85187eb8cbd777c6c7653fc0815816a4707

SHA512
e0ddeda35f35996b30a27d4c5b93e75662d9940726febf750e863e74b703e499226839642da2cf2ba82a96ff762b7cde56e99afab4940a25b0710adb4f5bb882

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab

Filesize
312KB

MD5
0aa0da68a91e9133715d9cde2a180ffb

SHA1
892e941bed49b3404dad2aa33cd36b708e1443a9

SHA256
64570910e03c337d4e1f8ab1b9fb8e4dc46fdccb93857a1e9c73b296c6850fe0

SHA512
247dc48b39844fcfbfd46ef8eb1c72375b183f2d54361f5fe857d3a1b7275145cd0a9be8f287e037b46912a496a39a8855c20a63a8c663b60fc620b0b35e2313

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi

Filesize
3.0MB

MD5
391dddd564a9e8a20576fe05e5e1f25b

SHA1
84f17830075abea6e6a369dee6b93ac16a71f025

SHA256
a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2

SHA512
10358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20230522195414_0_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
3fffac699abb8e985feb537fe24e7191

SHA1
faed6797aabc28e23c531dbf08564866b4be150d

SHA256
d79d69fee271dc17b64ca2d1d62662b5a6f2def93ea1f1497696264d3b26a008

SHA512
b7600675d3d1dbf6a93e31640d873e6c32db3fc440496c64284387e522fce8d8bd78543a47cb8be49d85b2050bd176d6b7dfd643fbbf20f408388b63dc2d2f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20230522195414_1_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
ddf6158a25780c12ac83d7a797c9a0a7

SHA1
10e67c2126d5e0142b426a4b61312ced957d2c7d

SHA256
72ed8f912a002306f3adbac2b95a6b07ea08d17b1674e3997beea5f4ac1afc6f

SHA512
4916dcd6519186b642b76d82680ccab7832fd1bf17e4c1192af33808b9ec09f8f5ad381cc85987ba400b875d80c6d0469ca7970af474fa8a8fb30a73403f750e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N4QSQ.tmp\cardpeek.tmp

Filesize
690KB

MD5
a2c4d52c66b4b399facadb8cc8386745

SHA1
c326304c56a52a3e5bfbdce2fef54604a0c653e0

SHA256
6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a

SHA512
2a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N4QSQ.tmp\cardpeek.tmp

Filesize
690KB

MD5
a2c4d52c66b4b399facadb8cc8386745

SHA1
c326304c56a52a3e5bfbdce2fef54604a0c653e0

SHA256
6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a

SHA512
2a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
269B

MD5
df0922a235186ba157e55349b3a2bbaf

SHA1
f0a789e40d245a0c0bc33567ae110b5ffcd3f90e

SHA256
ad54af529caf0aabeb5f4cfe6b8bee4947befceb010c9c813e43ce338c412444

SHA512
aa80773eaac8dd7477b3b48a3212a98fe83f42c00ac2cbcbc76dce44adb0c38b0b9c9f6b8381b4afd8adbebd522e9e2f218d26a2fc1b97297b8225cb7670d437

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
5aa859044e29b32da796bcbd08fc3b02

SHA1
2fec2537d317128177f4f7c79f3f9445ffe16f90

SHA256
f5096fd063378b9efed7b25da74e97b179b9618f9397b0267cc3e3051831d54b

SHA512
d27429d9527c85fbc582e67f85a7f560398b7dda8e2a912685c9bfa3163548a124fbc51aa098ab6b490762dac12f0a2e956b3134acc568fd5c373c7d99cef2b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
4KB

MD5
f39bd2a6a64a3ac3fa843f9d2e5070ca

SHA1
322c8f00e18456d2eefebe52a18c9a3152187b67

SHA256
bf8499e22c0b78ddfca58214a7c89a811274433f4bbf0401e0132e091ecf3577

SHA512
7ab4aa73cc185f2bd107000bdc710eb8a036c762fc41ab1caa6e30b5b8f30cc3f3292942fd8b0e2d0c85a0e3cce4874e82a15ec20d75e4f480a79c6046a8e95c

Download Submit
C:\Windowr\del.dll

Filesize
342B

MD5
39f489355ac6ccc48a810e2c867475fd

SHA1
ee47aaeb77a5dab592089ca07bb96c5e7b67364e

SHA256
71e16a8c9540cbeb6afc80045a21f7c5954f9e54b5ec731c93afca6d67a61646

SHA512
d0fe7293c9fe6e1591dfe615ddd00e5db16fcdd86fbb2da975ce23105c0d4c6705f9adae4784f8926290448aac8f85caf5d836e57753e74a4c471093e04dd1a3

Download Submit
C:\Windows\Installer\MSI68E4.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\e5f6606.msi

Filesize
3.0MB

MD5
391dddd564a9e8a20576fe05e5e1f25b

SHA1
84f17830075abea6e6a369dee6b93ac16a71f025

SHA256
a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2

SHA512
10358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
25.0MB

MD5
a2c3b70157c08743b352bde4540cf66e

SHA1
4dbf27d37db698b1efc6f4ba7a510116ca0509a8

SHA256
e8587fbc9b2b774333eec8c646a35453c758617a5619231213f76c0f243ea818

SHA512
c44a846d45978f02c7e523a0608b885ecd916c0f52543674bdf3ae20ac86dcaa02ae1c10bf6180dcea3b8065ab280d6faa7f7857e86ae182856b30324133fea4

Download Submit
\??\Volume{ce598122-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{77c2aa6f-fa86-4f2e-99af-abc81e4b0a07}_OnDiskSnapshotProp

Filesize
5KB

MD5
679823afa5e5304c7dadde5001ea84cb

SHA1
e44a300a67c45b374b13416b0bec239a19075db2

SHA256
b50d84791cc0acc90d9665c89871ee985e2afa124bd79f770fb88e70bf540ced

SHA512
2cd10fe2fe49bffc09b311fdac93e843050645c32a8b580ddd4b314ce8e11e7b424a3a80d3dee1c404002f2611a78d1715c8139419d75853c296a0a5d26cb354

Download Submit
\Program Files (x86)\Cardpeek\libcairo-2.dll

Filesize
908KB

MD5
b2e22212d725838193366b3e503fb6e1

SHA1
a0f19a5feb6c67d2f4e6e38ec3d41e651169451a

SHA256
31ebe67051122dfc2827806ca004e0921ab90d4b08b78361c5a6f5a2a3cb6eb5

SHA512
970f508496fbb8d3bc942582f8eb07a1ca52c6790554fc21f2de0536382dee5e1577e2586f0bd7ebda7bbdd7161bd0297c939f6f476cbae2a6f4cbe91372b53b

Download Submit
\Program Files (x86)\Cardpeek\libcurl-4.dll

Filesize
383KB

MD5
c3458361e917da7cb2776d4cbb3adcc1

SHA1
7791c51d217d0bf838ef1ce2392cf939de571582

SHA256
399a085f6f8bff870fb4929293fc8f72dccb265941b501f240406cb72e681e13

SHA512
9dc05ad0f94d6185e944eceb29dcf4ce63e462c1d39da08b94b69f4b0811ffe3fe1e8e8a20ce22e19624b7a2f7cb50ceb3130a699d2e60b3fe3f798184f6bb4d

Download Submit
\Program Files (x86)\Cardpeek\libeay32.dll

Filesize
1.6MB

MD5
a9f8f35cc2caf8dba7167b91420a680b

SHA1
6fd1de054c228e7d1a515b08377a4b4993e79c4b

SHA256
c7da870ad431d2bac13b40963ee5e7fec8fbc7ca7bc2b40308374ba5149e3651

SHA512
4d92ecd79a87c44ec5a7ff652f726d781c1505f4c73d5f86ae20c512f601df3747d3da244dd57ea4396ed44c69d8587d6567be5f4ae8156bc462b8e9232bb8e2

Download Submit
\Program Files (x86)\Cardpeek\libfontconfig-1.dll

Filesize
336KB

MD5
957425c8b294e2b5cf23581fee3dc69f

SHA1
8f8b49607925bafa6243d8ddd8b5c583f29c785a

SHA256
5a66f7524f07c36d08153f3ae1d6ac4bc9ce93de8ff3deeebd03338716e7bbf8

SHA512
4a172d7797677bcba963b99de595314e5117affd15a7ed97d155b929698c8a7269f98c04f928e2e3a8c5cd7dfb015e2b528534af60d3bb9cea3c7036724a151d

Download Submit
\Program Files (x86)\Cardpeek\libfreetype-6.dll

Filesize
693KB

MD5
a526b4b0a4d14d32fe8808237a602528

SHA1
9af08267d8874aa10fa2673ecdc0e348c3d319ae

SHA256
e0362758ca53f3f33ac63e16f80c0d49b27b4b7a57f258b118dcfec475682005

SHA512
fa9418def8d90dc7f52ed3b5e6be67d7de36c7f7cb74f8b61b57a801e5c57805bcd89131590eebdfab86af92d560ab876539a57cbd9a43271f19f2cfa1b38c04

Download Submit
\Program Files (x86)\Cardpeek\libgdk-3-0.dll

Filesize
748KB

MD5
29cc8139773fd351c46f944176b773aa

SHA1
eb663413d1787c2b330146efc1eed5b9ed193854

SHA256
d51cb85a57096aaec125673d7959f97b666a43ac8698fce8f54ab4d401c13b0d

SHA512
6222dac9315e59ce5b94714d2e59fb7be27bb9e18b66f458dd473bb98da58062bacc27459dba11c098b01cbc5ed727ab1c0c722b1757346a5bca1b6a801be8df

Download Submit
\Program Files (x86)\Cardpeek\libgdk_pixbuf-2.0-0.dll

Filesize
320KB

MD5
b2336c0afc66b2269c0d41a8fdcb9d2d

SHA1
7fe256673abfd860d42e1c4682cfee57dc1db008

SHA256
702613c87d2906570498b0f9c10a26aace9ac6c7b91bef95a598684a1f6dfbd8

SHA512
db54e2104bba617016a35d294d9907c0c625eeabdbea2888816dff82a027e179759b97ef808719182c560427c18799edab9b23cefe5a9917a05747bfc6a895b1

Download Submit
\Program Files (x86)\Cardpeek\libgio-2.0-0.dll

Filesize
1.6MB

MD5
bfba144374c9d7ca4117cfef3c3b9e7f

SHA1
2261e6e60ffdf77c84b7cf68c39803097e3df58f

SHA256
d34a47cc1cd34559d442be40f322bb525264a2d64cfda97a48df6c787beb05b0

SHA512
069b1c5bea0980e46cc6948700fc60402afe435aa7a825594f1338784db9917c0d63079d5e88862cd417343d4adafaf81c42c00b323d3347279a9b50b3bf2a42

Download Submit
\Program Files (x86)\Cardpeek\libglib-2.0-0.dll

Filesize
1.4MB

MD5
c8f66ec0df02d7586991e9dd25c55032

SHA1
33bd91e7156a33e9b3a7c7aa152a4540ecb24779

SHA256
8dfb98eedcbf8d99f8cedb42892be243cd69b6057963df5bb965b93edbb005a4

SHA512
2fcfa11c394be852a2edf3a5da0afe91a418dcdf5cfa3fb5aa2924a4d220e67f03dc5bb1ecab3007a82863a30758de8468b3ad478705cf88eb7c9928a7c27df8

Download Submit
\Program Files (x86)\Cardpeek\libgobject-2.0-0.dll

Filesize
366KB

MD5
b2e869bf8dc0e29ca756d456754a0f67

SHA1
19ac91277e972d2a0dafc1ede4ed9557a38ae505

SHA256
6a114f9d6ce7c918a0930603d65776d727482e733035ac3d30a6be71a17ee556

SHA512
6f7267ed97298a192d4a2de61fbea5a382d74dcf25179d76b096ef12e8c4cb281bcd1a57f7746f85f6db739e0c87d1737f7ade461a6205fae604d00b29aedecc

Download Submit
\Program Files (x86)\Cardpeek\libgtk-3-0.dll

Filesize
5.8MB

MD5
4bb080c4cba63a1862fa4e9d6fabbc6c

SHA1
41fce959f8a510f39e26acb50d9524ed6dbf1a34

SHA256
8acde5326e00af0e920b76d22934d879d9e63fc0749ec3f0adc39736ea3b81f0

SHA512
2db3559013142a6fe85bd7e9b6eaa3c1f6e1a207b48dc90d9082006795c10c33fd6386c3f0f03f37bb451e005a6989b13f04e2c3ca2989fef86a114453233292

Download Submit
\Program Files (x86)\Cardpeek\libiconv-2.dll

Filesize
998KB

MD5
fb777411d9a9a6e301e61006552f79af

SHA1
b324476c32fd943ee212180e4493fe8e67585082

SHA256
fa6d371bb04ebbce03cb8259ea0ce71f5d1f15026754fddd062500a9803080e4

SHA512
76ff8123fb6a03497a653296d07ccec040c9b5d81543981d3e2e2095b3a3a70f82958174b9e3a020fff2e057405718329becc5fd4e2dde5ab6bf4eda2c7e81f5

Download Submit
\Program Files (x86)\Cardpeek\libpango-1.0-0.dll

Filesize
392KB

MD5
53e85495932378517673380bae5fbbac

SHA1
af17f87a32566d5bb59b90a78493a2e634270d65

SHA256
165c4164cd091550fd66f131db34070789d0dbe3ccd480924b5c9983aa53be9b

SHA512
e73324d2af48495286e8061c00eaf7b787493e9a748b57aec14f46a4b522520ce510ed7e1fc075d24655eef7a85a2bb26f90823c867979ed6602d6ff01292f34

Download Submit
\Program Files (x86)\Cardpeek\libpixman-1-0.dll

Filesize
2.6MB

MD5
9dadbf5c355389bc7a850676b8b5c11c

SHA1
06b17c3f786d2eba6fbef477339a53d535f5abc4

SHA256
be531e056024da8ad2ebf8c372ae98a3888172443a4ea96703963a818418b40f

SHA512
acf76328f581421706a94844c24a07cb820ed1863b8155b2615431d4e709fc51e836143fc75959d528ca62949acdf6025a46d4463a48b1af7a8c28844f2a38be

Download Submit
\Program Files (x86)\Cardpeek\lua52.dll

Filesize
170KB

MD5
47dc408cb01b4606bc5d8c8fa1e16237

SHA1
e7b1e896dcc89fb903ced7edefb6d386acd5d8bb

SHA256
2d24c9bde08201682316e8fb5d3b5da8d24653f94125ff603f50fdca805f6e12

SHA512
1e7f3c04429a45ebe48a9b880068702530cbcf057f4d4c71b89ed11e55bbfb322fffa180f07dd1dd6129df6a138118b9a18e8f532b6f0b20db71d35dbd501f86

Download Submit
\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\wixstdba.dll

Filesize
126KB

MD5
d7bf29763354eda154aad637017b5483

SHA1
dfa7d296bfeecde738ef4708aaabfebec6bc1e48

SHA256
7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93

SHA512
1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c

Download Submit
\Windows\Installer\MSI68E4.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
\Windows\Installer\MSI68E4.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
memory/628-1065-0x000000006B740000-0x000000006B75B000-memory.dmp

Filesize
108KB

Download
memory/628-1074-0x0000000063CC0000-0x0000000063CF7000-memory.dmp

Filesize
220KB

Download
memory/628-1041-0x0000000063A40000-0x0000000063A8F000-memory.dmp

Filesize
316KB

Download
memory/628-1105-0x0000000065980000-0x0000000065A0D000-memory.dmp

Filesize
564KB

Download
memory/628-1104-0x0000000061CC0000-0x0000000061CEC000-memory.dmp

Filesize
176KB

Download
memory/628-1103-0x000000006D4C0000-0x000000006D4DD000-memory.dmp

Filesize
116KB

Download
memory/628-1038-0x00000000010D0000-0x000000000123C000-memory.dmp

Filesize
1.4MB

Download
memory/628-1102-0x000000006CF40000-0x000000006CF56000-memory.dmp

Filesize
88KB

Download
memory/628-1045-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/628-1046-0x0000000068DC0000-0x0000000068E80000-memory.dmp

Filesize
768KB

Download
memory/628-1047-0x0000000063000000-0x00000000631A9000-memory.dmp

Filesize
1.7MB

Download
memory/628-1048-0x0000000070EC0000-0x0000000070F57000-memory.dmp

Filesize
604KB

Download
memory/628-1049-0x0000000063A40000-0x0000000063A8F000-memory.dmp

Filesize
316KB

Download
memory/628-1050-0x00000000685C0000-0x0000000068700000-memory.dmp

Filesize
1.2MB

Download
memory/628-1051-0x000000006D580000-0x000000006D6B3000-memory.dmp

Filesize
1.2MB

Download
memory/628-1052-0x0000000066000000-0x00000000660FA000-memory.dmp

Filesize
1000KB

Download
memory/628-1053-0x0000000068B80000-0x0000000068BB0000-memory.dmp

Filesize
192KB

Download
memory/628-1054-0x0000000070800000-0x0000000070853000-memory.dmp

Filesize
332KB

Download
memory/628-1055-0x0000000065580000-0x00000000655D7000-memory.dmp

Filesize
348KB

Download
memory/628-1056-0x0000000064F80000-0x0000000064FD1000-memory.dmp

Filesize
324KB

Download
memory/628-1057-0x000000006C580000-0x000000006C623000-memory.dmp

Filesize
652KB

Download
memory/628-1058-0x0000000065340000-0x0000000065385000-memory.dmp

Filesize
276KB

Download
memory/628-1059-0x0000000066400000-0x0000000066896000-memory.dmp

Filesize
4.6MB

Download
memory/628-1060-0x0000000064740000-0x0000000064782000-memory.dmp

Filesize
264KB

Download
memory/628-1061-0x000000006CF40000-0x000000006CF56000-memory.dmp

Filesize
88KB

Download
memory/628-1062-0x000000006D4C0000-0x000000006D4DD000-memory.dmp

Filesize
116KB

Download
memory/628-1063-0x0000000061CC0000-0x0000000061CEC000-memory.dmp

Filesize
176KB

Download
memory/628-1064-0x0000000065980000-0x0000000065A0D000-memory.dmp

Filesize
564KB

Download
memory/628-1037-0x0000000000E30000-0x00000000010D0000-memory.dmp

Filesize
2.6MB

Download
memory/628-1067-0x000000006DD00000-0x000000006DD15000-memory.dmp

Filesize
84KB

Download
memory/628-1068-0x0000000062940000-0x000000006296C000-memory.dmp

Filesize
176KB

Download
memory/628-1066-0x0000000062E80000-0x0000000062E9C000-memory.dmp

Filesize
112KB

Download
memory/628-1069-0x000000006B280000-0x000000006B2A0000-memory.dmp

Filesize
128KB

Download
memory/628-1070-0x000000006D700000-0x000000006D7D0000-memory.dmp

Filesize
832KB

Download
memory/628-1071-0x0000000062480000-0x000000006249C000-memory.dmp

Filesize
112KB

Download
memory/628-1072-0x0000000000E30000-0x00000000010D0000-memory.dmp

Filesize
2.6MB

Download
memory/628-1073-0x00000000010D0000-0x000000000123C000-memory.dmp

Filesize
1.4MB

Download
memory/628-1101-0x0000000064740000-0x0000000064782000-memory.dmp

Filesize
264KB

Download
memory/628-1100-0x0000000066400000-0x0000000066896000-memory.dmp

Filesize
4.6MB

Download
memory/628-1086-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/628-1087-0x0000000068DC0000-0x0000000068E80000-memory.dmp

Filesize
768KB

Download
memory/628-1088-0x0000000063000000-0x00000000631A9000-memory.dmp

Filesize
1.7MB

Download
memory/628-1090-0x0000000063A40000-0x0000000063A8F000-memory.dmp

Filesize
316KB

Download
memory/628-1089-0x0000000070EC0000-0x0000000070F57000-memory.dmp

Filesize
604KB

Download
memory/628-1091-0x00000000685C0000-0x0000000068700000-memory.dmp

Filesize
1.2MB

Download
memory/628-1092-0x000000006D580000-0x000000006D6B3000-memory.dmp

Filesize
1.2MB

Download
memory/628-1093-0x0000000066000000-0x00000000660FA000-memory.dmp

Filesize
1000KB

Download
memory/628-1094-0x0000000068B80000-0x0000000068BB0000-memory.dmp

Filesize
192KB

Download
memory/628-1095-0x0000000070800000-0x0000000070853000-memory.dmp

Filesize
332KB

Download
memory/628-1096-0x0000000065580000-0x00000000655D7000-memory.dmp

Filesize
348KB

Download
memory/628-1097-0x0000000064F80000-0x0000000064FD1000-memory.dmp

Filesize
324KB

Download
memory/628-1098-0x000000006C580000-0x000000006C623000-memory.dmp

Filesize
652KB

Download
memory/628-1099-0x0000000065340000-0x0000000065385000-memory.dmp

Filesize
276KB

Download
memory/1076-1445-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/1076-1430-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/1280-1043-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1280-766-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1280-755-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1768-1552-0x0000000063A40000-0x0000000063A8F000-memory.dmp

Filesize
316KB

Download
memory/1768-1455-0x0000000063A40000-0x0000000063A8F000-memory.dmp

Filesize
316KB

Download
memory/2424-1427-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2592-768-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2592-1042-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2592-761-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2592-767-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2592-770-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2592-1001-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2592-773-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3112-1408-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/3796-1565-0x00000000010C0000-0x00000000010C1000-memory.dmp

Filesize
4KB

Download
memory/3960-1140-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/4604-1581-0x0000000063A40000-0x0000000063A8F000-memory.dmp

Filesize
316KB

Download
memory/4604-1838-0x0000000063A40000-0x0000000063A8F000-memory.dmp

Filesize
316KB

Download