8d6b2a634a81e4c09d0c623a24c4937d6032ed9da638c9015b7aab23fa255988

Analysis

max time kernel
165s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Size

14.0MB
MD5

27f56fe9c8bb63aadfa43ce4e34eec40
SHA1

5d271dc411d8470cb2b6e3000eab86d529434d41
SHA256

31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc
SHA512

d96daa8f91bbb2c1fe2ac45ffb7e3ec8c77c0925f4904097dc919c585509d971f52c71a10e584881962ecfa25ae4ce10c2be999f1d65cf831558872dfb39c656
SSDEEP

196608:t9iQpZfwAwdwpTyXvXPbHoPh2KNrM6ZkjmpxqZBrSnM77M:b+wOv/zoPh2KfmkwUMfM

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1544	vcredist_x86.exe
3224	VCREDI~3.EXE

Loads dropped DLL 12 IoCs

pid	Process
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3696	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	VCREDI~3.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XBasicLib92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\plugin.reg	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XClassLib92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XHttpLib92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\npXPlatformPlugin92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XPlatformAX92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XPEngineUninstaller.exe	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XPEngineUninstaller.exe	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XPlatformLib92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\npXPLauncherPlugin92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\default.xtheme	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XMemPoolLib92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XMemPoolLib92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\default.xtheme	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\OpenSource License.txt	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XHttpLib92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XPlatform.exe	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XPlatform.exe	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\npXPlatformPlugin92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\vcredist_x86.exe	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XPlatformLib92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\npXPLauncherPlugin92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XPlatformAX92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\vcredist_x86.exe	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\plugin.reg	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\OpenSource License.txt	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File created	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XBasicLib92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
File opened for modification	C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XClassLib92.dll	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e598a39.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231031145203171.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231031145203765.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203624.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203796.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231031145203858.0	msiexec.exe
File created	C:\Windows\Installer\e598a35.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D04.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203171.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145202952.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203171.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\mfc80DEU.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231031145202952.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145202640.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203811.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\VCREDI~3.EXE	vcredist_x86.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145202640.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\mfc80JPN.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203811.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231031145202640.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203624.0\vcomp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203765.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203171.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203796.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203827.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231031145203374.0	msiexec.exe
File opened for modification	C:\Windows\VCREDI~3.EXE	vcredist_x86.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145202640.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\mfc80ESP.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231031145203624.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231031145203811.0	msiexec.exe
File created	C:\Windows\TMP4351$.TMP	vcredist_x86.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{837b34e3-7c30-493c-8f6a-2b0f04e2912c}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\mfc80KOR.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231031145203796.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145202952.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203827.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203171.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203858.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\e598a35.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203765.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231031145203827.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI964C.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145202952.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203171.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203858.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145202952.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145202952.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203171.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203624.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231031145203374.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c.manifest	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000299f28d78dcfadf0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800000299f28d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809000299f28d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d0299f28d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000299f28d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\TOBESOFT\\XPLATFORM\\9.2\\XPlatformAX92.dll, 102"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4CBCE6F5-1E75-4813-897A-432959766B20}\1.0\ = "XPlatformAX92 1.0 Type Library"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\PackageCode = "89402836B2F60B04F9803CF6D2C84E21"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlatformAX.XPlatformAXCtrl92\CurVer	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\ProgID	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A1800FA-0890-4081-AFBA-91570ECB5F5E}\TypeLib\ = "{4CBCE6F5-1E75-4813-897A-432959766B20}"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\VersionIndependentProgID	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A1800FA-0890-4081-AFBA-91570ECB5F5E}\ = "_IXPlatformAXCtrl92Events"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\InprocServer32\ThreadingModel = "Both"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4CBCE6F5-1E75-4813-897A-432959766B20}\1.0\HELPDIR	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A1800FA-0890-4081-AFBA-91570ECB5F5E}	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A1800FA-0890-4081-AFBA-91570ECB5F5E}\ProxyStubClsid32	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3e43b73803c7c394f8a6b2f0402e19c2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlatformAX.XPlatformAXCtrl92\CLSID	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\ToolboxBitmap32	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4CBCE6F5-1E75-4813-897A-432959766B20}\1.0\FLAGS	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A1800FA-0890-4081-AFBA-91570ECB5F5E}\TypeLib\Version = "1.0"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\Control	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A1800FA-0890-4081-AFBA-91570ECB5F5E}\ProxyStubClsid32	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D639579B-004B-455D-A738-809746AC00F3}\ = "IXPlatformAXCtrl92"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D639579B-004B-455D-A738-809746AC00F3}\TypeLib	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\TypeLib\ = "{4CBCE6F5-1E75-4813-897A-432959766B20}"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\Version	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A733AAE8-110A-4D4E-BC83-9328FEC01C1B}\ = "XPlatformAX"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\InprocServer32	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4CBCE6F5-1E75-4813-897A-432959766B20}\1.0\0\win32\ = "C:\\Program Files (x86)\\TOBESOFT\\XPLATFORM\\9.2\\XPlatformAX92.dll"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4CBCE6F5-1E75-4813-897A-432959766B20}\1.0\FLAGS\ = "0"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4CBCE6F5-1E75-4813-897A-432959766B20}\1.0\0\win32	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A1800FA-0890-4081-AFBA-91570ECB5F5E}\ = "_IXPlatformAXCtrl92Events"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D639579B-004B-455D-A738-809746AC00F3}\TypeLib\Version = "1.0"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A1800FA-0890-4081-AFBA-91570ECB5F5E}\TypeLib\Version = "1.0"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D639579B-004B-455D-A738-809746AC00F3}	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\MiscStatus	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4CBCE6F5-1E75-4813-897A-432959766B20}\1.0\0	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D639579B-004B-455D-A738-809746AC00F3}\ = "IXPlatformAXCtrl92"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f004f007700390052005a004800670055003f005d004a004b0073002700780077005a0043003200560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43C5FE00-DD32-4792-83DB-19AE4F88F2A6}\MiscStatus\ = "0"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A1800FA-0890-4081-AFBA-91570ECB5F5E}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D639579B-004B-455D-A738-809746AC00F3}\TypeLib	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3e43b73803c7c394f8a6b2f0402e19c2\VC_Redist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3e43b73803c7c394f8a6b2f0402e19c2\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlatformAX.XPlatformAXCtrl92.1	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlatformAX.XPlatformAXCtrl92	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D639579B-004B-455D-A738-809746AC00F3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
1800	msiexec.exe
1800	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3532	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3532	msiexec.exe
Token: SeSecurityPrivilege	1800	msiexec.exe
Token: SeCreateTokenPrivilege	3532	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3532	msiexec.exe
Token: SeLockMemoryPrivilege	3532	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3532	msiexec.exe
Token: SeMachineAccountPrivilege	3532	msiexec.exe
Token: SeTcbPrivilege	3532	msiexec.exe
Token: SeSecurityPrivilege	3532	msiexec.exe
Token: SeTakeOwnershipPrivilege	3532	msiexec.exe
Token: SeLoadDriverPrivilege	3532	msiexec.exe
Token: SeSystemProfilePrivilege	3532	msiexec.exe
Token: SeSystemtimePrivilege	3532	msiexec.exe
Token: SeProfSingleProcessPrivilege	3532	msiexec.exe
Token: SeIncBasePriorityPrivilege	3532	msiexec.exe
Token: SeCreatePagefilePrivilege	3532	msiexec.exe
Token: SeCreatePermanentPrivilege	3532	msiexec.exe
Token: SeBackupPrivilege	3532	msiexec.exe
Token: SeRestorePrivilege	3532	msiexec.exe
Token: SeShutdownPrivilege	3532	msiexec.exe
Token: SeDebugPrivilege	3532	msiexec.exe
Token: SeAuditPrivilege	3532	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3532	msiexec.exe
Token: SeChangeNotifyPrivilege	3532	msiexec.exe
Token: SeRemoteShutdownPrivilege	3532	msiexec.exe
Token: SeUndockPrivilege	3532	msiexec.exe
Token: SeSyncAgentPrivilege	3532	msiexec.exe
Token: SeEnableDelegationPrivilege	3532	msiexec.exe
Token: SeManageVolumePrivilege	3532	msiexec.exe
Token: SeImpersonatePrivilege	3532	msiexec.exe
Token: SeCreateGlobalPrivilege	3532	msiexec.exe
Token: SeBackupPrivilege	4384	vssvc.exe
Token: SeRestorePrivilege	4384	vssvc.exe
Token: SeAuditPrivilege	4384	vssvc.exe
Token: SeBackupPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe
Token: SeTakeOwnershipPrivilege	1800	msiexec.exe
Token: SeRestorePrivilege	1800	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3532	msiexec.exe
3532	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 1544	3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe	93
PID 3648 wrote to memory of 1544	3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe	93
PID 3648 wrote to memory of 1544	3648	31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe	93
PID 1544 wrote to memory of 3224	1544	vcredist_x86.exe	94
PID 1544 wrote to memory of 3224	1544	vcredist_x86.exe	94
PID 1544 wrote to memory of 3224	1544	vcredist_x86.exe	94
PID 3224 wrote to memory of 3532	3224	VCREDI~3.EXE	97
PID 3224 wrote to memory of 3532	3224	VCREDI~3.EXE	97
PID 3224 wrote to memory of 3532	3224	VCREDI~3.EXE	97
PID 1800 wrote to memory of 4328	1800	msiexec.exe	113
PID 1800 wrote to memory of 4328	1800	msiexec.exe	113
PID 1800 wrote to memory of 3696	1800	msiexec.exe	115
PID 1800 wrote to memory of 3696	1800	msiexec.exe	115
PID 1800 wrote to memory of 3696	1800	msiexec.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe
"C:\Users\Admin\AppData\Local\Temp\31509a8632447e0b6ad6a2e0a414f8a22bb95f910560dd7a551aa75e52e1defc.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\vcredist_x86.exe
  "C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\vcredist_x86.exe" /Q /T:C:\Windows
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\VCREDI~3.EXE
    C:\Windows\VCREDI~3.EXE
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Windows\SysWOW64\msiexec.exe
      msiexec /i vcredist.msi
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:3532

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4328
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 734575A0D3870F167B73422673CED881
  2⤵
  - Loads dropped DLL
  PID:3696

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e598a38.rbs

Filesize
66KB

MD5
3a502c89cc4800be1a9bfcfc5a49756d

SHA1
5baa4aabde21a157ee8867ae239f78818a0d5957

SHA256
fa70cfbd2ebe07c44364bb591227ae25974982921f2f8c2c24ff8f60b8489d47

SHA512
0d9fe1b4f69d0c38d89789aacc36fc12b1e76bf2a2ba42a85f39031c67f7283d8925d6805ea6ce06e06b5db815096153beabc92d78a699788f0fb693d7b44e3f

Download Submit
C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XPEngineUninstaller.exe

Filesize
372KB

MD5
8e224f0135dbe9a31ca4bab15df2b1ce

SHA1
9612b981d747f1ca25f17908cdc92ba14243ee3a

SHA256
fcd6f0c9475c8243382769ca8be5eab58da0cddd45b4b227b7392de7eb90d637

SHA512
5c400dd958ed80db38c5bd2403229043a120c9c2565dcd2ebd38e8adae560bb2321baa97bd5e751adc324790f0c0b9d2b61b294b274dd82dd562c36d17791b89

Download Submit
C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\XPlatformAX92.dll

Filesize
162KB

MD5
ea0fd03b9c5578aed0c45c543c758331

SHA1
087f6dbf5621a1a331fbb99bbf60d6c6af789daf

SHA256
38d875cfe7140cd2012b7eeee6c0d7a6b7b4b8a61652806d51e3f15de445b408

SHA512
adabecaa246226405c288647757dd503a4da5f328dd572747408a3a127553e6b61cfebac6ffa7013a0450c12d66e0789e0199fa1b0e8c8a7fdae59b40d44c57d

Download Submit
C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\default.xtheme

Filesize
145KB

MD5
a28072429542b137d538ccfdc8c67da5

SHA1
a810cd607c0ecebe6a181691482911e6aa6ca567

SHA256
b0573bba0d90b296e0890d46262b151337e629b0d07940753211d07029cec715

SHA512
b945f64181d4b0b5189f182b4f9dcf1d6eae6a80a7df9d174d4a101dd37762d1a73e9a3af9167c3d0e4fce4cccdbdcf066174a0e77827332c1336f2e47b50ad4

Download Submit
C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\plugin.reg

Filesize
2KB

MD5
6275d63f1f06a1704d5b69703d8b70a8

SHA1
d05a85e88de488bbf8feb07db106c75ae4180ba2

SHA256
d42536e610df4219060da1cafd64ff5c505b71e8055cfc6f00b5028bec9ef56f

SHA512
0ced726133cf694e8ffa5cc5b49dfe2dcc0d585e1676b3bc346f6f1432c3359be9cd3846494cb9d7d6cb832887872c30b76db9f82ad55c4694c58ab90cd35f01

Download Submit
C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\vcredist_x86.exe

Filesize
2.6MB

MD5
6402438591b548121f54b0706a2c6423

SHA1
e052789ebad7dc8d6f8505a9295b0576babd125e

SHA256
d6832398e3bc9156a660745f427dc1c2392ce4e9a872e04f41f62d0c6bae07a8

SHA512
c615e6337a9507bfaaff14e23043e206351d48bf7ba1d0c244c4bc8a08f411b4aa27f9a9074a87b320007b3cfca448306752fd343392bdde83b851b0e7daadef

Download Submit
C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\vcredist_x86.exe

Filesize
2.6MB

MD5
6402438591b548121f54b0706a2c6423

SHA1
e052789ebad7dc8d6f8505a9295b0576babd125e

SHA256
d6832398e3bc9156a660745f427dc1c2392ce4e9a872e04f41f62d0c6bae07a8

SHA512
c615e6337a9507bfaaff14e23043e206351d48bf7ba1d0c244c4bc8a08f411b4aa27f9a9074a87b320007b3cfca448306752fd343392bdde83b851b0e7daadef

Download Submit
C:\Program Files (x86)\TOBESOFT\XPLATFORM\9.2\vcredist_x86.exe

Filesize
2.6MB

MD5
6402438591b548121f54b0706a2c6423

SHA1
e052789ebad7dc8d6f8505a9295b0576babd125e

SHA256
d6832398e3bc9156a660745f427dc1c2392ce4e9a872e04f41f62d0c6bae07a8

SHA512
c615e6337a9507bfaaff14e23043e206351d48bf7ba1d0c244c4bc8a08f411b4aa27f9a9074a87b320007b3cfca448306752fd343392bdde83b851b0e7daadef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab

Filesize
247KB

MD5
d5dd8a90812067e0ccb23a7299f82562

SHA1
5787391891cef8295666bce637d10e992d021d81

SHA256
71a4560b0eb5e45c385ce3aef154d97fa944b762f9aff3b3b9364d42bd1d5afd

SHA512
d38d3bcb8a640538a3a1b4052727d8d291d8d17218ba1abcaab1dca615bd83d3317a4bed89e495fadfbe6d20791562e5a8032284ae1cfeadc0020337ea0fe673

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi

Filesize
2.6MB

MD5
f194e681c552647c95441877b5552415

SHA1
285c6b1dbbc2d1525c9b1c276a4901b98d49b202

SHA256
6d4f42d5856384c2566ed79bdc587993208013640b035b04540de9f05ee597d6

SHA512
8ed21ce7829a1cb6c2dd4eff2e3701171aeba5b7e4337eaf0ddff86ea3fda812198a2e3fb4f1873b129944bdc8ddb09ebbd78e5c2b9811900cb853ef2afdab8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OpenSource License.txt

Filesize
16KB

MD5
1887d7610a7a2395eff113688fa2e177

SHA1
b71019dae177f9a032641917f9fa2782ae115696

SHA256
dee85807bfe229ac3ad8c27ddbd2ccb4e4c300ae32d683a3d13d121f88704285

SHA512
22cbc7b0ba6c3a26b6456ed8f69fe99fad4c35f91a912865c63d2695312fd301ab6531ab63a09e05f8ecfd6cbe65cf0e8d0f83107b63213ad08d20dfcf8b037a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XBasicLib92.dll

Filesize
2.2MB

MD5
e47d66dfbba10f9cf53d6014cad73b5b

SHA1
239706d9a0f555f970fa3c1c7f489d6294b78e99

SHA256
4d85686951bde29577d410fdf7f4ab0f50432ecd2d745c1eb185625394aaff9c

SHA512
4f24484612e8e6691005eea7965cc466c5d1ef6202933f310346b8acf23704bab42cc629106f05f99f59784f9213c5f98d6dd7c9ed5c8c1cc29f8c455781c59a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XBasicLib92.dll

Filesize
2.2MB

MD5
e47d66dfbba10f9cf53d6014cad73b5b

SHA1
239706d9a0f555f970fa3c1c7f489d6294b78e99

SHA256
4d85686951bde29577d410fdf7f4ab0f50432ecd2d745c1eb185625394aaff9c

SHA512
4f24484612e8e6691005eea7965cc466c5d1ef6202933f310346b8acf23704bab42cc629106f05f99f59784f9213c5f98d6dd7c9ed5c8c1cc29f8c455781c59a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XBasicLib92.dll

Filesize
2.2MB

MD5
e47d66dfbba10f9cf53d6014cad73b5b

SHA1
239706d9a0f555f970fa3c1c7f489d6294b78e99

SHA256
4d85686951bde29577d410fdf7f4ab0f50432ecd2d745c1eb185625394aaff9c

SHA512
4f24484612e8e6691005eea7965cc466c5d1ef6202933f310346b8acf23704bab42cc629106f05f99f59784f9213c5f98d6dd7c9ed5c8c1cc29f8c455781c59a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClassLib92.dll

Filesize
480KB

MD5
0a3a2af0187e10f6d097eee126a562ff

SHA1
90dfab0d26d60a1cd961559797bd38d4bff489cb

SHA256
3bccb804fa9b174b97a2c69cb4018dcfc1b32ab9a677d676d7d749619ddd4fac

SHA512
1f614cff5d4b6e8839c182f38ab6f824d1f539b19cbb28fd379511aa5c51055afa7a775ddff12e9cece498a1df6ea72ea2447e3bdadb7454b95621e3de40e4cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClassLib92.dll

Filesize
480KB

MD5
0a3a2af0187e10f6d097eee126a562ff

SHA1
90dfab0d26d60a1cd961559797bd38d4bff489cb

SHA256
3bccb804fa9b174b97a2c69cb4018dcfc1b32ab9a677d676d7d749619ddd4fac

SHA512
1f614cff5d4b6e8839c182f38ab6f824d1f539b19cbb28fd379511aa5c51055afa7a775ddff12e9cece498a1df6ea72ea2447e3bdadb7454b95621e3de40e4cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\XClassLib92.dll

Filesize
480KB

MD5
0a3a2af0187e10f6d097eee126a562ff

SHA1
90dfab0d26d60a1cd961559797bd38d4bff489cb

SHA256
3bccb804fa9b174b97a2c69cb4018dcfc1b32ab9a677d676d7d749619ddd4fac

SHA512
1f614cff5d4b6e8839c182f38ab6f824d1f539b19cbb28fd379511aa5c51055afa7a775ddff12e9cece498a1df6ea72ea2447e3bdadb7454b95621e3de40e4cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\XHttpLib92.dll

Filesize
208KB

MD5
21c523620bc089139003a2d30b8e2948

SHA1
0e719c93345f6d768b2b78d08c90168dc5ca1811

SHA256
d78eedea52dd5771deefd183debafb27e7b180b89c0803da953ea759557a4ef1

SHA512
1c6b915bbca6ddbf18a5ff436c264fa909b0123197bf6f7085b43dbe50a56c9f9dfc662a1ed124624dd1505ffda92552a8321cd6da98694ecd56b72a363e9559

Download Submit
C:\Users\Admin\AppData\Local\Temp\XHttpLib92.dll

Filesize
208KB

MD5
21c523620bc089139003a2d30b8e2948

SHA1
0e719c93345f6d768b2b78d08c90168dc5ca1811

SHA256
d78eedea52dd5771deefd183debafb27e7b180b89c0803da953ea759557a4ef1

SHA512
1c6b915bbca6ddbf18a5ff436c264fa909b0123197bf6f7085b43dbe50a56c9f9dfc662a1ed124624dd1505ffda92552a8321cd6da98694ecd56b72a363e9559

Download Submit
C:\Users\Admin\AppData\Local\Temp\XHttpLib92.dll

Filesize
208KB

MD5
21c523620bc089139003a2d30b8e2948

SHA1
0e719c93345f6d768b2b78d08c90168dc5ca1811

SHA256
d78eedea52dd5771deefd183debafb27e7b180b89c0803da953ea759557a4ef1

SHA512
1c6b915bbca6ddbf18a5ff436c264fa909b0123197bf6f7085b43dbe50a56c9f9dfc662a1ed124624dd1505ffda92552a8321cd6da98694ecd56b72a363e9559

Download Submit
C:\Users\Admin\AppData\Local\Temp\XMemPoolLib92.dll

Filesize
24KB

MD5
bbbc1b4082fd2cf775f25df2f3c2ffd6

SHA1
08377c226d0b008e8534c822cd4dc8eb77c352bb

SHA256
58fb7d84f128797b721c5982db51fe4a0c25c8890d63fabadef6442ba4633f10

SHA512
8157964a6df1dab7250ddfabf530b36f0a25746c77fd5988d9a1f5e04a940c1b4367cfc4ebd28e5fbf0cb6902382eb6a7f8386f08decd46814ab496efbe5976e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XMemPoolLib92.dll

Filesize
24KB

MD5
bbbc1b4082fd2cf775f25df2f3c2ffd6

SHA1
08377c226d0b008e8534c822cd4dc8eb77c352bb

SHA256
58fb7d84f128797b721c5982db51fe4a0c25c8890d63fabadef6442ba4633f10

SHA512
8157964a6df1dab7250ddfabf530b36f0a25746c77fd5988d9a1f5e04a940c1b4367cfc4ebd28e5fbf0cb6902382eb6a7f8386f08decd46814ab496efbe5976e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XMemPoolLib92.dll

Filesize
24KB

MD5
bbbc1b4082fd2cf775f25df2f3c2ffd6

SHA1
08377c226d0b008e8534c822cd4dc8eb77c352bb

SHA256
58fb7d84f128797b721c5982db51fe4a0c25c8890d63fabadef6442ba4633f10

SHA512
8157964a6df1dab7250ddfabf530b36f0a25746c77fd5988d9a1f5e04a940c1b4367cfc4ebd28e5fbf0cb6902382eb6a7f8386f08decd46814ab496efbe5976e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XPlatform.exe

Filesize
394KB

MD5
7fa3df4ff73974d6c8d283da8c7238ca

SHA1
b10f2c96ef9fe6dbf3bc85dfa049ad62512806ec

SHA256
518f51f76bad5d06957e1e353cf398a0b9a51819033f9d69bd6ed2c0e41e3588

SHA512
6f710f957fa044a1962a2a6a5d3b1a27f947ebcfccb39fb85787c779e4bf292f35e247305e5d3d69d6d8d1617dbb90643422a8515c2fa61da515dc44366b2cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\XPlatformAX92.dll

Filesize
162KB

MD5
ea0fd03b9c5578aed0c45c543c758331

SHA1
087f6dbf5621a1a331fbb99bbf60d6c6af789daf

SHA256
38d875cfe7140cd2012b7eeee6c0d7a6b7b4b8a61652806d51e3f15de445b408

SHA512
adabecaa246226405c288647757dd503a4da5f328dd572747408a3a127553e6b61cfebac6ffa7013a0450c12d66e0789e0199fa1b0e8c8a7fdae59b40d44c57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\XPlatformLib92.dll

Filesize
4.3MB

MD5
79b00326c14ce61458661959dfd09892

SHA1
45db39c6195dd6a52a60674172b432dfb29cc937

SHA256
67db95b288d5d5dd00c3021d9d2951605d0c20dd40bef949f2fac09b6c599a9f

SHA512
ef84f95498db6b06e800fc6ca39d5326406246054dcfb1743a385e32c5e66a7f8ea96bf44cf2f069ab2f392020b91f7a472670bb65b5987c5286203f0112484f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XPlatformLib92.dll

Filesize
4.3MB

MD5
79b00326c14ce61458661959dfd09892

SHA1
45db39c6195dd6a52a60674172b432dfb29cc937

SHA256
67db95b288d5d5dd00c3021d9d2951605d0c20dd40bef949f2fac09b6c599a9f

SHA512
ef84f95498db6b06e800fc6ca39d5326406246054dcfb1743a385e32c5e66a7f8ea96bf44cf2f069ab2f392020b91f7a472670bb65b5987c5286203f0112484f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XPlatformLib92.dll

Filesize
4.3MB

MD5
79b00326c14ce61458661959dfd09892

SHA1
45db39c6195dd6a52a60674172b432dfb29cc937

SHA256
67db95b288d5d5dd00c3021d9d2951605d0c20dd40bef949f2fac09b6c599a9f

SHA512
ef84f95498db6b06e800fc6ca39d5326406246054dcfb1743a385e32c5e66a7f8ea96bf44cf2f069ab2f392020b91f7a472670bb65b5987c5286203f0112484f

Download Submit
C:\Users\Admin\AppData\Local\Temp\npXPLauncherPlugin92.dll

Filesize
640KB

MD5
5b59a97ff3b9f4b5ec5071fa0a6e945b

SHA1
635d7998c89fe18527c44bdcb32a053b1f289852

SHA256
2ed749aa19cc19d75081e672f51c3a088c6c4a4b5257c0d974ac8acf93bce075

SHA512
5bd4dbc10cf083021432b56aa4dc32a2b0b1b13737a97122d90705f319b41ad588f6c8fa57f33cd3b7efab5401a40a35d675183f24e682bb18cc34fa0a412936

Download Submit
C:\Users\Admin\AppData\Local\Temp\npXPlatformPlugin92.dll

Filesize
88KB

MD5
62114054fa5cf6ebfd0b0768e9785357

SHA1
588807895f0f6fbf7150fd4db37ef27fd9579d16

SHA256
921618f252d7c6bd4fb093079b8ec5bf0c125d768caef66d64c49c3e5f16195b

SHA512
f0c6ef876ff413d427fc6283838a321ac4579505aa3c9dc7bb91e8d05e5358620b1f9a684a25ba401ee8df8851e6db71a30e11b1f8e1e9f58a9b0f1329511938

Download Submit
C:\Windows\Installer\MSI8D04.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSI8D04.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\e598a35.msi

Filesize
2.6MB

MD5
f194e681c552647c95441877b5552415

SHA1
285c6b1dbbc2d1525c9b1c276a4901b98d49b202

SHA256
6d4f42d5856384c2566ed79bdc587993208013640b035b04540de9f05ee597d6

SHA512
8ed21ce7829a1cb6c2dd4eff2e3701171aeba5b7e4337eaf0ddff86ea3fda812198a2e3fb4f1873b129944bdc8ddb09ebbd78e5c2b9811900cb853ef2afdab8c

Download Submit
C:\Windows\VCREDI~3.EXE

Filesize
2.6MB

MD5
c5c698758bd9da02cc2ef94dcf1b4637

SHA1
1d6773537b0baba779090c7fa29be43d2130c3dd

SHA256
e1df4fda1f4f6a5d9faa94cc53e77458a53c56a87df4f1062708095150c86dbf

SHA512
c238860204de3933c7c41ba5f621f957d602286fa3a19a1bf4b6b272d8b417a20f5351ccf6ae5b46dde6ae938c7158e0f11d610e7a76a3530ba6825a96c9196b

Download Submit
C:\Windows\VCREDI~3.EXE

Filesize
2.6MB

MD5
c5c698758bd9da02cc2ef94dcf1b4637

SHA1
1d6773537b0baba779090c7fa29be43d2130c3dd

SHA256
e1df4fda1f4f6a5d9faa94cc53e77458a53c56a87df4f1062708095150c86dbf

SHA512
c238860204de3933c7c41ba5f621f957d602286fa3a19a1bf4b6b272d8b417a20f5351ccf6ae5b46dde6ae938c7158e0f11d610e7a76a3530ba6825a96c9196b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
939ac0a8872c3fe065845a87917110f5

SHA1
b259377328163aa1188a8fa5bae440d638774aa1

SHA256
2d338e476224acec5958ed7a453472f4209476903665f5248204ec3a13fbd252

SHA512
910752c7ac1cfd3de818003cc105bb1076e508a62e5d21e028e02a60f05e466c853f1947f6b0b711d9b221e7f63f41878f660108bd699db526cea8a39b33a8a9

Download Submit
\??\Volume{8df29902-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4421db10-1766-4c65-b5bb-13b75e622821}_OnDiskSnapshotProp

Filesize
5KB

MD5
506bdd5ebab0d82c6af2e845cabb77e4

SHA1
6e1a8b608af270c88c55c4b722456ba3a3204c61

SHA256
9d3958f7c2bbc917255ea38bf496c7550c7266cfa83095940273905be4ad6967

SHA512
94ddf320990ec8983d6cbc38517fec3cce0b8432ae959125ea50d2bed754caaab1c1a2bed1b52403afb0437deeeed16931596860b6bd8078fa77680f9552289e

Download Submit
memory/3648-109-0x0000000003950000-0x0000000003B7F000-memory.dmp

Filesize
2.2MB

Download
memory/3648-108-0x0000000004E40000-0x00000000052DA000-memory.dmp

Filesize
4.6MB

Download
memory/3648-125-0x00000000052E0000-0x0000000005359000-memory.dmp

Filesize
484KB

Download
memory/3648-120-0x00000000032B0000-0x00000000032E4000-memory.dmp

Filesize
208KB

Download