agenttesla | hxxps://www[.]mediafire[.]com/file/t9usn5skz63s9p9/Sipari%C5%9F+%C3%96zellikleri+pdf[.]tgz/file

max time kernel
900s
max time network
858s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2023 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/t9usn5skz63s9p9/Sipari%C5%9F+%C3%96zellikleri+pdf.tgz/file

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot6322297669:AAGbvKNiIygEW0jh_mPJNVrdjpuyp8vIb4A/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 4 IoCs

Processes:

vkZoFBE0Nk6lkh2.exevkZoFBE0Nk6lkh2.exevkZoFBE0Nk6lkh2.exevkZoFBE0Nk6lkh2.exe

pid process

4964 vkZoFBE0Nk6lkh2.exe
184 vkZoFBE0Nk6lkh2.exe
2876 vkZoFBE0Nk6lkh2.exe
2132 vkZoFBE0Nk6lkh2.exe

pid	process
4964	vkZoFBE0Nk6lkh2.exe
184	vkZoFBE0Nk6lkh2.exe
2876	vkZoFBE0Nk6lkh2.exe
2132	vkZoFBE0Nk6lkh2.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exevcredist_x64.exeMsiExec.exevcredist_x86.exevcredist_x64.exevcredist_x86.exeVC_redist.x64.exeVC_redist.x86.exewindowsdesktop-runtime-6.0.25-win-x64.exeMsiExec.exeMsiExec.exeMsiExec.exe

pid	process
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4656	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
4248	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1232	MsiExec.exe
1752	vcredist_x64.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
4388	vcredist_x86.exe
5008	vcredist_x64.exe
1620	vcredist_x86.exe
1740	VC_redist.x64.exe
4840	VC_redist.x86.exe
1728	windowsdesktop-runtime-6.0.25-win-x64.exe
4388	MsiExec.exe
4388	MsiExec.exe
4508	MsiExec.exe
4508	MsiExec.exe
2776	MsiExec.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vcredist_x64.exevcredist_x86.exevcredist_x64.exevcredist_x86.exeVC_redist.x64.exeVC_redist.x86.exewindowsdesktop-runtime-6.0.25-win-x64.exewindowsdesktop-runtime-8.0.0-win-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20231201073316.log\" /uninstall ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20231201073353.log\" /uninstall ignored /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{fb0500c1-f968-4621-a48b-985b52884c49} = "\"C:\\ProgramData\\Package Cache\\{fb0500c1-f968-4621-a48b-985b52884c49}\\windowsdesktop-runtime-6.0.25-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.25-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{17316079-d65a-4f25-a9f3-56c32781b15d} = "\"C:\\ProgramData\\Package Cache\\{17316079-d65a-4f25-a9f3-56c32781b15d}\\windowsdesktop-runtime-8.0.0-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.0-win-x64.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in System32 directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\system32\mfc120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp110.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110rus.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100cht.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\atl100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110enu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

vkZoFBE0Nk6lkh2.exe

description pid process target process

PID 2876 set thread context of 2132 2876 vkZoFBE0Nk6lkh2.exe vkZoFBE0Nk6lkh2.exe

description	pid	process	target process
PID 2876 set thread context of 2132	2876	vkZoFBE0Nk6lkh2.exe	vkZoFBE0Nk6lkh2.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Primitives.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-interlocked-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-errorhandling-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tools.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Numerics.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Mail.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Primitives.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Ping.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Metadata.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.Common.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Primitives.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Tar.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationCore.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.Writer.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.AppContext.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Loader.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationCore.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Xaml.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Xml.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Extensions.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemDrawing.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\DirectWriteForwarder.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\coreclr.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Primitives.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebProxy.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Contracts.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\ReachFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsFormsIntegration.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\wpfgfx_cor3.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationUI.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationClient.resources.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIA7A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFAFA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE416.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA59C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE90C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A30.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100u_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CD2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEAB6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A6F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI276.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_msvcp100_x64	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID9E4.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8692.tmp	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE52B.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6594.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE1C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1819.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A2D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE91C.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\CacheSize.txt	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfcm100u_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcp100_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100esn_x64	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100ita_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EA4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE381.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9A5.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100deu_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8829.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_atl100_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAACE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE986.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE1A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2473.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2099.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE41F.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_vcomp100_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF075.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\99A1417CB29562244A9E7B761C0DBFFA\CacheSize.txt	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100jpn_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB251.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100jpn_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfcm100_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100cht_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE48D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE7B2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF096.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100ita_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\119b6.msp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\99A1417CB29562244A9E7B761C0DBFFA\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4B6.tmp	msiexec.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4756 4964 WerFault.exe vkZoFBE0Nk6lkh2.exe
5108 184 WerFault.exe vkZoFBE0Nk6lkh2.exe

pid	pid_target	process	target process
4756	4964	WerFault.exe	vkZoFBE0Nk6lkh2.exe
5108	184	WerFault.exe	vkZoFBE0Nk6lkh2.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005c866c3b1eef80320000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005c866c3b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005c866c3b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5c866c3b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005c866c3b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 58 IoCs

Processes:

msiexec.exechrome.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133458893584601285"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exewindowsdesktop-runtime-8.0.0-win-x64.exeexplorer.exevcredist_x86.exewindowsdesktop-runtime-6.0.25-win-x64.exeOpenWith.exeVC_redist.x86.exeVC_redist.x64.exevcredist_x86.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A2D1F4F1AD9DFC2399908484D50AD65D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\WINDOWSDESKTOP_RUNTIME_64.0.5329_X64\DEPENDENTS\{17316079-D65A-4F25-A9F3-56C32781B15D}	windowsdesktop-runtime-8.0.0-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.0.5329_x64	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\GroupByKey:PID = "0"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\LogicalViewMode = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C9F8B73BF303523781852719CD9C700\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUM_X86,V11\DEPENDENTS\{33D1FD90-4274-48A1-9BC1-97E33D9C2D6F}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\23C310658A152FD72F6C160480453ADC	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\WINDOWSDESKTOP_RUNTIME_48.100.4037_X64\DEPENDENTS\{FB0500C1-F968-4621-A48B-985B52884C49}	windowsdesktop-runtime-6.0.25-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99A1417CB29562244A9E7B761C0DBFFA\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings	OpenWith.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\888D68EA4041CC747ABBD8680C05E385\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 1e007180000000000000000000006abe817b2bce7646a29eeb907a5126c50000	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CDA0C311DB9B59F46935F4B55C04DE30	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1AFA6AFEE83700E31810DF308BB6921D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\167F57B58CABCB333A1864D4DD8D313A	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C025571B2A687A53689168CD7369889B\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\048607A32882C32409BE3B51542ECBA7	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a00000040010000904f1e8459ff164d8947e81bbffab36d02000000c0000000904f1e8459ff164d8947e81bbffab36d0b0000005000000030f125b7ef471a10a5f102608c9eebac0c00000050000000537def0c64fad111a2030000f81fedee0800000080000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\99A1417CB29562244A9E7B761C0DBFFA	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\Dependents	windowsdesktop-runtime-8.0.0-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V11\DEPENDENTS\{33D1FD90-4274-48A1-9BC1-97E33D9C2D6F}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Key created	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\FFlags = "18874449"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\50CEE778A84526C56C3E8C839BA3765F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v11\Dependents	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE6380BC270BD863282B3D74B09F7570\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2B4453F26E11D47BC9D3EDCA9ED45A	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DC8A59DBF9D1DA5389A1E3975220E6BB	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99A1417CB29562244A9E7B761C0DBFFA\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\DOTNET_CLI_HOSTFXR_64.0.4211_X64\DEPENDENTS\{17316079-D65A-4F25-A9F3-56C32781B15D}	windowsdesktop-runtime-8.0.0-win-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

2092 explorer.exe

pid	process
2092	explorer.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

chrome.exemsiexec.exevkZoFBE0Nk6lkh2.exevkZoFBE0Nk6lkh2.exevkZoFBE0Nk6lkh2.exe

pid	process
1312	chrome.exe
1312	chrome.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4160	msiexec.exe
4964	vkZoFBE0Nk6lkh2.exe
4964	vkZoFBE0Nk6lkh2.exe
184	vkZoFBE0Nk6lkh2.exe
184	vkZoFBE0Nk6lkh2.exe
2132	vkZoFBE0Nk6lkh2.exe
2132	vkZoFBE0Nk6lkh2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2092 explorer.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

1312 chrome.exe
1312 chrome.exe

pid	process
2092	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe
Token: SeShutdownPrivilege	1312	chrome.exe
Token: SeCreatePagefilePrivilege	1312	chrome.exe

Suspicious use of FindShellTrayWindow 57 IoCs

Processes:

chrome.exe7zG.exeexplorer.exe7zG.exevcredist_x64.exevcredist_x86.exevcredist_x64.exevcredist_x86.exeVC_redist.x64.exeVC_redist.x86.exewindowsdesktop-runtime-6.0.25-win-x64.exewindowsdesktop-runtime-8.0.0-win-x64.exe7zFM.exe

pid	process
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
3192	7zG.exe
2092	explorer.exe
400	7zG.exe
2092	explorer.exe
2092	explorer.exe
2092	explorer.exe
2092	explorer.exe
2092	explorer.exe
2092	explorer.exe
1752	vcredist_x64.exe
2092	explorer.exe
2092	explorer.exe
4388	vcredist_x86.exe
5008	vcredist_x64.exe
1620	vcredist_x86.exe
1740	VC_redist.x64.exe
4840	VC_redist.x86.exe
1728	windowsdesktop-runtime-6.0.25-win-x64.exe
4516	windowsdesktop-runtime-8.0.0-win-x64.exe
1140	7zFM.exe
1140	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe
1312	chrome.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

vcredist_x64.exevcredist_x64.exevcredist_x86.exevcredist_x86.exevcredist_x64.exevcredist_x64.exevcredist_x86.exevcredist_x86.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x86.exeVC_redist.x86.exeVC_redist.x86.exewindowsdesktop-runtime-6.0.25-win-x64.exewindowsdesktop-runtime-6.0.25-win-x64.exewindowsdesktop-runtime-6.0.25-win-x64.exewindowsdesktop-runtime-8.0.0-win-x64.exewindowsdesktop-runtime-8.0.0-win-x64.exewindowsdesktop-runtime-8.0.0-win-x64.exeOpenWith.exe

pid	process
3552	vcredist_x64.exe
1752	vcredist_x64.exe
3008	vcredist_x86.exe
4388	vcredist_x86.exe
4476	vcredist_x64.exe
5008	vcredist_x64.exe
4740	vcredist_x86.exe
1620	vcredist_x86.exe
536	VC_redist.x64.exe
1740	VC_redist.x64.exe
3416	VC_redist.x64.exe
5068	VC_redist.x86.exe
4840	VC_redist.x86.exe
3796	VC_redist.x86.exe
4612	windowsdesktop-runtime-6.0.25-win-x64.exe
1728	windowsdesktop-runtime-6.0.25-win-x64.exe
3204	windowsdesktop-runtime-6.0.25-win-x64.exe
4556	windowsdesktop-runtime-8.0.0-win-x64.exe
4516	windowsdesktop-runtime-8.0.0-win-x64.exe
5016	windowsdesktop-runtime-8.0.0-win-x64.exe
4608	OpenWith.exe
4608	OpenWith.exe
4608	OpenWith.exe
4608	OpenWith.exe
4608	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1312 wrote to memory of 3140	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 3140	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 5008	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 452	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 452	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe
PID 1312 wrote to memory of 4888	1312	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/t9usn5skz63s9p9/Sipari%C5%9F+%C3%96zellikleri+pdf.tgz/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a6f89758,0x7ff9a6f89768,0x7ff9a6f89778
2⤵
PID:3140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=304 --field-trial-handle=1888,i,17869927343523825882,11357554787634472211,131072 /prefetch:2
2⤵
PID:5008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1888,i,17869927343523825882,11357554787634472211,131072 /prefetch:8
2⤵
PID:452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1244 --field-trial-handle=1888,i,17869927343523825882,11357554787634472211,131072 /prefetch:8
2⤵
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1888,i,17869927343523825882,11357554787634472211,131072 /prefetch:1
2⤵
PID:2052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1888,i,17869927343523825882,11357554787634472211,131072 /prefetch:1
2⤵
PID:4656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1888,i,17869927343523825882,11357554787634472211,131072 /prefetch:8
2⤵
PID:5036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 --field-trial-handle=1888,i,17869927343523825882,11357554787634472211,131072 /prefetch:8
2⤵
PID:368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3976 --field-trial-handle=1888,i,17869927343523825882,11357554787634472211,131072 /prefetch:8
2⤵
PID:5064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=1888,i,17869927343523825882,11357554787634472211,131072 /prefetch:8
2⤵
PID:4620

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4984

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Sipariş Özellikleri pdf\" -ad -an -ai#7zMap10672:108:7zEvent27603
1⤵
- Suspicious use of FindShellTrayWindow
PID:3192

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\System32\appwiz.cpl",
1⤵
PID:1396

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\appwiz.cpl",
2⤵
PID:5020

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4232

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2092

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Sipariş Özellikleri pdf\Sipariş Özellikleri pdf\" -ad -an -ai#7zMap4062:156:7zEvent6058
1⤵
- Suspicious use of FindShellTrayWindow
PID:400

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4160

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:4232

\??\c:\Windows\System32\MsiExec.exe
c:\Windows\System32\MsiExec.exe -Embedding 6E90260D5B7E054D8BADB357AF1E9AA9
2⤵
- Loads dropped DLL
PID:4656

\??\c:\Windows\syswow64\MsiExec.exe
c:\Windows\syswow64\MsiExec.exe -Embedding 9FD15DE0D2291B2A19864A177E15579D
2⤵
- Loads dropped DLL
PID:4248

\??\c:\Windows\syswow64\MsiExec.exe
c:\Windows\syswow64\MsiExec.exe -Embedding 84D624E784E9E9A1D91B2CD155F7924F
2⤵
- Loads dropped DLL
PID:1232

\??\c:\Windows\System32\MsiExec.exe
c:\Windows\System32\MsiExec.exe -Embedding 63E1F36275886D0D863969173B5EFDCC
2⤵
- Loads dropped DLL
PID:544

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A0899AB27A41AACFC45404ECB0761AC6
2⤵
- Loads dropped DLL
PID:4388

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DB3B2B4356E71F261F4B7E44149AF35E
2⤵
- Loads dropped DLL
PID:4508

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4F345D33065673D075529528CBD159BD
2⤵
- Loads dropped DLL
PID:2776

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7867E1D997D1E1013D66B2F40EDDBC58
2⤵
PID:4020

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding FD3E4745CFFDADA79E8FE5ECF61274D3
2⤵
PID:1596

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5B76F511D3062CE771A3844C3BFAF02E
2⤵
PID:3872

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 49375F955E2CC9A3B968C10FFD0D3AE2
2⤵
PID:3760

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 3E3F1EEDD84A7D24CFC07DF14E01C94C
2⤵
PID:976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4744

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}
1⤵
PID:3160

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall
2⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3552

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall -burn.unelevated BurnPipe.{34E1F2E9-2ABC-4E3A-9E3A-BA3351F59CAD} {E4F952EB-7896-4BD0-A3BE-A128D604E98B} 3552
3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1752

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}
1⤵
PID:1012

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall
2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3008

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall -burn.unelevated BurnPipe.{42C87F6A-DBC9-4DD0-85C7-D342D54DE454} {D33D7AF6-EBEC-4439-9521-CA2D65F577EC} 3008
3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4388

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall
2⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4476

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall -burn.unelevated BurnPipe.{F9FD5188-205C-4C37-9FD0-D2EA75234613} {3783AC47-7C7D-4823-93F2-54273963F3FC} 4476
3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5008

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall
2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4740

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall -burn.unelevated BurnPipe.{90A65C89-C975-409A-A40D-7399F8CB5371} {80581A96-ECAE-4662-ADFE-C232F234C44E} 4740
3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}
1⤵
PID:1928

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /uninstall
2⤵
- Suspicious use of SetWindowsHookEx
PID:536

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 /uninstall
3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1740

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{580F2118-1588-4C6B-BBBF-D52214396F7E} {78BFF053-B91E-4F0C-9E9E-73E95BACBB53} 1740
4⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3416

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /uninstall
2⤵
- Suspicious use of SetWindowsHookEx
PID:5068

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 /uninstall
3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4840

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{46BAEF28-3F7E-4414-A9FC-7363C73C415B} {48B19A22-BBF3-4B47-AAD0-04CACCF6226E} 4840
4⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3796

C:\ProgramData\Package Cache\{fb0500c1-f968-4621-a48b-985b52884c49}\windowsdesktop-runtime-6.0.25-win-x64.exe
"C:\ProgramData\Package Cache\{fb0500c1-f968-4621-a48b-985b52884c49}\windowsdesktop-runtime-6.0.25-win-x64.exe" /uninstall
2⤵
- Suspicious use of SetWindowsHookEx
PID:4612

C:\ProgramData\Package Cache\{fb0500c1-f968-4621-a48b-985b52884c49}\windowsdesktop-runtime-6.0.25-win-x64.exe
"C:\ProgramData\Package Cache\{fb0500c1-f968-4621-a48b-985b52884c49}\windowsdesktop-runtime-6.0.25-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{fb0500c1-f968-4621-a48b-985b52884c49}\windowsdesktop-runtime-6.0.25-win-x64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=568 /uninstall
3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1728

C:\ProgramData\Package Cache\{fb0500c1-f968-4621-a48b-985b52884c49}\windowsdesktop-runtime-6.0.25-win-x64.exe
"C:\ProgramData\Package Cache\{fb0500c1-f968-4621-a48b-985b52884c49}\windowsdesktop-runtime-6.0.25-win-x64.exe" -q -burn.elevated BurnPipe.{C8FF38DF-21EF-46ED-9FF5-A3085C3743E5} {77F9F63C-BA01-42D2-A49C-95432AFE7E04} 1728
4⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3204

C:\ProgramData\Package Cache\{17316079-d65a-4f25-a9f3-56c32781b15d}\windowsdesktop-runtime-8.0.0-win-x64.exe
"C:\ProgramData\Package Cache\{17316079-d65a-4f25-a9f3-56c32781b15d}\windowsdesktop-runtime-8.0.0-win-x64.exe" /uninstall
2⤵
- Suspicious use of SetWindowsHookEx
PID:4556

C:\ProgramData\Package Cache\{17316079-d65a-4f25-a9f3-56c32781b15d}\windowsdesktop-runtime-8.0.0-win-x64.exe
"C:\ProgramData\Package Cache\{17316079-d65a-4f25-a9f3-56c32781b15d}\windowsdesktop-runtime-8.0.0-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{17316079-d65a-4f25-a9f3-56c32781b15d}\windowsdesktop-runtime-8.0.0-win-x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 /uninstall
3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4516

C:\ProgramData\Package Cache\{17316079-d65a-4f25-a9f3-56c32781b15d}\windowsdesktop-runtime-8.0.0-win-x64.exe
"C:\ProgramData\Package Cache\{17316079-d65a-4f25-a9f3-56c32781b15d}\windowsdesktop-runtime-8.0.0-win-x64.exe" -q -burn.elevated BurnPipe.{E727D07C-4159-4A3A-941E-E18E935CD976} {123EA14A-2FDE-4759-BF90-3006DB47888C} 4516
4⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5016

C:\Users\Admin\Downloads\Sipariş Özellikleri pdf\Sipariş Özellikleri pdf\vkZoFBE0Nk6lkh2.exe
"C:\Users\Admin\Downloads\Sipariş Özellikleri pdf\Sipariş Özellikleri pdf\vkZoFBE0Nk6lkh2.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 1168
2⤵
- Program crash
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4964 -ip 4964
1⤵
PID:3584

C:\Users\Admin\Downloads\Sipariş Özellikleri pdf\Sipariş Özellikleri pdf\vkZoFBE0Nk6lkh2.exe
"C:\Users\Admin\Downloads\Sipariş Özellikleri pdf\Sipariş Özellikleri pdf\vkZoFBE0Nk6lkh2.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 184 -s 1140
2⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 184 -ip 184
1⤵
PID:1520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4608

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Sipariş Özellikleri pdf\Sipariş Özellikleri pdf.tar"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1140

C:\Users\Admin\AppData\Local\Temp\7zO474D95F1\vkZoFBE0Nk6lkh2.exe
"C:\Users\Admin\AppData\Local\Temp\7zO474D95F1\vkZoFBE0Nk6lkh2.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2876

C:\Users\Admin\AppData\Local\Temp\7zO474D95F1\vkZoFBE0Nk6lkh2.exe
"C:\Users\Admin\AppData\Local\Temp\7zO474D95F1\vkZoFBE0Nk6lkh2.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e59e40f.rbs

Filesize
30KB

MD5
0110cd79d1ef9dcc4fe759f131dedbf5

SHA1
91adef0f4f5c034ea32d3bfd9dca78f99d336544

SHA256
600b45fd918e84acf59535d6e1b5815f47461b0c63bb381ca02695740c842bfe

SHA512
2e12ba191fe959a3dbadc80027bbe27be51a6e77aea3a03028d35139d03607bbe9bcf02ea6ab54fe65f2b881ad060ce9112cf13e963d758fe7c88f50273bf638

Download Submit
C:\Config.Msi\e59e413.rbs

Filesize
31KB

MD5
d2905c5fc531c221662e3d5233a54288

SHA1
a314b1f8ce6f47f2a83b6954a175ed5232d6d28b

SHA256
d8b5d6f5adb681fa2d7830db6862657cb0072297e01671ed75fe4a03413518d3

SHA512
fbe1904eef7d3d21eb0bf16f8a1112c7eedb59308b59f019cbcc33ce5d893ecb8ea28a7b9fafe8fa8d55b9d32d3046f3c61cb2bf683a58093c616ebd4e343bb6

Download Submit
C:\Config.Msi\e59e417.rbs

Filesize
49KB

MD5
274301966b242cf3d6f9527e3ef50e00

SHA1
47da07851670dad2e2b2bf310af11a8567affe50

SHA256
22857764432fc052066de829aa458fbc2b0e33a5eebb0d780d32b0f1e29c3280

SHA512
5057c0d13344cb18c83cbf73dcac66171816f04c9143ce6a7f76a91527f296cfd4e04422a1ae576a9ec0d89decf42c21f4c415adaf2cb9411c2690e6718ab144

Download Submit
C:\Config.Msi\e59e43b.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Config.Msi\e59e43e.rbs

Filesize
23KB

MD5
e83152a031094b6e593408d436d3a5cf

SHA1
fda329e60e2bac3bf990b9b11b95ede3bac587af

SHA256
cfefeba2fe8bb0cce5af273de03837f7d871d26df85f99dc15d19ca47291dcce

SHA512
89fff591e826f8394ec8138a57c82e695111eee27f40599f0f35268dc6d671703f93304b2de494815a517cecc99b9d96e3e9c2db356c0b95ca7e58685ec1773c

Download Submit
C:\Config.Msi\e59e451.rbs

Filesize
14KB

MD5
bbc1221f690a7ee388fbfad329f025e2

SHA1
1d03e9be894cba7cbd3f72d0b1c3c9ca17eaf7e6

SHA256
50ccc67e75af490ff79f2b4e91a4d0426d9e0307c87634c9ee55b5493ef9d1f1

SHA512
1d0d6d9fad987e1a98b94153943ba17246b6746bcbc0eed338abb737fd2825897a7947989226cec0e88b4d8cf8e77c206a9ec60f1d5e901b01e7ced5c84a1100

Download Submit
C:\Config.Msi\e59e458.rbs

Filesize
52KB

MD5
faf752e53c748d2ff3670833a9dd8631

SHA1
bf4e16cef374bd692dc96b184d58e3b67eed8c47

SHA256
208bfa92a82ae169b0489f15448298424d684ffa039590da1ac2e24616afa399

SHA512
8667fd30add42750c82d78169a5f19632da20555b971e69ad0bfbebc26386309432c67e11ff583b6eb3a8f2207979c1ab02cd5966d61f53f66b6825f30a19748

Download Submit
C:\Config.Msi\e59e47f.rbs

Filesize
23KB

MD5
f8ef4a331e34544a45c76fb2307df295

SHA1
353b17ab4f1c2ee51bfa465a9ceee3bc3fbf9fad

SHA256
0d29c5820491719d6ade7fd7a3e105cea5c972e2dbae4996c9e503e993904a13

SHA512
86d26c8fbed794fab0462cffb04bbcc79b457ea00637557d2efca80fbfebd152fe2cb3ba12a8a63af81e153007c14ca98a7f4bdf9277ca72f573a073d99ad85a

Download Submit
C:\Config.Msi\e59e492.rbs

Filesize
14KB

MD5
beddf7239bd70f8c0ef69044a957fe73

SHA1
1fb07bbfc5708efb36e5b510b3f2a79b7ee72430

SHA256
2999a3543b7ed546a323cbbc914c453b684819a84dd78948ee23b861d716532a

SHA512
9fae4f0da3221a952ffe893da27474366512b3f72513c536b3d6301099df91a7484901cc85ba892d9316a7d3ed1535c6872fb092ec01b4201f5bf33dffa722e1

Download Submit
C:\Config.Msi\e59e496.rbs

Filesize
22KB

MD5
66e3b3e1fb1ced58fb73240ff0002001

SHA1
7a46dc1e3d70ed18b8b1b05d14192290b809098b

SHA256
a352b394f7223c3fea6051f772ac844bc761ce4531269f53e6b61d43061bfafa

SHA512
2b68489de5cadc822e1333f3e0987fc7c803bc42c00493bfeefa10a4421edb00da20c0ff5cc9f007b76929ebb4d529d56aed885cc4e920a0eaa3542749fe9566

Download Submit
C:\Config.Msi\e59e4a7.rbs

Filesize
15KB

MD5
4498d0ddd5da18a51454328284f89050

SHA1
e89c1bb5e18a697a3144a9e01067f3897285d17e

SHA256
eeb2380fdd4ea8b7e5ada4f2e8f556375d67972bdf0713554b60c56b38901e1d

SHA512
73eaf4b2d5fc4c4900e3bf2ef00235cf8086288f6a7e0dc6b39fa06eefac082dd3e27a055038b0de427d1cac48c7b9b3a1bd574ba4084473f2b149297b7aa10b

Download Submit
C:\Config.Msi\e59e4af.rbs

Filesize
21KB

MD5
78b667df1940173ec983f150db4c5f60

SHA1
63469651c76869f448145b7c91098d061736c53a

SHA256
ba1e36203dfa35183a4be88e51a4f9e25f821273ec98fa00049de63ba10eb048

SHA512
aa84a729e42bc18d7124d5bacf6f0c28ed43540aca89f09a5642db0bbec89006bf7e0594ea69e491c7b8eafb75df6b9ea2bd0d795214b1c3c1f01160821c375a

Download Submit
C:\Config.Msi\e59e4c0.rbs

Filesize
13KB

MD5
07e88d1fc5ee85ffe71cc3e03ff36746

SHA1
b2182771478119649a78469418f7f56717639871

SHA256
42f9e5ce94aa161936b3d3b0206273bd6cebdd2ca2895c957784c3203bcc733e

SHA512
d94aaca4b08fffc904f39bce62523699bc2655b15890c8ecd0caa5c62e3cd5001702f1235685c6fda09fa91ffdd4aee47c54413ef8d8c4aa8797ea1c11c18204

Download Submit
C:\Config.Msi\e59e4c5.rbs

Filesize
21KB

MD5
8165376ceb173e117fa1d5224ab8661b

SHA1
ab71c2110d383544d13c705d07f16b0a10875dce

SHA256
5402caa037cbda8ae359c80b2b4b5401c37cbba253ba2994315dc469bf0e599c

SHA512
4c0d10963d076905ef895660fe49c5151e2a453a6952b65b3548e1e763ed35137e301c894bf9785cdd6ce3b50e6f98b09aa81044a27d237c61357b807bcaf8df

Download Submit
C:\Config.Msi\e59e4d6.rbs

Filesize
20KB

MD5
3a52f25bae4af0d92f489d58f66579c5

SHA1
2148e4985b76f5716e5425f2fbb67ea0be7c8053

SHA256
40ac1c366ccbe9133758e3aa57091b8d2762218b2ea79973b93e184b3bf02b79

SHA512
dd6cb9e6e74fc2764f709c8c93a8309956e215d9b935928a30a5e3fd6c1e82c436b3da7a924884bdb9e21ed6fe9d6c8ccdf56a295e14654bc6c6987761453f13

Download Submit
C:\Config.Msi\e59e4e4.rbs

Filesize
20KB

MD5
f6a7d900ce752bd6127595d14da3f25b

SHA1
9724167b11996a5cb1644d66303a975c325e2e32

SHA256
77ef852dcb779e48c8ebbf8b3420897e580001bbbc3227915b97fd9547e1d511

SHA512
3fb833c7895c7845292b1dc7478ec351464e9c30b4acc85bbbfabf79b3b65f2b57e22ab414f3b29a1b25841b394a33135e7457a41c06475f6c7053b3ab53098a

Download Submit
C:\Config.Msi\e59e4f5.rbs

Filesize
16KB

MD5
7c82f1b31d80ae260b94925dd7073c3c

SHA1
80de919309f8414c0df1548f9623029ea0d2f5ae

SHA256
dc60c8e81275062339e2caad3ebbacafa1d0d74e9a28b7872b66fb2edb7acb0f

SHA512
00f07e007fffb5b11e42fbae6324f0bcfd9477c69cac2c9773f34b13c410bfac5afdd8215c6dcf50b1bc5e40663efc8a4061d830479e0a528738632b176a4989

Download Submit
C:\Config.Msi\e59e4fc.rbs

Filesize
132KB

MD5
1deb46ac7f53e35c9e61b9103820f311

SHA1
2cd7f58d3104de7f2108fcd2cd0165f8f89f01e5

SHA256
155145f667b5a84470a17a6338d96ff96298882dd2e3f5865815fe9f86b7e920

SHA512
1a3e2c1117e4bb537e96aa185b704719327cdcfaf38cf3cec6bf68e4f37b61f3ca1911a0f1157af3d182c0c372046658e6baaa50b0d65c48bbc1c188947b82b1

Download Submit
C:\Config.Msi\e59e619.rbs

Filesize
9KB

MD5
936f0d6cda1e27f5d8ff4e10536f9641

SHA1
6ecd5bf0d845a768ad65fd73bd2333022fd6ff80

SHA256
51fe2d05853b6cad3e28c9f0cfee0e7c523b815a2dbe4d3c3169148d8a083d0f

SHA512
2508494cecf94daf99658540b29668d7a153dcd6437d9cd5c2e904a9fb48aede01a2fc7c71ca46cd80a8387542194defda8715d29e9f2e6fc3a764879be9c267

Download Submit
C:\Config.Msi\e59e61e.rbs

Filesize
8KB

MD5
630b45f7f1f56a8562b25b33dea1f4e5

SHA1
2d415f96b0127aaf735ccd1dc0adcc236be1b252

SHA256
50c176b77feb78322e6325fb2dfe4013f747c39721835b489f9e19668f814410

SHA512
a4cf850038cbf067ef8ddf742534c6541211d5ff0c218718a43af202c7bcffc3ba1838c21f4941ef0fa964fd333a3aa89fd052dd9d75921b03913dc8a34ed1f2

Download Submit
C:\Config.Msi\e59e622.rbs

Filesize
102KB

MD5
a71d1113232eeb161459119311a21cdf

SHA1
b420e7c89179e4c73ae23a4971ed738bc42760d6

SHA256
b857499d4a8cd1b6df370befded6bebdc0ea4ae443b846df8e409f2c03bafe3a

SHA512
d21cdc72edbbe48e672fd1408ffb7a27611df033f26eff1355099e4b7b10d3670f0dcf120b7e2ae65c68582c87a7baa0edd90e004b71b071c9dd982ca2fc83b9

Download Submit
C:\Config.Msi\e59e705.rbs

Filesize
131KB

MD5
c39f803a2176a664a80c85c40dc25549

SHA1
ffaa045ba87c4d769e260d89990fcd6c846d25a9

SHA256
3529afb9676bff1ce05cbe0d983ef5db6ee5ceea14dfcdc259a18df98115a627

SHA512
51654fd8e7147a7f28e17a9ba092de16d5709c471229ceb81f6358b8f05e4797a3dd4e17979a5e0e072c828f4cd26d321477f6f56982304eb46fe2aaa800dda2

Download Submit
C:\Config.Msi\e59e822.rbs

Filesize
10KB

MD5
30748ce1480cbdac6c717f23f61711ab

SHA1
9c762fe4e0d88af80a51fa7046c2be454b99c7c6

SHA256
ad2d568fb833e425fb1347d83f047040e319eba3051371df1e53d294a0fd6bd2

SHA512
57109a0bc522227467201805d00279c9b3f43af8b773fbfa6505ab6306c35d8c832037d77832d2129a6fac69833ef27f6999514a8fb70cc995b00d8ab09f4f4c

Download Submit
C:\Config.Msi\e59e828.rbs

Filesize
9KB

MD5
7c141bad130cf475dfae284f3c595a79

SHA1
344d1e301f8eeccddd02edf6f6282959701e9871

SHA256
061febc3a9aacd2e4abf2eee0e8c0c2c664b0c79d49c4dc73c2d7f693ea6c510

SHA512
72afa7e94bbaaa208ec1a7d151196f899f8c16fd59a6d64b3ae9f55aaac6cafcab9d32ebc8743f9ff13ef42eb014e3c362724e2578e9a821ee1d187a2f56065c

Download Submit
C:\Config.Msi\e59e82c.rbs

Filesize
85KB

MD5
d5461b1c68faaccae184b52daf04d2a5

SHA1
7306818155f29bdbe1a1c7b3cd11711b156fdf4f

SHA256
39f48e6b47faa7ddd487877f1778d1c35074c811e36ec6be7aaca003a93b5d31

SHA512
1f5c9f3815bc9a46bf08586befa04d3c4f9c38b553ea40c69ccff9f3aa2b0e1412fb5db59c369b91390efc37d27fad3dcfc64b8067de0353b3d07f33b19df309

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4940fee4da9c983ee1349eb3853b6abd

SHA1
bbcdc7d60db92d9c9fffe6ec361eefdea236496f

SHA256
3a5ec002cb354303c66e50baee8cfa5d2698ae5b895943a3bb9744a4769a7032

SHA512
8cf79266a279aba5d811c9be5f643989921a70829837facb700c53cc0ff120aa7cf3b9b95a9c7487e433e02159e375f227eb3b844621738b1c158e49dd1f18ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
fae7e13e6a0298e07cc6eeba2dc360bc

SHA1
9f14fdd3abc8f89f795525e8466a7524b278b5fb

SHA256
304bbc9e173db1a53b7abbdaf18393d2a8013803cd5bde6e33c4eaba5b7c6285

SHA512
0180d3e2f5df8212247dc092d1cda32bd765ef77cf2d53343be3c79a07d3df781b00b3765198b68a82a0392618d4982f41894e5f16a4e0742ed81af418bb8cfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e61182a039ffa5e2842e09e16c99a15a

SHA1
e64e4b9d7b38fbd29da6acd4c951d1a4f04e580a

SHA256
947ac7fc68852e1b14d477582b0e22da8054e6ced3123699960692425ff1b9b7

SHA512
a9f881a6537bb0d4c71c1dba3b5c9bdce922a6754a65413c89c0d7bbf44dcb6bebbb381f8b360d03d9480792d102972d22a6f62529cfa555e879d2e259cca594

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
1281ada486e24f2a20ee588f64198a29

SHA1
17ffbed26cf99de5969851c2c4802f0ae8479a54

SHA256
bfee87771e6df49791d633fe72223ebf7694c26c80905c264a8193c422b41ec3

SHA512
790440b027f7f0979e7e09256bd5cad3615c407afd21705bbde8786a6644bce8c9cb9fdd392d4d06b2c966d01f77d50ab923647bcd11b96bf0dabc2580951749

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
bb663b76d2218d72615bb2655f6bf48b

SHA1
9fe539f218a6a93419d12d543789e7118312cf71

SHA256
6e5c1bc832469982330c8decef21580bc1c049c8c43a3400cf8c273d5051c090

SHA512
a27f7304992bc757728088b6f8d1637dad64e2c6830412c497e1f4e766aad408066d29c1114cde6e65f293dfe3d5a5c1998418023ed2e1515fc2b3c488678da5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
75fde28c6cb3ef54aacc06be539ed79d

SHA1
02ad227ae984af7c074ead6e955e64a78951a406

SHA256
956650a7d7a264979f5e1c5f1336de4ea07a00e63520a50a3eaf5f182830e725

SHA512
6a6f659f07acc15a3846a2620c204bf742d3fdd9c9fa3ae73a48af6d7d61b2e27030f05830b100346682b4231803a91e30f775237abbaacf06a86f488ba07c63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO474D95F1\vkZoFBE0Nk6lkh2.exe

Filesize
906.0MB

MD5
e822b76c86ee3e9305be43cf984bfcd7

SHA1
2fa171f184b0445a36a6c4f9abe347e1080fb81f

SHA256
8ec00181b69ca49ad97abcec20add832d0ba27efb4e17b8b83bd5f221a1dd1b0

SHA512
d5b81846e379803944530bf7e7cd7f9f494ebb2448d09edf0c00d6e6d74359d7c38f44f1c4a73c3a17901b5644a86a7235f873489975082e98cf02f2bd9b6097

Download Submit
C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll

Filesize
126KB

MD5
d7bf29763354eda154aad637017b5483

SHA1
dfa7d296bfeecde738ef4708aaabfebec6bc1e48

SHA256
7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93

SHA512
1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\thm.xml

Filesize
5KB

MD5
0056f10a42638ea8b4befc614741ddd6

SHA1
61d488cfbea063e028a947cb1610ee372d873c9f

SHA256
6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87

SHA512
5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e

Download Submit
C:\Users\Admin\Downloads\Sipariş Özellikleri pdf.tgz

Filesize
1.5MB

MD5
5883534be4593a80889f2f4730caccce

SHA1
7fb9efab0a189d9b1847e90413cbd62b57271cdc

SHA256
b78d738520d11ad149122ee20b6388d37b0bbf28a751d218dce50b64bdaf97ff

SHA512
dc23443f9a8cd3f6462811dfca07db3162479fdf76ddbb6b4f3ca52db03ec83fd7605e6948a2e52431b506138a7e97680e1a54d0eea9861ec3825f1aab3d54d3

Download Submit
C:\Users\Admin\Downloads\Sipariş Özellikleri pdf\Sipariş Özellikleri pdf.tar

Filesize
906.0MB

MD5
cdcdfe7aee40f749f26261fbeebc6b71

SHA1
6f1b7289ca0f2b3224b67be22829feca8634dfc5

SHA256
89c4d650b0c839779d3a1da99c8dc574708d57d8a50920441712b32f53dee144

SHA512
35fc63addd4c7ccc7606fd9ec7e7350f7f03e04e65b8eceeb35e53c1f196f6e6049daa6cecc4ad7ec10271c906e0c1cafe44b4a56243575601af7b0e39b36811

Download Submit
C:\Windows\Installer\MSI8662.tmp

Filesize
93KB

MD5
186694813c3d5e33202a1a72c5079cc3

SHA1
90a9c2bf6419be6f46999e137c2149feca62cd13

SHA256
fb13d67c05d0e3c693701d782a55bc002ab62e972e4f018bd6b1717493bf1ae2

SHA512
57bf8ef4bdc08bcd7a83f82d14556710a2ef0cc7ef63366c48b144002a5f70cd58a130011cce648dcb3e9f62eafd6b188aa908b3b8f324448fb38567e499383b

Download Submit
C:\Windows\Installer\MSIA7A1.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIE2C5.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE2C5.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE381.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE381.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE416.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE416.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE41F.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE41F.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE41F.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE48D.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE48D.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE50B.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE50B.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE52B.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE52B.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE5B9.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE5B9.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE5E9.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE5E9.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE687.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE687.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE6A7.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE6A7.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE7B2.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE7B2.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE7B2.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE811.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE811.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE90C.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE90C.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE91C.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE91C.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIE986.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIE986.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIEA17.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIEA17.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIEA57.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIEA57.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIEAC6.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIEAC6.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIEB92.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIEB92.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIEE1A.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIEE1A.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIEE4A.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIEE4A.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIEE7A.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIEE7A.tmp

Filesize
97KB

MD5
d36a56e88a78b4d3c7ee1f4f804e17d6

SHA1
a520426523be085ec67291241f4219ab13f4d4b8

SHA256
8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5

SHA512
def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca

Download Submit
C:\Windows\Installer\MSIF075.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIF075.tmp

Filesize
87KB

MD5
46790e2748ddb98e3d6115a5f0360ed7

SHA1
d041d6aa45a7fd2433b46560377559e04b92f7b6

SHA256
76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e

SHA512
c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f

Download Submit
C:\Windows\Installer\MSIF7CD.tmp

Filesize
80KB

MD5
393da89078925f78e19445882c37fc59

SHA1
1313f4e6c62670f1b10aaec77c105be275f50121

SHA256
bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4

SHA512
aea5690cc1e6decedfb963c728b880ddcccc3d15b190943a890c38d41057d3511afff2e6298c6042ad2d862abb13e95992406511356bc58bad82754954f321c0

Download Submit
C:\Windows\Temp\{0F3A2E3F-0CC8-4288-B7DD-ECF97115B63A}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{1E6CDD37-F38B-4158-9A46-C9A584CF895C}\.ba\1033\thm.wxl

Filesize
5KB

MD5
d5070cb3387a0a22b7046ae5ab53f371

SHA1
bc9da146a42bbf9496de059ac576869004702a97

SHA256
81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a

SHA512
8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3

Download Submit
C:\Windows\Temp\{1E6CDD37-F38B-4158-9A46-C9A584CF895C}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{5BCC8E08-282C-4E2E-8724-5048BC9E53F7}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
c421951267eec76155779a399b7d98c1

SHA1
4e454bd95e615c86f050a027dc1b7f6abb85c8f4

SHA256
2269dbc5e01b14d07de0f2f4588abd3becb861bf5174091d54681b384ee6c2d9

SHA512
aef28ba124fdd33e1c6e2d5e8cdbb1e5219b597eb0554e392f33fb5f7bfe0bfa312d1f287667a0deeb79fedd1ab94128aca7d92662ce9551fe6a90c46f655406

Download Submit
\??\Volume{3b6c865c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c8a85c2e-28f4-45f4-8884-2581b6e5f1f6}_OnDiskSnapshotProp

Filesize
6KB

MD5
ea7ffd3ca7ca8ff6258869bf2fd72675

SHA1
58e2020125da350b124d28d744f7523eb39bb1bd

SHA256
9c888a7e3c2279e80870c3356848fcdc1c658073f3d251e0c1fba0a6d7370092

SHA512
aea830a35839d9d6d17bfd2cba30e00131d8e08983631a968159ce6c9419c31151d48beefc9b9e2cb87e768980fd56be2891a73b4c3ad9cfe65086a36bbc249d

Download Submit
\??\pipe\crashpad_1312_WPQBIOQQWJEFJVVP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/184-1092-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/184-1094-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/184-1093-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/2132-1113-0x0000000005130000-0x0000000005196000-memory.dmp

Filesize
408KB

Download
memory/2132-1112-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/2132-1111-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/2132-1107-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2132-1114-0x0000000005DB0000-0x0000000005E00000-memory.dmp

Filesize
320KB

Download
memory/2132-1115-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/2132-1116-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/2876-1110-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/2876-1109-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/2876-1106-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/2876-1105-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/2876-1104-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/4964-1081-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/4964-1091-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/4964-1090-0x000000000F640000-0x000000000F6DC000-memory.dmp

Filesize
624KB

Download
memory/4964-1089-0x000000000BFB0000-0x000000000C02C000-memory.dmp

Filesize
496KB

Download
memory/4964-1088-0x000000000BC70000-0x000000000BC7A000-memory.dmp

Filesize
40KB

Download
memory/4964-1087-0x0000000005610000-0x0000000005616000-memory.dmp

Filesize
24KB

Download
memory/4964-1086-0x00000000055B0000-0x00000000055C8000-memory.dmp

Filesize
96KB

Download
memory/4964-1085-0x00000000050E0000-0x00000000050EA000-memory.dmp

Filesize
40KB

Download
memory/4964-1084-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/4964-1083-0x0000000005110000-0x00000000051A2000-memory.dmp

Filesize
584KB

Download
memory/4964-1082-0x0000000005620000-0x0000000005BC4000-memory.dmp

Filesize
5.6MB

Download
memory/4964-1080-0x0000000000620000-0x00000000006D0000-memory.dmp

Filesize
704KB

Download