141ff9af883a01e924a49bc4a21e2f05cfacebb5980880b4a53d7cb332986601

Analysis

max time kernel
97s
max time network
162s
platform
windows10-1703_x64
resource
win10-20240214-en
resource tags

arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
submitted
21-02-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Grand-Theft-Auto-V-Windows-1-68-en.exe
Size

98.4MB
MD5

85e308c6c7ec934b8613b8ce3c55760f
SHA1

49aba69e8cda016c85f16c89b3f86edaf7583c11
SHA256

141ff9af883a01e924a49bc4a21e2f05cfacebb5980880b4a53d7cb332986601
SHA512

8754cf7674994dd93b80dbe71d96de0c43761155edab24d7557070cdf5e9e24a095137abd2db77d21842ae8eb92bb9824cd88dd99f69c8395355dbe1ea4488de
SSDEEP

3145728:89+Mv0uqW7MpxW/0WnFJ60Vy+dKDe0/evXsnCxs:89FvqWV/0W5UbDe02Ef

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
3580	vc_redist.x86.exe
3348	vc_redist.x86.exe
4216	VC_redist.x86.exe
5920	vc_redist.x64.exe
5968	vc_redist.x64.exe
2480	VC_redist.x64.exe

Loads dropped DLL 3 IoCs

pid	Process
3348	vc_redist.x86.exe
5428	VC_redist.x86.exe
5968	vc_redist.x64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{410c0ee1-00bb-41b6-9772-e12c2828b02f} = "\"C:\\ProgramData\\Package Cache\\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8bdfe669-9705-4184-9368-db9ce581e0e7} = "\"C:\\ProgramData\\Package Cache\\{8bdfe669-9705-4184-9368-db9ce581e0e7}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe

Drops file in Program Files directory 52 IoCs

description	ioc	Process
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-synch-l1-2-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\ucrtbase.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-interlocked-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-process-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-time-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\RockstarService.exe	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-file-l1-2-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-profile-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-string-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-heap-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-math-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-heap-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-memory-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-processenvironment-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-conio-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-stdio-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-datetime-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-filesystem-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-string-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-utility-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\offline.pak	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-libraryloader-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\libovr.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\ThirdParty\Steam\steam_api64.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-console-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-localization-l1-2-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-timezone-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\RockstarSteamHelper.exe	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-sysinfo-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-locale-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-namedpipe-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-runtime-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\Launcher.exe	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-file-l2-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-util-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-handle-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-rtlsupport-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-debug-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-processthreads-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-convert-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-private-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\uninstall.exe	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-errorhandling-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-file-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-processthreads-l1-1-1.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-environment-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-crt-multibyte-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\Launcher.rpf	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe	Grand-Theft-Auto-V-Windows-1-68-en.exe
File created	C:\Program Files\Rockstar Games\Launcher\api-ms-win-core-synch-l1-1-0.dll	Grand-Theft-Auto-V-Windows-1-68-en.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIFEFE.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ca32.msi	msiexec.exe
File created	C:\Windows\Installer\e58ca21.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{73F77E4E-5A17-46E5-A5FC-8A061047725F}	msiexec.exe
File created	C:\Windows\Installer\e58ca33.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ca33.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C2C59CAB-8766-4ABD-A8EF-1151A36C41E5}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI349.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ca48.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e58ca49.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ca49.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ca21.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents\{410c0ee1-00bb-41b6-9772-e12c2828b02f}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\ProductName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.36,bundle\Version = "14.36.32532.0"	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.36,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Version = "14.36.32532"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{73F77E4E-5A17-46E5-A5FC-8A061047725F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{73F77E4E-5A17-46E5-A5FC-8A061047725F}v14.36.32532\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.36,bundle\Dependents\{410c0ee1-00bb-41b6-9772-e12c2828b02f}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Version = "14.36.32532"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\679E80FBE29B63345BF612177149674C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BAC95C2C6678DBA48AFE11153AC6145E\VC_Runtime_Additional	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-455411700-4159991363-783884305-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.36,bundle\Dependents	VC_redist.x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\ = "{8bdfe669-9705-4184-9368-db9ce581e0e7}"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\Version = "237272852"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.36,bundle\ = "{410c0ee1-00bb-41b6-9772-e12c2828b02f}"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\PackageCode = "1670FAE368D173749B9C4C5C64DAEC3D"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\ = "{C2C59CAB-8766-4ABD-A8EF-1151A36C41E5}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\PackageCode = "66BA6B50A49EFFA418122BDB80C144B2"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\Version = "237272852"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BAC95C2C6678DBA48AFE11153AC6145E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\BAC95C2C6678DBA48AFE11153AC6145E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.36,bundle\Dependents	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.36,bundle	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4E77F3771A55E645ACFA860017427F5\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1\E4E77F3771A55E645ACFA860017427F5	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4E77F3771A55E645ACFA860017427F5\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4E77F3771A55E645ACFA860017427F5\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BAC95C2C6678DBA48AFE11153AC6145E\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
5356	msiexec.exe
5356	msiexec.exe
5356	msiexec.exe
5356	msiexec.exe
5356	msiexec.exe
5356	msiexec.exe
5356	msiexec.exe
5356	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	firefox.exe
Token: SeDebugPrivilege	2276	firefox.exe
Token: SeBackupPrivilege	932	vssvc.exe
Token: SeRestorePrivilege	932	vssvc.exe
Token: SeAuditPrivilege	932	vssvc.exe
Token: SeShutdownPrivilege	4216	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	4216	VC_redist.x86.exe
Token: SeSecurityPrivilege	5356	msiexec.exe
Token: SeCreateTokenPrivilege	4216	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	4216	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	4216	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	4216	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	4216	VC_redist.x86.exe
Token: SeTcbPrivilege	4216	VC_redist.x86.exe
Token: SeSecurityPrivilege	4216	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	4216	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	4216	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	4216	VC_redist.x86.exe
Token: SeSystemtimePrivilege	4216	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	4216	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	4216	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	4216	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	4216	VC_redist.x86.exe
Token: SeBackupPrivilege	4216	VC_redist.x86.exe
Token: SeRestorePrivilege	4216	VC_redist.x86.exe
Token: SeShutdownPrivilege	4216	VC_redist.x86.exe
Token: SeDebugPrivilege	4216	VC_redist.x86.exe
Token: SeAuditPrivilege	4216	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	4216	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	4216	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	4216	VC_redist.x86.exe
Token: SeUndockPrivilege	4216	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	4216	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	4216	VC_redist.x86.exe
Token: SeManageVolumePrivilege	4216	VC_redist.x86.exe
Token: SeImpersonatePrivilege	4216	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	4216	VC_redist.x86.exe
Token: SeRestorePrivilege	5356	msiexec.exe
Token: SeTakeOwnershipPrivilege	5356	msiexec.exe
Token: SeBackupPrivilege	5240	srtasks.exe
Token: SeRestorePrivilege	5240	srtasks.exe
Token: SeSecurityPrivilege	5240	srtasks.exe
Token: SeTakeOwnershipPrivilege	5240	srtasks.exe
Token: SeBackupPrivilege	5240	srtasks.exe
Token: SeRestorePrivilege	5240	srtasks.exe
Token: SeSecurityPrivilege	5240	srtasks.exe
Token: SeTakeOwnershipPrivilege	5240	srtasks.exe
Token: SeRestorePrivilege	5356	msiexec.exe
Token: SeTakeOwnershipPrivilege	5356	msiexec.exe
Token: SeRestorePrivilege	5356	msiexec.exe
Token: SeTakeOwnershipPrivilege	5356	msiexec.exe
Token: SeRestorePrivilege	5356	msiexec.exe
Token: SeTakeOwnershipPrivilege	5356	msiexec.exe
Token: SeRestorePrivilege	5356	msiexec.exe
Token: SeTakeOwnershipPrivilege	5356	msiexec.exe
Token: SeRestorePrivilege	5356	msiexec.exe
Token: SeTakeOwnershipPrivilege	5356	msiexec.exe
Token: SeRestorePrivilege	5356	msiexec.exe
Token: SeTakeOwnershipPrivilege	5356	msiexec.exe
Token: SeRestorePrivilege	5356	msiexec.exe
Token: SeTakeOwnershipPrivilege	5356	msiexec.exe
Token: SeRestorePrivilege	5356	msiexec.exe
Token: SeTakeOwnershipPrivilege	5356	msiexec.exe
Token: SeRestorePrivilege	5356	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe
3136	Grand-Theft-Auto-V-Windows-1-68-en.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2276	firefox.exe
2276	firefox.exe
2276	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2276	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 3580	3136	Grand-Theft-Auto-V-Windows-1-68-en.exe	72
PID 3136 wrote to memory of 3580	3136	Grand-Theft-Auto-V-Windows-1-68-en.exe	72
PID 3136 wrote to memory of 3580	3136	Grand-Theft-Auto-V-Windows-1-68-en.exe	72
PID 3580 wrote to memory of 3348	3580	vc_redist.x86.exe	74
PID 3580 wrote to memory of 3348	3580	vc_redist.x86.exe	74
PID 3580 wrote to memory of 3348	3580	vc_redist.x86.exe	74
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 1552 wrote to memory of 2276	1552	firefox.exe	76
PID 2276 wrote to memory of 4852	2276	firefox.exe	77
PID 2276 wrote to memory of 4852	2276	firefox.exe	77
PID 3348 wrote to memory of 4216	3348	vc_redist.x86.exe	78
PID 3348 wrote to memory of 4216	3348	vc_redist.x86.exe	78
PID 3348 wrote to memory of 4216	3348	vc_redist.x86.exe	78
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79
PID 2276 wrote to memory of 4244	2276	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Grand-Theft-Auto-V-Windows-1-68-en.exe
"C:\Users\Admin\AppData\Local\Temp\Grand-Theft-Auto-V-Windows-1-68-en.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe
  "C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe" /install /norestart /quiet
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\Temp\{94B2814C-30CF-453A-855F-4A3AD99187A1}\.cr\vc_redist.x86.exe
    "C:\Windows\Temp\{94B2814C-30CF-453A-855F-4A3AD99187A1}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe" -burn.filehandle.attached=512 -burn.filehandle.self=592 /install /norestart /quiet
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Windows\Temp\{1A1B6E2C-DD4B-42A8-A625-BDC29A50EC70}\.be\VC_redist.x86.exe
      "C:\Windows\Temp\{1A1B6E2C-DD4B-42A8-A625-BDC29A50EC70}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{FCC1C18E-A4D9-470F-9DD9-D9EDD771F128} {3ED70D7E-C1F1-48A6-A72F-56162AC3BA18} 3348
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:4216
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={410c0ee1-00bb-41b6-9772-e12c2828b02f} -burn.filehandle.self=1064 -burn.embedded BurnPipe.{7D79793E-BA70-409B-82C8-DC8A1AA36406} {4B10B3A8-A529-4E40-97DD-FE2DABC7BDC7} 4216
        5⤵
        
        PID:5200
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532 -uninstall -quiet -burn.related.upgrade -burn.ancestors={410c0ee1-00bb-41b6-9772-e12c2828b02f} -burn.filehandle.self=1064 -burn.embedded BurnPipe.{7D79793E-BA70-409B-82C8-DC8A1AA36406} {4B10B3A8-A529-4E40-97DD-FE2DABC7BDC7} 4216
        6⤵
        Loads dropped DLL
        
        PID:5428
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{06E33434-AEA3-465E-A303-CFDF6EADF66C} {194FC42E-9617-4F19-9B1B-F830C3169F28} 5428
        7⤵
        Modifies registry class
        
        PID:5692
- C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe
  "C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe" /install /norestart /quiet
  2⤵
  - Executes dropped EXE
  PID:5920
- - C:\Windows\Temp\{26697E26-8591-4BBD-88BE-69F5AF753F6C}\.cr\vc_redist.x64.exe
    "C:\Windows\Temp\{26697E26-8591-4BBD-88BE-69F5AF753F6C}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532 /install /norestart /quiet
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5968
  - - C:\Windows\Temp\{1CFB37C0-D929-4F68-8BB5-E9F1F4DEEE59}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{1CFB37C0-D929-4F68-8BB5-E9F1F4DEEE59}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B5BB4597-AB1F-48D1-BC82-31E727FFD37E} {B1ED2554-8935-402E-A005-264533F9CAF9} 5968
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      PID:2480
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1000 -burn.embedded BurnPipe.{DA1AF58C-401C-480D-A95C-D3E800E9A20B} {80E237DA-45A4-4ACC-A423-A17AD0205A4F} 2480
        5⤵
        
        PID:5160
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={8bdfe669-9705-4184-9368-db9ce581e0e7} -burn.filehandle.self=1000 -burn.embedded BurnPipe.{DA1AF58C-401C-480D-A95C-D3E800E9A20B} {80E237DA-45A4-4ACC-A423-A17AD0205A4F} 2480
        6⤵
        
        PID:3584
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{3FEE609C-10B4-4CE8-8527-C005513FD584} {3EBB8413-6E0E-491C-BA55-7A974D1AF6B4} 3584
        7⤵
        
        PID:4308
- C:\Program Files\Rockstar Games\Launcher\RockstarService.exe
  "C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" stop
  2⤵
  PID:2112
- C:\Program Files\Rockstar Games\Launcher\RockstarService.exe
  "C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" uninstall
  2⤵
  PID:5788
- C:\Program Files\Rockstar Games\Launcher\RockstarService.exe
  "C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" install
  2⤵
  PID:4872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2276.0.1310080664\257984980" -parentBuildID 20221007134813 -prefsHandle 1620 -prefMapHandle 1608 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7e067a0-38a1-4296-9584-0799475e9e90} 2276 "\\.\pipe\gecko-crash-server-pipe.2276" 1752 211cf809658 gpu
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2276.1.1862781944\2038332454" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fd06252-ff6d-4375-9e2f-bd1c4bd42b99} 2276 "\\.\pipe\gecko-crash-server-pipe.2276" 2120 211ce3e3558 socket
    3⤵
    - Checks processor information in registry
    PID:4244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2276.2.1460362883\2125995570" -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 2840 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {29c44976-9536-4875-bd9a-0989eb8f3c6b} 2276 "\\.\pipe\gecko-crash-server-pipe.2276" 2964 211d2571558 tab
    3⤵
    PID:3628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2276.3.417747640\1786301027" -childID 2 -isForBrowser -prefsHandle 3184 -prefMapHandle 3148 -prefsLen 26044 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {65cfb70b-32e2-41f1-97fe-b76c405ba159} 2276 "\\.\pipe\gecko-crash-server-pipe.2276" 1068 211c3567e58 tab
    3⤵
    PID:68
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2276.4.723256841\2050475955" -childID 3 -isForBrowser -prefsHandle 4224 -prefMapHandle 4156 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05d0b2b5-5780-4c6f-8295-7a61f2f58378} 2276 "\\.\pipe\gecko-crash-server-pipe.2276" 4236 211c356ab58 tab
    3⤵
    PID:1032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2276.7.947039734\574799258" -childID 6 -isForBrowser -prefsHandle 5044 -prefMapHandle 5048 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b0dadd2-69c0-4961-9e76-521f835a3e34} 2276 "\\.\pipe\gecko-crash-server-pipe.2276" 5036 211d489bd58 tab
    3⤵
    PID:4536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2276.6.1989617151\921940960" -childID 5 -isForBrowser -prefsHandle 4856 -prefMapHandle 4860 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e2c09d3-9d0c-4b11-a8f7-809bf73bd032} 2276 "\\.\pipe\gecko-crash-server-pipe.2276" 4852 211d489c058 tab
    3⤵
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2276.5.661003669\230721962" -childID 4 -isForBrowser -prefsHandle 4680 -prefMapHandle 4696 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 996 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5fd6d5d-9d4e-4a97-aefb-ce715d6dec16} 2276 "\\.\pipe\gecko-crash-server-pipe.2276" 4720 211d489d558 tab
    3⤵
    PID:4676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5072

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5240

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4628

C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe
"C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe"
1⤵
PID:5952
- C:\Program Files\Rockstar Games\Launcher\Launcher.exe
  "C:\Program Files\Rockstar Games\Launcher\Launcher.exe"
  2⤵
  PID:5960
- - C:\Program Files\Rockstar Games\Launcher\RockstarService.exe
    "C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" start
    3⤵
    PID:928

C:\Program Files\Rockstar Games\Launcher\RockstarService.exe
"C:\Program Files\Rockstar Games\Launcher\RockstarService.exe"
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58ca26.rbs

Filesize
14KB

MD5
48c8c366de0f9bcd30c5fa7ee1419cc7

SHA1
478fe3bdfaf73f939a33896d09f0333069d469cb

SHA256
40ad9be576a7570da6fafb34892e564dbdaae8d12c23fb319256d12fe6020989

SHA512
639172f9ab6f082b1772370c24ce14bc8a15234d49881601280c369f4a896faa72b1ab073a2178c3ac25bd2451a1ed2a3be3925c11f65579f9b13e3e82a2a6a9

Download Submit
C:\Config.Msi\e58ca2b.rbs

Filesize
16KB

MD5
352402740ce0e9271ec6e78481c4010e

SHA1
b803cf70a74d25bc307684ee34f6e940b3921c95

SHA256
dcd375d5c8febb20a02075fb1cd322e72507d55e5c556c8b3707ec6c424ff855

SHA512
20f466704042b2d013bc5bf975ef842080638a46f1ac6116e6f240201891beefab33ac7ef0afdc07b9a78e3f418dca7faffc9f2f23fe4b0630603022cc51f60b

Download Submit
C:\Config.Msi\e58ca38.rbs

Filesize
18KB

MD5
b6785e91f3c89b17a0dce1e08fa74342

SHA1
156c8971d2d0791c052f1d276aabe357e9fd27b5

SHA256
43e58006ba6a65b1d370c413e85a72b884bfc8eb0bfe0aaa7c25a41d68409a66

SHA512
6ab64a15414e3ccf3b077288880871a109d03126a3108ac3f76830d53305fa07b2fe1d3615c57d110f592ed33b97a0c0b849972a5df6b2f74a48f797efa1304e

Download Submit
C:\Config.Msi\e58ca47.rbs

Filesize
16KB

MD5
92770ef1cd8211bc42f2ba2426ff7c19

SHA1
3072690ec4e7c0ab237f920221d3f39cf1aafcb4

SHA256
0a47f20688944f5dfc9eba9a42fdce817e7cb5f8c0362caa028d074b1c9503e8

SHA512
810f68e5705a4f0c00fc819caf08b4d85273cd31b690d6dfe88f75b35345e191c78d1ac320f5b524dbdd468f87e6d1126e17639f8c617c7c7b9c2aa4b0e8bdc4

Download Submit
C:\Config.Msi\e58ca4e.rbs

Filesize
17KB

MD5
6bcf27f430797e83e5293292f473c701

SHA1
96b05081662eaae38d49051039149f8437d671b5

SHA256
0f9c11a65487162e5453ec625a856006aab1b053d4517aa762c82724a1a97ac4

SHA512
1e36602cdc4139d77f36797467476fe1c1b4f05d7772f4f5d0b38358b6885bc80da4c7ff6016fbd270bb8ebc8946de844e9dbb7b315b9810db02bb10c852bc1c

Download Submit
C:\Config.Msi\e58ca5a.rbs

Filesize
16KB

MD5
0c8103648c8a21deca01b7d2b48f72ac

SHA1
c61233a7785e678e209c4525627e648bf8786fbf

SHA256
e1d49debf8dd293f345a0d4fb088ae2d0cf1ad619346861c0bb2d9c818be877a

SHA512
250aba99043a2373663280bd3548a1dede70e875d3d8a6f3c703b15bb953f549c788559ea0fffe0f0fd1a67485f9c0dd90ecaec23914dd596b194c4b3769af36

Download Submit
C:\Config.Msi\e58ca61.rbs

Filesize
19KB

MD5
a3f2cedabadc7b6fe229809dd50bb691

SHA1
ecc0140fb67bf12d4335da0b5d975916470c9bc6

SHA256
9b9c29fbbd66afc9bed0b52438a9de1a236ccd7f9668a2120583bf58432908f4

SHA512
cf624f90a2c7bda146af72d166ddf5f34af26eb1060a9fa899a715b846bafcfb6aa57bcad84b43299e12d8bfa7646e0fe16e93bd4ba74083547077b6e3c51974

Download Submit
C:\Config.Msi\e58ca70.rbs

Filesize
18KB

MD5
a4946520a37195fa597f2429e6932e6f

SHA1
fff52d928ef2e02f99a49374695203a46c593c2d

SHA256
716f7712f9297b868d8bba04b1194d8c570f1ca76cfea99204609de81ab1655e

SHA512
3ddfd3130c13b5f3f8462fe100c5860fa25284c00dd93fdeb766266ed39d495a9536ab7c8dc84e4986232d6f67efefdf69d60d84ac6e7ab88c6a967266cd3344

Download Submit
C:\Program Files\Rockstar Games\Launcher\Launcher.exe

Filesize
11.7MB

MD5
4a320e6ed86ed381a6ed63d361ea6fdc

SHA1
fc60b7882584387dfa8353505f6ff1237fd7024c

SHA256
5e25201c4c7ee750d051819d3ce0e5f684aea33d91f254545193b15e6d3198f6

SHA512
1d0f1dde9844e54c79dc27526c49bddaaaeed07f9b80b0ae97bb6bd59d0d9cba4a0ec29ab3ab432f10c51e7441df1017cba18e09b2224230bf5f6fa510a29bf0

Download Submit
C:\Program Files\Rockstar Games\Launcher\Launcher.exe

Filesize
7.9MB

MD5
effed4b7a87614477f04448cce6caeea

SHA1
dd4008e382f202b455279cf837782110e395d628

SHA256
7f3bb3799e456d1e13a430bc0a4e9723a0bf7900bf8f638cac9f34c22b01190e

SHA512
54a66608bff95597fc6937a0ff586d02f18ad199cb514ed3e72fa6626985a41e6ab6aebd065bb9743c4df1ea81071d94313cde6737592b55050a4b9dfd0ee0bc

Download Submit
C:\Program Files\Rockstar Games\Launcher\Launcher.rpf

Filesize
846KB

MD5
1257cfebb79a1deed4e624f7342e0ed3

SHA1
c7f41218da5d97ade62e883eee958e1b369e03fa

SHA256
4340a0d2c15e6dedd2b15ce079830d6c550d67fbb0882fc3930fc0d8350fb9ca

SHA512
4ec892402e44cd0e9d5850c5f86b0d9f82da5e55743d6ca99fc6fe97e1217c8a951699e61ddb74cdd97103c600e354b2eed99429b56ae9ffb686678d7c82cde9

Download Submit
C:\Program Files\Rockstar Games\Launcher\LauncherPatcher.exe

Filesize
962KB

MD5
c5c25c8c3d6bbfb713ff1954395b7c95

SHA1
f9a7299e25ad03b10723221141c2fb76aff9dd02

SHA256
b2901c4848da7d3534f68bfa732ab50e0e4438383b640f36d53abd603a653388

SHA512
594e3b6f6c6ce3e86d2cf6ab667d7c31b53688c0d4ba3b8d073ff3cf955787a8a8f20b950a194aa60344016c8df65718233da839385717a17b8fdee029389ece

Download Submit
C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe

Filesize
7.9MB

MD5
56e6ae81b80eac4868181dfd4fb19b66

SHA1
cf571e708c0178b7d07c7f74fb3efb7e0f6a8a10

SHA256
cb81139175396c3a82521a15f57f6ea31bb8f16a7fcb36fddb21d16cab4ae7a0

SHA512
04a2e50258f5f8ddd0d5b63edbf71c46c41a79383e7d2c07d9603b16efe784dd711ebd720aeada07eb4833ad7617f206e9333252f3deab0c87d8257d2b0a8eed

Download Submit
C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x64.exe

Filesize
6.7MB

MD5
c5f30dfda655d3c4f65954a47780b2c8

SHA1
1b9cbf9951c8e1de6936b434f3e9efcba82ba523

SHA256
b77f31e078c57ba1c571b6a7f2eefda2bae735e22acee63ea9dbeda551f8df95

SHA512
513cfb021e3e2f76a19a79ecca3676989d5d7705c95f7bd770cc673be057192567e8af1515982309ba266b2da2947a259f9d438912fdc3f0053ab814c0424b98

Download Submit
C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe

Filesize
5.6MB

MD5
619cc8b7c21702f6ce1fe33437ee5f01

SHA1
6d3e906a71201eec55160c7b656dc74568f10b83

SHA256
4d8979aaa1073e90aa8898c326cccd8251fd3176012e4c1beb8886b8447bc8f1

SHA512
9cd59c28e490c1a50ba993b45070d05a6caf3d690d8a739ccaa5538b50776e1005dcffe380a6dfa27424cc464154df62f0c5e8f8f259cb3eb61782cb0b711dd6

Download Submit
C:\Program Files\Rockstar Games\Launcher\Redistributables\VCRed\vc_redist.x86.exe

Filesize
6.2MB

MD5
a6f6d68e6f2c5ae2b79703c020cf64f2

SHA1
1e8049b20276cc67a88c5562c5bb7b07c1395632

SHA256
e111ed117de19439da95fac48e57ee2ca5b5bb1fd98b25c761e4a194e78f4953

SHA512
253b8d6cf16a89f0efccaf92586d99c9bbaa784a21e2fa7af09b492b2df1ae8ac6106745adef59aa6ec4897485005c1efd4324e99c7997e4ebd15937b56aecd9

Download Submit
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe

Filesize
1.8MB

MD5
dfdaaf36fd2a337acbe3ee54b27092f0

SHA1
6b5450f5dec29ada3705410833e42cbac11afd73

SHA256
4a65bdd0edc382010e6e12feefdeab6c01c3591c9fce605ee55238ef8d9f9a79

SHA512
8ebe8d1fc53bfeee3ec23f85dfb446462504a1efe510b3935dfe34fbd6e6a787b698b68fcb1d612a6eed9d0f5f549d0ae8084f9039a066e8e5145271e5a81d77

Download Submit
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe

Filesize
1.9MB

MD5
26f6af43723672f28db87d17a857ba17

SHA1
cb0aa8996b8e873afcb343460d620fd3189a4a8e

SHA256
a4d69ac6d3adf8ee72cc84685eee63705642a093e37c790f05b199df7905c27d

SHA512
91d89b2971eb740605b796b158357be0b520f3100f35bb02120d61dae8fbf640ad656846ac699baaf10c23c152c03054590ba86711d84960a579bec1db530485

Download Submit
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe

Filesize
3.4MB

MD5
58f963ed4b4ad5d749f2163cea1acb29

SHA1
87837e1ce2759589e4d71d11db85ee2391c6b53b

SHA256
59b36566b67f637ada136b79e9e817146a976cf881dbf1b1f4fee780512bc10a

SHA512
93779b6d676dc80e30e3a4638aa92a013c90ec098ff0fdc5e27c930a7b949541717328451cb7285d4bce79247d4457e315d8e876c6ea2064074fb2d73efec331

Download Submit
C:\Program Files\Rockstar Games\Launcher\RockstarService.exe

Filesize
4.3MB

MD5
94915f0acdd7f158e87f3d180d8456f2

SHA1
15b8c4d9d1380b753f8a9a9091a92e41b9f66514

SHA256
ef391896096b4d2843ae550b1e892e7b730d79e4c8c10b3d9913b046e20b3427

SHA512
8aa73eb6fa4c81d9d8dc0ed590c814092fe855c50c57f2add8a5fc5cfe909ee18d5f7d4aa9f5823242871a6d615d1a9627fb69cd02bbd2e53d8339fd71549e37

Download Submit
C:\ProgramData\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\state.rsm

Filesize
1KB

MD5
6b8b90d484fc3971d7c0cc004c506329

SHA1
1d422a24db747b1195ec8a08d56068653749c6ec

SHA256
d8ac6f7fd888311561e149cdd9a59e8424782f7f7f95faab66273bb336d05816

SHA512
c549b9ed2bbc3b7b20af7a10115b007c80edc9549c7ab1f80d5a77a5a7a81400f40f285e0cb72da02bcb821f44439d0824e0dde5cdc499b44ba899d3ffe003b2

Download Submit
C:\ProgramData\Rockstar Games\Launcher\service_log.txt

Filesize
1KB

MD5
e428233bd5cc13aeecd4f4a0bfa7a377

SHA1
58431bd40c06243f6f0844fb7dd8840da3c26b8e

SHA256
ca1752797deec470aa58fc492aa1174d3ba8b4748516315cdca3433a4934e486

SHA512
60384f17ba27b24d0b933ed0bb403132749b5c7ee8de0a7295df49b8c0dded01576f55cfbae028a17c50bdbb7a877e7d21f1f1e2149a9cd9d713adcd1ff9cf79

Download Submit
C:\ProgramData\Rockstar Games\Launcher\service_log.txt

Filesize
2KB

MD5
fe249342dff4e6a43163cb0420125e66

SHA1
5e88669ff97a1756e49638987c9f210d02df39f4

SHA256
f6750a31e5526b53d641528bdabf963918f156d7761761449137a18a267f8f4e

SHA512
d537b0d7af6d37730db3df43148c2b11621b93af8a929db5abfc3776c8bd81a1515bf777d2a7e760bfd66f4278f88874068ad5d36f0623800a67a6ef026e7d79

Download Submit
C:\ProgramData\Rockstar Games\Launcher\service_log.txt

Filesize
3KB

MD5
0edb795a0eb59d8798983e80baf09863

SHA1
a2860874f3cee5a3e27534662ec4b6786decc3a4

SHA256
a967d12c51f1d4248d03ac7b3b171cf309f1eca2909d5bccdf98727451c3fbe7

SHA512
33d6ebedefe0e12bee4c7cfb1237dc096deba5ff696943eb2354ed4faba04a6f9a93ee897f971eb5db0eb170d0de87142627d105cc1ae98c04173c806cea51b7

Download Submit
C:\ProgramData\Rockstar Games\Launcher\svc_events.json

Filesize
189B

MD5
321d535c9bbd9ac3d9d7f42ca7c9db95

SHA1
28ddf62aa00b94195a2a5669c3a6841d05f71fd3

SHA256
a8987a60c0b323a674504e99b39f255ce51eaefc47a1994fbbbd7cb98eb5761b

SHA512
2989d7807dbb38572eda2767934f6cb19e9013eca1f3b6514b556932dffa0d9fe5b9c733db34f62b31acdabb61dcc3756b78304c2d907fff355cdf88bc0ef3cc

Download Submit
C:\ProgramData\Rockstar Games\Launcher\svc_events.json

Filesize
349B

MD5
80b27683065d78f7b22a81ebff9285df

SHA1
4e81a55066b685beeeaad34dd77e25fd32ecd236

SHA256
cdb8cd964ec0533d844c081cb322e21707fd79682836cafc83e872c2744d896e

SHA512
9c2848681033790b2fdd594ef0be385aad5aec03af2d81bae14df7be71d323b2948724de1d3ec94dde17333b8eafc7619202ef0620ac9a6cfed1b59fad8a4d4d

Download Submit
C:\ProgramData\Rockstar Games\Launcher\svc_events.json

Filesize
421B

MD5
0eeeca5a9cc3fef3b55ddd9f0ccc523c

SHA1
45a5874cc99a1a780610d1830952d4fb1989a0ca

SHA256
eec76b6b4d138499513b5805733df60a045cc11d2410b2e531c9bdddc94c3c8a

SHA512
33da9868170be1af23f9b0730c4cf0a916de93cae07f612a8c373addd0358548dc7042718799029f01700359ee9be0b75e6f202b635d124ce66e2654ccd21d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240221004401_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
54f170c6ceb97556bdfbe01a7f44f746

SHA1
6d3963082d091fb6aa5f40b6f8b2d28a131c645d

SHA256
ffc2adb9408e955cdfb6ec21bc3215ed9892439fa8dcd4ad22fb1a609d3cd4d0

SHA512
66636868a7734b43ee6b70ac9d8c1977aa74ce4918b5212e4b43622cc57c062d6a660f3f4e12d5fbedb87e538203a105eb61d1fc1788440a061ff7cf896701b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240221004401_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
62e63633d23a9eb5bad03d461e89ab20

SHA1
538e33f9ef3506b105e4d558086db7509db6a452

SHA256
2442e7807758433ae2a540b611040ed97bde1212820c2b846feff8788f2ea6e4

SHA512
60f11f19a46f8cd51867ac8790dc8fedf36168a617fd1a0cdc4560715a6067ee72065f937a445867dec164e4a8f841d5ef7a9fe4a09dfccd0479fedaa375a26f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240221004319_000_vcRuntimeMinimum_x86.log

Filesize
2KB

MD5
e4f036e8b46768085cc13afbf9e77331

SHA1
46884af386b8fbde86532095148013bda57a7a53

SHA256
ab5c792899681db38fbb269655a09615bad63814264939af05e41ac60320450f

SHA512
58d3133d6903f394179eed73c4bd0cf94efb87fc670cd4f26f73a917fa570d94294196ad027cb6f7d24fcb962a12ace05d583a04146aa5b9d8a156e630ed806c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240221004319_001_vcRuntimeAdditional_x86.log

Filesize
12KB

MD5
35f98e387c6e96516a38c1c8c25b6a18

SHA1
1b6624d55f8ff1527b16dadf1c6ae78966a2eeb0

SHA256
37e7bc4054ebd8fb6a52c5bde177001c863f8291c860b982b76a200fc22df8a4

SHA512
c787f217864a05215f1b5ac7a825dc0a575247d3e77d52c2f7652ec3d06695ae6c4e55f875807a00d977cc7a62e2f87107b76e48fc9aa9419843d5a154d293fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hp78bw39.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
ecff9981a3333dd44b76000434169316

SHA1
f5e0f4eef7e3275aaf7430ab63a9a491a424b728

SHA256
ec776e66b7a2e761c1c16f9b72c6a85f097d8250e9f69a400733325cdc39b621

SHA512
818c2bebe6da99c580361afa494a4f823bf7bb1c18b104957ebe026c2f986fb80c07e58dada2cdb25f7103860b65a1bd095d4b6dbe74e08b54b1367c78948211

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hp78bw39.default-release\datareporting\glean\pending_pings\7e180558-2146-43e6-b309-ab981b35d27e

Filesize
734B

MD5
d88c833426e3fe9bc613df091d31d8fe

SHA1
df940a6c91c844a405da80c05e5031d14aab56f9

SHA256
06602d9f56720b89e279cf11d716086102b0063f71c206de225a4a31908849bf

SHA512
dca0a9193ddbfda226e4f08a3804b8ea1b3b2eb0b1ca40aca5369f6209d9e4b80adc601c2f461a84cde8256fbd438e19cd49186d9e06b4d5008a928ee7a77fc8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hp78bw39.default-release\prefs-1.js

Filesize
6KB

MD5
8291d8f93109f42df77a4347613a2caa

SHA1
ebd4140a1b7fd6db651b35544abd087660f55191

SHA256
e40d07afda95e0f7b794fb67efb547ac14fba29571b0bcb1dc8bbd9a4db96257

SHA512
0b099775d8546abb3fde7d254610e8ec817a0be7f451a73f3301f8329119c4f88fdc1afd7a6d9698bf174d21a9553e2b8c6981a695d8d84974748fcee5725b73

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hp78bw39.default-release\prefs-1.js

Filesize
6KB

MD5
b9832133828273bb0f68bf0faffbb11e

SHA1
9219b461e0c3cfb34d7c81827f117bd62e80ac58

SHA256
8d5ea78ee9270c8c708d9ba36e7d33bdf6a6ba98349ef548d73974cb85fe3ed6

SHA512
7e6e2f6d9f87a3e7501299be607707caeac495f61d1692dd642762298524643ac3244c8dd3c10e8f28465c933cf982598ee99cc79bf083e92997a66e04a4cfcf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hp78bw39.default-release\prefs.js

Filesize
6KB

MD5
25a297d3d478b34e701047a9eb06c849

SHA1
22bae4c84e3f88659d4435d22e7eb93cef2fe2d3

SHA256
c99eb56bed427e6d506c68196518f16adeb55e15575a8ef2bcbe0fcb77c31200

SHA512
f2e6099bcbb1fad141c2ff50784a74c7c79189c5111b767c008aff7402657d3e64cd9f88a9b838f81cb0f5fd7f540d94dc5fd424c1f6e866fac11da2afd1a6cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hp78bw39.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
40299abf1e468d624313eaba915e52a7

SHA1
7063b22d9f243c6dbacdbd95f7f213b4f681b872

SHA256
cfeb880e474f79437624e3a0613ad201c6aa66947f1aee060ef7b49713ab4ef5

SHA512
7c390bc32636878fd26886b4da4a66e470676ad805f1fa5d8f811e263561c43b044010b8d882b0e24ac1a98b873fb37fdb6984a5c5c52f39d6bad7a4c53bfbbf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hp78bw39.default-release\sessionstore.jsonlz4

Filesize
976B

MD5
a06dbc7fcfc7c4a69939da5ae51c2734

SHA1
01c58b68745d5b84f31de9f125ec7ba7050eb6bc

SHA256
f91d502f1251764cf216f351364694aba3aec7aa15826472d5b9cbc4612af96d

SHA512
d3a94b8ae45939dd8cb7df29f063b48076ebdf02ccd7d8a10d577c8bc81a86a162248d292df092438335c179f606ba9ba2472be1a430607535ca375c294d02b9

Download Submit
C:\Windows\Temp\{1A1B6E2C-DD4B-42A8-A625-BDC29A50EC70}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{1A1B6E2C-DD4B-42A8-A625-BDC29A50EC70}\cab54A5CABBE7274D8A22EB58060AAB7623

Filesize
576KB

MD5
36f33b73f3bb4fbf71605490362120c3

SHA1
5a29110770e39c3c52a47eda690480accf8450a7

SHA256
13c51145dd9a5e901663418f8b711ec4c0347e8250b6b13943c1f274f6e2c3cc

SHA512
384569f90fd4e4d0d0d8beefaa514080aba5d7c7193be57fb674aa0c3a7698620d466874dd2880e62fe53cad86d47fbe326317f87d719c094f438cfa3b6fa1e8

Download Submit
C:\Windows\Temp\{1A1B6E2C-DD4B-42A8-A625-BDC29A50EC70}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Filesize
448KB

MD5
e78af19cc623df2e31d2b2932197b2cd

SHA1
95bac63c83b8cc83ca1f6a2c841698318b9967bd

SHA256
57e94e9c0f158280f1417f77fe7d5af6447a0d02c72078fac4daf785c35b2870

SHA512
7f5082453e24d6b7a6e4890daae5fa91d0a9439d7477dc96193724b6ccd95c357945cb25595bf926df5ee8c67830216a6383ac4c4b76531c01c3032825811cdd

Download Submit
C:\Windows\Temp\{1A1B6E2C-DD4B-42A8-A625-BDC29A50EC70}\vcRuntimeAdditional_x86

Filesize
180KB

MD5
df1b1ee46deb824a89f18e228f8a4a41

SHA1
001d86480ce0a9e1b2fed8c48296bb3384dad793

SHA256
ff8884498c3174b7d2bd35bd1a43d75d3538dca2c0821ca5876fa45eb2c8a47f

SHA512
6587452fa6ebef2eac6634cd3c6d8629cdcd9f214a5a13cfbebfd232318a3a5d3cd5d3c9baa721270f5283d3127d36475d40071132ba063bdda49bc48cc21fab

Download Submit
C:\Windows\Temp\{1A1B6E2C-DD4B-42A8-A625-BDC29A50EC70}\vcRuntimeMinimum_x86

Filesize
180KB

MD5
7c87329a66d4c22f03acea4e817971f9

SHA1
12a2134fa09fd7df026ffc20bfe58a7d30d6ae73

SHA256
c78bc45113d0270c2154930761c3b74db714987a16c0fbe5e7a05fa3a853d0c8

SHA512
73f11aa3f9b3dbfba157a0d47dc61ff2a22509b61339882a9c2cee53ee335b18820700d7a413b81b426e71c83443f0d99bea8b3638b8b87ee9a42f01f404f955

Download Submit
C:\Windows\Temp\{1CFB37C0-D929-4F68-8BB5-E9F1F4DEEE59}\.ba\license.rtf

Filesize
9KB

MD5
04b33f0a9081c10e85d0e495a1294f83

SHA1
1efe2fb2d014a731b752672745f9ffecdd716412

SHA256
8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b

SHA512
d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685

Download Submit
C:\Windows\Temp\{1CFB37C0-D929-4F68-8BB5-E9F1F4DEEE59}\.ba\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Windows\Temp\{1CFB37C0-D929-4F68-8BB5-E9F1F4DEEE59}\.ba\thm.xml

Filesize
8KB

MD5
f62729c6d2540015e072514226c121c7

SHA1
c1e189d693f41ac2eafcc363f7890fc0fea6979c

SHA256
f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916

SHA512
cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471

Download Submit
C:\Windows\Temp\{1CFB37C0-D929-4F68-8BB5-E9F1F4DEEE59}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
1.9MB

MD5
50d3de1027ee41be7fdc39bf45dd7775

SHA1
8ffeba7e98ccdc339a2ac0fa6990c890badf8333

SHA256
98f411d9006aaf32c92f2518ed5a65c9976ceef949f11a44c82b1c55065c3858

SHA512
c687eb2528ff1631b30633953c25aef4a4953d22202b9c7c234ae3e5bb43e8b972ffabd2147ae610d1c5a42947f34e9eec7738fc4e4e5688c517546a92a1c874

Download Submit
C:\Windows\Temp\{1CFB37C0-D929-4F68-8BB5-E9F1F4DEEE59}\cab5046A8AB272BF37297BB7928664C9503

Filesize
935KB

MD5
c2df6cb9082ac285f6acfe56e3a4430a

SHA1
591e03bf436d448296798a4d80f6a39a00502595

SHA256
b8b4732a600b741e824ab749321e029a07390aa730ec59401964b38105d5fa11

SHA512
9f21b621fc871dd72de0c518174d1cbe41c8c93527269c3765b65edee870a8945ecc2700d49f5da8f6fab0aa3e4c2db422b505ffcbcb2c5a1ddf4b9cec0e8e13

Download Submit
C:\Windows\Temp\{1CFB37C0-D929-4F68-8BB5-E9F1F4DEEE59}\vcRuntimeAdditional_x64

Filesize
188KB

MD5
dd070483eda0af71a2e52b65867d7f5d

SHA1
2b182fc81d19ae8808e5b37d8e19c4dafeec8106

SHA256
1c450cacdbf38527c27eb2107a674cd9da30aaf93a36be3c5729293f6f586e07

SHA512
69e16ee172d923173e874b12037629201017698997e8ae7a6696aab1ad3222ae2359f90dea73a7487ca9ff6b7c01dc6c4c98b0153b6f1ada8b59d2cec029ec1a

Download Submit
C:\Windows\Temp\{1CFB37C0-D929-4F68-8BB5-E9F1F4DEEE59}\vcRuntimeMinimum_x64

Filesize
188KB

MD5
a4075b745d8e506c48581c4a99ec78aa

SHA1
389e8b1dbeebdff749834b63ae06644c30feac84

SHA256
ee130110a29393dcbc7be1f26106d68b629afd2544b91e6caf3a50069a979b93

SHA512
0b980f397972bfc55e30c06e6e98e07b474e963832b76cdb48717e6772d0348f99c79d91ea0b4944fe0181ad5d6701d9527e2ee62c14123f1f232c1da977cada

Download Submit
C:\Windows\Temp\{26697E26-8591-4BBD-88BE-69F5AF753F6C}\.cr\vc_redist.x64.exe

Filesize
635KB

MD5
35e545dac78234e4040a99cbb53000ac

SHA1
ae674cc167601bd94e12d7ae190156e2c8913dc5

SHA256
9a6c005e1a71e11617f87ede695af32baac8a2056f11031941df18b23c4eeba6

SHA512
bd984c20f59674d1c54ca19785f54f937f89661014573c5966e5f196f776ae38f1fc9a7f3b68c5bc9bf0784adc5c381f8083f2aecdef620965aeda9ecba504f3

Download Submit
C:\Windows\Temp\{94B2814C-30CF-453A-855F-4A3AD99187A1}\.cr\vc_redist.x86.exe

Filesize
634KB

MD5
415e8d504ea08ee2d8515fe87b820910

SHA1
e90f591c730bd39b8343ca3689b2c0ee85aaea5f

SHA256
e0e642106c94fd585782b75d1f942872d2bf99d870bed4216e5001e4ba3374c0

SHA512
e51f185c0e9d3eb4950a4c615285c6610a4977a696ed9f3297a551835097b2122566122231437002c82e2c5cf72a7a8f67362bff16b24c0abe05fe35dddbf6a1

Download Submit
\Windows\Temp\{1A1B6E2C-DD4B-42A8-A625-BDC29A50EC70}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/928-833-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/928-824-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/928-823-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/928-822-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/2112-781-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/2112-780-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/2112-782-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/2112-785-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/4872-803-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/4872-797-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/4872-796-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/4872-798-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/4952-827-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/4952-826-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/4952-828-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/4952-834-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/4952-836-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/5788-794-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/5788-788-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/5788-787-0x00007FF6B7BE0000-0x00007FF6B803FC00-memory.dmp

Filesize
4.4MB

Download
memory/5960-815-0x00007FF7D5030000-0x00007FF7D78EE400-memory.dmp

Filesize
40.7MB

Download
memory/5960-816-0x00007FF7D5030000-0x00007FF7D78EE400-memory.dmp

Filesize
40.7MB

Download
memory/5960-835-0x00007FF7D5030000-0x00007FF7D78EE400-memory.dmp

Filesize
40.7MB

Download
memory/5960-837-0x00007FF7D5030000-0x00007FF7D78EE400-memory.dmp

Filesize
40.7MB

Download