b7278c3c38801c0873759df432bcdf89d3709a7e638a4a150c3f4af179c3372b

Analysis

max time kernel
119s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7278c3c38801c0873759df432bcdf89d3709a7e638a4a150c3f4af179c3372b.msi
Size

20.7MB
MD5

8cad37c93cf7d11f1024b814f3da0727
SHA1

fb39f4d2a74e9b600cc812ce05a77361d3282369
SHA256

b7278c3c38801c0873759df432bcdf89d3709a7e638a4a150c3f4af179c3372b
SHA512

bd80292dbd8a4da9cc6b414add992c8f791e74bb7edb74fae4a4ae46fe6f6f6e7593f6fd45b21b3b6eedddb1a26214323ebb498579854c7f7c75d7d72dec42d9
SSDEEP

393216:h1z9wvtrdCjOdUprFfa69uxhGkYlwo6qFUklbOebxUf3LCDsHDM5gxp:hx9wvtrMjOdgtaMuxhGXhDb1bafbzDMu

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	3032	msiexec.exe
5	3032	msiexec.exe
6	2836	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Caribou Store Agent\nssm.exe	msiexec.exe
File created	C:\Program Files\Caribou Store Agent\agent.exe	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f770de9.msi	msiexec.exe
File created	C:\Windows\Installer\{198F6BAC-DB05-420F-B6B6-1F0CDAED636B}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f770de7.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18C6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{198F6BAC-DB05-420F-B6B6-1F0CDAED636B}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\f770de7.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f770de6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f770de6.msi	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
1984	nssm.exe
820	agent.exe
3060	agent.exe
2592	agent.exe
2404	agent.exe
2408	agent.exe
2604	agent.exe

Loads dropped DLL 2 IoCs

pid	Process
464	Process not Found
1984	nssm.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000070018d747a922bf35d9d97c51b8d70e0644c1da0b12109e12c24c46680af82c3000000000e8000000002000020000000512db6cec7d48d80e563476c3284c3d5fc92690a828c982d688f02a363ad3638900000007f797f713167a38175617c52a5482d21b7e6191e9685e16029b2e2a501dd4f5078f93b6375be954617f27f85ae341323cabbcd22c0812a7add7df91ef702bd985f3f03d79e3567f68b189c6a1d00e1113600c85d865ecdb407f8a5f9ee75de65ad8d068602c70c33d6b3191afd7b86de5fc9486fc4be398b3b9ba7ee6d2ad8bcc0f0c60bdc2a6498f745f464c861ceb540000000d46a3dadea9e0447c6cb8e2f940885ae6a96be8c3d209e32237426332a7f42413df97a9c751187c38cfd290cd3ca966430a69d40e15a0d3d2be6a1ef22eecca4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416470498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b1c77f0975da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8248C61-E0FC-11EE-989B-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000e5ab45c9b0e7f0a2f237852ff030ce8c7e21585a3f1fd2616f4ce2a99ad9ab43000000000e8000000002000020000000b49336bf408937c8a215f02c3b1e42e067998668663eb42fa9cac8859f63174e20000000dd10b76b0de35ab1943fedf28f0da50cde151d08dbd958382a7455172b760455400000009ef7f8f6e9daac5bba70cc9cce296681e5ba2c100e7814f36381dd2707486de5e5922b9fdb6090907b757ab341e63e9e12a1fa5284533885679a2c96c35a098b	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\14B3E41DD6913854DA0EAEC7579618D1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\ProductIcon = "C:\\Windows\\Installer\\{198F6BAC-DB05-420F-B6B6-1F0CDAED636B}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CAB6F89150BDF0246B6BF1C0ADDE36B6\Complete	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\SourceList\PackageName = "b7278c3c38801c0873759df432bcdf89d3709a7e638a4a150c3f4af179c3372b.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\PackageCode = "205A1A943CDC3A34F89AAA987C3B91FA"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\14B3E41DD6913854DA0EAEC7579618D1\CAB6F89150BDF0246B6BF1C0ADDE36B6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\Version = "17367049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CAB6F89150BDF0246B6BF1C0ADDE36B6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CAB6F89150BDF0246B6BF1C0ADDE36B6\ProductName = "Caribou Coffee Agent"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1984	nssm.exe
1984	nssm.exe
1984	nssm.exe
1984	nssm.exe
1984	nssm.exe
1984	nssm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3032	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeSecurityPrivilege	2836	msiexec.exe
Token: SeCreateTokenPrivilege	3032	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3032	msiexec.exe
Token: SeLockMemoryPrivilege	3032	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3032	msiexec.exe
Token: SeMachineAccountPrivilege	3032	msiexec.exe
Token: SeTcbPrivilege	3032	msiexec.exe
Token: SeSecurityPrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeLoadDriverPrivilege	3032	msiexec.exe
Token: SeSystemProfilePrivilege	3032	msiexec.exe
Token: SeSystemtimePrivilege	3032	msiexec.exe
Token: SeProfSingleProcessPrivilege	3032	msiexec.exe
Token: SeIncBasePriorityPrivilege	3032	msiexec.exe
Token: SeCreatePagefilePrivilege	3032	msiexec.exe
Token: SeCreatePermanentPrivilege	3032	msiexec.exe
Token: SeBackupPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeShutdownPrivilege	3032	msiexec.exe
Token: SeDebugPrivilege	3032	msiexec.exe
Token: SeAuditPrivilege	3032	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3032	msiexec.exe
Token: SeChangeNotifyPrivilege	3032	msiexec.exe
Token: SeRemoteShutdownPrivilege	3032	msiexec.exe
Token: SeUndockPrivilege	3032	msiexec.exe
Token: SeSyncAgentPrivilege	3032	msiexec.exe
Token: SeEnableDelegationPrivilege	3032	msiexec.exe
Token: SeManageVolumePrivilege	3032	msiexec.exe
Token: SeImpersonatePrivilege	3032	msiexec.exe
Token: SeCreateGlobalPrivilege	3032	msiexec.exe
Token: SeBackupPrivilege	1052	vssvc.exe
Token: SeRestorePrivilege	1052	vssvc.exe
Token: SeAuditPrivilege	1052	vssvc.exe
Token: SeBackupPrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeLoadDriverPrivilege	1980	DrvInst.exe
Token: SeLoadDriverPrivilege	1980	DrvInst.exe
Token: SeLoadDriverPrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeRestorePrivilege	2836	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3032	msiexec.exe
3032	msiexec.exe
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE
1292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2104	2836	msiexec.exe	36
PID 2836 wrote to memory of 2104	2836	msiexec.exe	36
PID 2836 wrote to memory of 2104	2836	msiexec.exe	36
PID 1984 wrote to memory of 820	1984	nssm.exe	38
PID 1984 wrote to memory of 820	1984	nssm.exe	38
PID 1984 wrote to memory of 820	1984	nssm.exe	38
PID 2908 wrote to memory of 2708	2908	explorer.exe	39
PID 2908 wrote to memory of 2708	2908	explorer.exe	39
PID 2908 wrote to memory of 2708	2908	explorer.exe	39
PID 2708 wrote to memory of 1292	2708	iexplore.exe	41
PID 2708 wrote to memory of 1292	2708	iexplore.exe	41
PID 2708 wrote to memory of 1292	2708	iexplore.exe	41
PID 2708 wrote to memory of 1292	2708	iexplore.exe	41
PID 1984 wrote to memory of 3060	1984	nssm.exe	43
PID 1984 wrote to memory of 3060	1984	nssm.exe	43
PID 1984 wrote to memory of 3060	1984	nssm.exe	43
PID 1984 wrote to memory of 2592	1984	nssm.exe	46
PID 1984 wrote to memory of 2592	1984	nssm.exe	46
PID 1984 wrote to memory of 2592	1984	nssm.exe	46
PID 1984 wrote to memory of 2404	1984	nssm.exe	48
PID 1984 wrote to memory of 2404	1984	nssm.exe	48
PID 1984 wrote to memory of 2404	1984	nssm.exe	48
PID 1984 wrote to memory of 2408	1984	nssm.exe	50
PID 1984 wrote to memory of 2408	1984	nssm.exe	50
PID 1984 wrote to memory of 2408	1984	nssm.exe	50
PID 1984 wrote to memory of 2604	1984	nssm.exe	52
PID 1984 wrote to memory of 2604	1984	nssm.exe	52
PID 1984 wrote to memory of 2604	1984	nssm.exe	52

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b7278c3c38801c0873759df432bcdf89d3709a7e638a4a150c3f4af179c3372b.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3032

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\explorer.exe
  explorer.exe http://localhost:8090/config
  2⤵
  PID:2104

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000059C" "00000000000004D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Program Files\Caribou Store Agent\nssm.exe
"C:\Program Files\Caribou Store Agent\nssm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files\Caribou Store Agent\agent.exe
  "C:\Program Files\Caribou Store Agent\agent.exe"
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Program Files\Caribou Store Agent\agent.exe
  "C:\Program Files\Caribou Store Agent\agent.exe"
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Program Files\Caribou Store Agent\agent.exe
  "C:\Program Files\Caribou Store Agent\agent.exe"
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Program Files\Caribou Store Agent\agent.exe
  "C:\Program Files\Caribou Store Agent\agent.exe"
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Program Files\Caribou Store Agent\agent.exe
  "C:\Program Files\Caribou Store Agent\agent.exe"
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Program Files\Caribou Store Agent\agent.exe
  "C:\Program Files\Caribou Store Agent\agent.exe"
  2⤵
  - Executes dropped EXE
  PID:2604

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:8090/config
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f770de8.rbs

Filesize
12KB

MD5
cdfc6547fd7f76915bdf3aeae1f73def

SHA1
60fb61077761db8da8e51bd3e7ae0753bd4eea33

SHA256
d4bae44e205fd6c40d8e390c3ec5508af49997d24cb71350cf8a1d58b035cc3b

SHA512
e52f0834b41eff3af77c73668b4770c0135332f3bf4fe7e48da66d7b845f7e2cfecc18d078fe0b0a765336a2f91af4445871b78922d721f543f9cf4c3e248925

Download Submit
C:\Program Files\Caribou Store Agent\agent.exe

Filesize
2.3MB

MD5
956c01a002e91041d02699e388c47598

SHA1
901eee79bca1dc4ced9b3ad0bf18a56c8fc39390

SHA256
52884f86fac9ad0cf72de4ec4a7e3ddcc91d66ea0829ed6ff8dee6971523370a

SHA512
eb4747b0437e349fb830a8bc5303240d06e5f02bbbe6a7d478f714d56095c98f5f7a70231dd4ab4178870b74cc49dcb3307d4172ec4513b385084e85a0c29e59

Download Submit
C:\Program Files\Caribou Store Agent\agent.exe

Filesize
1.3MB

MD5
10f003cec3e2712854fc5a5886f51146

SHA1
dc17dfd016539bde5c63b71f6dd8d7c75c9ca25b

SHA256
07bbdd0c7c03247a04e9841a48c2ee362ea0812a2337da0eec86924edd3e5332

SHA512
64b16d704bca3a7c7f6215d2a67bf209c149ab98af83cf35f10b919ad803ca79b5696bf0f8560804354af80a03397baa355921e0bb17b8418a2eb2d6936bf163

Download Submit
C:\Program Files\Caribou Store Agent\agent.exe

Filesize
72KB

MD5
410a98042fe2540459d46bb127fea0f2

SHA1
a8a42c7e31ef9ac7f82b277b9599b5d785ade1a9

SHA256
d56d920ada97d60d4f42886903e1c484f0e8b2c4738612abdc0ac5afd7e45907

SHA512
0f2ba20f7315ccd77dcd92e632e11085805c06e512ed6cb2f8bcbddb6b57870146b29045f2c9887935406f0912e7de9b6570530d218ec93505f2b8711f39a468

Download Submit
C:\Program Files\Caribou Store Agent\agent.exe

Filesize
4.0MB

MD5
2bd6863133867a904333382f9baa68a8

SHA1
5a4bd205b3188da3cf7e02df5da97248b7b7d0c8

SHA256
41d09f72cc3f93cf0a1f7cfd56c70bff0dd0fdce9fa8bab8857dd5bf6a64d03a

SHA512
b751e29370a25635b56c99ab9de5c2e2d68bbec5013925a323ee9b94e9957f6160cd3500fd69e5faf88ef7e33e07a66e46fd29acce1d5f5d643c306537600481

Download Submit
C:\Program Files\Caribou Store Agent\agent.exe

Filesize
4.6MB

MD5
f62d44b56c10c6a6d155569fc58c09c4

SHA1
38aa46cf2ef1fa510af88ce71acda9dedf58aaf6

SHA256
fa842689af047a481c94ee63b9ac7a5fe82cd6229441ae0cfccbc362b503f447

SHA512
340399d8d18dc1ee44ef9394049d477f7354d0ac8c0c27eae4e41b95e1aa324b4ed32ad6a425c9b681c6fae3b475098411ca01a776d77efa544a45416c6dc55f

Download Submit
C:\Program Files\Caribou Store Agent\agent.exe

Filesize
3.8MB

MD5
90318d61cbf522c36fa9587683fc3053

SHA1
f04d998f7f1078ee75fed24504e6bb924d75195d

SHA256
e40b20176d7021465fc74942e22b1bcb80e14be8892873f30e4c69457da2852a

SHA512
7fa7d307672e11025d199b4e4c261e555528284262352627006ea731b146fee40348ba15b97ffc8c048b37453d6c0ac3e2e47e2ca177a7fe3ad11cd6a2777ab3

Download Submit
C:\Program Files\Caribou Store Agent\agent.exe

Filesize
13.7MB

MD5
1a809ec2c0100272c14d15e2f2741c58

SHA1
6875953bcf1b0cb29c7b178ffd5ddac3565cfd9b

SHA256
ee19ef50e92bf225c06079792f7504781367702f9956b3d75b748a4999ad5244

SHA512
b146d4f9ee070d1294364a51205a06c17df0fc8c5fca3412ef5212b224aca4dfa7fa51d292d5af389e78ac76f27f0610eeb616bc99062d98b7107a00d980d737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
233212e18b5d8cfa5546498fa96b5a3a

SHA1
b300e11e295a8df80d18b4888a22c9668d9b9250

SHA256
2001bd0fd3d6b5f17b5d0da455c7f724a1829b26b77c675f90f9fbe102d52d6b

SHA512
76de53eb1e2f341444e52c664e0caa4c2bb88acbec9ace8570aa89c5b1e6942be81538b3df1e55d2be24292497e364e26e92d434ecf074fc6f80763f58d5f302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ce89f876f2f9bdbbf4ff939527d20baf

SHA1
16b44c72617c3463f74292fc99051ccacadae93b

SHA256
ae1cf543a700cbf612168db36a3840d6bf05a9711c5b60fef83df529e9583ec5

SHA512
28f098fe1a180c36a0ea62bd57c988a4083d107c316ca5389e5a472e65383a36ba131ce933e70e9e3098a8fd4d599d11faaf8c9129609185f06d2675f8c7f278

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
72390c4c3d837f5e97a6b5d41ce367ba

SHA1
f9fa589ff8bc900588fa384d93e2cab3dd625680

SHA256
4107a9680865a7bc617041cd664f676bb375db48e2745f92aa19ad729c7e66a6

SHA512
068af26edabafa2c027dc2bb27b43c962c9ed7105b3588f7bd7ae6489b276efd1500ef409800a52bdff574b31c65e844f71d09753da4ede7b32868b5f17cec13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8f1611b4ec7a66300c56c340b55c586f

SHA1
1b9320181c1656278819e44c70e945af3e8ec280

SHA256
542a57856234ed95d08808c197a2fe4df7078629a2b9a902d10690116ec153db

SHA512
7ec822a73a33dcc3ad35b4bcc29df85426275f36db0077a36ceed37e703d4a29fd2ed026dbcf3bc260b48cb8fb8ffe9b128e887a1242b088db4713043636d09b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8c430c67b9f8c7cbd6267cd680da291e

SHA1
6d53e1acff0a1764d002cbb43d4e235901b348f6

SHA256
d3574693e8d43d6dd351aef9c2137f9f2ec7606d0b23926d14c763b56409b6cc

SHA512
ddbc18b258cc5e69b98a88d1ab7b024e1ad30a2c30fbb8d8f4c48790c779441cb413301d6bbc2749a42804dff609310938b290f3d96cadf29aac14349059080c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f0370cb25aa3832973a52427abc5bda8

SHA1
4f8480f015c6bbf2c07aed137f86c62cff6ce86c

SHA256
8dd7a8da3f9be852a7a17c9d59129a991d3a324263d5fd2c9cb62204bd9fc897

SHA512
7270727b1630de26412039bd7cac38f86e4ab70ab1204e706669ec4f4105b9fde2f4afd5cb210451f272ea311149c6c27bf5e6bcea581e6f445ada0a3795e84f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7d2d73bc066d5daddcec0729dc84a41d

SHA1
4e2b898f7d45441bc0075f31d0dbc4b981b55102

SHA256
7fc32ddfc8e01c6cf7f6267af8e641715b2e17d5083f6176418e2c3027d84cd1

SHA512
3de3a80599290c981cd8a74c4569a549faf7533830da53a48e57fec678f0c20d400e77c7a48c14e87f947ad38fb72db6ac22dacbe7d38492bebe165d2d5419ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c2c527868ddda687fc52d045265cd9b7

SHA1
938e84035a593e407be6bcade8a8714c312354c7

SHA256
5c7a549f26ca6c7ffeb24ffad806e0c906235e18e24decf122231d8eddb1cebd

SHA512
69605dad4a2f812ce88b4a01a2638a608a37b348dadb96586b5cc62864592dac0db187376ae0cfd24d3e21ab5af5bc0a57df240f200c2ab91c77f1c09011c0ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
36a20b39f823d27d870076fae5a6bac1

SHA1
6c77f54bbfabdc437dabd8715a4c028d391b3854

SHA256
9db900fdd208798c26d3dead36b0eff4043311f313d0521de77e317930d0385d

SHA512
0a353575265dd9a5d6f419528004722b00ce4ad61c46521160be9e1634fb335a15cd9103a489aa2a485188eaadc49d2f4d7abfbda72a999687c4b17d71cdbeef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2a9961d150a7e728976295d0f486595a

SHA1
fde7e84c674485e1d36e91aed3770e953b5374d7

SHA256
242e8d48ff871a586efbc1d846771f17dd20692d4116d73971845d20d84a43b1

SHA512
da852c567a92c0325e6e2ce3a2596b2707b91e9900ce94490fab25bb230add9b1a76a191540e178ee1d2c4edcaaf6e504925446cadfc550b3c47848999e06450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
001c4f55973014b984f72f8f2cc98f2e

SHA1
95ec775bf9c78a77412420b4f22c341caed838ff

SHA256
2c62eb50df4efd02da156d17c91aebd9d6b2ed82af92dedd429d93752ec45cc4

SHA512
38bc748390febeff598bcac121352b4d6feba8aaa9fc377214f7dee35057504021152ff12b1e1cdd29b2cb9641765e808f847a6595ec41c3e378cf20922602b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2d2d7c59731fe123fc27421e63ab86f6

SHA1
370660a59acb57f3ba42ea5482854746ce6a501f

SHA256
c67a169679c7d3c97e27bd99b50b8296cdfda77cf36223ab2fd66db7447d3f6b

SHA512
57c1aba2a9cbafba0a23db2fa2b872bc2c0b4793785fd12a67777286dd14365ec41d9fe615e1ec957b593a3ceadcad502ce3eb1e5987b9e441012740c4136857

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
095c59e20b5fc9bafc5737c94b8ce112

SHA1
8b2d0a76af7f46dc9619caad2f6a5750a541887f

SHA256
bdf902b97c597c98b11f51ba5d214a8194d9f5b9b7a14e519f42290ec2ad69da

SHA512
8161dbc19ab79808fd15784d8e05bdf49c0ea8d21b82e5d7b733d9ea3bbebce2a3a14a59d5e8d712c14de8ecb66ce4ca64744ae25e35146d1f46f23b2ad361c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3c8c3de443363f57823c78940b366adf

SHA1
a08dbc0b4df00b8ef38f36d60c99b77f3d35817d

SHA256
544b27601b530230df575b6a840c15d6117e4d39d5c932b951c889cf692c005f

SHA512
9703dbe60c15dbab4a51aadf0519d4ab31475f6448a71dc813b0b8291259b37a546d17c539cf74f57c737ecc317e664b12d54e9a48f1611204679bfe6264283a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
74806b87bbeaaea63a25a57d0bde949a

SHA1
d809d66f4a2ee4f570947a213b80c744bf795b26

SHA256
127a3c809bf226588f456476ba6a81adfcd45917a71bac08cdbe3ab292d9e81a

SHA512
417948f7aaf044a48ec24bb40f2e1cec4d29ae95fedf3cd64c5a32dca16367a72102949dd84ed95b59d154e58fa91814ed05ce68946d95035dc7b23fc57bcf0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
00244075f219894fd735ba4821a0bbc9

SHA1
d0be7487263fdd6e1ff54c1134993ef29e98126c

SHA256
dfd01460e485307daeb11ce20d89f51c8019acc142f316d89b8679edb5e1b578

SHA512
5413530a06525691b575def8ef3ef0edb62993513a986897848f211ea81ec39317616cdd6dabffe967cc57229d4653dd39dfdb6abad34797118ddf959b82b61e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bc44b5a34f188b1034d53ab4053c263a

SHA1
216dde90324e535e97af4e18e0e1e9ccb199dad7

SHA256
19b06c84df8233db35b35149187aa43e3c83f6a4f677d4db7ccee81573a02592

SHA512
b42ef3c54d31e1db02a37d364503477c8d5344fe8d1d1481fa2da6eb3b306e93bbfb6286c1e7265583717625a8c61421e3482de0df7b5997a9342202c69c98ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b78ba772508926def10bb98be3f181ef

SHA1
d022284b04351deca744660cedb15f0f864a6e3e

SHA256
1f3721f85013c9d4f2960b1c172c57e0d543334dcb56e39309a528f7f069bb0f

SHA512
bd548df41968ff32b799a36c77cb67235066261a4a472505f693753d16330dc7fa2b311534177967daee43ad7a937e077298067d1a7d0949dbcbf290b6d176f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b213b9b2f5022f35fbd981cea6a8d438

SHA1
8b1e3cb8e3c919ca3bdb1041a903f5d6e1e63a91

SHA256
ddcd1ff493ccae5223dfcf2937ea77fc52d15f4ebcbd0d6babc8efec6990ca49

SHA512
9b74c9cb93f8f59cb00556446faeacb7fc59a3f1aba07bc5142d9bc1ab7f3b62d53ea7cec7b83747a49a3ef7ef38a7d2f1a3208cd661120ae41d05139586343c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
05d2e5d1262c9e73a7b1a2b39e90e830

SHA1
25d6b2ef41d2c621b45835a09b3475de94a9d300

SHA256
b8a40bfa91a5c69eea003f7a998ba831e90a3fb5a496fcdc29f2de578464833b

SHA512
36f38d0dd3281a965b87c137877e1ce8f5698594ba9d8310f914c52a668b5f4a2e8a594c918c44b0002fa3e8072969e42b4d80c1393da3b1e9b5a7ceb0816f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
612856de932e29229d1aa0e22acf7eaf

SHA1
bfdc31b1bd09808787a52b26bd929e8e2314b9e2

SHA256
7212008c7c378f79ebdb67b88510c316bc44bc727280e03c1572750be886fb61

SHA512
4bc5be552cf7a7f546597c8fb3080138461dfdaad21f8ec2cf57086d7dacc3a0c879df08dd28922a598c70f8564e85b0fc0005da3129fc736857cd2c7fa211b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9916.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA898.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Windows\Installer\f770de6.msi

Filesize
2.9MB

MD5
50dce6ed30daf6228c32b55dd10c1f0f

SHA1
1d1dd8e15bca0f39ce677cae06b3ba3de3d63c08

SHA256
74900bdfd21602c8c1ac47558b47d238b942b1109edd12d367512b0e66af7ebc

SHA512
55008ac8078b724bfe11b46d27289cf01a2b6ddb304c7ad45a57a3b5a79aa0105298e53486234f29d92355239ee8baccb11c31e829a318ac4a0c4705a8bc0ca6

Download Submit
\Program Files\Caribou Store Agent\agent.exe

Filesize
1.8MB

MD5
d8a1f1dcf3693ae791736bfb7c9c5975

SHA1
c9dea58fb230ed69d6383684584b4c11f17b9a7f

SHA256
663bd0eaf586436d6c92d8f32822dd4362da5638d3ce5232aa5bbe9c30810402

SHA512
49643e5a94036518571857e735d8a611110ea0ba0e0f05505d8b9687ec774df7ae76e8e10876fbee0af4be38973cd0c775ed659e3d69b636c9456d5f4091cfc3

Download Submit
\Program Files\Caribou Store Agent\nssm.exe

Filesize
323KB

MD5
beceae2fdc4f7729a93e94ac2ccd78cc

SHA1
47c112c23c7bdf2af24a20bd512f91ff6af76bc6

SHA256
f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c97

SHA512
073f5ae0d4ffedb5edb3b92b8e19bea2c482a3ad7ab02ed71955d3e55aa44a297307fe4334d28c6f7683cb02d40b4313e560c9049507b16a8c5d6ee0a0f0071f

Download Submit