1c6191ddeb164efff30358f7de88022577b6bfe0dfbe0a29ab0f3a2b25637bd2

Analysis

max time kernel
98s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

systemutilities.msi
Size

9.9MB
MD5

41eda719c231e212e02b2683d36edfa4
SHA1

7257a3350b7b856c16b146ff063f002b42903543
SHA256

1c6191ddeb164efff30358f7de88022577b6bfe0dfbe0a29ab0f3a2b25637bd2
SHA512

1d7382b75d1b12a690d2caeead05c74c3fe83f7888be1bee1bbcfec31d0675967473393b39af87d97ad10c91d2ad6420ad0be8ac58b45d88779ec8e9c4403e77
SSDEEP

196608:mkBx8XfML5Nf7QJ91JUREHYtDBkXfML5D9qdSK:mw8XfMvy91JUgyDOXfM1I

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiagnosticDriver = "C:\\Users\\Admin\\AppData\\Local\\DiagnosticDriver\\DiagnosticDriver.exe"	MsiExec.exe

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exeMsiExec.exe

flow pid process

4 2312 msiexec.exe
6 2312 msiexec.exe
53 2276 MsiExec.exe

flow	pid	process
4	2312	msiexec.exe
6	2312	msiexec.exe
53	2276	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

autorun.exeDiagnosticDriver.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	autorun.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	DiagnosticDriver.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 23 IoCs

Processes:

msiexec.exeMsiExec.exeSystemUtilities.exe

description	ioc	process
File created	C:\Program Files (x86)\System Utilities\Installer.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\x86\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\Microsoft.WindowsAPICodePack.Shell.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\Microsoft.WindowsAPICodePack.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\Downloader.exe	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\autorun.exe	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\es\SystemUtilities.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\autorun.bat	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\autorun.exe.config	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\SystemUtilities.exe.config	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\System.Data.SQLite.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\Downloader.exe.config	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\Installer.InstallState	MsiExec.exe
File created	C:\Program Files (x86)\System Utilities\SystemUtilities.pdb	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\update.json	SystemUtilities.exe
File created	C:\Program Files (x86)\System Utilities\SystemUtilities.exe	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\DotNetProjects.DataVisualization.Toolkit.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\DotNetZip.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\x64\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\de\SystemUtilities.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\System Utilities\System.Drawing.Common.dll	msiexec.exe

Drops file in Windows directory 16 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e58122b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{8D439B00-EFD8-4BDF-8285-9B99B795546E}\_56C98E63F9074DDB7DCF8F.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2867.tmp	msiexec.exe
File created	C:\Windows\Installer\e58122b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{8D439B00-EFD8-4BDF-8285-9B99B795546E}\_56C98E63F9074DDB7DCF8F.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI17BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12F6.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8D439B00-EFD8-4BDF-8285-9B99B795546E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14EC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{8D439B00-EFD8-4BDF-8285-9B99B795546E}\_5A06E2C7FE64B3FCB5D52A.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1411.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{8D439B00-EFD8-4BDF-8285-9B99B795546E}\_5A06E2C7FE64B3FCB5D52A.exe	msiexec.exe
File created	C:\Windows\Installer\e58122d.msi	msiexec.exe

Executes dropped EXE 5 IoCs

Processes:

DiagnosticDriver.exeautorun.exeSystemUtilities.exeDiagnosticDriverUpdater.exeDiagnosticDriverUpdater.exe

pid process

3444 DiagnosticDriver.exe
4872 autorun.exe
3792 SystemUtilities.exe
4196 DiagnosticDriverUpdater.exe
3224 DiagnosticDriverUpdater.exe

Loads dropped DLL 13 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeDiagnosticDriver.exeSystemUtilities.exe

pid	process
3348	MsiExec.exe
3348	MsiExec.exe
1196	MsiExec.exe
1196	MsiExec.exe
2276	MsiExec.exe
2276	MsiExec.exe
2276	MsiExec.exe
2276	MsiExec.exe
3444	DiagnosticDriver.exe
3792	SystemUtilities.exe
3792	SystemUtilities.exe
3792	SystemUtilities.exe
3792	SystemUtilities.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000042283678384db7f50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000422836780000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090042283678000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d42283678000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004228367800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeSystemUtilities.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|es\|SystemUtilities.resources.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|DotNetProjects.DataVisualization.Toolkit.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\ProductName = "System Utilities"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|Newtonsoft.Json.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|BouncyCastle.Crypto.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|SystemUtilities.exe\SystemUtilities,Version="1.2.0.0",Culture="neutral",ProcessorArchitecture="x86" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e007e00510031002e006d006e00270062002100620024003600710060006e005300310045005d003d0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|Downloader.exe\Downloader,Version="1.0.69.6892",Culture="neutral",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e0044005e00380050006a007b0070006d0054006a0073005b004500390056003300320054005900270000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|de\|SystemUtilities.resources.dll\SystemUtilities.resources,Version="1.2.0.0",Culture="de",ProcessorArchitecture="x86" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e007400560078002a006f003f007e0030005300320044006d0037005f006e004a004c003f0035004c0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\SourceList\PackageName = "systemutilities.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|BouncyCastle.Crypto.dll\BouncyCastle.Crypto,Version="1.8.9.0",Culture="neutral",PublicKeyToken="0E99375E54769942",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e0066007b00720030007900300041004d004d006500670039005100450033006f002900250027006b0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|SystemUtilities.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|DiagnosticDriver.exe\DiagnosticDriver,Version="1.4.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e00540075005000730079007700380027005900340070007d0039006c002d0037002500250047006a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|Installer.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|autorun.exe	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|autorun.exe\autorun,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e00360056004c006f0038006e00210034004a0055004500370079003800480032002100360069007a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|DiagnosticDriverUpdater.exe	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|System.Net.Http.dll\System.Net.Http,Version="4.0.0.0",Culture="neutral",PublicKeyToken="B03F5F7F11D50A3A",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e0062003500320066005b0036006e005f005e0026007200290073006c0039006d004a0070002a006b0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|Microsoft.WindowsAPICodePack.dll\Microsoft.WindowsAPICodePack,Version="1.1.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e0031005400540051005600320044005f006f0053007a0049006900700040002d0051006d005500310000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1B8F158B661FA3042BCD0AAEFBF7A91C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|System.Data.SQLite.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|System.Net.Http.dll\System.Net.Http,Version="4.2.0.0",Culture="neutral",PublicKeyToken="B03F5F7F11D50A3A",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e0062003500320066005b0036006e005f005e0026007200290073006c0039006d004a0070002a006b0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|System.Security.Cryptography.ProtectedData.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|System.Drawing.Common.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|System.Drawing.Common.dll\System.Drawing.Common,Version="7.0.0.0",Culture="neutral",PublicKeyToken="CC7B13FFCD2DDD51",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e00590051007500610050002a00300021002c0040004c00650048007a004800770068004c007700460000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	SystemUtilities.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|System.Data.SQLite.dll\System.Data.SQLite,Version="1.0.108.0",Culture="neutral",PublicKeyToken="DB937BC2D44FF139",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e00490049002e0048002d00420077002900490024005e00600041004d0076002b00260053004b00450000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|System.Net.Http.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|System.IO.Compression.FileSystem.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|DotNetProjects.DataVisualization.Toolkit.dll\DotNetProjects.DataVisualization.Toolkit,Version="6.1.94.0",Culture="neutral",PublicKeyToken="79778C5F2EED289B",Pro = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e004600790052004000280056006a0076004d002c005200650043006a005f006900430036007500370000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	SystemUtilities.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|System.IO.Compression.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|Newtonsoft.Json.dll\Newtonsoft.Json,Version="12.0.0.0",Culture="neutral",PublicKeyToken="30AD4FE6B2A6AEED",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e006a006000620029006b007b0031007e004500620036006f0074007400330052005f002e002800700000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|DotNetZip.dll\DotNetZip,Version="1.11.0.0",Culture="neutral",PublicKeyToken="6583C7C814667745",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e0046007300660064006b0051006b006f00740030006700460031006f0040007d002c0075006a00750000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00B934D88DFEFDB42858B9997B5945E6	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	SystemUtilities.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|Installer.dll\Installer,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e0066006c006c007d0026005b0064006a0056004a00660033005d002800770068003f00440066006c0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\PackageCode = "06840FC617825EB4E9A4C3BD7A22705D"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|Microsoft.WindowsAPICodePack.dll	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1B8F158B661FA3042BCD0AAEFBF7A91C\00B934D88DFEFDB42858B9997B5945E6	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	SystemUtilities.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|DotNetZip.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|Newtonsoft.Json.dll\Newtonsoft.Json,Version="13.0.0.0",Culture="neutral",PublicKeyToken="30AD4FE6B2A6AEED",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e002500500046002100520068006000720067002100540053002e006c00750053007b00680075004b0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|System.IO.Compression.dll\System.IO.Compression,Version="4.0.0.0",Culture="neutral",PublicKeyToken="B77A5C561934E089",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e0032004600240076007700600071004b007000550027007d0072005300620078006e005a0057004c0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|System.Security.Cryptography.ProtectedData.dll\System.Security.Cryptography.ProtectedData,Version="6.0.0.0",Culture="neutral",PublicKeyToken="B03F5F7F11D5 = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e007200410062004100270030003d0050005e0063005600320073004c00310055007e0060002600650000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00B934D88DFEFDB42858B9997B5945E6\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	SystemUtilities.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|System.Data.SQLite.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Users\|Admin\|AppData\|Local\|DiagnosticDriver\|DiagnosticDriver.exe	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|es\|SystemUtilities.resources.dll\SystemUtilities.resources,Version="1.2.0.0",Culture="es",ProcessorArchitecture="x86" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e0067003f005e004b0033006b006300510073003700480025003f00630040005d004300400024006d0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|Microsoft.WindowsAPICodePack.Shell.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|System Utilities\|Microsoft.WindowsAPICodePack.Shell.dll\Microsoft.WindowsAPICodePack.Shell,Version="1.1.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 3f00330033004a005500720036006e004800400066007600480047005900340076002b004f004b003e00610066006e00590059003800580056006400720063004c00630029006e0070005000260078005b0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

DiagnosticDriver.exeSystemUtilities.exe

pid	process
3444	DiagnosticDriver.exe
3444	DiagnosticDriver.exe
3444	DiagnosticDriver.exe
3444	DiagnosticDriver.exe
3792	SystemUtilities.exe
3792	SystemUtilities.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2312	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2312	msiexec.exe
Token: SeSecurityPrivilege	4340	msiexec.exe
Token: SeCreateTokenPrivilege	2312	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2312	msiexec.exe
Token: SeLockMemoryPrivilege	2312	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2312	msiexec.exe
Token: SeMachineAccountPrivilege	2312	msiexec.exe
Token: SeTcbPrivilege	2312	msiexec.exe
Token: SeSecurityPrivilege	2312	msiexec.exe
Token: SeTakeOwnershipPrivilege	2312	msiexec.exe
Token: SeLoadDriverPrivilege	2312	msiexec.exe
Token: SeSystemProfilePrivilege	2312	msiexec.exe
Token: SeSystemtimePrivilege	2312	msiexec.exe
Token: SeProfSingleProcessPrivilege	2312	msiexec.exe
Token: SeIncBasePriorityPrivilege	2312	msiexec.exe
Token: SeCreatePagefilePrivilege	2312	msiexec.exe
Token: SeCreatePermanentPrivilege	2312	msiexec.exe
Token: SeBackupPrivilege	2312	msiexec.exe
Token: SeRestorePrivilege	2312	msiexec.exe
Token: SeShutdownPrivilege	2312	msiexec.exe
Token: SeDebugPrivilege	2312	msiexec.exe
Token: SeAuditPrivilege	2312	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2312	msiexec.exe
Token: SeChangeNotifyPrivilege	2312	msiexec.exe
Token: SeRemoteShutdownPrivilege	2312	msiexec.exe
Token: SeUndockPrivilege	2312	msiexec.exe
Token: SeSyncAgentPrivilege	2312	msiexec.exe
Token: SeEnableDelegationPrivilege	2312	msiexec.exe
Token: SeManageVolumePrivilege	2312	msiexec.exe
Token: SeImpersonatePrivilege	2312	msiexec.exe
Token: SeCreateGlobalPrivilege	2312	msiexec.exe
Token: SeCreateTokenPrivilege	2312	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2312	msiexec.exe
Token: SeLockMemoryPrivilege	2312	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2312	msiexec.exe
Token: SeMachineAccountPrivilege	2312	msiexec.exe
Token: SeTcbPrivilege	2312	msiexec.exe
Token: SeSecurityPrivilege	2312	msiexec.exe
Token: SeTakeOwnershipPrivilege	2312	msiexec.exe
Token: SeLoadDriverPrivilege	2312	msiexec.exe
Token: SeSystemProfilePrivilege	2312	msiexec.exe
Token: SeSystemtimePrivilege	2312	msiexec.exe
Token: SeProfSingleProcessPrivilege	2312	msiexec.exe
Token: SeIncBasePriorityPrivilege	2312	msiexec.exe
Token: SeCreatePagefilePrivilege	2312	msiexec.exe
Token: SeCreatePermanentPrivilege	2312	msiexec.exe
Token: SeBackupPrivilege	2312	msiexec.exe
Token: SeRestorePrivilege	2312	msiexec.exe
Token: SeShutdownPrivilege	2312	msiexec.exe
Token: SeDebugPrivilege	2312	msiexec.exe
Token: SeAuditPrivilege	2312	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2312	msiexec.exe
Token: SeChangeNotifyPrivilege	2312	msiexec.exe
Token: SeRemoteShutdownPrivilege	2312	msiexec.exe
Token: SeUndockPrivilege	2312	msiexec.exe
Token: SeSyncAgentPrivilege	2312	msiexec.exe
Token: SeEnableDelegationPrivilege	2312	msiexec.exe
Token: SeManageVolumePrivilege	2312	msiexec.exe
Token: SeImpersonatePrivilege	2312	msiexec.exe
Token: SeCreateGlobalPrivilege	2312	msiexec.exe
Token: SeCreateTokenPrivilege	2312	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2312	msiexec.exe
Token: SeLockMemoryPrivilege	2312	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2312 msiexec.exe
2312 msiexec.exe

pid	process
2312	msiexec.exe
2312	msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

msiexec.exemsiexec.exeautorun.exeDiagnosticDriver.exe

description	pid	process	target process
PID 4340 wrote to memory of 3348	4340	msiexec.exe	MsiExec.exe
PID 4340 wrote to memory of 3348	4340	msiexec.exe	MsiExec.exe
PID 4340 wrote to memory of 3348	4340	msiexec.exe	MsiExec.exe
PID 4340 wrote to memory of 5108	4340	msiexec.exe	srtasks.exe
PID 4340 wrote to memory of 5108	4340	msiexec.exe	srtasks.exe
PID 4340 wrote to memory of 1196	4340	msiexec.exe	MsiExec.exe
PID 4340 wrote to memory of 1196	4340	msiexec.exe	MsiExec.exe
PID 4340 wrote to memory of 1196	4340	msiexec.exe	MsiExec.exe
PID 4340 wrote to memory of 2276	4340	msiexec.exe	MsiExec.exe
PID 4340 wrote to memory of 2276	4340	msiexec.exe	MsiExec.exe
PID 4340 wrote to memory of 2276	4340	msiexec.exe	MsiExec.exe
PID 2312 wrote to memory of 3444	2312	msiexec.exe	DiagnosticDriver.exe
PID 2312 wrote to memory of 3444	2312	msiexec.exe	DiagnosticDriver.exe
PID 2312 wrote to memory of 4872	2312	msiexec.exe	autorun.exe
PID 2312 wrote to memory of 4872	2312	msiexec.exe	autorun.exe
PID 2312 wrote to memory of 4872	2312	msiexec.exe	autorun.exe
PID 4872 wrote to memory of 3792	4872	autorun.exe	SystemUtilities.exe
PID 4872 wrote to memory of 3792	4872	autorun.exe	SystemUtilities.exe
PID 4872 wrote to memory of 3792	4872	autorun.exe	SystemUtilities.exe
PID 3444 wrote to memory of 4196	3444	DiagnosticDriver.exe	DiagnosticDriverUpdater.exe
PID 3444 wrote to memory of 4196	3444	DiagnosticDriver.exe	DiagnosticDriverUpdater.exe
PID 3444 wrote to memory of 4196	3444	DiagnosticDriver.exe	DiagnosticDriverUpdater.exe
PID 3444 wrote to memory of 3224	3444	DiagnosticDriver.exe	DiagnosticDriverUpdater.exe
PID 3444 wrote to memory of 3224	3444	DiagnosticDriver.exe	DiagnosticDriverUpdater.exe
PID 3444 wrote to memory of 3224	3444	DiagnosticDriver.exe	DiagnosticDriverUpdater.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\systemutilities.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2312

C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exe
"C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3444

C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriverUpdater.exe
"C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriverUpdater.exe" SystemUtilities https://yasupro.net/lup/version/last If3xxt9DetP078aGCd7pJ/waX+JxPR57uz8oQjBcAms= C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exe
3⤵
- Executes dropped EXE
PID:4196

C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriverUpdater.exe
"C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriverUpdater.exe" SystemUtilities https://yasupro.net/lup/version/last If3xxt9DetP078aGCd7pJ/waX+JxPR57uz8oQjBcAms= C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exe
3⤵
- Executes dropped EXE
PID:3224

C:\Program Files (x86)\System Utilities\autorun.exe
"C:\Program Files (x86)\System Utilities\autorun.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872

C:\Program Files (x86)\System Utilities\SystemUtilities.exe
"C:\Program Files (x86)\System Utilities\SystemUtilities.exe"
3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3792

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5F2B7F3618D8360571CC0BE5FC9D8F52 C
2⤵
- Loads dropped DLL
PID:3348

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:5108

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6A0B93E9250834A2375C2B3976D02AD9
2⤵
- Loads dropped DLL
PID:1196

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E5DCC68FFA22414931B36084B5CD3852 E Global\MSI0000
2⤵
- Adds Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:2276

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3104

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2168

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58122c.rbs
Filesize
129KB

MD5
ed1c13844762d74a93b2321b9df9f9a7

SHA1
24a464375b29b83380367369e8018f498abd1104

SHA256
8f3734a017886bbba8b061894fad6878e3c5104361720fe17c2a1110e0c8544c

SHA512
97affb68c3baa6e726dcfd7b7acd493c94e3ad5b8b02ea9c3d1e667cdc416fb7f92515653421c7a83ca69af81e1d3f0881647ded67b2301f7d262f07ec95a937

Download Submit
C:\Program Files (x86)\System Utilities\Installer.dll
Filesize
104KB

MD5
10e3b8cdb5ea0edccc1e0b530aa86728

SHA1
1130df082a5c4e76996a9cd5f592dab241d1d5b9

SHA256
17e36de345871c2af2575ddcbbd0a8f30da15ae2dedeca5a094fb57bd9e0d71a

SHA512
5b34f3f7c10b8266f8773c5771f9fa5e1aab8799a8bf0db0fb23e54c047417005a8cf97169e7e7eb825983c59125d4fa07e3157a693d32b15a4de1234bbc11ff

Download Submit
C:\Program Files (x86)\System Utilities\Microsoft.WindowsAPICodePack.Shell.dll
Filesize
529KB

MD5
54fe9a2748c4a0f282d4ec91e3cadc16

SHA1
970b783a697d893ecd4916dd86b5ff7574896c9e

SHA256
e6fa9d9e34ff3bf63ce782654b14e4b54a3abd1022c87bc099032c2948157672

SHA512
c7d567e3c039f98f3a99249b2d9bc2186c34efd73eec421331732d2307a8af940911381e27b015f58d0f65871bb4b038cc0f27d3fa495acd08994226bb033b7f

Download Submit
C:\Program Files (x86)\System Utilities\Microsoft.WindowsAPICodePack.dll
Filesize
102KB

MD5
9531b41519156855a45c46f0b379a784

SHA1
00b857f09dcf0c71dab40c1a8c4c54d411fdb197

SHA256
418b5e7a96f9a6105cc6fe45896a9164e79c8849f40be23a411b5563a8e3a0d0

SHA512
10034288101d235cb7af984fd6a0db11c7f56dbed648a71596b8b0c93f68d5ac5cf00be033153a91e71a311374b220507f07aa5b6e1849a80930d37a5c2577f0

Download Submit
C:\Program Files (x86)\System Utilities\SystemUtilities.exe
Filesize
1.9MB

MD5
cb597b9b40c93cfe74cd8a0775905a38

SHA1
1111ab2f4dccfd9f333cb234fae8063167d0c9ad

SHA256
31934a61620f3a9bf2de6f67fda177991abd1ec78b8cc37f0ce31e263290285e

SHA512
eeb19899f0bcdf3256c8e8d4bfa16e0acefa0802c06b4fce64fee1d74c9409571697affa4dce2259433f00fe0a7abf9a77799667bfe86a3f07307db76125b10e

Download Submit
C:\Program Files (x86)\System Utilities\SystemUtilities.exe.config
Filesize
176B

MD5
21fa0b1d75c0cc7369f1e735fe90c7a9

SHA1
e2d01a1b6aa66e5d3ed575aca79560b014bbfefe

SHA256
ad8267122c40d37dcd9d99e1412d763187a1825732f378db8867f3ecf675cf70

SHA512
60f6704cd1b3035a1a3403ee3870c7cbc13d6e601172745336ebbffa2ee3dc21785702470ab006c69dbbde0d5525625bb25ade5c641c80c8165fbc46fdad2ad0

Download Submit
C:\Program Files (x86)\System Utilities\autorun.exe
Filesize
17KB

MD5
f0c37252c88c7030cbf9cf30e5fb6048

SHA1
5ae57e47270aed2ea22dc1c28914442a99f59fc6

SHA256
15fa6afa5d20085b42c84ba131abf7553fa538efeaa53d7b7c866ff9e3458bb7

SHA512
93a102954dafe1fa883f77ed4b1b6a049f0ef641f97d5b18e739d58b652d2eba20ec85a6123b565cd8954cefca41175a5038fdc00791fd6d81794c58e73c2c1c

Download Submit
C:\Program Files (x86)\System Utilities\autorun.exe.config
Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_916782E55E1A78E82793614EB4F362C2
Filesize
1KB

MD5
8e9ea3e7582039d70dc78e598db6a87c

SHA1
9ba6faa833e9de7f54cf802ea6c160a0a60cca05

SHA256
09f2dcefc4dee6d152fcfb7796848f459ba1295073fbd8830799cdd46c2c38ac

SHA512
387703e2e8f48228037c473bb187b4829f39ee3397a0e37cf04041bf3f5b683ec6b7ad861f01149447ba5883a61e40cd7be859228c7b01932fb77d21aa373ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize
1KB

MD5
86c82daf298c3044e106a8ff70bb4773

SHA1
4401ed1aa0b6bbd8f262637b51f737c21ed26bb5

SHA256
a8b44f88bc3c66a98631aba8e02b5d28e990d06112d8ec1155ff0f1315aab37f

SHA512
cea2ae25a56658a6f43c702131bf7de68ae4f6a42edbf3b029cb83b7931586dd1c7dbd5c159d80ecf877b7d263065cda97a2a6b89159c058cb37acf269213a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Filesize
1KB

MD5
eac07941aafe836bd0dad76b9c75fe3c

SHA1
b2bc0a96ab10e4387017d24d1ff7f1b3b9911c91

SHA256
6bcece6326c58a91eed4b4965628ae9ccb61fe85a3d1061bb5081becdd17c76e

SHA512
dfe12982fcba8835e200af8f56c3225883b1a3e3e3069f17a4dd738f16db3d30972b7928fb322f2e35101199d54baddafff73e2d2e204a14cce0985eb4b5c859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_916782E55E1A78E82793614EB4F362C2
Filesize
540B

MD5
4baedca29be4179c85b02d3bd7f6e1ae

SHA1
27dffef355bfd278f9e1ecabaa40abfa1fd5aff9

SHA256
05e7458dbd336bde4317c018409366b17c9ce55cdea3cebae03098bf3d73b003

SHA512
55404022432323669f3870faaf6cf14fa27a95302df437ea13db042136a0f92cba0e557fa910db3ba3581e219dab8e8b4f63425f4acb3148063e10f57f284db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize
536B

MD5
7608cdf82533bd415213ebe24214810b

SHA1
6eb4a9b3abaf802741bee0162641b682c12775ca

SHA256
7eb30e78eab3097791d081349e081c5cd4e6ef07ac8a84ece43b3051503a37f9

SHA512
3100c4036d1bc356a0ed78b13ea6adbf5a06f22e0e4fd5b86173d19e78551a7bcf47bec00ec61aae902ba9460f0fd48227ff152419340b7c92aeccaac226efd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Filesize
508B

MD5
c9a3cdabcceb88b50dde53541401f71c

SHA1
749bd957baca185e9acaa5f56c457555e6f1d3e7

SHA256
bcbc1fddbc5f2ffa0d32ae32bb72f7b0b8fe49273cd16b95cfcd3b96789ac56d

SHA512
146e1963a4d00f57d48b88f1f8bbb3300afcc9764e17f9badc1aab8595f57bc922f3c0dcc8f888b14812494b8df862f8110a4c636ccf4edd4cba01b57749ec5e

Download Submit
C:\Users\Admin\AppData\Local\DiagnosticDriver\Config.txt
Filesize
296B

MD5
23bc669aa82b3cf8c4e8243eae7be74f

SHA1
ed4e56a75682046e2d8dc867952b6485435bf800

SHA256
984d1ce3ffcc988d27b739f6f41dfd959c617e51c459ed72e08b81c1243004fe

SHA512
88f57a851f88a966339ffe565770e310ed804b51c3b0af3261d4729c1a5f3c0f6703a3591eed0104bce5e2be58a42f37b9129d8dfe2f5199417f4aaca4d3da15

Download Submit
C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exe
Filesize
160KB

MD5
ab4441a5f23e443a4c1ab843930c586c

SHA1
b03227d6915e33bb123548a257951a131f022191

SHA256
2670ec42a59de4be83ddb4593fa3ae740864323dcf5e2bd31e341835c00a6446

SHA512
72442465a0cca56b6cfc8156ee5625ab6e551a5e2319ecfea7df85b68a531dc1f96830830e0eece24d98e22f2597a339d7a41d016998b0a91a326d547ab41b30

Download Submit
C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriverUpdater.exe
Filesize
89KB

MD5
8be6095eaccd83f4041b90ccee472737

SHA1
eace4fd2816e7ec5eebcbf1ffb81c397c5efb48e

SHA256
5d306348840972424bd18287b5b6ea73e956bc77eda50eddff912d68abeff0cd

SHA512
c61a7a8cbbf8c3a0a18b8d327dc0c22c0e134fbdc61f1aaa99fcfa3d7fb5855c0e8e1301d64480b0113673d19b56d6ed2241e369c37f89cbcb3beb699cd775fb

Download Submit
C:\Users\Admin\AppData\Local\DiagnosticDriver\Newtonsoft.Json.dll
Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\Users\Admin\AppData\Local\DiagnosticDriver\System.Data.SQLite.dll
Filesize
384KB

MD5
55c797383dbbbfe93c0fe3215b99b8ec

SHA1
1b089157f3d8ae64c62ea15cdad3d82eafa1df4b

SHA256
5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d

SHA512
648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757

Download Submit
C:\Users\Admin\AppData\Local\DiagnosticDriver\x64\SQLite.Interop.dll
Filesize
1.7MB

MD5
56a504a34d2cfbfc7eaa2b68e34af8ad

SHA1
426b48b0f3b691e3bb29f465aed9b936f29fc8cc

SHA256
9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961

SHA512
170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DiagnosticDriverUpdater.exe.log
Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\SystemUtilities\Sources
Filesize
64B

MD5
310ddee0d0f95e0b68a637773dac4a09

SHA1
06362dbf7b44fd1e09a77ff6f553cbc9572df69e

SHA256
b1af38a608fa3c1c3814692da1ad61a7944df902b1423dc1ea4e8181d08d8a24

SHA512
8cf9c5a4c9e1d0885a7ade4b008ba1629fc294466b49b59d70a50c2356d873cacccf24af532c28fd86ccdbbb866dd76990a62a898ba846c28c46c4f7ace309f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CFG13F0.tmp
Filesize
152B

MD5
68675e0d405c8c76102802fa624eb895

SHA1
f8cf5e4a678b4574365057ff91019adeb2f9d4a0

SHA256
b839cdd1c3f55651cd4d0e54a679bce5ac60ed7618a7b74bfc8ef8ca311e53ed

SHA512
c712c1bc97c9b7282262622367f399c18dd73156acd09c80d151a92c78d4119af9101bf902678b3fe767e9cc9fff95b6aafb858d179c7ff7d2721d1e9171cc3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3DE4.tmp
Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Windows\Installer\MSI17BC.tmp
Filesize
106KB

MD5
77c9fc2bca8737f2de4d1d31ac0e385d

SHA1
4eb76332e4cfb9d217cd42b7a0a31fc1b092be98

SHA256
f9f945ef8cf84de18a4c2a5fabf14f425bec19225f99164684ef3f65e9eeadbd

SHA512
867b2d0b59c54b909076120f7a92bb7d1d3e86e098dfb0284d50592cf9ed6a03b5c9d24e6bba7d424c67a4b9c0564095a28f744af393fa276053073a7cdbb45f

Download Submit
C:\Windows\Installer\e58122b.msi
Filesize
9.9MB

MD5
41eda719c231e212e02b2683d36edfa4

SHA1
7257a3350b7b856c16b146ff063f002b42903543

SHA256
1c6191ddeb164efff30358f7de88022577b6bfe0dfbe0a29ab0f3a2b25637bd2

SHA512
1d7382b75d1b12a690d2caeead05c74c3fe83f7888be1bee1bbcfec31d0675967473393b39af87d97ad10c91d2ad6420ad0be8ac58b45d88779ec8e9c4403e77

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.7MB

MD5
e4092644af17e3f2e86334d98fcbadc8

SHA1
5524caf83b0a024f241a7d4e4648eb8dc16a24a3

SHA256
c18a16badd8c46fb4676b72e5af6ff4cbc6bdfe1579327b829901186793159a0

SHA512
d47f5296fac785846f7fdca472068ee6c7fc7d7e2589f436194d62e0b725f66ca65e12ae37d9a55208bf5aa85f255910a458e88cba2a155200242be94929afd8

Download Submit
\??\Volume{78362842-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{33f5355d-d2e0-4a6b-98b4-86f43a8e8345}_OnDiskSnapshotProp
Filesize
6KB

MD5
c317c1fc74028d14e4b70bd548428d57

SHA1
b30152b9cc69892a4a00f18efcd5fc6a46944fd1

SHA256
04754edf52876c56178451f39f8870a6165a15a47c2a5f16f254cea48df48dd2

SHA512
36134c10b210682f00a029b19d8402edf66a6ddc272c37b3447a552aa1c4c2fec9deca824ee6983c7293b5e92b220a652a3ac6026c26a80e58b35a23e313b4b6

Download Submit
memory/2276-99-0x00000000034E0000-0x00000000034FE000-memory.dmp

Filesize
120KB

Download
memory/2276-104-0x0000000005EB0000-0x0000000005EC2000-memory.dmp

Filesize
72KB

Download
memory/2276-94-0x0000000003490000-0x00000000034AA000-memory.dmp

Filesize
104KB

Download
memory/2276-95-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/2276-100-0x0000000005790000-0x00000000057F6000-memory.dmp

Filesize
408KB

Download
memory/2276-102-0x0000000005ED0000-0x00000000063FC000-memory.dmp

Filesize
5.2MB

Download
memory/2276-125-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/2276-105-0x0000000006440000-0x000000000647C000-memory.dmp

Filesize
240KB

Download
memory/3224-198-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/3224-197-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/3444-157-0x00000165CE900000-0x00000165CE9B0000-memory.dmp

Filesize
704KB

Download
memory/3444-137-0x00007FFBCA3A0000-0x00007FFBCAE61000-memory.dmp

Filesize
10.8MB

Download
memory/3444-155-0x00000165CE7E0000-0x00000165CE842000-memory.dmp

Filesize
392KB

Download
memory/3444-150-0x00000165CEA60000-0x00000165CEF88000-memory.dmp

Filesize
5.2MB

Download
memory/3444-195-0x00007FFBCA3A0000-0x00007FFBCAE61000-memory.dmp

Filesize
10.8MB

Download
memory/3444-158-0x00000165CE850000-0x00000165CE8A0000-memory.dmp

Filesize
320KB

Download
memory/3444-159-0x00000165CE7A0000-0x00000165CE7C2000-memory.dmp

Filesize
136KB

Download
memory/3444-204-0x00000165CD410000-0x00000165CD420000-memory.dmp

Filesize
64KB

Download
memory/3444-136-0x00000165B2EA0000-0x00000165B2ECC000-memory.dmp

Filesize
176KB

Download
memory/3444-165-0x00000165CE9F0000-0x00000165CEA2A000-memory.dmp

Filesize
232KB

Download
memory/3444-166-0x00000165CE770000-0x00000165CE796000-memory.dmp

Filesize
152KB

Download
memory/3444-139-0x00000165CD410000-0x00000165CD420000-memory.dmp

Filesize
64KB

Download
memory/3792-146-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/3792-147-0x0000000000210000-0x00000000003F4000-memory.dmp

Filesize
1.9MB

Download
memory/3792-178-0x0000000007AD0000-0x0000000007AF0000-memory.dmp

Filesize
128KB

Download
memory/3792-167-0x0000000007680000-0x0000000007688000-memory.dmp

Filesize
32KB

Download
memory/3792-164-0x0000000007B70000-0x0000000007C02000-memory.dmp

Filesize
584KB

Download
memory/3792-207-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/3792-205-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/3792-196-0x00000000088D0000-0x00000000088DE000-memory.dmp

Filesize
56KB

Download
memory/3792-190-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/3792-148-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/3792-194-0x0000000008910000-0x0000000008948000-memory.dmp

Filesize
224KB

Download
memory/3792-174-0x0000000007C10000-0x0000000007C9A000-memory.dmp

Filesize
552KB

Download
memory/3792-199-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Filesize
64KB

Download
memory/4196-189-0x0000000005600000-0x0000000005610000-memory.dmp

Filesize
64KB

Download
memory/4196-203-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/4196-188-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/4196-187-0x0000000000B20000-0x0000000000B3A000-memory.dmp

Filesize
104KB

Download
memory/4872-145-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/4872-138-0x00000000748C0000-0x0000000075070000-memory.dmp

Filesize
7.7MB

Download
memory/4872-135-0x0000000000210000-0x0000000000218000-memory.dmp

Filesize
32KB

Download