c9a959e0312e0a67a982fb135437ac2c627b81928f6db8240462c64566537ae6

Analysis

max time kernel
1928s
max time network
1923s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Unilock V2.0/Firmware/Firmware Programmer/sttoolset_pack42.exe
Size

85.4MB
MD5

7805adcf13281071e8e91f8a0d030c6a
SHA1

bb6a9427bdac09c5307f14b4eb2b2730b59adfb9
SHA256

b15c8e1596c4a54c46398d42c6910c028711259ece4cbbc4f98b5f6108787565
SHA512

12b75fc9471d16e55fd93c8fc48d0498e1a3d6e9ed57d09c24d9101ae39dd7577076e9ed10f6b3bd150b4c44ab239a619fd23e1d3bc2ff5bd8cfad4d72860f9f
SSDEEP

1572864:T25mWgklqIpZRPQKHcCXq5UjEEgG/RHqhcc48Fw//lNcXxfWBT:T2YklrPOsMUnRHOccbwXD9

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\htiu2f50.rra	sttoolset_pack42.exe
File opened for modification	C:\Windows\SysWOW64\drivers\htiusb.sys	sttoolset_pack42.exe

Executes dropped EXE 3 IoCs

pid	Process
1604	ISBEW64.exe
648	dpinst_x64.exe
2796	dpinst_amd64.exe

Loads dropped DLL 29 IoCs

pid	Process
3648	sttoolset_pack42.exe
3648	sttoolset_pack42.exe
3648	sttoolset_pack42.exe
3648	sttoolset_pack42.exe
3648	sttoolset_pack42.exe
3648	sttoolset_pack42.exe
1328	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
4920	MsiExec.exe
4920	MsiExec.exe
4920	MsiExec.exe
4396	MsiExec.exe
3608	MsiExec.exe
2532	MsiExec.exe
2532	MsiExec.exe
2532	MsiExec.exe
1420	MsiExec.exe
1420	MsiExec.exe
3528	MsiExec.exe
3528	MsiExec.exe
3612	MsiExec.exe
3612	MsiExec.exe
3612	MsiExec.exe
1868	MsiExec.exe
1868	MsiExec.exe
3648	sttoolset_pack42.exe
3648	sttoolset_pack42.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000109-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000014-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000109-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e0052007500520066002e00260060002b006700280026006400310058006100240056006c002500270000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000010-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{0002E005-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000016-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000016-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000106-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e0052007500520066002e00260060002b006700280026006400310058006100240056006c002500270000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000107-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e0052007500520066002e00260060002b006700280026006400310058006100240056006c002500270000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000011-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000015-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000101-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000019-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000101-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e0052007500520066002e00260060002b006700280026006400310058006100240056006c002500270000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000107-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000107-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000019-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\DAO350.DLL"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000104-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e0052007500520066002e00260060002b006700280026006400310058006100240056006c002500270000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000106-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000018-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000018-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\DAO350.DLL"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000105-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000016-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e005200660037002100290029002a0031007e003f002b005d007800720069004d00720042005e00700000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000013-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000015-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e005200660037002100290029002a0031007e003f002b005d007800720069004d00720042005e00700000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000105-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e0052007500520066002e00260060002b006700280026006400310058006100240056006c002500270000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000104-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000017-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\DAO350.DLL"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000017-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e005200660037002100290029002a0031007e003f002b005d007800720069004d00720042005e00700000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000109-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000018-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e005200660037002100290029002a0031007e003f002b005d007800720069004d00720042005e00700000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000014-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\DAO350.DLL"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000018-0000-0010-8000-00AA006D2EA4}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000013-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000106-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e0052007500520066002e00260060002b006700280026006400310058006100240056006c002500270000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000105-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 54 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msjet35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msjint35.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\sttube.inf_amd64_175f837f295c24ae\sttube.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\amd64\WdfCoInstaller01009.dll	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\msvcp71.dll	sttoolset_pack42.exe
File created	C:\Windows\SysWOW64\JETCOMP.exe	msiexec.exe
File created	C:\Windows\SysWOW64\msexcl35.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}\x64\STTub30.sys	DrvInst.exe
File created	C:\Windows\SysWOW64\msltus35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msrpfs35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvc7f54.rra	sttoolset_pack42.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\sttube.inf_amd64_175f837f295c24ae\sttube.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\stlink_dbg_winusb.inf	DrvInst.exe
File created	C:\Windows\SysWOW64\mspdox35.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}\sttube.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\SETA142.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\stdi2f40.rra	sttoolset_pack42.exe
File created	C:\Windows\SysWOW64\msjter35.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}\SET9AE6.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\amd64\SETA130.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\msexch35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Odbcjet.cnt	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}\SET9AE7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\SETA141.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\msxbse35.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\sttube.inf_amd64_175f837f295c24ae\x64\STTub30.sys	DrvInst.exe
File created	C:\Windows\SysWOW64\mstext35.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Odbcjet.hlp	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}\SET9AE7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}\sttube.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}\x64\SET9AE8.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\msvc7f45.rra	sttoolset_pack42.exe
File opened for modification	C:\Windows\SysWOW64\msvcr71.dll	sttoolset_pack42.exe
File created	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}\x64\SET9AE8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\amd64\SETA12F.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\stdics32.dll	sttoolset_pack42.exe
File created	C:\Windows\SysWOW64\msrepl35.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}\SET9AE6.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\msrd2x35.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\amd64\SETA12F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\amd64\SETA130.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\stdics16.dll	sttoolset_pack42.exe
File created	C:\Windows\SysWOW64\msjt4jlt.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{87dc2362-f7fc-be46-980f-20d7164597c7}\x64	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	dpinst_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\amd64\WinUSBCoInstaller2.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\SETA141.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\VBAR332.DLL	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sttube.inf_amd64_175f837f295c24ae\sttube.PNF	dpinst_x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\SETA142.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\STLinkDbgWinUSB_x64.cat	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\include\ST7Fe33e.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72F321AR6.asm	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST721aaa.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\include\ST72652.h	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\stm82a01.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\include\ST72P611F4.h	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\include\STM8e496.rra	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST7F179d.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\swim\config\stm8l-8k-swim-emu_mb430_2s60_gp.bin	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\STTubDriver\dpin2619.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\adc\ADC.wsp	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST7F18a6.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\erLCDicp.s19	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM8L152C4.inc	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST722180.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\MinGW\bin\windmc.exe	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\tutorial_cosmic\Debug\vector.o	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\include\STM8L151FGK.h	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72F325C7.asm	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72_F_361J7.asm	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72324BJ2.inc	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM8L151C6.asm	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\eep539.s19	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM8AL31E88.inc	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72F325C9.inc	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM83baf.rra	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM83e6e.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\rdf62icp.s19	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\include\ST72F345C4.h	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72651.inc	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\STice\config\stm848ee.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\emu3\dlgtrace.dll	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\adc\adc_cosmic.pdb	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\include\STM8AF6126.h	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72F321B_A_R6.asm	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72fad.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72P611F4.asm	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST722103.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\hds\hdsmdt6b.cnf	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\pgf63icp.s19	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\erai24d0.rra	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST7F1616.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM8AF6188.asm	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM8AH6189.asm	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\blkud13.s19	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\monicc4.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\tutorial_stm8\step2_build\cosmic\Debug\cosmic.lkf	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\include\STM8L150R8.h	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST7FL35.asm	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\stm8.tab	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\tutorial_cosmic\cosmic2.wed	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72F324BJ6.asm	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM8AH6199.asm	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\rdic24e0.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST72F63BK4.inc	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\pm1723d6.rra	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\MinGW\mingw32\lib\ldscripts\i3862e75.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\include\ST7FLITE25.h	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\ST7FHUBAR6T1.inc	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\dvp3\config\mdt1c09.rra	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM826ef.rra	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM83f0a.rra	sttoolset_pack42.exe
File created	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM845b2.rra	sttoolset_pack42.exe
File opened for modification	C:\Program Files (x86)\STMicroelectronics\st_toolset\asm\include\STM8AH5178.asm	sttoolset_pack42.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7EF3.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\F479_Dao360.dll.5B60FF9E_851D_11D4_A752_00B0D0428C0C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\F248_vbajet32.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\inf\htiu2f50.rra	sttoolset_pack42.exe
File opened for modification	C:\Windows\inf\htiusb.inf	sttoolset_pack42.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\htie2f50.rra	sttoolset_pack42.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\e5e693b.msi	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\htienum.exe	sttoolset_pack42.exe
File created	C:\Windows\Installer\e5e6937.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\F248_vbajet32.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	dpinst_amd64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6B1C.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\F1122_Expsrv.dll.9D68DD2A_1AF8_11D4_AB3C_00C04F0971B2	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C6A7EE84-E316-4BE2-902F-254DAE898768}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\DPINST.LOG	dpinst_x64.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	dpinst_x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\DPINST.LOG	dpinst_amd64.exe
File opened for modification	C:\Windows\Installer\e5e6937.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\F479_Dao360.dll.5B60FF9E_851D_11D4_A752_00B0D0428C0C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\UnManaged\S-1-5-21-1230272463-3683322193-511842230-1000\48EE7A6C613E2EB409F252D4EA987886\4.3.1000\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 47 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	dpinst_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dpinst_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dpinst_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	dpinst_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	dpinst_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	dpinst_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dpinst_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	dpinst_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	dpinst_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dpinst_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dpinst_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	dpinst_x64.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	dpinst_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	dpinst_x64.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006a6a7fae100b6ebf0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006a6a7fae0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809006a6a7fae000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6a6a7fae000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006a6a7fae00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dpinst_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	dpinst_x64.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\Interface\{B196B283-BAB4-101A-B69C-00AA00341D07}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\Interface\{B196B289-BAB4-101A-B69C-00AA00341D07}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000015-0000-0010-8000-00AA006D2EA4}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\DAO350.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000000FF-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000069-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000101-0000-0010-8000-00AA006D2EA4}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e0052007500520066002e00260060002b006700280026006400310058006100240056006c002500270000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000009B-0000-0010-8000-00AA006D2EA4}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000003B-0000-0010-8000-00AA006D2EA4}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000091-0000-0010-8000-00AA006D2EA4}\TypeLib\ = "{00025E01-0000-0000-C000-000000000046}"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000033-0000-0010-8000-00AA006D2EA4}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000071-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000063-0000-0010-8000-00AA006D2EA4}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000071-0000-0010-8000-00AA006D2EA4}\TypeLib\Version = "4.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000029-0000-0010-8000-00AA006D2EA4}\TypeLib\Version = "4.0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000106-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000043-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000023-0000-0010-8000-00AA006D2EA4}\ = "Error"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000000FE-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\DAO.Group.35\ = "Microsoft DAO 3.51 Object Library Group"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000059-0000-0010-8000-00AA006D2EA4}\TypeLib\ = "{00025E04-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000008B-0000-0010-8000-00AA006D2EA4}\TypeLib\Version = "3.5"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000000FE-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}\ = "DAO.DBEngine.36"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000043-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000051-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\ = "CLSID_StdPict"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000003B-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000041-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000000A-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000003B-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32\InprocServer32 = 6000390028007100680050007d002d00490040005a004f0054006c00400050004e005e005a0049003e004d0035004b0044005900530055006e0066002800480041002a004c005b007800650058002900790000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000008B-0000-0010-8000-00AA006D2EA4}\ = "Relations"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000061-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000005D-0000-0010-8000-00AA006D2EA4}\TypeLib\Version = "3.5"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000029-0000-0010-8000-00AA006D2EA4}\TypeLib	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000039-0000-0010-8000-00AA006D2EA4}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000000A2-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000089-0000-0010-8000-00AA006D2EA4}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000103-0000-0010-8000-00AA006D2EA4}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000079-0000-0010-8000-00AA006D2EA4}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000071-0000-0010-8000-00AA006D2EA4}\TypeLib\Version = "3.5"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000000A-0000-0010-8000-00AA006D2EA4}\TypeLib\ = "{00025E04-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000091-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000006B-0000-0010-8000-00AA006D2EA4}\TypeLib\Version = "4.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00025E04-0000-0000-C000-000000000046}	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\DAO.Index.35	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\Interface\{B196B287-BAB4-101A-B69C-00AA00341D07}\NumMethods\ = "7"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000039-0000-0010-8000-00AA006D2EA4}\TypeLib\ = "{00025E04-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\Interface\{B196B28D-BAB4-101A-B69C-00AA00341D07}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\Interface\{B196B28F-BAB4-101A-B69C-00AA00341D07}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000071-0000-0010-8000-00AA006D2EA4}\TypeLib\ = "{00025E04-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\CLSID\{00020425-0000-0000-C000-000000000046}\ = "PSTypeComp"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\DAO.Field.35\ = "Microsoft DAO 3.51 Object Library Field"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\WOW6432Node\Interface\{B196B284-BAB4-101A-B69C-00AA00341D07}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000000A-0000-0010-8000-00AA006D2EA4}\TypeLib\Version = "4.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000099-0000-0010-8000-00AA006D2EA4}\TypeLib\ = "{00025E04-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000000FE-0000-0010-8000-00AA006D2EA4}	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\DAO.PrivateDBEngine.36\CLSID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000_Classes\DAO.Index.36\ = "Microsoft DAO 3.6 Object Library Index"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4964	msiexec.exe
4964	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	4628	vssvc.exe
Token: SeRestorePrivilege	4628	vssvc.exe
Token: SeAuditPrivilege	4628	vssvc.exe
Token: SeBackupPrivilege	3556	srtasks.exe
Token: SeRestorePrivilege	3556	srtasks.exe
Token: SeSecurityPrivilege	3556	srtasks.exe
Token: SeTakeOwnershipPrivilege	3556	srtasks.exe
Token: SeBackupPrivilege	3556	srtasks.exe
Token: SeRestorePrivilege	3556	srtasks.exe
Token: SeSecurityPrivilege	3556	srtasks.exe
Token: SeTakeOwnershipPrivilege	3556	srtasks.exe
Token: SeShutdownPrivilege	1244	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1244	msiexec.exe
Token: SeSecurityPrivilege	4964	msiexec.exe
Token: SeCreateTokenPrivilege	1244	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1244	msiexec.exe
Token: SeLockMemoryPrivilege	1244	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1244	msiexec.exe
Token: SeMachineAccountPrivilege	1244	msiexec.exe
Token: SeTcbPrivilege	1244	msiexec.exe
Token: SeSecurityPrivilege	1244	msiexec.exe
Token: SeTakeOwnershipPrivilege	1244	msiexec.exe
Token: SeLoadDriverPrivilege	1244	msiexec.exe
Token: SeSystemProfilePrivilege	1244	msiexec.exe
Token: SeSystemtimePrivilege	1244	msiexec.exe
Token: SeProfSingleProcessPrivilege	1244	msiexec.exe
Token: SeIncBasePriorityPrivilege	1244	msiexec.exe
Token: SeCreatePagefilePrivilege	1244	msiexec.exe
Token: SeCreatePermanentPrivilege	1244	msiexec.exe
Token: SeBackupPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	1244	msiexec.exe
Token: SeShutdownPrivilege	1244	msiexec.exe
Token: SeDebugPrivilege	1244	msiexec.exe
Token: SeAuditPrivilege	1244	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1244	msiexec.exe
Token: SeChangeNotifyPrivilege	1244	msiexec.exe
Token: SeRemoteShutdownPrivilege	1244	msiexec.exe
Token: SeUndockPrivilege	1244	msiexec.exe
Token: SeSyncAgentPrivilege	1244	msiexec.exe
Token: SeEnableDelegationPrivilege	1244	msiexec.exe
Token: SeManageVolumePrivilege	1244	msiexec.exe
Token: SeImpersonatePrivilege	1244	msiexec.exe
Token: SeCreateGlobalPrivilege	1244	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe
Token: SeTakeOwnershipPrivilege	4964	msiexec.exe
Token: SeRestorePrivilege	4964	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3648	sttoolset_pack42.exe
1244	msiexec.exe
1244	msiexec.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 1604	3648	sttoolset_pack42.exe	104
PID 3648 wrote to memory of 1604	3648	sttoolset_pack42.exe	104
PID 3648 wrote to memory of 1244	3648	sttoolset_pack42.exe	115
PID 3648 wrote to memory of 1244	3648	sttoolset_pack42.exe	115
PID 3648 wrote to memory of 1244	3648	sttoolset_pack42.exe	115
PID 4964 wrote to memory of 1328	4964	msiexec.exe	118
PID 4964 wrote to memory of 1328	4964	msiexec.exe	118
PID 4964 wrote to memory of 1328	4964	msiexec.exe	118
PID 4964 wrote to memory of 3408	4964	msiexec.exe	120
PID 4964 wrote to memory of 3408	4964	msiexec.exe	120
PID 4964 wrote to memory of 3408	4964	msiexec.exe	120
PID 4964 wrote to memory of 4920	4964	msiexec.exe	121
PID 4964 wrote to memory of 4920	4964	msiexec.exe	121
PID 4964 wrote to memory of 4920	4964	msiexec.exe	121
PID 4964 wrote to memory of 4396	4964	msiexec.exe	122
PID 4964 wrote to memory of 4396	4964	msiexec.exe	122
PID 4964 wrote to memory of 4396	4964	msiexec.exe	122
PID 4964 wrote to memory of 3608	4964	msiexec.exe	123
PID 4964 wrote to memory of 3608	4964	msiexec.exe	123
PID 4964 wrote to memory of 3608	4964	msiexec.exe	123
PID 4964 wrote to memory of 2532	4964	msiexec.exe	124
PID 4964 wrote to memory of 2532	4964	msiexec.exe	124
PID 4964 wrote to memory of 2532	4964	msiexec.exe	124
PID 4964 wrote to memory of 1420	4964	msiexec.exe	125
PID 4964 wrote to memory of 1420	4964	msiexec.exe	125
PID 4964 wrote to memory of 1420	4964	msiexec.exe	125
PID 4964 wrote to memory of 3528	4964	msiexec.exe	126
PID 4964 wrote to memory of 3528	4964	msiexec.exe	126
PID 4964 wrote to memory of 3528	4964	msiexec.exe	126
PID 4964 wrote to memory of 3612	4964	msiexec.exe	127
PID 4964 wrote to memory of 3612	4964	msiexec.exe	127
PID 4964 wrote to memory of 3612	4964	msiexec.exe	127
PID 4964 wrote to memory of 1868	4964	msiexec.exe	128
PID 4964 wrote to memory of 1868	4964	msiexec.exe	128
PID 4964 wrote to memory of 1868	4964	msiexec.exe	128
PID 3648 wrote to memory of 724	3648	sttoolset_pack42.exe	129
PID 3648 wrote to memory of 724	3648	sttoolset_pack42.exe	129
PID 724 wrote to memory of 648	724	cmd.exe	131
PID 724 wrote to memory of 648	724	cmd.exe	131
PID 2352 wrote to memory of 1124	2352	svchost.exe	133
PID 2352 wrote to memory of 1124	2352	svchost.exe	133
PID 3648 wrote to memory of 4716	3648	sttoolset_pack42.exe	134
PID 3648 wrote to memory of 4716	3648	sttoolset_pack42.exe	134
PID 4716 wrote to memory of 1740	4716	cmd.exe	136
PID 4716 wrote to memory of 1740	4716	cmd.exe	136
PID 4716 wrote to memory of 2796	4716	cmd.exe	137
PID 4716 wrote to memory of 2796	4716	cmd.exe	137
PID 2352 wrote to memory of 3516	2352	svchost.exe	138
PID 2352 wrote to memory of 3516	2352	svchost.exe	138
PID 3516 wrote to memory of 2524	3516	DrvInst.exe	139
PID 3516 wrote to memory of 2524	3516	DrvInst.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Unilock V2.0\Firmware\Firmware Programmer\sttoolset_pack42.exe
"C:\Users\Admin\AppData\Local\Temp\Unilock V2.0\Firmware\Firmware Programmer\sttoolset_pack42.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\{22507B48-8828-4C14-8D6C-2364F6DF2E62}\ISBEW64.exe
  C:\Users\Admin\AppData\Local\Temp\{22507B48-8828-4C14-8D6C-2364F6DF2E62}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B6D4B6F7-2A68-4FE8-9423-5C4B8A0435C3}
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe /i "C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\dao\ST Toolset.msi" /qb
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\STTubDriver\STTSLink_Install.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:724
- - C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\STTubDriver\dpinst_x64.exe
    dpinst_x64.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\STMicroelectronics\st_toolset\stlink\stlink_winusb_install.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\system32\openfiles.exe
    openfiles
    3⤵
    PID:1740
- - C:\Program Files (x86)\STMicroelectronics\st_toolset\stlink\dpinst_amd64.exe
    "C:\Program Files (x86)\STMicroelectronics\st_toolset\stlink\/dpinst_amd64.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2796

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1020,i,4770062162764366287,7825742579436984831,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
1⤵
PID:924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DDCAD8E10C1B0A10F639FE7FEADCB668
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:1328
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexch35.dll"
  2⤵
  - Loads dropped DLL
  PID:3408
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msexcl35.dll"
  2⤵
  - Loads dropped DLL
  PID:4920
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjet35.dll"
  2⤵
  - Loads dropped DLL
  PID:4396
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msjt4jlt.dll"
  2⤵
  - Loads dropped DLL
  PID:3608
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msltus35.dll"
  2⤵
  - Loads dropped DLL
  PID:2532
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mspdox35.dll"
  2⤵
  - Loads dropped DLL
  PID:1420
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msrd2x35.dll"
  2⤵
  - Loads dropped DLL
  PID:3528
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\mstext35.dll"
  2⤵
  - Loads dropped DLL
  PID:3612
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\msxbse35.dll"
  2⤵
  - Loads dropped DLL
  PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{223535f1-65eb-b24b-9bae-561132d4cf2a}\sttube.inf" "9" "477b48daf" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "c:\program files (x86)\stmicroelectronics\st_toolset\stvp\sttubdriver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1124
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d6038810-d50a-e442-b170-d0f739d16da2}\stlink_dbg_winusb.inf" "9" "4a9513c4f" "0000000000000174" "WinSta0\Default" "0000000000000150" "208" "c:\program files (x86)\stmicroelectronics\st_toolset\stlink"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{386df3fc-a927-0d40-8adb-7bd001464034} Global\{009848de-3705-0a43-bee7-16892ed5d6a0} C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\stlink_dbg_winusb.inf C:\Windows\System32\DriverStore\Temp\{171e7d5c-c7b8-0c4d-bff8-60a7e644fc6a}\STLinkDbgWinUSB_x64.cat
    3⤵
    PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5e693a.rbs

Filesize
132KB

MD5
2e5eab109e1ac8dd21db37507431a9a1

SHA1
44ca3c57dceb40cf292a84ebdf2c8c1535e531c8

SHA256
64287c9a8a62fc412ca90ed53a84820adef5ffd80fa239ebf5faa3d0ca1c88b1

SHA512
f4a0fc13ec493b2537997e465f8dd10d323120103bb43e14e333883cdd470b01501d39f81d757f3cbbfdd4b1566939a558406bb16e05b14f2c1db1394d41efd7

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DAO2535.TLB

Filesize
71KB

MD5
6cd1ae8eac6a7377329af15e1c493ba5

SHA1
66b7385b8da563b5dc0b1828a7ec1a9bef53c450

SHA256
49135b5921186861112072a73c4945d10527b4c487789ceb20b6c1ca8c577230

SHA512
62d7980a447408b950209ca9480042218389d3a2438c4f704646ada3995a1cef95723ef87f12737e7a6768b14c292387e2ae9e4422e839479a383f3a84ce46ec

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\DAO350.DLL

Filesize
556KB

MD5
8888bdbd4e118d915d40a11748282bca

SHA1
4e8822d2242d175cc3d708843e2cd71b7ee7033d

SHA256
a4b20735be317a924d2e36707baaf911fbae890ca53c5044fb506f15d33bcb6d

SHA512
a96f5e72905571de84f515dd8a19c87d5143ead532bf01f0132da8262974bfaf910f24b466d49cd4ee83845fc65f02c273a550786854aec3e0f4fa713929b562

Download Submit
C:\Program Files (x86)\InstallShield Installation Information\{D80F4010-990F-11D3-B362-006008E7FE2C}\data1.cab

Filesize
3.7MB

MD5
06cbe9476b6a4733238f6cd7ab8b07c6

SHA1
653ef2ea1c18dda0c1247a6d315290c6649385e4

SHA256
0fa51db6eeda43cd590c540900a1768952c2c63f409eced9c6d790f26b4c5324

SHA512
8a4211177b5be34856c018bd7057dbd29ba417ca418db93c492250ed0473aab7da5559f230382d7cae5761b1f43e3a0362b401cbf9df711755a59b385053c909

Download Submit
C:\Program Files (x86)\InstallShield Installation Information\{D80F4010-990F-11D3-B362-006008E7FE2C}\data8cd.rra

Filesize
303KB

MD5
0cb1a1df645c0021a999e4b284ded777

SHA1
cb21f90c8f248b7477527fa3ef80ce8639e9168d

SHA256
6438459d755ea8ee3224449d3c3281f363347df40b9f916cdc6f5c497178b6ab

SHA512
f174ad2f170b90fc706943d1b20397b36f345fb22003477de6e8067ddfbce3ed4326812163c9b1df1388c380bf16f9bed63397487682216579bcc72c57f41fb3

Download Submit
C:\Program Files (x86)\InstallShield Installation Information\{D80F4010-990F-11D3-B362-006008E7FE2C}\layo8bd.rra

Filesize
819B

MD5
c6868e813693ebb54c1642281f8f145c

SHA1
6d0b4e025eb80738fceeec7a26108647ed3aaef8

SHA256
f86a8b364d610c4f5caf0057f602b9635431a1a4a4db9ca9d14a717db7bcbb8a

SHA512
8ea50fb341cfba8d8c1d2dc7c4cb08c4be670e58da85206185c09431542a1e74e2fd97bb5df4fbd0562c705c131b4957ef5022604e8c14a13b186f0e71b18b37

Download Submit
C:\Program Files (x86)\InstallShield Installation Information\{D80F4010-990F-11D3-B362-006008E7FE2C}\setup.exe

Filesize
786KB

MD5
3f49ccb07dd991746fbc6efb32d26cfd

SHA1
6cd913a113a8cf3da677153619e1f87b68e1bde0

SHA256
40366fb068dbb61168f6047cad61e2a8d7c58c40e8040acb448375044ca2689b

SHA512
fd021875fecaa374e8f79c78e6e6ddcdab252c744a62679965c06d29f783f89c977fd47d91a0938fb9d3b474191f6c4e96146016ff67fc5f7e1eb86fa9765d05

Download Submit
C:\Program Files (x86)\InstallShield Installation Information\{D80F4010-990F-11D3-B362-006008E7FE2C}\setup.ini

Filesize
1KB

MD5
7172fa3c04c21c286f342fff499bbf90

SHA1
fd25506ec3b33c0ca74ba4e2abadf3ae2f2a89b1

SHA256
a57f769e7d20230b4bab08930e4ca0de6924984021ba5636119bb16908f230b3

SHA512
0ef59a7a3ae8af773df7f3e49ec9220a5aa2e093d884c5679902bc0783c6695b02522f4a46138a68cbb8a30ce41949f7ee11468608f74d1dcc102312e4bf6c25

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stlink\ST-LinkUpgrade.exe

Filesize
761KB

MD5
10a7b1a6b826415f650268466ab40422

SHA1
24acd01d6a98f6c2b8dfe987a30abd40a0c4849f

SHA256
2acab18152dd55049a755a0073120d592b2bfed29f3070123a8feaf219d6faf2

SHA512
ee15a4f118e76aa5dcbf48c255ec7b807bea21ba2b413fcc0545f6624fbe29a6e48a8dfbd7240a2af6e295fbe7d31d09d1abb8e3121753f2422974aa7ea113c7

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stlink\stlink_winusb_install.bat

Filesize
633B

MD5
f3b967a206a88d9a5c97c0fbe6906e1b

SHA1
cc51228779ef3025bfa67294728f851f860cd590

SHA256
e3a1e9b5b88a1343f3074aab547a1e15d0075d95edf711d86132ec8e61ac2e74

SHA512
d065284d98c7353b818ce0243d659574e8608414ceb147c045b3aeaf2a306332d54e126e22434b28f1d06949702fab5a71d699601053ec80295e7bc796d8a35c

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\tutorial_cosmic\cosmic.opt

Filesize
102B

MD5
fb3589051d74ad06d8e9432fedaf59ae

SHA1
39f680f4c73c455cb978a3dc7a5a213a9f4ae297

SHA256
87f573e000bc417bdb482bf0b82f468e394bcb0d0a8b325312b5ddbeea437ebc

SHA512
102722cf977e4a4f5476acbbe3855c455ff2c65b0cd6181a19e3f761c1ebc78d6dce4d5b452e2332a1037fd0436a1c0cb34d5388a6ec3fef61f8f1e33e2b595c

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\tutorial_cosmic\cosmic.stw

Filesize
205B

MD5
6f985f4eacd5bd81b36dd8fa1264f16b

SHA1
14973554344c1a4c47cf293268e0ef18d2916113

SHA256
de3f988d0bd72d57b62223cfbc1e64c30d69d8717cafbba45ed0c009f9307a45

SHA512
de2e6af80c0932b10d2b4369313973194af56190c89458172dad3d104c63feb533d541803ab741495bc00c5526aa819e9c972be94ae874b69345d3d36a503e0d

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\tutorial_stm8\step1_setup\cosmic\stm8_interrupt_vector.c

Filesize
2KB

MD5
e28bcde19c811fb05c1d7a8b2ad91e2a

SHA1
e959d742d403701210bbc511ee8fcd2aa96ce8bc

SHA256
8b46594425d38b2482d375272818a34a36a17c3c222f5d85270fea59f9591388

SHA512
e2a971d443ea7070b4a0af84ea65a3b3e1f5c00e00e7bbcf05fc429c10e18aa18b5abde3fae3b1232cf791621d94fa8ebc572cf0ecd3a0be0918a4ec1df0fa02

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\tutorial_stm8\step1_setup\raisonance\R_stm8_interrupt_vector.c

Filesize
2KB

MD5
789fb66163d7017dae0e6d5e37336aac

SHA1
b7112e87c46fbae8622bf1e7f94050a79505fcfa

SHA256
26c4034f16e05765b46bbb4655a76ed3ed4110a4c108efbd3eb8143550acfe12

SHA512
d7f5168b7e8b4b530254f3946a1a83d9abc54dda86ef94ba2c49247b0fe61bc23a376ad4b0ae2da3d9173050ee59e00881f7d57249902be0424cc07b2d10a0a9

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\tutorial_stm8\step1_setup\src\mcuregs.h

Filesize
1KB

MD5
4506904d6045335093d54186d54eb902

SHA1
be49856c7b67b8952193711c0f982e51c6503791

SHA256
fdcbe18c952accd4ac9187e033223e2d81233e36dcb1a474d9392da998811d29

SHA512
bd91953d03b9cbcceef404eaa33968ff702e57ef0f70f9fc4cedf0ad5efd3a5c431c5f9d61a33f596eb1fbc37ab0effe7e3c09f6fff4b80aab01948b223457d3

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\tutorial_stm8\step1_setup\src\timer.c

Filesize
7KB

MD5
41c5a118954b5d1909fb1cb050cd34c1

SHA1
d4505992fb5dbb54b8cb9f51cf1fab7f8b29aea2

SHA256
b9d2599bf945c0ffdfe7897ad366061d8ca1ef63dbc49da69f4ffec2e9c41727

SHA512
b8f02c2a935f8b3097ddd42ea231ee6a9bf406e264560bd6d2164adc4626f270b6e58670d6f1de579f020b2196209ca710fc62e9d4ac9b40faffe1ed329d36d8

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\Example\tutorial_stm8\step2_build\cosmic\cosmic.dep

Filesize
83B

MD5
585568f631bec0767b1e7246a27dbeaa

SHA1
73b7c364a38b6adb901663dcd96094701c0362ac

SHA256
24d59f1cb6ac774740789c2dd8e61a213b7022c7edd6ec65d2710d7e8720f411

SHA512
28f78c9749f4b407d389bec649089faf93f81c77a5f75ed94bfaf559b063bb26bb5713d14734abaf027a7902868434de7a9849d6de79b2a3a681a2e6251e2e7f

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\MinGW\bin\dlltool.exe

Filesize
638KB

MD5
d2ec17c97f584477ed90d6ce988a268f

SHA1
7c9c54ad001b18129083ddf2565c3d74227d2094

SHA256
8044d14b7391a72f9851da4a62ebfe0f14246c5b970ba42a15aa2a815feb456d

SHA512
3857634de293bf195baee5858bbb0ea455d658aa85908d5936c6555d3273b0cfa99a725471275a4732ad69212e18e8f80f18755874d9ba31b683310c5f493e30

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\STice\signedDriver\dpinst_amd64.exe

Filesize
664KB

MD5
25d0a711e33c75b197d76884dba1dbf1

SHA1
bf00904f2a3126485332b2c088f0bd9b9c1baf6f

SHA256
b6bae3bb8fe8dee5db004965bbea0466bab7bb4b4193e8fa544abf47f03562a5

SHA512
962114a727009b45dff1d03a40391ef24f316194aec82944ffbee7c351108ae380e5ff1cc7bbb942ff756d2c3359217dbd6800a36ffb8658497bf5ffe7dbc9e5

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\STice\signedDriver\dpinst_x86.exe

Filesize
539KB

MD5
3fd16c1cca83d9f0e91fccfe32d812d0

SHA1
e1cb7d9b8f73afc2602c74cdea3f91773b98841d

SHA256
0af038b08f84604d2805202b5429210c5ef37f23623b8dae2bd8921e4e76a0c8

SHA512
e0505a0aec5e404877a917d1ac2ca436cf045549509a7654185143cdbfde7d774a5333b4385883d154d538d88e60de9bd43b65577d057fe1a567db0af120804b

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\builder\main.c

Filesize
102B

MD5
c1d5eba200384910d3ec3a17e60b5b0d

SHA1
416d28b0c99279d3d8d73edbc921b032f1f80442

SHA256
533405f5156a64437b370ba161bcf15d816340c374adbe7afc2cd36ab467e91f

SHA512
3cc3d9e106d2f2a6c782db8fbac8bfe0b32a26838f12a16655c0cd4213f85ba0bfa6cd574d2cca170efc6bd70a2287b85feb9ad17f30fe763f75061ffaa60b64

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\dao\ST Toolset.msi

Filesize
3.8MB

MD5
801763b601f44ad94d10722b4b281991

SHA1
88f5e41596695f8b01accad9a8ceb1c7634067d6

SHA256
3ae892cab8764e69f380e80343b22653823c6492f05529cb6e0318675342bd79

SHA512
a44c84c49e1d4ed67a7b6a2a5568d154c99be4f32196b1f47cf9ca399f8632b08056f6bda77ce90ebe2e662ccfb28754340552bcbf546aeb56309d851ab77488

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\dvp3\config\ST72264.bin

Filesize
283KB

MD5
e30c9b4cf8dba2d6a86439f4a12e37b2

SHA1
5681e67a7befc0add7413d17ba12ac757e5dbe49

SHA256
00397d7095d6f5655e7199c6af45c443c3266c74b5f8698b993b1ca6ab356754

SHA512
b2bc2378bd10b0bbf63893eccd0bd5ad657c6f8eea145d1c0d687e754a95d354f232b8a11bde2f623d23c22bbd96ff89f5cc978b259d6032ff11e1c5f3fb9b4b

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\dvp3\config\Tebb6c.rra

Filesize
19KB

MD5
d7f9d4551e57ea6e4840bab69c1691f6

SHA1
3ff453860e708ed71f2de2be1c6f66e4b2fc782c

SHA256
eb2c2f31e2a530da08a87dd71f43e37e11f9895fd6fda595e997ecaaf0be3f17

SHA512
8606fbafcf97341853eea48ec6a8c4f659970c8f6097973dc32c82b823030aee1e39655fa02ee0ee6b27eea9c569701bd32c7144543e8f33dfac4fd615c796f6

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\dvp3\config\Top_dvp3.bin

Filesize
57KB

MD5
3c6b2d67e2cf237a9d2388d5badb28e1

SHA1
c4d84a476433bd76d63146bc4dfe9c4f6069ef0f

SHA256
798587685f87ea86f8e21ea6a0651f7377682435f49a7c29c46e205b8314209f

SHA512
4d703f15d661fbb1d8b5f5993e917d020327ee56219060a1ce1c33b8913ece1f8027a7037c883af9c83aa5571d0e57a30f14eb26f821fb97cc1bb1589b162e2d

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\dvp3\config\mdt25.bin

Filesize
19KB

MD5
bc847612ae0f917f97d5cc950181b59b

SHA1
b87e7985cdc6054510b03044fca99bc28365403f

SHA256
eab783db5ae08bf1f5c0d04ae91f86e31f1d862f6fdbd53ec020efcd83829fb3

SHA512
d697449fc19c7a45fc401274abeb9a3ed02d4e372692e431ecbaeb6b77ac56e45549f6e66dbf3a0957f4acc3e7d6895406db99e81a4c212174e367bfa3adc1ed

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\dvp3\dlgtrace7.dll

Filesize
292KB

MD5
fce15873eb56eb6311128349053460c4

SHA1
73e619441fec168862a1c0ec9ac0085d093daebd

SHA256
d76a525aff705eb5614cd11ba98e213e2c84300845af4b75248a72612b63fb0c

SHA512
b079faaf3c2169fdf46640a7015189bf14cc36f4bbedd8d6b98f47a62d8fb46f8931a40451d311c38306cbebcf27b59765d71b993fbb34809948a2a884bc6f86

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\dvp3\trace.cfg

Filesize
797B

MD5
9c2303223ef981ca17a8f5c6e753dd58

SHA1
41ddd389fbdf33a5e35c5595cbd476ea238d2881

SHA256
704e254cdf094bb757e727731b73a2b8f7567b6c76520d7b2d1bc667ad52c775

SHA512
5c066892a3fd68c6a0eb68370c75ba7a888ba29cd3134123bb2808fb0cab27aed9ff90124b9482598df8378eee579a73293cc6a39d8e7af435ad150bbdc5ccd2

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\JICC_API.dll

Filesize
120KB

MD5
cd9ff4f15cfad9fbb2a22bca415629a8

SHA1
1de291d8ea64bf78089ce9dc357298f8c4e16cd0

SHA256
9ef2ddb8447a2903a8ee84b49906b62615fe9abac4533f2cbad09d6f3fa7dc4b

SHA512
7fac1045da09805c03d73e8bffac73afc912a90dde69aae5a87a58cd4682c8164249012186fe878554aca85b0dda84804a5694d7a3933baaa4aa5c3e7cb6505e

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\MonitorTools.dll

Filesize
176KB

MD5
0b8b25abf792de67e9cf6bb44ca6990e

SHA1
e7520f16c31bf9d165269872c253f45474dd50fc

SHA256
ea6f4a65595675125f1cab77ba560507546278d191d0e2f5b689641d70cf0b94

SHA512
8442bf696dcf2bd12117b07f60a9a57b8a80a3c3a0543cc0fa14b1f66405715ef39db4da23aec5691501cf3eb930ad7c0e78880ac5083fae1172a0f2d8d95060

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\RLink_WinUSB.dll

Filesize
60KB

MD5
5a8c850dd7d816ab32d8551c03d0654b

SHA1
27796bb95ee53178c22128f32020df683a297b5a

SHA256
cb4c8af8fc9ff84cfdd9fa0775f7e44dd1ad2c732cbee27d25c537c1c2036985

SHA512
b8b3178a96684b367e0a6f52b9bd86dfb1a9ecb1efe7a9afc080d36d9876cb26693ea0384295273999e00602e6fc16d4352e14acbad7a9b3a2643e3f1f80bac8

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\pg264icp.s19

Filesize
368B

MD5
b0d2395dd305d268d5fcbb6fa52f2851

SHA1
6a3671a267522a81e5b451b43829368f570a4e6b

SHA256
c4751c5c964802532263fa2d5b57e3afc31090e2a4fc4753d44e65434168ba71

SHA512
b505e5f94ec5c68df0140f3a85e0321a8510e89d6013d96d083a417df8ac9fcd31818741426268c776c69c69d71edc8101dc1dde8eee19b666924e1dba769125

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\pm16icp.s19

Filesize
822B

MD5
c3c3c540719faf2bb4bd50a893dade52

SHA1
c7817d3b61509775e5f2b51e8eb881fc92c7589b

SHA256
c7e3714b2f075823401bf9df075ff0af0ade6772b402eeb5db033bf5176955b6

SHA512
397e8a4ca6863cfbcccefe6784496f1fe838fab61ba33f2a5d2af47a9dd8b467fefd7dcdba25598d79648f414f8033c01dfd67c86cf9b24020cde02cbae43333

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\pmicplt1b.s19

Filesize
312B

MD5
62e21194808b504ca36690baeba9c1b8

SHA1
30f8287c147481e36fccb8cac263480cdabd5e51

SHA256
1ce96e4052fcca39429ce2e1fdf8300259e6d75407481567cfff6ce30735bb21

SHA512
3e471e78598f0820d7c58b882530782bef860671b39dcaad0f0ad9704d568496b5fcce7f175b27262fbfdb07704c0ac411d0dbe9958bf4d1bd27ca4f8e689e9f

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\pmicplt2.s19

Filesize
934B

MD5
9893b2bac0aeba1ccde7cdb3bba91851

SHA1
1ef655d43487d1dcd876c2afbd64c516f1090437

SHA256
33363653b9951a727ae67e15575142c0d216b2b274b5bf1ebd5ba787fce9b615

SHA512
c68bfff8986c07178f75600989562fdf37fea8e25d608443cf0744cbdff10ac73ae859704a4bb8654826d32f6c6d497a2a5b92c4447e95e6b57976a190991616

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\pmicplt4.s19

Filesize
312B

MD5
e2bc3c8cb97e80c8860d4753e50c3de9

SHA1
50e3e451335d943784f61021cb334684ca22421e

SHA256
bac5ccfb9d9092c28df883a7b6e8e44a38a5d76445474a3cde121a0e79501d28

SHA512
f9242e3ae20f5fb03899b995b56de809e488b93b43b83fe1a289fabd90343d640d761afaa231fc78f95660fa7d3b6d56dad16c9ea38004811ce862f71cffd6ef

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\pmicpult.s19

Filesize
316B

MD5
6868b03e24433ea7a79f895f51e5eaef

SHA1
653c2df2c563c8974fdbf1d0df686e9bfa385a6b

SHA256
b8cadec81d9fd626d8f368f87fb9add031246f326446a00197ed411fda99bafb

SHA512
8d8801a08ea800dc135ae629df1ec971fa2b1d5083115c797cde823667a35785461378d56f984733daa1089d0d74df44da429b48d388ac4676b74023078bd520

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\st7icc.bin

Filesize
49KB

MD5
05344ca1ff918721821c73bb5ab7895c

SHA1
bfe8d3ab71515b3e7a05aee63abd6118450b5ab5

SHA256
19ba7274b0f26b93855bc8c481fc3d6d12e272afeb94974cc1037aaede98e933

SHA512
3b825597986805657b09bec151e1430d78e5553ac5e5e9b59feaade4f5c3db73f03a9a7e297d106e86311e9b1d1f8c37a4864d623f0522d360baf063c6f28e1f

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\swim_icc_mb430_2s180.bin

Filesize
2.0MB

MD5
2c3a62e55a1954c20e387c592e8ddfc4

SHA1
0e2723e74629c017af3100111c70693af69ce898

SHA256
5ca724a8ec4ae377a8e535890d3dc55bc0bb5a18c05cb571f3eba8bc0e04b8f1

SHA512
28cbd1e825eb831370173b76c7a0e700980e535a83809d6a3e0c2e50e07d7cdbe512fbcaabb771d754de11b38ca54e8de8fa7deeedd618b94b8c0b52f0703589

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\swim_icc_mb430_2s60.bin

Filesize
885KB

MD5
870115ef5355e173c84dd513138b5208

SHA1
49cfb0a5ab688228c3b3ad9fd0f116baf3d6b188

SHA256
278bf90c9cf901368fa17a951a31e5b722fd742155b9c33a225621b76430c8fe

SHA512
f203aa80b8102cbde020426e136cb19093493ebacde3d065cb6aa49005909df64066edce7a4f6406ef8be152d89452d7915ad7cb437e505ee7f382a71679a67b

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\config\swim_icc_mb430_2s90.bin

Filesize
1.2MB

MD5
e352042e187d474f89a67e1564a0f874

SHA1
39fa0330b9931797c6f8a008403b9cbb24c9849d

SHA256
1bd35d50d3190200c61339507665cf293caf0fb33470ee6de9d58ee93d2dea22

SHA512
77806e4efa9e0e2a68caa0f70a13dd4e32d59168b82cd48ec57ab05f790b70ae229d24e3cd81c4a64864a0312177aabafaa38f66a3d4b4ae234b58733212bec2

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\dlgmsci.dll

Filesize
408KB

MD5
3888c7d9be8cb54f2cdef4f26578555f

SHA1
dee4fc9547412a4833d7e2b35cd548c44fe81fcb

SHA256
0f951936832884adc80a69c27c689fa57f72949c89f52c6074906387d297484d

SHA512
63313bf6a1a7bd6d59360c75863a32dbb7ad1e0530a1155b7de3bf42c210f31f40f25b2a4f944b709ddd790389213cdd89ea39a873ed52d816551e3b0bd9f1b3

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\icd\rlink_driver\RLinkUSBInstall_121024.exe

Filesize
2.8MB

MD5
770305feff8a57f586a3b9e20d7dc7b4

SHA1
447d2167725fb7e49585ea7b03d1f02f71bb09ce

SHA256
e80fdc24de36814adc62c863a1731608e6adfbd49aaddaf0089b45a08b040851

SHA512
5e09aa107af6e4a51d8d6561b04e2f1e145021781daea0b122bd07103073913946bfe584692039ccf70276389d346b21b34d08255f6a50b2b0948b3710feb806

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\sim\simst7.cnf

Filesize
343KB

MD5
33341df129d22fef7133e54935438974

SHA1
2611e13ec023bde7afaa41c77f1fd286735dbf3a

SHA256
1e314071ab72a2dff7dc95247891ac1bd5b95b919f84ef17ed2162460596acb2

SHA512
bb4c136e5f28c8e7787062e022c9efe91e356c8375ca7cea84ab286f064a3f8fb840e37149013ba95612d3d86cd280c65ecd2f1b420333cedb170ca6a08045c8

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvd\stvdebug.exe

Filesize
2.4MB

MD5
0212685cab5adf1839bdeefb8dc6b594

SHA1
d589f71942c2fa30a4c8455e58a148dcff9efb18

SHA256
4cd20d83b143281a29f58d6d64c6668009a11e8a6345b935f138137e4b441d7d

SHA512
e2cc55510f458f628459780fb917b8206015664e15fab2c859a10b27be6e54aa0f1bd541d55357d07f574569d566d74e3ff6c1596de09bfdd2a23b89df6532db

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\STLinkUSBDriver.dll

Filesize
96KB

MD5
c11fb9f478e74df8ce28bf22279149db

SHA1
7e14b2ceccf003e46bba13432995539ffd003ca0

SHA256
3382b950373958e20e5c56c58b9b828123c06f85a335c071c78da92d9f26319e

SHA512
b55b02355c36927e969576fc198776f6fd8ae5c1935d411a1c5c999d15f8d3f2586def7a813be8f7d72a3173eb5b429c74e9f4b98aec44fbb35f205905f75746

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\STTubDriver\STTSLink_Install.bat

Filesize
198B

MD5
6b615ae4c5d8683866c57714c6387a23

SHA1
7f34e6f7d77b4416043a5816d4bf7e98feaf1f25

SHA256
88e0820a90f5b14fd77f4cdf2b3ab10ac99aac2361950402fb58a54d9762bee3

SHA512
cfd1950cd3f6aa8a2879f40280dfb914303f1e28414fa70938a2fd8afd310772404d94e6f660b028b0adfbb86f68a76e247c3bc7855f5b76aace8a71d6a56744

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\STTubDriver\dpinst.xml

Filesize
182B

MD5
22283539e50f5e56375a847dda43aac2

SHA1
f4dca6fb0bb9a0c0566f055fe120b5b8b92fb0da

SHA256
2bd2f21053ce847f3e4108db3447b4d43fea3e722590a9b5b20d91004df976d6

SHA512
96852edfbef5986cfff570b2c784dc0b6cef9fd5eef71638d179ce0190853bf8c5d7c484eded6fee8a8a556290696b1283697c6285912dc64128c72983aa1732

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\STTubDriver\dpinst_x64.exe

Filesize
1.0MB

MD5
be3c79033fa8302002d9d3a6752f2263

SHA1
a01147731f2e500282eca5ece149bcc5423b59d6

SHA256
181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab

SHA512
77097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\SWIM_API.dll

Filesize
140KB

MD5
5bd16e0524c720629048a0c7366052a4

SHA1
4cb46fea38fff3d47fcab90fd0e9054021ecb635

SHA256
99b06de3d582ac6e8787a5cc80990af3799c1f833f863fbfe3bb52e4c012b556

SHA512
d94ed478b0c2dc86c2cf51ee86e91661c17d93b5d7c031bc5f13368efcfd79336e03d1f22fcb0cee823bfad1003c377548e89ff91d69517b6549647a6d9079a4

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\oricp51x.s19

Filesize
402B

MD5
fb2af70949d4937b137adb32fd47cbb3

SHA1
c0891ba58acfd47e44aa24d7b9229e129972c51e

SHA256
40aeadc98f0b8a2f96acc72313e2c7112667857d2f3d9aaeb602d0a308daac40

SHA512
1ecdb5c6f18d1ff52538dc02a77677a66ef8e419bb60eb12cf9765f8122ee1500d2f289ae71afcb0bfd5b53ca2aae2b8937f062a8541e7ec0fb9fb52ca3a310a

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\rdicp51x.s19

Filesize
256B

MD5
1ede63fa7aea35440d599285ce15a783

SHA1
ea04eaa4b73126208e606dcdb5fc7d174af4a135

SHA256
a5fc07db22b490b2d1c9dd975285aeba77871eb5cbac8d903f8394df42da851a

SHA512
8f9a42ee07270d9f45dff1dfa66b1a6a7bdeb93f7de156a6c42530142403c44e3578ee571199130049d923dbdf2b0749634c3b9d3e25093fef97c979d5f795d2

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\st7_EPB_user_manual.pdf

Filesize
695KB

MD5
465d3472baffb20f39b3567f22e46ec1

SHA1
dfa7a2277f6da27f8af44fb158bc90895ec683b7

SHA256
895eb1627e4daac8df084167a2ad0e7691b09128135c2aba3557ba97f214225c

SHA512
4218f0208d3a7f5401b6f1ee5550909918be005b127b2842c9c79ad5d0936b80aeae6fdece43a3f1a82b0c60696bdb6b39b41e4f92feb27ac8af3bbb9b48a73c

Download Submit
C:\Program Files (x86)\STMicroelectronics\st_toolset\stvp\swim.s19

Filesize
398B

MD5
9d64c471a3ebd04de370093d833d8c6d

SHA1
723dcf499879fa9325a7fb09442c9e02cc2d4cb8

SHA256
420b0628870e1fd1b5ae9aaa7d1276e3bfacd573e08be9dca58a980bd393acf7

SHA512
9a8d44cafd4a0eab9cbe2992f816c57f9901d1ab3bba7995796a9f3beee2411778d672f6b3024e5e033e0feaef1e5e03d2ab82dfd8df769145cdc564eb2b1e67

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ST Toolset\ST Microcontroller Support Site.url

Filesize
115B

MD5
43d35cbc01ea3a350e713a23caeee65d

SHA1
2fc2ac0c8cd4d2f547a095983b9d7f33365754dc

SHA256
e621b857e9390753b2d5aab5033888fefbf015d3490b4191cd248d9f9f8f4a9a

SHA512
443ccc2c8825dba2c99d16527c7cce055ee589291993ab91fd8d5231af50d17c22ed5ecb7c22eae437ff20f7cfa7ff0ad05ced19f8613ca34f95d4905c46d110

Download Submit
C:\Users\Admin\AppData\Local\Temp\{22507B48-8828-4C14-8D6C-2364F6DF2E62}\ISBEW64.exe

Filesize
104KB

MD5
41cb698f967b4d9f2580ea2a21a5a710

SHA1
1e2db1ac09d0cfbd6601b95c2a1d78a80f78e236

SHA256
10205dd8642824f9c81f32e73d8402e892a839b71a13b3816f548f3805fded8b

SHA512
7e2f439d2ca8369c771819f8d137ec96822ea63ede9b34b10946343ea14b0b1cb3b828d43c17fb3c6c6ac8e2bd7aec4ee77dd6cce861706d476af1150d85a158

Download Submit
C:\Users\Admin\AppData\Local\Temp\{22507B48-8828-4C14-8D6C-2364F6DF2E62}\{D80F4010-990F-11D3-B362-006008E7FE2C}\DIFxData.ini

Filesize
86B

MD5
10baa5b67536f4433f37534b9c8bb828

SHA1
82e5c34b1279afda223b639b49078d03c52875f5

SHA256
1b9fd5c1f18357bd459be20bfcbf47ee18fa0c5d5cc42f6aed2705d5868b65f4

SHA512
49c6798ebb3b6137cafb78b88350d02094367523dcf8f9e580de1941e514b8b3df786d1d817090e5dab80ac4d0d015796b2ce28b296db31d111e0d0bbaeebb37

Download Submit
C:\Users\Admin\AppData\Local\Temp\{22507B48-8828-4C14-8D6C-2364F6DF2E62}\{D80F4010-990F-11D3-B362-006008E7FE2C}\FontData.ini

Filesize
39B

MD5
00f313e3e007599349a0c4d81c7807c4

SHA1
f0171f15aab836a1979d3833e46b5e59e4ea32e0

SHA256
766ee687d90b0217eb41cb85aca04375bdc24db986a33536631f864b7ce1a08a

SHA512
8bb25a62c0b1640dec36403a493ed54c05f7cde7b7357c8faea785a79c4b76bbe6a3d6fe78db52b558a37abac90c2b2e8b13868a76294554d51670e9fa8764ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\{22507B48-8828-4C14-8D6C-2364F6DF2E62}\{D80F4010-990F-11D3-B362-006008E7FE2C}\_isres_0x0409.dll

Filesize
540KB

MD5
8938d3d18b09e92eeb9c403593365eb0

SHA1
7ce126881e50f3d62b24e86fcb213510db33b9e4

SHA256
1df36449f88bcfe640ad648a75b0830a82eafa38cd43f069dd6ddaee8144f975

SHA512
ad1b5e8cc1583e036ee2a6b2b640349f23d60e45f61edbf38885db8473488dbc55b3c82ea33a711b8701fca6f457b44d86cf337631f44e67476bfd99b072a3de

Download Submit
C:\Users\Admin\AppData\Local\Temp\{22507B48-8828-4C14-8D6C-2364F6DF2E62}\{D80F4010-990F-11D3-B362-006008E7FE2C}\_regtlb.dll

Filesize
31KB

MD5
729f35dfd44b7039e5bb34e6e4d3a201

SHA1
43816def223043bbe9ca70a9d5d460c418d64a7a

SHA256
12d30ab4a8e7631793cc6f1cf55df9052d023debe69afc4e8230a03e0e8966b9

SHA512
086ffc174cdece96275d50eab42a4a9e6235cc9f84de0c6f643c751b3f476b4ebadc0b55166219c2b06337841a96afcfd41a2bd3a2b5ebc3f1014719527694c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\{22507B48-8828-4C14-8D6C-2364F6DF2E62}\{D80F4010-990F-11D3-B362-006008E7FE2C}\altimage.bmp

Filesize
19KB

MD5
e8ee197d4bebeb97934d461017fd9959

SHA1
64067c849bdb2f77c609cd1432b255442575aaba

SHA256
7d0dbc5e41b93f7168f06d400fc5062500c106dbdc993490ee78aa4daac80ebd

SHA512
45c198d85662b8f1de748af657ca20f32aaa1e1487c6483bc15dffcc298a8f799b0073aab6c22a14660b76f9854b54936e1e78d4f3729e5c4b5e03a7cafa7a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{22507B48-8828-4C14-8D6C-2364F6DF2E62}\{D80F4010-990F-11D3-B362-006008E7FE2C}\fullscr.bmp

Filesize
1.4MB

MD5
350bff7c41e13df92198a2f3de95a68c

SHA1
6b9cca35e280e894f63b45c51b0aab1030568a44

SHA256
fc42c5b3ce003f0ed356a98dcfadbe1c577bc270be594eac74e9a5be7150ea97

SHA512
7935766ebb0b64773d6ab24171b230722c849abbf8b1bc685d71dd65f67ddc973b67422f86107777612fcad11c17e79d1ecd5177a8663b3e5c59c20c951648c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{22507B48-8828-4C14-8D6C-2364F6DF2E62}\{D80F4010-990F-11D3-B362-006008E7FE2C}\isrt.dll

Filesize
255KB

MD5
0ec6b3d99d56f9fb9078b24d3b5ec4eb

SHA1
f56262260561f5c342661a4956ee96eb1c84946a

SHA256
eccd250aed9710a4b58f09bc2eea62bc5f9e181efd85dcbe2aa11d61f7a9c520

SHA512
3267e8648b599cedf84a8b2fff8405e6c0662264fed9707e0c89791d4c9e33845576bd96cb3d17621d5e4cde5cac07526e11791bd0ef8017fcc4b441ba304465

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\0x0409.ini

Filesize
21KB

MD5
554aae16acc564b63af8549188334ccd

SHA1
9a3b99d2ab664ea07b0ab74a930c5ba6b4b60859

SHA256
6e780b5929ec3327b6b19aa77134b6e4544b4f0549857507a44093f9cd3fe48e

SHA512
61a1809fb0fb965761d5d37314f2d1d8e55986da0772b24b2b78d847adc1ce9c59a360ca50fd7d13e41cf64dd686b6d7256759b7825c5600aed8fca4a6da8b52

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\GPL-components.txt

Filesize
42B

MD5
ed4dadc8a96df002a54a51016c035af2

SHA1
6e19009ee25304a006304869189c933331e00af2

SHA256
7a4f5d530021e4a405429f4de9e8073856e56f21699da1a9bf03c751c6257e28

SHA512
0ccf7447fd2f89f75cc4ac66ca399a43d4b2692917ed6590bdd9a5e5492ecd7e99cbde0222a18883b166fd274704464262fa2497938c03f3e49e0be066a07eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\Gnu-Gpl.pdf

Filesize
18KB

MD5
bcb73213a84d97b52b73a66246ec3ed8

SHA1
34b331e0b0d24113072148d6c1d2c1c4bb79e95f

SHA256
3b933b246518b97f3fcdcb209a609bf0dce9a8f75eae1c3d2593058e8b669dba

SHA512
e52136ed9421c51e43b9d6cc05f9690b5f80d289dfd71a66307c22a0e2ecf007bd75851e4c4b8526638ced18cb2bf58cdabd3ae480f1136134c576f12f719118

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\ISSetup.dll

Filesize
566KB

MD5
dcde5a9372757a2739e811221066f0ad

SHA1
527f9ecf8d65e43dfd529cbb4d68462da00b6cbc

SHA256
3dfa92d9a0ecefbb95a6b73dc15e8ae424725b2ddafe33a3e0b8d97b49a36be0

SHA512
900d2e7b526a075bbcf508213c041e92e879a9bf51f66bec08b4cde97640c4c6e40d03584c63978628421afb8d26b18ec635b77c75478ea7e8a2347c57bb959e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\ST-LINK.pdf

Filesize
691KB

MD5
3984441b0d7349aff4989fd15ec66272

SHA1
d1833327ca331e03204290ca1422f7125d0072df

SHA256
7b855fda2d65879cba5aaa40fca64bd7027ad014df7a621f43ecd84c58c27720

SHA512
0f10e47f89fc3b666a0f30926d680a1dcbbfaa00e821bd75485d2925970f8bc7e9cb69f89bf4ab7b986b98ee90df8535e594259401ef1bb143e46bc9b5fa1d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\ST-License.pdf

Filesize
5KB

MD5
4c0a35d0304d3540893397efc0db572b

SHA1
3cbb7e3a8b20883824d178dbab607c546445342d

SHA256
1408a92ae541db90f359daa33a6af195d40916b34caf99f68e8ddc9cb07b6dbe

SHA512
eb13de3d96936cf1cca65bd5f47c7f5c60a631f245dcf84f6e3012b2f5f87b6216e8bdbc99e15ed546dea62dda1436b52806f2931fa99721bc2f6c03dfffb263

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\ST7-Toolset-Contents-and-Licensing.pdf

Filesize
6KB

MD5
2a11b69e983e5315a4c3533a12997810

SHA1
a10a8527af972b6d7d9b675dfc32067b3fb078e8

SHA256
6c06daaff026ca5e4b6742d5e8d2bc0b4f3a4ec62a0b8cc5f40c68a2a9495508

SHA512
4e2b0c3440c6971ae98e77ca6aeae6bc1f70190780d82404e72d0117bae310af0e73243a6f610776298919f5bc6de31e61988294dd82a1ad6c0c49a388bacccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\ST7_Flash_STICK.PDF

Filesize
846KB

MD5
81ad1a28aa5454e0776f3dd6d2e63c17

SHA1
bd09cc5d16f931804d9089b3c39685278b514fa9

SHA256
4623bc756123de00457738d26223e0075c59730a67ed1c67f1827934a2f4940a

SHA512
87373614c248f6e09905ca8187692edc9ed94e77293297189fcbd477f1c4e79ff2c78fc17f9d8c6e3654b56004ec453683c74b7c0c4664434719487b8241c47a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\asm_lnk_release_notes.pdf

Filesize
197KB

MD5
7290b8e97537c545726ae5aa707abf0a

SHA1
8f9adfd165ddcd8dd62cd00bd7e2e7bd9a6edc72

SHA256
21dffaac857fd4df66b8d064944053fe16598df4fcb00f4fb0001d0c79e5226a

SHA512
a73591cc5f583458025c086d88b35ca9018142d4083aa220382bd3dfde4681049e992b290e4b2941dd5176c1032ac58fc1402941d265e5f4348bd4fad3db1e71

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\asm_lnk_user_manual.pdf

Filesize
755KB

MD5
32fb9170f19490abfa1baba8dae6b783

SHA1
dd3d4cf6783bdc467030ad7293cd8e546e18e70c

SHA256
2a15c8dcc401f84a7ca6dc18c1c41b611c583badad31040788e4c00809d258a2

SHA512
741ff893958a7d48283ddcfa69aedd9195d602e97ba940dae83e5ad1697cade016c4c9f1a1d84e4a53df8d4b223292f6b03aef195ffb6729f713aa3c7b2d43f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\release_notes_stvd.pdf

Filesize
620KB

MD5
761031e29a07544966eed502b7a1e714

SHA1
e1def633dd94cf63d71579a3100d9df72e86b5e3

SHA256
ae7e53a0ee919dd2982b05b5a9c13528678e74824ea534a82f7e8a2df9cfada1

SHA512
75d231fd502bd23b68eff53ca47bd3c89053c9ab0bb25a6d0cab7572eae41f7fe58e3d6699094cb22b2287f7d89cc437914523e1854a5c41392722e30a5804b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\setup.inx

Filesize
325KB

MD5
9d12c8affdecad1b7b61aa9b575e9c72

SHA1
a633a7948a1af2877d0b8b670521b9825e21eb4e

SHA256
b86d7e22fb1a94500d77d0f36d3ee626f67dfaaf8721b47a71a0454f49f05df2

SHA512
0a0174dac0418e2616295f02e1ea516751d337711b018ff6e461a3610a99b4fef15ebde2a954fe64ac4b6cf9bd02e68576deffa0d8819439c8425d6ef5f3c27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\st7_sb.pdf

Filesize
565KB

MD5
cbe07712a2c40429d42e0f0a766b2e2f

SHA1
9c8116e83a3b7e72723bcfb05f2b94f3461d7a1f

SHA256
86102e18dd8840143cead4bde35a087396def7d1814255891283e4dfdc5343b0

SHA512
f7206ac671a4518a799b27a684fd09ff1d5eb4fcbc9a5dea712c6c8bcf67b3659a0b26d4852ed87668a351210af944a9def66ce8cd89cf1e5468ad5c4592dc3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\Disk1\stvp_release_notes.pdf

Filesize
485KB

MD5
e133f8611575a81ac8ad54053b6eaeaf

SHA1
2f04dd2b333f87802d3ed7a2a2f7b3bff07602cc

SHA256
41618d35ecc8e293a4fe8fdcdb935043b639f27d7c7a8a997979f3c3ee94e242

SHA512
a3a444f810e4e80325094fcd545be534daf3b4a5ce8af7500ec40a5d1c4dd340bde614445ca0085a7f6fde692128e78072251a852f0c43522b6e9ad960f430bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{EB5FBD87-417C-4618-B323-B5CB6972BEB8}\setup.ini

Filesize
1KB

MD5
739ec7c49b289a72c5710bc6d45341a8

SHA1
4b433fc6832cac5cc3feee2b91f0523a1f86c852

SHA256
5078724017cbbbefd2929fa36af8ef0817d6f20fb09a9ed6930dd1f5aac7994e

SHA512
8a5ce1f054285a23ccf962029156b4805176bd68c8f25adfb33324fdf3431bdbcb04e62f546551779cff28b7be7d1cde207d7aec2b172554098c8a4e590c060b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{d6038810-d50a-e442-b170-d0f739d16da2}\SETA086.tmp

Filesize
4KB

MD5
8e7dd75660a8a10c086dbdbd8c214197

SHA1
403382154e15abd09c654533be9e031d5661cc9d

SHA256
d7c9464bd8d6fa5fdb4a3498b423970f75f786893170d844663ffd9c746d7ee4

SHA512
b45483556f6a302e95de06f41c07bc718cf48fce17ebcfc56464f4b59a38dd37e7edd6092883f381acb6951bf2fba828c74fb421262f8f1b2d509b2701bf4874

Download Submit
C:\Users\Admin\AppData\Local\Temp\{d6038810-d50a-e442-b170-d0f739d16da2}\SETA096.tmp

Filesize
10KB

MD5
d2ae689a0374fb172a83118b9c73b65b

SHA1
42c577d39fc0191d61b1baedc8b81d80e0f69382

SHA256
367153ca1442eaa837777412c2f966a257a58f16d1aba516dd2ab4e8e958aa03

SHA512
b618c6034f9c9e7c479baf5931ba58c5533334411eb2138a6b5ac0acaf620f95dc5b594db244ac17e5560c203d1d83712a44e6d0945b61baf1e0177111dcd4e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{d6038810-d50a-e442-b170-d0f739d16da2}\amd64\SETA045.tmp

Filesize
1.6MB

MD5
4da5da193e0e4f86f6f8fd43ef25329a

SHA1
68a44d37ff535a2c454f2440e1429833a1c6d810

SHA256
18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e

SHA512
b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853

Download Submit
C:\Users\Admin\AppData\Local\Temp\{d6038810-d50a-e442-b170-d0f739d16da2}\amd64\SETA085.tmp

Filesize
979KB

MD5
246900ce6474718730ecd4f873234cf5

SHA1
0c84b56c82e4624824154d27926ded1c45f4b331

SHA256
981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6

SHA512
6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c

Download Submit
C:\Windows\DPINST.LOG

Filesize
5KB

MD5
4c89b9a4a05f3e786bbb223057e3e83a

SHA1
e8c1662421b4b1f83a6d6c0a05b065f674ec5851

SHA256
718d6dcea57bee0e5d8bd2b0d31729a35a1b7942bc1692f34a202f5c12922004

SHA512
6bb05860e1f501754ca132404141c4267a6f7a5158d679dc12c90ebd4c291a04f09f44c3587f459a1be45a41d65cbe9a1d9d49bb9d56f5551c29aff35b09539d

Download Submit
C:\Windows\Installer\MSI6B1C.tmp

Filesize
40KB

MD5
73f88a86a315ce7e97ff9fbe33c13964

SHA1
3524c2d1d0d9e48bcdd634fcdadf2e96d185d4c9

SHA256
a1104b6aca5b08d0c1e3b60179bbed417907eda805967d54f380d527c75adf8d

SHA512
2989561804026fc10bc312beb403b31c3352585c7e91bb150822d6d1ee09d15b5dd6cf1909e1ffc47cef2dfed1847967a332def90c7d7972ed9f51354be31104

Download Submit
C:\Windows\SysWOW64\msexch35.dll

Filesize
336KB

MD5
6cdbca8aa1e3d84d3c5e462aede82197

SHA1
b76e21f6a3294edf068c871b98de184f60bca5e4

SHA256
df96fc53ecf98a7e721c070bac8da32c1ab2419131c2e8ab523198aae45ff093

SHA512
1e53f085b4695e614201d7a54a05f222a4388f7c003801dac4294c3fcfb53b1c80c37745f2c971795c17b987db2adb0ce4ec3d426f14e3b7f35e5554e20c2986

Download Submit
C:\Windows\SysWOW64\msexcl35.dll

Filesize
246KB

MD5
29281b0fa3b49c18b900072b26702f14

SHA1
015f3891e4880adff77bc8c14c95ef1726f207a6

SHA256
ae1b44a86bc9666e65921f1cb6f85a49fac774e7249101a5cf2081d1d76098ce

SHA512
8d3ca40ceb57aab6c950b4e93ca392a6afb89e79e0d7660541c4833365fa0ee305025adf5c6ddded6e4f26bc9164398bf134fe543064466bd3d867eceddd0359

Download Submit
C:\Windows\SysWOW64\msjet35.dll

Filesize
1.0MB

MD5
2bcb3e39703a69b0235ad937c0e4b1ac

SHA1
8a3a66c533f3e9361f698f280423dad4bfa7431b

SHA256
91dc7e10f4f97c0046b4b91b04b5195b95f3f0fd36260fa6433ef2ef623cb0dc

SHA512
500574ed6231d2354165052de53383190c7c187399991d3fb1ccb95709dc8cb795f4a9241d6da4f68f66ada5f1adc782786e6f2fd2a7a46252d0f9c599cefc03

Download Submit
C:\Windows\SysWOW64\msjint35.dll

Filesize
136KB

MD5
0b2fe7d80aa65475af3ecc9992a1d6f2

SHA1
0da878965cee2f38b25645e6b7c95553a9fa182c

SHA256
ddc3a3749258ae7e40c3ffc2289a52e85eb93bdf87b445db46e2a6ca5b437815

SHA512
09063dabd3824dfdf89cf6d2e47963bb234900403a1017ee0ad78821a568220798ad5c2a78bb638e840963957aae7b0a64cfbfdeca7a6a19cc424594f8cb6e14

Download Submit
C:\Windows\SysWOW64\msjt4jlt.dll

Filesize
1.2MB

MD5
731831efa9182992f9c5e4c65d0bd077

SHA1
190b62fbd3674d3cab85e9b1169ae6430b4e6696

SHA256
9329f42ac6f2c7470c070863af04572c9f32148c1d86cdbb6e0e301c7f5d780e

SHA512
6fa121f48077bafe82a36da39b74f8500a469b6544c6cd03e7fafe4ec18ebdf4e6db46c74dd78c095cc4983e0eb740bf07d1e651927213ac19c5d82b5b4eed93

Download Submit
C:\Windows\SysWOW64\msltus35.dll

Filesize
164KB

MD5
89c1d25c3adb055130f42840e2663be6

SHA1
acf4d7463bc8a656199079a87824ca8db9c6a539

SHA256
e8c87e978a87246a32693f83027488ea204b7c6182bd80a9156bb60709276de7

SHA512
3d4186213b20ccc4ca74952d3bb9ea103ed19ea3cd4514662deb763c7724267451a6d0ebaea1bcb649e165fb4b45d2ccdc93c1162be0b51560e614e3e6277847

Download Submit
C:\Windows\SysWOW64\mspdox35.dll

Filesize
244KB

MD5
ec7713bd6cf95baae1a2f67c75b74376

SHA1
239f0c53f6241c0b78ff404eb7912a1e9936e4cb

SHA256
b7bd9fb77332b113dc615a307f24d10df999860220b0b822e21c43e6990c51eb

SHA512
bb898434a2abd4cf510d2f14e2b20e15310d7778895e36e3ddd7a32c41e48114f8c38721d0d9b6c6d7dbf1997ab4dbd3aa3a094928ddb0ad285b1502899ec60f

Download Submit
C:\Windows\SysWOW64\msrd2x35.dll

Filesize
256KB

MD5
34d390ea0d5969db0d7dd133eff0a48a

SHA1
522ffddb883314940ee6843b631fe15d96f5c12a

SHA256
544886cd823e8b04e3cc88456c669ece1deb186b804a07c11e4a1de318aaf4f7

SHA512
a809ae31b6feb0591d70981aa5d0e01fb0dd0f7b5d51a608a235d0b8119c0ed24f698bbf849f83535cec7e99704c413b38ec89c8c293ad572cd472000fc6ea31

Download Submit
C:\Windows\SysWOW64\mstext35.dll

Filesize
162KB

MD5
8e29affbf309490cbb33bcb25fd1f8bb

SHA1
546ec23cb9868252e0b2b7b90cda625a52da964e

SHA256
ae8f54c2fd76b33803c4877eaab73e133469b34436808ec6a8185616b8ff98a2

SHA512
0da47d5525cfcdf7151290d6246ae1832d8d68893ce2197d60213a29cb612157b74589b610c706e283e73ff160ee3384224d14b0679aa3c7aa800982a8cd13b0

Download Submit
C:\Windows\SysWOW64\msxbse35.dll

Filesize
288KB

MD5
fba99d04ed1b2a29dca48932c8926355

SHA1
1e786dbf4f056835e4f6fa699d102e63009193ad

SHA256
e2c0e5d5b3772e012942c2af3d611b94f45d73442a6b1cd2406ed25cf49e655e

SHA512
b18fd0b056944716727f923f4b91e3ccedae0ab64a5016084a657aacd240d6a63eb7621dcc70dc933f4abeade325962f88f2f75c366d9ff6f1ba48095155f123

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
21KB

MD5
81a8b22b0e6d31b5ca15dc3846565f93

SHA1
23cd813ddcdbf104b486be44f42715a9e7152dbf

SHA256
88878030737bb7d411a48a9bb707ccd5f1f8bd19827aba8f9b8ad5dc5b4e8805

SHA512
ce2f1f9a2509000acabaf595a7f0bbcbde4efe2f2f288534d31f3c91b5c042e84a2a6ac48284a6e0ac3588ccc8c455ae0c417f18e9565e8d7157200495d41e98

Download Submit
\??\c:\PROGRA~2\STMICR~1\ST_TOO~1\stvp\STTUBD~1\sttube.cat

Filesize
8KB

MD5
9a1822df5b201e8ba00cd4ad3730a4f9

SHA1
2cee5e1cca43737e8c39807765d5be16e2595ca5

SHA256
c7ca0c67cf4e9005e17174aa3f5f76895a6f7bc429c88f7ad5c647f93c3d21eb

SHA512
1e3e9d9f365c8a5792530ace8c9293f81b3c8a129ee5625db52c7a9213c9f99411e22a90f2c4a8df196ae5e14c3813c897492d714cc910925cd291d1648b8b2a

Download Submit
\??\c:\PROGRA~2\STMICR~1\ST_TOO~1\stvp\STTUBD~1\x64\STTub30.sys

Filesize
43KB

MD5
bd038dea65c09cd178159f7d9a9d0fcf

SHA1
ba69332b20168299f0897ba03334e5bc44071975

SHA256
166370288ac92ee976b9c1e54c3de825ef616944db8570dde0b5574dbfb35935

SHA512
010c0009fc5ef036bcda3217cb5186c16d71dbb87b38dd696f637b07d390463e35a237a32725e53cd6eb6731b4d7484c7bf1d985a106e4c2dafb843dd1169375

Download Submit
\??\c:\program files (x86)\stmicroelectronics\st_toolset\stvp\sttubdriver\sttube.inf

Filesize
4KB

MD5
8aeff2b9c08d2b1f168827a171bcad8b

SHA1
53ce3e570993ab2791a87b0143b353b816401784

SHA256
7da6093fbb03a3bc08e2b1be77624e89d6ec9ff9f2be043033f2c15943c39068

SHA512
b06a93127dfd9dfa9851be8939d12f75acf9f4539a33387d3a46445270fca1d183a43ca769d42a8cee4a51f131eeba9bf34dffb62304f3c8bdc09cd52e4f4482

Download Submit
memory/3648-172-0x0000000004FD0000-0x0000000004FD2000-memory.dmp

Filesize
8KB

Download
memory/3648-169-0x0000000005C90000-0x0000000005D31000-memory.dmp

Filesize
644KB

Download
memory/3648-839-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-11047-0x0000000005C90000-0x0000000005D31000-memory.dmp

Filesize
644KB

Download
memory/3648-11046-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-171-0x0000000005C90000-0x0000000005D31000-memory.dmp

Filesize
644KB

Download
memory/3648-177-0x0000000005F70000-0x0000000005FF9000-memory.dmp

Filesize
548KB

Download
memory/3648-8376-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-209-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-210-0x0000000005C90000-0x0000000005D31000-memory.dmp

Filesize
644KB

Download
memory/3648-7090-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-4904-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-164-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-3211-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-70-0x0000000000C20000-0x0000000000C22000-memory.dmp

Filesize
8KB

Download
memory/3648-47-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-2116-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-36-0x0000000000C20000-0x0000000000C22000-memory.dmp

Filesize
8KB

Download
memory/3648-214-0x0000000005C90000-0x0000000005D31000-memory.dmp

Filesize
644KB

Download
memory/3648-215-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-218-0x0000000004FD0000-0x0000000004FD2000-memory.dmp

Filesize
8KB

Download
memory/3648-226-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-33-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-11243-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-11244-0x0000000005C90000-0x0000000005D31000-memory.dmp

Filesize
644KB

Download
memory/3648-227-0x0000000005C90000-0x0000000005D31000-memory.dmp

Filesize
644KB

Download
memory/3648-1947-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-1911-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-1887-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download
memory/3648-1861-0x0000000002730000-0x00000000028DA000-memory.dmp

Filesize
1.7MB

Download